ML20081E268
| ML20081E268 | |
| Person / Time | |
|---|---|
| Issue date: | 07/31/1990 |
| From: | Emrit R, Milstead W, Pittman J, Riggs R NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | |
| References | |
| NUREG-0933, NUREG-0933-S11, NUREG-933, NUREG-933-S11, NUDOCS 9008070346 | |
| Download: ML20081E268 (180) | |
Text
..
,\\
UNITED $ TAT ES
[
g NUCLEAR REGULATORY COMMISSION
('~'s L
I WA6Hi40 YON, D C. 20666 i
\\g g,
... +,@
July 1990 SUPPLEMENT 11 TO NUREG 0933
)
- A PRIORITIZATION OF GENERIC SAFETY ISSUES" REYlSION INSERTION INSTRUCTIONS 1
Remove Insert introduction pp. 27 to 60, Rev.10 pp. 27 to 60, Rev.11 Section 1 pp.
1.1.0-1 to 13. Rev. 4 pp.
1.1.D-1 to 13, Rev. 5 Section 2 p.
2.A.17-1 pp. 2.A.17-1 to 2, Rev. 1 p.
2.A.29-1 to 4 pp.
2.A.29-1 to 4. Rev. I p.
2.A 40-1 pp.
2.A.40-1 to 3, Rev. 1 p.
2.A.47-1 pp.
2.A.47-1 to 2, Rev. I n
Section 3 pp.
3.15-1 to 8, Rev. 1 pp. - 3.15-1 to 9 Rev. 2 3.51-1 to 5 3.103-1to$,Rev.I (V) pp. 3.51-1 to 5 pp.
Rev. 1 pp.
3.103-1 to 3 pp.
pp. 3.125-1 to 79, Rev, 5 pp.
3.125-1 to 79,Rev. 6 pp.
3.131-1 to :
pp. 3.134-1 pp.
3.134-1 to,, Rev. 1 Appendix B pp. A-9 to A-21, Rev. 2 pp. A-9 to A-21, Rev. 3 i
NN Q t
~
to,
'D HNcp e
TABLE II LISTING OF Att IMI ACTION PLAN ITER,, TA5E ACTION PLAN ITEMS, NEW GENERIC ISSUE 5. AND Hl5Nift F ACiGR51550E5 (his table contains the priority designatio s for all issues listed in ti.is repert. For thew issues found to be covered in other issues described in this document, the appropriate notations have been made in thr Safety Priority Ranking column. e.g.. I.A.2.2 in the Safety Priority Ranking column means that Ites I. A.2.6(3) is covered in Ites I. A.2.2.
For those issues fotrid to be covered in programs not
' described in this docue.nt. the notation (5) was made in the Safety Priority Ranking column.. For resolved issues that have resulted in new requirements for wrating plants, the appropriate multiplant licensing action number is listed. The licensing action numeeting system bears no relationship to the numbering systees used for identifying the prioritized issues. ' An explanation of the classification and status of the issues is provided in the legend below.
Legend Is0TES: 1 - Possible Resolutica Identified for Evaluation 2 - Resolution Avitable (Docismented in NUREG. MRC Noorandue. SER, or equivalent) to 3 - Resolution Resulted in either: (a) The Establishment of New Regulatory Wequirements (By Rule. SRP Change, or equivalent) or (b) No feew Requirements 4 - Issue to be Prioritized in the Future 5 - Issue that is not e Generic Safety Issue but shovid te Assigned Resources for Ceapletion HIGH
- High Safety Pelority NEDitM - - Medive Safet..iority LOW
- tow Safety Priority DROP.
- Issue Dropped as a Generic Issue EI
- Environmental Issue I
- Resolved TMI Action Plan Itee with Implementation of Resolution 9tsndated by NUREl-N3F' LI
- Licensing Issue PFA
- Multiplant Action MA
- Not Applicable RI
- Regulatory Ispect Issue -
5
- Issue Covered in an IIRC Progras Outside the Scope of This Document l
- Unresolved Safety Issue t
c l
=
o6 o=
l' W
y w.
y I
-.---9---
TABLE II (Continued)
U D Action Priority tead Office /
Safety latest H
Plan Item /
Evaluation Division /
Priority /
Latest Isseance NPA D
Issue No.
Title.
Engineer tranch
$tatus Revision Date leo.
to TMI ACTION ptAN ITEMS M
OPERATIIIG PER50NesEL I.A.1 Operating Personnel and Staffing T~K l.1 Shift Technical Advisor NRR/DHF5/LQ8 I
2 12/31/86 F-01 I.A.I.2 Shift Supervisor Administrative Duties NRR/DHF5/LQ8 I
2 12/3U86 I.A.I.3 Shift Manning MR/DHF5/LQB I
2 12/31/86 F-02 I. A. I. 4 Long-Tem Upgrading Colmar RES/DF0/HF6R NOTE 3(a) 2 12/3U86 1.A.2 Trainirva and Qualifications of Operating Personnel I.A.2.1 Immediate Upgrading of Operator and Senior Operator Training and Qualifications I.A.2.I(1)
Qualifications - Erperience seRR/DHF5/LUB I
5 12/31/87 F-03 I.A.2.1(2)
Training MR/DHF5/LQ8 I
5 12/3UST F-03 11.2.I(3)
Facility Certification of Competence and Fitness of leRR/DHF5/LQ8 I
5 12/31/87 F-03 ro Applicants for Operator and Senior Operator Licenses CD I.A.2.2 Training and Qualifications of Operations Personnel Colmar WR/DNF5/LQB NOTE 3(b) 5 12/3U87 81 4 I. A. 2. 3 Administration of Training Programs 88RR/DNF5/LQB I
5 12/3U87 I.A.2.4 NRR Participation in Inspector Training Colmar leRR/DHF5/LQB LI (NOTE 3) 5 12/31/87 IIA I.A.2.5 Plant Drills Colmar NRR/DHF5/LQ8 NOTE 3(b) 5 12/3U87 gen I.A.2.6 Long-Tem Upgrading of Training and Qualifications I.A.2.6(1)
Revise Regulatory Guide 1.8 Colmar leRR/DHFT/HFIB IIOTE 3(a) 5 12/3UST 88 4 I.A.2.6(2)
Staff Review of feRR 80-117 Colmar leRR/DHF5/LOS fe0TE 3(b) 5 12/3U87 8e4 I.A.2.6(3)
Revise 10 CFR 55 Colmar 88RR/DHF5/LQ8 I.A.2.2 5
12/3U87 gen I.A.2.6(4)
Operator Workshops Colmar MR/DHF5/LQB 880TE 3(b) 5 12/3U87 88 4 I.A.2.6(5)
Develop Inspection Procedures for Training Program Colmar leRR/DHF5/LQB Is0TE 3(b) 5 12/31/87 NA I.A.2.6(6)
Nuclear Power Fundamentals.
Colmar MR/DHF5/LQB DROP 5
12/3U87 88 4 I. A. 2. 7 Accreditation of Training Institutions Colmar MR/DNF5/LQ8 NOTE 3(b) 5 12/3U87 lea I. A. 3 Licensing and Requalification of Operating Personnel I.A.3.1 Revise scope of Criteria for Licensing Examinations
- Eerit MR/DHF5/LUB I
5
- 2/3U86 I.A.3.2 Operator Licensing Program Changes Eerit feRR/DHF5/DL8 Is0TE 3(b) 5 12/3U86 sen I.A 3.3 Requirements for Operator Fitness Colmar RES/DRAC/HF58 IEDTE 3(b) 5 12/3U86 8e4 I.A.3.4 Licensing of Additional Operations Personnel Thatcher leRR/DNF5/LQB NOTE 3(b) 5 12/3U86 les I.A 3.5 Establish Statement of Understanding with IlePD and DOE Thatcher IIRR/DHF5/NF E8 LI (NOTE 3) 5 12/3 U86 88 4 I.A.4 Simulator Use and Development S
Q ' TI 3.1 Initial Simulator Improvement 1
e I.A.4.1(1)
Short-Tem Study of Training simulators Thatcher NRR/DNF5/0LS NOTE 3(b) 5 06/30/88 Na en g
I.A.4.1(2)
Interim Changes in Training Simulators Thatcher NRR/DHF5/DLB NOTE 3(a) 5 06/38/98 7
w I.A.4.2 Long-Tem Training Simulator Upgrade 3
W I.A.4.2(1)
Research on Training Simulators Colmar feRR/DNFT/HFIS NOTE 3(a) 5 06/30/88 gw O
O O
jq
(
w
,/
TABLE II (Continued)
H P@D Action Priority lead Office /
Safety latest H
Plan Item /
Evaluation Division /
Priority /
Latest IssuaM e WA D
Issue No.
Title Engineer Branch Status Revision Date No.
e I.A.4.2(2)
Upgrade Training simulator Standards Colmar RES/DF0/HFBR NOTE 3(a) 5 06/30/8B I.A.4.2(3)
Regulatory Guide on Training simulators Ccimar RES/DF0/MF BR NOTE 3(a) 5 06/30/8B I.A.4.2(4)
Review Simulators for Conformance to Criteria Colmar NRR/DLPQ/LOLB NOTE 3(a) 5 06/30/88 I.A.4.3 Feasibility Study of Procurearnt of MRC Training Colmar FES/DAE/R$RB LI (NOTE 3) 5 M/30/88 M
Simulator I.A.4.4 Feasibility Study of MRC Engir*ering Computer Colmar RES/DAE/RSRB LI (NOTE 3) 5 06/30/88 NA I. B.
SUrPORT PER50M'8EL I.B.1 Management for Operations Q.1 Organization and Managament Long-Tern Improvenants I.B.I.1(1)
Prepare Draft Criteria Colmar NRR/DNFT/HFIB NOTE 3(b) 3 12/31/86 NA I.B.I.1(2)
Prepare Commission Paper Colmar NRR/DHFT/MFIS NOTE 3(b) 3 12/31/86 M
I.B.I.1(3)
Issue Requirements for the Upgrading of Management and Colmar NRR/DNFT/HFIB NOTE 3(b) 3 12/31/ %
NA Technical Resources I.B.I.1(4)
Review Responses to Determine Acceptability Colmar NRR/DHFT/HFIB' NOTE 3(b) 3 12/31/86 M
I.B.I.1(5)
Review Implementation of the Upgrading Activities Colmar DIE /DQASIP/ORPS NOTE 3(b) 3 12/31/86 M
I.B.I.lf6)
Prepare Revisions to Regulatory Guides 1.33 and 1.0 Colmar NRR/DHF 5/LQB I.A.2.6(1).
3 12/31/86 M
75 e
I.B.I.1(7)
Issue Regulatory Guides 1.33 and 1.8 Colmar NRR/DHrs/LQB I.A.2.6(1),
3 12/31/86 M
75 I.B.I.2 Evaluation of Organization and Managament Improvements of Near-Tern Operating License Applicants I.B.I.2(1)
Prepare Draft Criteria NoR/DHF5/LQB NOTE 3(b) 3 12/31/86 M
I.B.I.2(2)
Review Mear-Tern Operating License Facilities NRR/DHF5/LQB NOTE 3(b) 3 12/31/86 NA I.B.I.2(3)
Include Findings in the SER for Each Near-Term M % 3RAB NOTE 3(b) 3 12/13/86 MA Operating License Facility I.B.I.3 Loss of Safety Function I.B.I.3(1)
Require Licensees to Place Plant in Safest shutdown Sege RES LI (MOTE 3) 3 12/31/86 m
Cooling Following a toss of Safety Function Due to Personnel Error I.B.I.3(2)
Use Existing Enforcement Options to Accomplish Safest Sege RES LI (NOTE 3) 3 12/31/86 NA Shutdown Cooling I.B.I.3(3)
Use Non-Fiscal Approaches to Accomplish safest Shutdown Sege RES LI (NOTE 3) 3 12/31/86 M
Cooling I.B.2 Inspection of Operating deactors T.1 Revise DIE Inspection Program
- z-I.B 2.1(1)
Verify the Adequacy of Management and Procederal Controls Sege OIE/CQASIP/RCPB LI (NOTE 3) 11/30/B3 NA c
and Staff Discipline e
I.B.2.1(2)
Verify that Systems Required to Be Operable Are Properly Sege OIE/DQASIP/RCPB LI (NOTE 3) 11/30/83 M
1 m
Aligned me O
W W
HH
~
3 TABLE II (Continued)
UD Action Priority lead Of fice/
Safety latest
>-a Plan Item /
Evaluation Division /
Prierity/
Latest Issuance MPA 5
Issue No.
Title Engineer Branch Status Revision Date he.
so I.B.2.1(3)
Follow up on Completed Maintenance Work Orders to Sege OIE/DQASIP/RC/B LI (NOTE 3) 11/30/83 NA Assure Proper Testing and Return ta Service I.B.2.1(4)
Observe Surveillance Tests to Determine Whether Test Seoe CIL/DQA51P/PCFB LI (NOTE 3) 11/30/83 NA Instruments Are Properly Calibrated I.B.2.1(5)
Verify that Licensees Are Complying with Technical Seg.
CIE/DQASIP/RCPB LI (NOTE 3) 11/30/83 NA Specifications I.B.2.1(6)
Observe Routine flaintenance Sece CIE/DQtm P/RCPB LI (NOTE 3) 11/30/83 M
I.B.2.1(7)
Inspect Terwinal Boards, Panels, and Instrument Racks Seg.
OIE/DQASIP/RCPB LI (NOTE 3) 11/30/83 NA for Unauthorized Jumpers and Bypasses I. B. 2. 2 Resident Inspector at Operating Reactors Sage OIE/1X)ASIP/ORPB LI (NOTE 3) 11/30/83 NA I.B.2.3 Regional Evalt.ations Sega DIE /DQASIP/ORPB LI (NOTE 3) 11/30/83 NA I.B.2.4 Overview of Licensee Performance Sega OIE/DQASIP/ORPB LI (NOTE 3) 11/30/83 NA
_M OPERATING PROCEDURES I.C.1 Short-Term Accident Analysis and Procedures Fevision 1.C.1(1) 5=s11 Break LOCAs I.C.1(2)
Inadequate Core Cooling NRR I
3 12/31/R6 I.C.I(3)
Transi-nts and Accidents NRR I
3 12/31/86 F-04 NRR I
3 12/31/86 F-05 I.C.1(4)
Confirmatory Analyses of Selected Transients Riggs NRR/D5!/RSB NOTE 3(b) 3 12/31/86 NA I.C.2 Shift and Relief Turnover Procedures I.C.3 Shift Supervisor Responsibilities NRR I
3 12/31/86 1.C.4 Control Room Access NRR I
3 12/31/86 NRR I
3 12/31/86 I. C. 5 Procedures for Fe*<iback of Operating Erperience to NRR/DL I
3 12/31/86 T-06 Plant Staff I.C.6 Procedures for Verification of Correct Performance of NRR/DL I
3 12/31/86 F-07 Operating Activities I.C.7 N555 Vendor Review of Procedures I. C. 8 Pilot Nonitoring of Selected Emergency Procedures for NRR/DHr$/P5RB I
3 12/31/86 Near-Tere Operating License Applicants NRR/DHF5/PA' B I
3 12/31/86 I.C.9 Long-Term Program Plan for Upgrading of Procedures Riggs NRR/DHF5/PSRB NOTE 3(b) 3 12/31/86 NA IJ CONTROL ROON DESIGN I.D.1 Control Room D 4ign Reviews NRR/DL 1
5 12/31/89 F-08 I. D. 2 Plant Safety 5 rameter Display Console NRR/DL I
12/31/89 F-09 I.D.3 Sa'ety System Status Nocitoring Thatcher RES/DE/MEB NEDItM 5
12/31/89 I.D.4 Control Room Design Standard Thatcher RES/DRPS/ mFB NOTE 3(b) 5 12/31/89 NA zc I.D.5 Improved Control Room Instrumentation Research I.D.5(1)
Operator-Process Communication Thatcher RES/Df0/W BR NOTE 3(b) 5 12/31/89 NA 1
i&
E 0
8 0
9 9
9
~
i kj w/
- Q)
TABLE II (Continued) ea ND' Action Priority Lead Office /
Safety Latest e-Plan Item /
Evaluation Division /
Priwrity/
Latest Issuance NPA y
Issue leo.
Title
. Engineer Branch States Revision Date No.
so I.D.5(2)
' Plant Status and Post-Accident Ibnitoring Thatcher RES/DF0/HFBR pe0TE 3(a) 5 12/31/89 I.D.5(3)
On-Line Reactor Survelliance System Thatcher RES/DE/M8 P9TE 1 5
12/31/89 I.D.5(4)
Process Monitoring Instrumentation Thatcher RES/DF0/ICBR NOTE 3(b)- -
5 12/31/89 88A I.D.5(5)
' Disturbance Analysis Systems Thatcher RES/DRPS/RHF8 LI (fe0TE 5) 5 12/31/89 M
I.D.6 Technology Transfer Conference
- That W r RES/DF0/MFBR LI (NOTE 3) 5 12/31/89 feA ANALYSISAseDDISSEMINATIONOFCPERt.,thSEXPERIEleCE I.E.1 Office for Analysis and Evaluation of Opeeational mttf-ws AE00/PTB LI (NOTE 3) 1 6/30/84 NA Data I.E.2 Program Office Operational Data Evaluation N tthews NRR/DL/ ORA 8 LI (NOTE 3) 1 6/30/84 18A I.E.3 Operational Safety Data Analysis h tthews RESIDRA/RR8R LI (NOTE 3) 1 6/30/84 NA I.E.4 Coordination of Licensee Industry, and Regulatory Matthews AE00/PTB LI (NOTE 3) 1 6/30/84 M
Programs I.E3 Nuclear Plant Reliability Data System N tthews AE00/PT8 LI (NOTE 3) 1 6/30/84 8eA I.E.6 Reporting Raquirements h tthews AE00/PTB II (NOTE 3) 1 6/30/84 M
I.E.7 Foreign Sources Matthews IP LI (NOTE 3) 1 6/30/84 NA I. E. 8 f4uman Error Rate Analysis' N tthews RES/DF0/HFBR LI (NOTE 3) 1 6/30/84 sea M
QUALITY ASSURAfeCE i
I.F.1 Expand OA List Pittman RES/DRA/ARGIB NOTE 3(b) 2 06/30/89 NA I.F.2 Develop More Detailed QA Criteria I.F.2(1)
Assure the Independance of the Organization Performing Pittman CIE/DOASIP/QUA8 Low 2
06/30/89 M
the Checking Function I.F.2(2)
' Include QA Personnel in Review and Approval of Plant Pittman 01FjDQASIP/QUA8 NOTE 3(a) 2 06/30/89 NA Procedures I.F.2(3)
Includa QA Personnel in All Design Construction.
Pittman GIE/DQASIP/QUA8 180TE 3(a) 2 06/30/89 M
Installation. Testing, and Operation Activities I.F.2(4)
Establish Criteria for Detemining QA Requirements Pittman CIE/DOASIP/QUA8 LOW 2
06/30/89 NA for Specific Classes of Equipment I.F.2(5)
Establish Qualification Requirements for QA and QC Pittman CIE/DQASIP/QUAB LOW 2
06/30/89 IIA Personnel I.F.2(6)
Increase the Size of Licensees' QA Staff Pittman CIE/DOASIP/QUA8 NOTE 3(a) 2 06/30/89 sea I.F.2(7)
Clarify that the QA Program Is a Condition of the Pittman CIE/DQASIP/QUAB LOW 2
06/30/89 M
Construction Permit and Operating License-I.F.2(8)
Compare feRC QA Requirements with Those of Other Pittman 01E/DQASIP/QUA8 LOW 2
06/30/89 M
- '"C I'5 -
lNF 9
2c I.F.Z(9) _
Organization Clarify Organizational Reporting levels for the QA Pittman CIE/DQ4 SIP /QUAB 8e0TE 3(a) 2 06/30/89 M
g y
c) 1.F.2(10)
Clarify Requirements for Maintenance of "As-Built" Pittman 01E/DQASIP/QUAB LOW 2
06/30/89 NA -
f Documentation o
u>
I.F.2(11)
Define Role of QA in Design and Analysis Activities Pittman 01E/DQASIP/QUA8 LOW 2
06/30/89 NA 2-N
--... - ~.
... + - ~ - -
, 7g: WW s
O 01 23 4
A.
11 11 1
f N m
m#
mAA NNNN FN ro 4
AAAA A
FF FF sN e
e 99 44 88 88 8e8 6 88 8888 999 c
88 88 88 88 888 8
88 8888 888 tn
//
//
// //
/// / //
////
///
so 00 11 00 00 000 0
00 1111 000 eoe 33 33 33 33 333 3
33 3333 333 tst
//
//
// //
/// / //
////
///
asa E6 22 66 66 666 6
66 2222 666 LID 00 11 00 00 000 0
00 1111 000 no tiss ei 22 11
?2 22 222 2 22 2222 111 t v ae LR
)))
555
/
)
)
)
)
))
)
y a
b EEE a
a bb b
t
(
(
TTT
(
(
((
(
yi s 3
3 OOO 3
83 33 3
t ru 1
NNN eot E
E
(((
E B. TE EE7E fi a T
T A.
TT1T t
T t
art O
O III O
IO OO-O 0
SPS IN NV II II -
LLL N
IN NNAN ILI B8 S
R J
/
R4 BAB 8 8M 4ABN B8 I
e S5 ERE A
c PP B8 APA R
5R RRIR i/
//
///
R C/
/RG/
f n 55 S5 AAA
/
/0 0//S f o FF
//
AAA T
1A ATTP Oih HM EE LL LL RRR S
5R RSSR t
DD DDDD D
din
//
//
// //
/// / //
////
/
RS SERS RSR eir MM MM MM RM-EEE RE E
RE ER N
RRR M
NR RMNa MRN LDB no yi r s
tte n
nn nnn n wn nnnn i ae e
ee eee a
ee aeaa run l
l t 1ll m
hl memm s
oli o
oo
% 'M M oo t
to tttt g
iag M
MN t
tM tttt g-O rvn i
a iiii i
PEE
'V
'Y 'V V Y 'v P
M 'V PPPP R
n m
o a
s dn i
r t
no t
h g
n ai a
t o
e t
d i
r m
sa a
w s
P e
ar r
t S
r ee g
s n
n E
i rp e
e e
o V
u N
AO D
n t
d i
L q
I o
i i
T t
A en l t e
S c N a
V R o S
an r
s c
E u
i E
te o
n t
A M l
Y tt id C
o a S
a T
sa s
O Vi i
e S
mv E
ec e
C c
h s
s r
E aE F
Ti G
i oc t
o r o
S r
A d
N t
D tA ei l
o C
S gy S
en I
i E
gw p
t A
ot vI T
l T
st a
l x c d
ri D
l S
i L
ss md e
E a
e E
Pl N
an E
c E
eo ae e
d S
i A
Vo tt T
a M cP Dt F
d R
a I
nb i
F c
a n
r R
oa F
yt R
R sAr ei d
a g
l g ii E
ti E
ng O t
o rc e n oe D tl I
es W
on nef oo g
g i rD N
ae L
f o O
i i D
ed Cs a
n tst A
uR E
aP P
tt E
Vit s
m i aenn l
R S
as D
vn gA a
n rioo G
ae g
e W
li A
moegn D
r etC N
vi n M dv O
ss ux R
e r m ni a t u e pi g
I Er i E
nl L
t a mE G t P pi t n ylBrOsnn R
e r T
saa n i r
E s
il ae l e u
nei E
yt ne S
V t, f D
e of D youpgm e M
, t r e gd E
t noe Y
I m %
Eatngem mr I
f o Stqmio r
coDoe N
iIi n S
ey i
A er e
F uf re I
l ti t
rP R n O tg Sienv ndc G
i f cg T
l e L
i o
nny Mhieo tnoyo N
boan N
,ef PtSC1 A
ut yi N
W aitt e o n e f f n,S o i H r E
a rE A
ira N
qs ct O
E l denr i
it P
t ne L
u S
O ee ia I
I olf ttaf Y
i ot y O qn I
RT l u T
V oeadf oNoo ncl og T
ei n t O
eod T
ol A
E Cisi f euu n I
RtIi C
R n
A gf Pa R
R h
c gh l r r o m d p si L
a l
ha R
no v
E rStcnceoo neoik I
ousi R
gc E
i G
gE D
Y o c Ai r uii ti P P s a B
inmb O
nrf
)
e P
ne N
n I
I tte-naF vvca ym A
ri e a T
iae d
l O
ip I
i e S
t cntti e aaetkhl e I
etti C
t ei e
t E
ao T
tt N
f aaosasdhhf nsgal L
tnsl A
ssl v
O A
el roreneef oiinu E
noye E
eee i
R rc I
ii r
T P
TS S
SS C
S RPPPTR aBBECRHAR R
ICSR R
TRR i
tno C(
/m.
)))
I eo 123 O..
I tN
(((
nI 12 12 345 555 6
78 1234 123 E
o e 12 t
inu A.
A. A.
B.
B. B.
B. B. B.
B. B. B.
B.
B. B.
C.
C.C.C. C.
D.
D. D. D.
G. G.
8 tas I
II I
II III III I
II I
IIII I
III A
cl s T
API II I
II I
II III III I
II I
IIII I
III NDwDo wN gA?gww t
,m y
(
\\
\\
V V
k' /
TABLE II (Continued)
N Q
Action Priority lead Office /
Safety latest W
Plan Item /
Evaluation Division /
Priority /
Latest Issuance MPA
(
Issue No.
Title Engineer Branch Status Revision Date No.
IM SYSTEM DESIGN II.E.1 Auxiliary Fee m ter Systee TECLI Auxiliary feedwater System Evaluation MR/DL I
1 12/31/ %
F-15 II.E.1.2 Auxiliary Feedwater Syster Automatic Initiation and MRR/DL I
1 12/31/86 F-15. F-17 Flow Indication II.E.1.3 Update Standard Review Plan and Develop Regulatory RitJgs RES/DRA/RR8R MOTE 3(a) 1 12/31/86 Guide II.E.2 Fuergency Core Cooling Systee TI C 7.1 Reliance on ECC5 Riggs NRR/D51/R58 II.K.3(17) 1 12/31/85 NA II.E.2.2 Research on Small Break 1DCAs and Anomalous Transients Riggs RES/DAE/R588 NOTE 3(b) 1 12/31/85 NA II.E.2.3 Uncertainties in Performance Predictions V'Noten MR/D5!/R58 LOW 1
12/31/85 NA II.E.3 Decay Heat Removal IEEll Reliability of Power Supplies for Natural Circulation WRR I
II.E.3.2 Systems Reliability V'Nolen NRR/ DST /GI8 A-45 11/30/83 NA II.E.3.3 Coordinated Study of Shutdown Heat Ramo' sal Requirceents V'Molen NRR/ DST /GIB A-45 11/30/83 NA w
II.E.3.4 Alternate Concepts Research Riggs RES/DAE/flHtB NOTE 3(b) 11/30/83 NA w
II.E.3.5 Regulatory Guide Riggs NRR/OST/GIB A-45 11/30/83 NA II.F.4 Containment Design TIT 4.1 Dedicated Penetrations NRR/DL I
06/30/88 F-18 NRR/DL I
06/30/88 F-19 II.E.4.2 Isolation Dependability II.E.4.3 Integrity Check Milstead RES/
'.s*RPSI NOTE 3(b) 06/30/88 NA II.E.4.4 Purging II.E.4.4(1)
Issue Letter to Licensees Requesting Limited Purging Milstead NRR/DSI/C58 MOTE 3(a) 06/30/88 II.E.4.4(2)
Issue Letter to Licensees Requesting Information on Milstead NRR/DSI/CSB NOTE 3(a) 06/30/88 Isolation letter II.E.4.4(3)
Issue Letter to Licensees on valve Operability Milstead NRR/DSI/C58 NOTE 3(a) 06/30/86 II.E.4.4(4)
Evaluate Purging and Venting During Normal Operation Milstead NRR/DSI/C58 NOTE 3(b) 06/30/88 44 II.E.4.4(5)
Issue Modified Purging and Venting Requirement Milstead WRR/D51/C58 NOTE 3(b) 06/30/88 NA II.L.5 Design Sensitivity of B&W Reactors IEE5.1 Design Evaivation Thatcher NRR/DSI/R58 NOTE 3(a) 1 12/31/84 II.E.5.2 B&W Reactor Transient Response Task Force Thatcher NRR/DL/ORAS NOTE 3(a) 1 12/31/84 II.E.6 In Site, Testing of Valves II EE.1 Test Adequacy Study Thatcher RES/DE/EIS NOTE 3(a) 1 06/30/89 I
e"
=
M a.
ir, o=
wW Nw
~ - -.
e1 0
==
135 222 FfF 0
0246 F o.
2222 A
A A
A AA A
AAA MN FFFF N
N N
NN M
NMN e
7 9
99 9
3 3
33 3
333 y
c 8
8 88 8
8 8
88 8
888 tn
/
/ // /
/ / //
/ ///
sa 0
0 00 0
0 0
00 0
000 eue 3
3 33 3
3 3
33 3
333 t st
/
/ // /
/ / //
/ ///
6 6
1 1
11 1
111 0M M asa 0
1 1
11 1
111 LID no tiss ei 2
2 22 2 t v ae tR
)
)
)
)))
3 3
3 333
/
)
)
y a
E b
E E
EEE t
(
T
(
T T
TTT O
O OOO
- 2. N yi s 3
O 3
N NNN t re N
eot EP
(
E H
H. (
(
(((
fi a TO T
G art OR I
O I
II 1
III SPS I
I ND L
I N
H IL L
LLL RB
/
R8 B
E e
B5 E
S c
CC A
/
P PPP i/
II O / ON I
III f n
//
P A
PW S
SSS f o 0I I
A I5 A
AAA Oih L
L FS E
M R
MH Q
OQQ sc D
D D/ D T
D TD D
DDD D
/
/ / //
/ ///
din
/
/
ava R
R 5R S
R P
S RS E
EEE ei r R
R ER E
E R
E RE I
III LDB N
N RN R
N N
R NR O
COC no yi r r
r s
d dd t t e ne e
w a
aa iae eh h
e e
ee run l c c
h t
tt i iii oli ot t
t s
ss n nnn l
l l c
aaa i ag Ma a
t i i i i iii 0
h h
a rvn
'V T T
M M MM R
RRR PEE se I
e k
l M
s c
a e T
n o
t h
l r
ed l
n t
ma o
cn n
s s ~
d B
e oe d
ia n
m e
rR n
L o
n nn a
n d
f e
s i
o og s
o i d
v nr t
i ii e
r s dn oo a
t t s l
v i n ea D
g Nd e o l
v I
n N
n m n t
id idD r
a n
ic A
i ate ne n n t
V E
s ai t
rnV m
o on n n
t m N
c ge u
C Co o
f e o t o G
u osr I
d reo C
On t
m tt ie z i r
i i
t o
S n
Prt nc E
o Pc s
ognc l
m i n
rneA n
e i
d oe D
C n a n
n i o ore I
fid o
R i
C ac O
o tv li e i o
ti R
r i eR g
yocv t
r M
n roci a
e N
mo F
f coo eCAt t
zs O
d e
rS e
t S
i L
r v
c n i r I
n heo I
e pl O
o oege e
ro T
a trf n N
e sos P
t crnt m
u\\
A uno T
m t nrr eoio u
sa N
2 ntI a s Ito T
i RCrr r
sc I
oc I
F S
r y
nt N
n I
ukM O
E gS roc O
o i
'I t
ei M
C M
det s
rd A
M arcT I
o oCe ntid nt Pn X
T tta S
I r
y d p
P t
nyss D
t aann I n I
E aSBf N
l ernr N
n uoa e
r f
D o
O b
i A
e f qM f m ol D
o td I
I n
r VoI e d
oe l
op R f e N
l net T
T o o t
e gatn i
E v
A y aeecs A C
i i
N i
dro O
c naor nu W se t
cmF ae C
A t
r nl ni ueg I
c onft oq O el P
e i n pu I
c P i
f nidml L
N e
t gdn W
T A
iI nsiE P
i a
hanI a P
O p asseiE A
t sott l d aotCnal L
pn A
S ct a V M
I s
niR s-T la ctn eca A
pa E
en e
I I
n hox et N
ef mic C
u L
n Toeny C
I ciEeR c E
n if gmoefi I
S,
C i
Ctit L
U it s
e M
o -
nu rir R
s cyant atn a
r A
R r
l tci2ume U
i
)
e R
t i i r yi s t R
T o b ef e gi T
re 2
'n J t d u s c C
ev naa l ep E
S d
a pi r i h d
l T
id-eesuqae E
wl I
i pt I at o N
N n tsdcsc e
t S
u i
N d
de.t ell L
oa M
ambM ver E
O e snonsr n
T I
A ILISRCE E
PV T
MIOTEDP G
C vEIMIAA i
tno C(
/m I
eo 1
234 0
I tN l.
- 1. I.1 nI 1
2 34 5
I.
1 2
34 1
E o enu F.
F.
F.
F. F.
F.
G.
G.
H.
H.
H.
H. H.
J.
J. J.
J. J. J.
L i
B tas A
cl s I
I I
II I
I I
I I
I II I
I I
III T
API I
I I
II I
I I
I I
I II I
I I
III E:Q oDQcw w >.
=
o t
c s
Revision 11 L
~[
l I
(
e 11 1 1 1 y
(j,
ke 22 E
E E E
E Ek E E E N &
yl3 gg g eg e
h h h
h c 33 D ee e's h
A hd 3*a s3
.c
-3c e
4
~ ~
'* d 2
4 0
E 4:
3.,C
.=
'RR R 1
77 7
7 77 777 7 7 ww w wt g gg g 9
~
M M M
M MM M M M M X Tbt 22 W
W W W
W WW W W W W W
~~ ~
Ji v.
- 0 F
.W E
F R 29 E R R R R t
8.8 I
xs th '
28c 2* -
ggq h
o;$
g 1, *2,
'w
,8 w
tr w a se
=
=== = a w
wom oo o E E
!E E E
E EE E E E E E E
'E b.'
bs c
Ti i i
t 2 2
2 22 2 5 2 2 2
\\
rY
- r. w: wr.:.:.:
ee
't a
a tt t a
.n.
t 4
3 c
=
r.
=
=
w w w
w ww w w w
%j
. w I
.x Ct b
E 8
y
- E c
5 y
c
.2
& t e
1 3 g
g a s _g;5 t%
Et a t
- : a a
- p. -:
g r _g a a
- "s r I t
- l yg g-g a t_g g--
a gc x
- t..
a s 2w
" =
" f "I "g.
? g 3.E %
i 7 2*
s 1 !$ c 8
I t ' * :. t 7
"a v W
E y
2 A M: Et*
g g "4 6' Er
, E c~c-g8 gE A
b"sf S $
- b
. 5.*
T*
=
3 t
- y
[5
'S
'f*a W
) g )3 a m i
3 a s 3
f"r28 f3*T' E.':. T
- K q I
- g.1 3
_r.r s 2
z
- _s a
,.g 7 7 rg J:a:{! ra s.-
- e r t z~*
- t t g f t
2:
$3 382 h_ 0 g
es y
g-ag g: ag g a a y~sz_;
e W 4 i
"E.- s "la. _a3 rj,etij%g gr_ E r s
.pf..t r
- s s e,
~1* r # r * ;g s b
..r 2
t E;. Es T b $ 8 : S T
- f:A'zE s
a ? $.E E" ss:hz t_
-s
- t 3 2 2 E srze f.gs.*igt
- pEutgja-yufEt" E 18.-
8E' xx E
ta 2 o
re g.,s 2 E i.,2
- s 7. e s
- o 1 :s p -
b l a. t " l a. l v a gras-n y. 8 8 e a e
7:
2 ult %le~I ti e
yes-
- L 2 % l
- wl? i 7
tgb6 f~ay % & E 8 5l~
l n
e g
]
3 g g g g%- d 3
w a -v 4. f o$ { a. I
- 2
'";.'. ; S a i t
T7%
W A 5 &8t aa[. A Adas.Id-}gi STT *1. 2 4 j
C A A' W W A 30 a d f.lif v
%8
}2.
"l N ":
9 N 9
0 $
0
_, $$ b SC O O
~
8 =
n n
n n ~~ ~
n n
n /N
=
f L
_8 " B N N,N N '.,".
"' ": 9
" " ' ~.
7 w
w ww w w
w ww w w w w w 1
s e
X$$
b b
$_$b'$ bb b
_ bb' $
0
.b
- 12/31/89 35 NUREG-0933
TABLE II (Continued)
U N
Action Priority Lead Office /
Safety Latest Plan Item /
Evaluation Division /
Priority /
Latest Issuance NPA N
Issue No.
Title Engineer Branch Status Revision Date No.
co e
II.K.1(12)
One Hour Notification Requirement and Continuous Estit MRR NOTE 3(a) 12/3UM Communications Channels II.K.1(13)
Propose Technical Specification Changes Reflecting Eerit NRR NOTE 3(a) 12/3 U84 Implementation of All Bulletin Items II.K.1(14)
Review Operating Modes and Pro..dures to Deal with Enrit NRR NDTE 3(a) 12/31/84 Significant Amounts of Hydrogen Eerit NRR NOTE 3(a) 12/3U84 II.K.1(15)
For Facilities with Non-Automatic AFW Initiation, Provide Dedicated Operator in Continuous Communication with CR to Operate AFW II.K.1(16)
Implement Procedures That Identify PRI PORY "Open" Eerit MRR NOTE 3(a) 12/31/84 Indications and That Direct Operator to Close Manually at " Reset" 5etpoint II.K.1(17)
Trip PZR Level Bistable so That PZR Low Pressure Enrit NRR NOTE 3(a) 12/31/84 Will Initiate Safety Injection II.K.I(18)
Develop Procedures and Train Operators on Methods Eerit MRR NOTE 3(a) 12/3 U84 of Establishing and Maintaining Natural Circulation II.K.1(19)
Describe Design and Procedure Modifications to Eerit NRR NOTE 3(a) 12/3U84 Reduce Likelihood of Automatic PZR PORY Actuation in Transients w
II.K.1(20)
Provide Procedures and Training to Operators for Eerit NRR NOTE 3(a) 12/31/84 Proset Manual Reactor Trip for LOFW, TT, MSIV
-Closure. LOOP, LO5G Level, and LO PZR Level II.K.1(21)
Provide Automatic Safety-Grade Anticipatory Reactor Eerit NRn NOTE 3(a) 12/3 Ua4 Trip for L0fW, TT, or Significant Decrease in SG Level II.K.1(22)
Describe Automatic and Manual Actions for Proper Enrit NRR NOTE 3(a) 12/31/84 Func ioning of Auxiliary Heat Removal Systems When FW System Not Operable II.K.I(23)
Describe Uses and Types of RV Level Indication for Eerit NRR NOTE 3sa) 12/31/84 Automatic and Manual Initiation Safety Systems II.K 1(24)
Perform LOCA Analyses for a Range of Small-Break Eerit NRR NOTE 3(a) 12/31/M Sizes and a Range of Time Lapses Between Reactor Trip and RCP Trip II.K.1(25)
Develop Operator Action Guidelines Enrit NRR NOTE 3(a) 12/31/M II.K.I(26)
Revise Emergency Pro edures and Train R0s and SR0s Enrit NRR NOTE 3(a) 12/3U84 II.K.1(27)
Provide Analyses and Develop Guidelines and Eerit NRR NOTE 3(a) 12/31/84 Procedures for Inadequate Core Cooling Conditions II.K.1(28)
Provide Design That Will Assure Automatic RCP Trip Enrit NRR NOTE 3(a) 12/3UM for All Circumstances Where Required II.K.2 Commission Orders on B&W Plants y
II.K.2(1)
Upgrade iimeliness and Reliability of AFW System Eerit MRR/DSI NOTE 3(a) 12/3U84 m
m II.K.2(2)
Procedures and Training to Initiate and Control Enrit NRR NOTE 3(a) 12/3UM g
~Q AfW Independent of Integrated Control System II.K.2(3)
Hard-Wired Control-Grade Anticipatory Reactor Trips Eerit MRR/DSI NOTE 3(a) 12/3UB4 el C,
II.K.2(4)
Small-Break LOCA Analysis, Procedures and Operator Enrit NRR/DHF5/0LB NOTE 3(a) 12/31/M o
3 w
Training H
H O
O O
TABLE II (Continued)
U Priority Lead Office /
Safety Latest N
Action Evaluation Division /
Priority /
Latest Issaance WA W
Plan Item /
Enginee-Branch Status Revision Date No.
Issue No.
Title g
Eerit WR MOTE 3(a) 12/31/M e
II.K.2(5)
Complete TNI-2 Simulator Training for All Operators II.K.2(6)
Reevaluate Analysis for Dual-Levet Setpoint Control Eseit MR/DSI NOTE 3(a) 12/3UM II.K.2(7)
Reevaluate Transient of Scotesber 24, 1977 Eerit MR/DSI NOTE 3(a) 12/31/M Eerit MR II.E.1.1, 12/31/M M
II.K.2(8)
Continued Upgrading of AFW System II.E.1.2 Enrit MR I
12/31/M F-27' II.K.2(9)
Analysis and Upgrading of Integrated Centrol Systes II.K.2(10)
Hard-Wired Safety-Grade Anticipatory Reactor Trips Eerit MR I
12/31/M F-28 Eerit NRR I,
12/31/M F-29 II.K.2(11)
Operator Training and Drilling II.K.2(12)
Transient Analysis and Procedures for Management Eerit NRR I.C 1(3) 12/31/M M
II.K 2(13)
Thermal-Nechanical Report on Effect of HPI on Vessel Eerit MR I
12/31/M F-30 of Small Breaks Integrity for Small-Break LOCA With No AFW II.K.2(14)
Demonstrate That Predicted lif t Frequency of PORVs Enrit NRR I
12/31/M F-31 Enrit NRR I
12/31/M and SVs Is Acceptable II.K.2(15)
Analysis of Effects of Slug Flow on Once-Through Steam Generator Tubes After Primary Systee Voiding Eerit NRR I
12/31/M F-32 II.K.2(16)
Impact of RCP 5eal Damage following Small-Break Eerit MR I
12/31/M F-33 LOCA With Loss of Of fsite Power II.K.2(17)
Analysis of Potential Voiding in RCS During Eerit NRR I.C.1(3) 12/31/M M
W Anticipated Transients II.K.2(18)
Analysis of Loss of Feedwater and Other Anticipated II.K.2(19)
Benchmark Analysis of Sequential AFW Flow to Once-Eerit MR I
12/31/M F-34 Transients Eerit NRR I
12/31/M F-35 Through Steam Generator II.K.2(20)
Analysis of Ste m Response to small-Break LOCA That Causes System Pressure to Exceed PORV Setpoint Eerit WR/DSI NOTE 3(a) 12/31/M l
II.K.2(21)
LOFT L3-1 Predictions Final Recommendations of Bulletins and Orders Task II.K.3 II.K.3(1)
Install Automatic PORY Isolation System and Perform Eerit NRR I
12/31/M F-36 Force II.K.3(2)
Report on Overall Safety Effect of PORY Isolation Eerit MR I
12/31/M F-37 Operational Test-System Eerit WR I
12/31/84 F-38 II.K.3(3)
Report Safety and Relief Valve Failures Promptly II.K.3(4)
Review and Upgrade Reliability and Redundancy of Enrit MR II.C.I.
12/31/84 M
and Challenges Annually II.C.2 Non-Safety Equipment for small-Break LOCA Nitigation II.C.3 Eerit WR I
12/31/M F-39, G-01 II.K.3(6)
Instrumentation to Verify Natural Circulation Eerit NRR/DSI I.C.1(3).
12/31/ M M
II.K.3(5)
Automatic Trip of Reactor Coolant Pumps II.F.2, ap II.F.3 II.K.3(7)
Evaluation of PORY Opening Probability During Eerit
. NRR I
12/31/M 1
so en Overpressure Transient o.
4 e
~
W W
...m......
~
...m.......m m
TABLE II (Continued) w Q
Action Priority Lead Office /
' Safety tatest w
' Plan Item /
-Evaluition Division /
Priority /
tatest is waAe MPA Q
Issue No.
~ tle Engineer Branch Status Revision Date No.
.s co w
.C.1, 12/31/84 NA II.K.3(8)
Further Staff Consideration of Need for Diverse Eerit NRR/ DST /GIB Decay Heat Removal Method Independent of SGs II.E.3.3 II.K.3(9)
Proportional Integral Derivative Controller Enrit NRR I
12/3US4 F-40 Modification II.K.3(10)
Anticipatory Trip Modification Proposed by Some Enrit NRR I
12/31/84 F-41 Licensees to Confine Range of Use to High Power Levels II.K.3(11)
Control Use of PORY Supplied by Control Cumponents.
Enrit MRR I
12/31/84 Inc. Until furt % r Review Complete II.K.3(12)
Confirm Existev e of Anticipatory Trip Upon Turbine Enrit NRR I
12/31/84 F-42 Trip II.K 3(13)
Separation of HFCI and RCIC System Initiation Levels Eerit NRR I
12/31/84 F-43 II.K.3(14)
Isolation of Isolation Condensers on High Radiation Eerit MRR I
12/31/84 F-44 II.K.3(15)
Modify Break Detection Logic to Prevent Spurious Enrit NRR I
12/3UB4 F-45 Isolation of HPCI and RCIC Systems II.K.3(16)
Reduction of Challenges and Failures of Relief Enrit NRR I
12/3U84 F-46 Valves - Feasibility Study and System Modification II.F.3(17)
Report on Outage of ECC Systems - Licensee Report Eerit NRR I
12/3UB4 F-47 and Technical Specification Changes II.K.3(18)
Modification of ADS Logic - Feasibility Study and Eerit MRR I
12/31/84 F-48 wco Modification for Increased Diversity for Some Event Sequences II.K.3(19)
Interlock on Recirculation Pump Loops Enrit NRR I
12/3U84 F-49 II.K.3(20) loss of Service Water for Big Rock Point Eerit NRR I
12/3UB4 II.K.3(21)
Restart of Core Spray and LPCI Systems on Low Eerit MRR I
12/31/84 F-50 Level - Design and Modificatior II.K.3(22)
Automatic Switchover of RCIC System Suction -
Eerit NRR I
IU 31/84 F-SI Verify Procedures and Modify Design II.K.3(23)
Central Water Level Recording Enrit NRR I.D.2, lu31/84 NA III.A.1.2(1),
III.A.3.4 II.K.3(24)
Confirm Adequacy of Space Cooling for HP"I and Eerit NRR I
12/31/84 F-52 RCIC Systems II.K.3(25)
Effect of Loss of AC Power on Pump Seals ferit NRR I
12/3U84 F-53 II.K.3(26)
Study Effect on RHR Reliability of Its Use for Eerit NRR/DSI II.E.2.1 12/3U84 NA Fuel Pool Cooling II.K.3(27)
Provide Common Reference tevel for Vessel Level Enrit MRR I
12/31/84 F-54 Instrumentation II.K.3(28)
Study and Verify Qualification of Accumulators Eerit NRR 1
12/31/84 F-55 on ADS Valves i
z II.K.3(29)
Study to Demonstrate Performance of Isolation Enrit NRR I
12/31/84 F-56 Condensers with Mon-Condensibles E
rn II.K.3(30)
Revised Small-Break LOCA Methods to Show Compliance Eerit NRR I
12/31/84 F-57
?
with 10 CFR 50, Appendix K o
II.K.3(31)
Plant-Specific Calculations to Show Compliance with Eerit MRR I
12/3 UB4 F-58 10 CFR 50.46 8
~
M O
O O
s I
/
s TABLE II (Continued)
- ro w
Action Priority Lead Office /
Safety Latest Q
Plen Item /
Evaluation Division /
Priority /
-latest Issuance WA co
-Issue No.
.Tltle Engineer Branch Status Revision Date No.
to II.K.3(32)
Provide Experimental Verification of Two-Phase Eerit NRR/DSI II.E.2.2 12/3UB4 M
Natural Circulation Models II.K.3(33)
Evaluate Elimination of PORY Function Eerit NRR II.C.1 12/31/84
-M II.K.3(34)
Relap-4 Model Development Eerft MR/DSI II.E.2.2 12/31/84 M
II.K.3(35)
Evaluation of Effects of Core Flood Tank Injection Enrit MR I.C.1(3) 12/3 UB4 M
on Small-Break LOCAs II.K.3(36)
Additional Staff Audit Calculations of B&W Small-Eerit NRR I.C.1(3) 12/31/84 NA Break LOCA Analyses II.K.3(37)
Analysis of B&W Response to Isolated Small-Break Eerit NRR I.C.1(3) 12/31/84 NA LOCA II.K.3(38)
Analysis of Plant Response to a Small-Break LOCA in Enrit MR I.C.I(3) 12/31/84 NA the Pressurizer Spray Line II.K.3(39)
Evaluation of Effects of Water Slugs in Piping Enrit NRR I.C.1(3) 12/3UB4 NA Caused by ifPI and CFT Flows II.K.3(40)
Evaluation of RCP Seal Damage and teakage During Emrit MR II.K.2(16) 12/31/84 MA a Small-Break LOCA II.K.3(41)
Submit Predictions for LOFT Test L3-6 with RCPs Eerit NRR I.C.1(3) 12/3U84 M
Running II.K.3(42)'
Submit Requested Information on the Effects of Eerit NRR I.C.1(3) 12/31/84 MA w
to Non-Condensible Gases II.K.3(43)
Evaluation of Machanical Effects of Slug Flow on Eerit NRR II.K.2(15) 12/31/84 NA Steam Generator Tubes II.K.3(44)
Evaluation of Anticipated Transients with Single Eerit NRR.
I 12/31/84 F-59 Failure to Verify No Significant Fuel Failure II.K.3(45)
Evaluate Depressurization with Other Than Full ADS Enrit NRR I
12/31/84 F-60 II.K.3(46)
Response to List of Conc is from ACRS Consultant Enrit MR I
12/31/84 F-61 II.K.3(47)
Test Program for Small-B%k LOCA Model verification Eurit MR I.C.m(3),
12/31/84 M
Pretest Prediction, Test Program, and Model II.E.2.2 verification II.K.3(48)
Assess Change in Safety Reliability as a Result of Enrit NRR II.C.I.
12/3U84 NA Implementing 840TF Recommendations II.C.2 II.K.3(49)
Review of Procedures (NRC)
Eerit NRR/DMF5/PSRB I.C.8 12/31/84 M
I.C.9 II.K.3(50)
Review of Procedures (N555 Vendors)
Eerit M R/DW S/PSRB I.C.7, 12/31/84 NA I.C.9 II.K.3(51)
Symptus-Based Emergency Procedures Enrit M R/DHF5/PSRB I. C. 9 12/3 UB4 M
II.K.3(52)
Operator Awareness of Revised Emergency Procedures Enrit MR I.B.I.I.
12/31/84 NA I. C. 2 I.C.S z
II.K.3(53)
Two Operators in Control Room Emeit MR I.A.I.3 12/31/84 NA c:
II.K.3(54)
Simulator Upgrade for Small-Break LOCAs Eerit.
MRR I.A.4.I(2) 12/31/84 NA E
rn II.K.3(55)
Operator Monitoring of Control Board Enrit MRR I.C.1(3),
12/31/94 M
?
1.D 2, 7
I.D.3 og II.K.3(56)
Simulator Training Requirements Eerit NRR/DHF5/DLB I.A.2.6(3),
12/31/84 M
I.A.3.1 4
o, II.K.3(57)
Identify Water sources Prior to Mar.ual Activation Enrit MRR I
12/31/84 F-62 U
of ADS l
Revision 11 l
33$
3 $
=.ti 111 11 1 a 12 1 11 1 15 i fil
$$ $ $$ $ $$ $$ $k$
-F 33 ss s.
ss s ss ss RR R RR R RR RR MRR s
C3.
m a - 3" hq 33 3 37 3 3 33 333 U
E yg m
25 1
22 22 2 22 2 22 22 222 r
xx xx x xx' X xx xx xxx w
g 53%
WW W WW W WW WW WWW
."W EE E RE E.EE RE REE AAM
-.-~~ EE
.-~~ ~ ~
e e ere re If f BB B ff II EEE s
e 5 <= 5<=5 <5 ek ck e
=D DD <<5 wk
.3 e e ret Et tr r Et t Et et tre i
=
==
=
bb b
bb b5
.5 B.555.55
.$$$ $ I
.EE 55 5.55 55.555
~
m.8
- s-
...kh
. hk k $k h.
y.
Aaw
==
= ===
E III.
e g
8 v J g
A 3
E j g
y 1
t
> 4 2 -
.t
=
r 2
"[ a t t
p
-O
.. _t:
y"
..F ]
-Q b
ti "y
f, 1
=
I=
A'.
Ig[
j B
- t " j
=b l
j*33 b
g F
a
.r-.
zu t
u 1
g 1
t T P"?
.fu
$ $.:;8 4,
%${ }
}
.f.u$
I E
"a.
% 3
{T y
{
k az xa q
ula e
x
~
. sz a
y, t a
}e?a f :)
s
=
i P
, s ets-esg pp2 r.
't z --.F j. 3I:
- fr,gg[3'@ }i.,E ~.
.g
- "S$*
Ce F 40W E.
es g.it [, g* $ 3. c A-1-
p e
d, "a W t
e 3 33 3.3 g
p j,ises el g5I3 b
g-g m-3 Esi.ll 8 _3
-algEfki=es. i *=>N tI I isEbrIz t
r v
z-o s-
.g.-
t "Y.r s ! e r. i. a: ! pt " g E
E
.r e s t.3 a# a 5 E "8
e or -
' e.r
- b w f, s es.
.Y 5
t,. es satv2=
-e"v e t. g f :F.N372*".PB g
F a 3e Fe"""
5 Sa pts T
"[s*"t.rzaaro
.g: }:gr.g b=5.px.st. 3.xp-e 2
e
. r.
e
.i il e
EettEehsas's es t.=tE =i ::P.2 eE e
cev t r e i. =t t e e l t " n 1 e r v t s e
r e
saw-=
==---e-
-=
=
N
-Nm N
Nm N
-N Nm i
y.
= =~nnnmxx
=== = ~
== === Nmxx...www I
=
-1 as aaaaaaaa ~4Wwa w w mgss s ss ssss ssssse E'y d dd 4d444444 4 4444 4 4 4 4d4 4 44 4d44 4d4444 w
S.
a a aa aaaaaaaa a aaaa a a a aaa a aa aaaa aaaaaa y ;E:
N
=
===== ===== = = ==== =======
i i
i 12/31/89' 40 NVREG-0933 j
,~
{
]
{
I t
%./
'%.J
'w/,
- TABLE II (Continued)
U N
Action Priority lead Office /
Safety Latest W
Plan Item /
Evaluation Divisfor/
Priority /
Latest Issuance MPA Issue No.
Title Engineer Brancts Status Revision Date No.
pg so III.8 EMERGENCY PREPAREDwESS OF STATE AND LOCAL GOVER984ENTS III.B.1 Transfer of Responsibilities to TEM?.
Milstead OIE/DEPER/IRDB NOT; '(b) 11/30/83 NA III.B.2 Implementatbn of MRC and FEMA Responsibilities 111.8.2(1)
The Licensing Process Milstead ole /DEPER/IRDB NOTE 3(b) 11/30/83 h4 III.B.2(2)
Federal Guidance Milstead 01E/DEPER/IRDB NOTE 3(b) 11/30/83 m
III.C PUBLIC INFORMATION III.C.1 Have Information Available for the News Media and the Public III.C. I(1)
Review Publicly Availabic Documents Pittavi PA LI (NOTE 3) 11/30/83 NA III.C.1(2)
Recommend Publication of Additional Information Pittman PA LI (NOTE 31 11/30/83 NA III.C.I(3)
Program of Seminars for News Media Personnel Pittman PA LI (NOTE 3) 11/30/83 MA III.C.2 Develop Policy and Provide Training for Interfacing With the News Media III.C.2(1)
Develop Policy and Procedures for Dealing With Briefing Pittman PA LI (NOTE 3) 11/30/83 NA Requests III.C.2(2)
Provide Training for Members of the Tech.iical Staff Pittman FA LI (NOTE 3) 11/30/83 MA 111.0 RADIATION PROTECTION III.D.1 Radiation Source Cortrol ITI~D I.I Primary Cooiant sources outside the Containment Structure 111.D.1.1(1)
Review Infomation Submitted by ? icensees Pertaining NRR I
1 12/3_^88 to Reducing Leakage from Operating Systems III.D.I.1(2)
Review Information on Provisions fo, Lealt Detection Eerit RES/DRA/ARGI8 DROP 1
12/31/88 111.D.1.l(3)
Develop Proposed System Acceptance Eri*.eria Eerit RES/DRA/ARGIS DRGP 1
12/31/88 III.D.I.2 Radioactive Gas Managemant Erit WRR/D5I/METB DROP 1
12/31/88 NA III.D.1.3 Ventilation System and Radioiodine Adsorber feiteria III.D.I.3(1)
Decide Whether Licensees should Perform Studies and Enrit MRR/DSI/METB DROP 1
12/31/88 NA Make Modifications III.D.1.3(2)
Review and Revise SRP Eerit NRR/DSI/NETB DROP 1
12/31/88 M
III.D.I.3(3)
Require Licensees to Upgrade Filtration Systems Eerit MRR/DSI/METB DROP 1
12/31/88 NA III.D.I.3(4)
Sponsor Studies to Evaluate Charcoal Adsorder Eerit NRE/DSI/M TB NOTE 3(b) 1 12/31/88 NA III.D.1.4 Radwaste System Design Features to Aid in Accident Eerit NRR/DSI/METB DROP 1
12/31/d8 NA
- xy Recovery and Decontamination 1
Q III.D.2 Public Radiation Protection Improvement e
M.1 Radiological Monitoring of Effluents III.D.2.1(1)
Evaluate the Feasibility at:d Perform a value-Impact Enrit NRR/DSI/METB LOW 2
12/31/85 NA 7
~8 Analysis of Modifying Ef fluent-pbnitoring Design w
w W
Criteria w
_>-,.m,-au---
o---
--s_--w
- m,-
....m_--:
gyg13 gI )3oup unap(
n.g y31 gov dJ!oplA laep g;stsaf selaid 1e14s1 N
dleu glam/
3segneitou 0tagsgouf da gopiK/
1e1*s1
!ss'eu34 WdV N
!ssna go-igga 3u6gua44 gaemy sleims gaa! slo # 0'18 NO' oc nc III'O T I)Z( 51npA 1ya 3aesiqits14 os sabntpuS 1ya aanagodeauS
]uP2 43H/OSAW318 10M 2
IREI/85 W
oJ 3;;asigna waeus ;ca wougtoatub eup s h gruS qqta sesas eup yeptogop!ua sataesap go 1ya ylmosdyaaa
!!!'O T T)E( daagsa ya6ngelo24 snipas 3mp1 N55/OSI/N318 1 091 Z
IREI/05 NV I!!'O T 2 aepsotop!ua* 3e2qou-Ip* eup 1P p nu delgaeJ acsa yuet s!s i
eII'O T 2)I(
d*P02a sinpX 03 geplotop!u4* 3?Jqou-Ip* eup ippna 3mp1 Nba/OSAsVB N013 E)4(
Z IREA85 W
3ayea!oJ III OT2)Z( laegneta 0 ele 301gwlap el dnep ]!p as 3891 nab /OSI/uyS Ij!'O T S Z
IREM85 NV III0 7 2)E( 0alaamtua )ya 0*s14ggnpou o; 1ya 34a8!381 Sdastas oJ jep1 4s!P/OSI/3vS III~O T S 2
IREI/85 4v depiotop!ua !u f*ga-netaa-Slaem w!wgnaas ggg g T g)g{ gaaisa syd eup da6nge1024 gn! pas
]sp1 N3B/351/3YS III*0 T S 2
IZ/E M9S bv
!!!'OT E libnip deiWeK geplogo6 :eg 3oulaog 5
III'O T E)I(
O*** god dJc3apnaas )o c!sapsguela galma u 3sP 2 N33/03/3H3E N013 E)9(
2 IREA85 4v St1*5/dleuts III'O T E)Z( O!sapa!uela galaaau sglas eup dge91s lyrt gabngaa 3apa maH/03/]H3H N013 E)4(
2 IZ/EA85 W
3ousgpaae)!ou 031gbnip deiwef gulaapl31!ou lwyul nas b
III'OT E) E(
3sleqggsy jaeslqta % 1yop oJ deiWef gulaaptsilou 3891 NME/03/3H3E N013 E)4(
Z IZ/EASS 4v III'OT E)p(
JJade2a e sneseaA yssasseaut
]sa!1 NBM/G3/3H3S N013 E)4(
Z IZ/E ABS W
v III'O T t 011sgla aos,a waesnaamauls m
ggg g T p)g(
ginpf jaes qggilA oJ 3ua!Jouwaulet woutloJs A.Wogac N5H/05AHYS N013 E)4(
Z IZ/EI/SS s'v III G T P)2( dge3a 50 1105 VJonup 3e34 S!la A.wotau 013/03d/0348 lI )4013 E(
Z IZ/EI/05 4v III'*0 T S 011sgna gosa 3egangelgou wecneg A,wogau N3B/OSI/uv8 N013 E)4(
Z IREI/BS uW ggg 0 T 9 gupedauoaul aep!oto6 3eg g esnaamauts A,wotau 013/03d/0848 lI )N013 E(
2 IREI/8G NV 5
gg gr t nop aa gep!eggou dJoi w 6 !sd2onamaul III'O T Z 0EI yepgelgou dJota31;ou ggeas A,wotau Nhs/QSI/MW N013 E)9(
E IREA81 mv III'OT2)I(
Heeg14 44 s!3s ladeonasauts A
III' Vmaup IO 333 20 A %gau A.
335/030/034EB lI )N013 E(
E IREI/SI W
III'OT2)2(
gssna e da6ngetoaX gn!pa Wotau 33S/O!0/0348E 11 )N013 E(
E IREI/SI NW
!!!'0'E'g)3(
2)E(
0*aatod 52eupeap da p 02sem a 39 1aH
- A.uotau 535/030/05488 lI )N013 C(
E IZ/EI/81 MY ggg g r ganasod wagyop ;oa laspu6 eup 3aa2g;5gu6 yga-dnp;igu6 A Wotau 335/c30/03488 lI )N013 E(
E IREI/91 W
gasd!Jeloas III'0 T E)I(
!u dgeul gepgellou gnilopu6 OTE III' issna laitas gabngpu6 gad 2onap nepge)!ou seedg sus NbB/01 Z
J-96 rustanaauneitou III'O T E)2( 5a13plape gabn! pus 1,)ausaas lo 3segnela Naap 102 NdB N013 E)e(
Z IZ/EA99 uv ypp )!ouet sn24aK jbngdeaul III*0 T E)E(
!ssna e sata 34eu6a 4Joatp!ub y33adaegga walyopS 403 33S N013 E)e(
Z IZ/EA89 NV 3eg!q2e13ou o; gep!epou-woutiopc6 lustanuauis III a T E)D(
!ssna e se6nge1o24 sn!pa a3S N013 E)e(
2 IREA89 4v E
III T E p
]ou1 Jot doom neq!1eogg514 N5H/01 I
3-20 g
ggg g r's uep5elgov nopa2 3xdosnaa e
ggg g r g}g( aanagod 3oasel )oa 3 ele fo ga 3oggassap qA algg!tgas A,wotau 535/0f0/03498 11 )N013 E(
2 IZ/EA89 NV f
gabeapguS toleg gep!et;cu 3rdosma go mavaas M
-III'O T S)2(
lunasts6e)!aa miyops o; ogle!uguS ]natotaa gaeg1y a,wotau 535/0$0/03483 lI )N013 E(
Z IZ/EI/89 4v y
n gele gK sougabgstettaa m eus
!!!'O'C'S)E(
saa!sa IO 3JH 20 A.%gau 33S/010/03J85 lI )N013 E(
Z IZ/EA89 W
Q O
O O
_ ~-
-r.,
.s,
-4 g~g
[
ps it
(
{
, (
_ (
~
G/
'G, s
TABLE II (Continued)
- p
(
"A tion,
Priority Lead Office /
Safety Latest c
- W.
Plan Item /'
-Enalisetion Division /
Priority /
tatest Issaance WA
- (-
Issue No.
Title
~ Engineer Branch status Resision Dete No.
op e
IV.A STRENGTHEN ENFORCEMENT PROCESS IV.A.1 Seek Legislative Authority Eerit GC LI (NOTE 3) 11/30/83 - M IV.A.2 Revise Enforcement Policy Eerit OIUES LI (NOTE 3) 11/30/83
. M IV.B ISSUANCE OF INSTRUCTIONS AND INFORMTION TO LICENSEES IV.8.1 Revise Practices for Issuance of Instructions and Eerit DIE /DEPER LI (NOTE 3)-
11/30/83 M
Information to Licensees IV.C EkTEND LE55045 LEARNED TO LICENSED ACTIVITIES OTHER THAN POWER PE ACIOR5 IV.C.1 Estend Lessons tearned from IMI to Other NRC Programs Eerit MM55/WM NOTE 3(b) 11/30/83
- 4 IV.D NRC STAFF TRAINING
.a.
W IV.0.1 NRC Staff Training Eerit ADM/MDT5-LI (NOTE 3) 11/30/83
- 4 IV.E SAFETY DECI510N-MA(ING IV.E.1 Expand Research on Quantification of Safety Colmar
- RES/DRA/RA8R LI (NOTE 3) 2 12/3UM NA Decision-Making IV.E.2 Plan for Early Resolution of Safety Issues terit NRR/ DST /5FEB 11 (NOTE 3) 2 12/3Ue6 NA IV.E.3 Plan for Resolving Issues at the CP Stage Colmar RES/De4/RASR LI (NOTE 2) 2 12/3Ua6 NA IV.E.4 Resolve Generic Issues by Rulemaking
- Colmar RES/DRA/RA8R LI (NOTE 3) 2 12/3U M NA IV.E.5 Assess Currently Operating Reactors htthews NRR/Dt/SEP8 NOTE 3(b) 2 12/31/M NA IVJ FINANCIAL DI5 INCENTIVES TO SAFETY IVJ.1 Increased DIE Scrutiny of the Power-Ascension Test Thatcher 01E/DQ451P NOTE 3(b) 1 12/3UM MA Program IV.F.2 Evaluate the Impacts of Financial Disincentives to Ntthews SP NOTE 3(b) 1 12/3UM NA the safety of Nuclear Power Plants g
22 c
JO m
o 3
W W
W' t
u..
rr
--tt.--
w-+c.,ws<
e troy-r
'aw h*r
+
m-e.-
-+ -
w wr---#<.c vs w-
~.r-w-v.
w sv ----w.
=
-,tv ev.rr
-~-
,..wi---.-
v
--.. ---ewmw-
-M
TABLE II (Continued)
's a fQ D Action Priority Lead Office /
Safety Latest
- a Plan Item /
Evaluation Division /
Priority /
Latest Issuance NPA D
Issue No.
Title Engineer Branch States Revision Date No.
so IV.G IMPROVE SAFETY RUtEMAKI1G PROCEDURES IV.G.1 Develop a Public Agenda for Rulemaking Eerit ADM/Rr8 LI (NOTE 3) 1 12/31/86 M
IV.G.2 Periodic and Systematic Reevaluation of Existing Rules Milstead RES/DRA /WABR LI (NOTE 3) 1 12/31/86 NA IV.G.3 Improve Rulemaking Procedures Milstead RES/DRA/RA8R LI (NOTE 3) 1 12/31/86 NA IV.G.4 Study Alternatives for Improved Rulemaking Process Milstead RES/DRA/RA8R LI (NOTE 3) 1 12/31/86 NA IV.H NRC PARTICIPATION IN THE RADIATION POLICY COUNCIL IV.H.1 NRC Participation in the Radiation Policy Council Sege RES/DH51M/HEBR LI (NOTE 3) 11/30/83 NA DEVELOPMENT OF SAFETY POLICY V.A.1 Develop NRC Policy Statement on Safety Eerit GC LI (NOTE 3) 12/31/%
M V. 8 POSSIBLE ELIMINATION OF NONSAFETY RESPONSIBILITIES
^
V.8.1 Study and Reconnend, as Appropriate. Elimination of Enrit GC LI (NOTE 3) 12/3U86 M
Monsafety Responsibilities VJ ADVISORY C0pMITTEES
[C.1 Strengthen the Role of Advisory Committee or s
'.or Emeit GC LI (NOTE 3) 12/31/86 NA Safeguards V. C. 2 Study Need for Additional Advisory Committet Eerit GC il (NOTE 3)
IZ/3U86 NA V.C.3 Study the Maed to Establish an Indapandent Nuclear Eerit GC LI (NOTE 3)
I2/.T U86 NA Safety Board VJ LICENSING PROCESS V. '.1 Improve Public and Intervenor Participation in the Eerit GC LI (NOTE 3) 12/31/86 NA J
Hearing Process V.D.2 Study Construction-During-Adjudication Rules Eerit GC LI (NOTE 5) 12/3UB6 NA V.D.3 Ecexamine Commission Role in Adjudication Eerit GC LI (NOTE 5) 12/31/86 NA V.D.4 Study the Refom of the Licensing Process terit GC LI (NOTE 5) 12/3UB6 NA z
g g
VJ LEGISLATIVE NEEDS
.e m
[
7 v.E.1 Study the Naed for TMI-Related Legislation Eerit GC LI (NOTE 5) 12/31/86 NA o
O
='
mW O
O O
,e1e7 WW 3
0 1
5 2
1 0
2 1
A.
AM4AMN N
NN
- A A
N NN DNN NN P o A
AA N
MN
,t e
6666 6
66 888 333 393333 c
8888 8
8e 55 888555 5555 888 888888 tn
//// /
//
88
///888 8888
/// //////
sa 1111 1
11
//
111///
/ ///
000 010000 eue 3333 3
33 00 333000 0000 333 333333 t st
//// /
//
33
///333 3333
/// //////
asa 2222 2
2Z
//
222///
////
111 121111 TID 1111 1
1I 66 111666 6666 111 111111 no tiss 11 111111 1111 1
ei t v ae LR
)
))))
)
))
5 3333 3
33
))
))))))
))))
)
)
))
'y EEEE E
EE aa aaaaaa aaaa a
b ab E
((
((((((
((((
(
(
((
T t
TTTT T
TF 33 333333 3333 3
3 33 4O O O O W '(
NN N
4 yi s NNN t ru EEPE(M
(((
((
EE EEEEEE EEEE EPE eot TTOT TT TTTTTT TTTT TOT fi a art IIf I II OO OOOOOO OOOO ORO 4OROI t
SPS LLi L t
LL NN NNNNNN - NNNN NDN
? NDNLt BBB TTT B
8
/
BB MMMBBB BBBB BB BI SBB e
II EEEIII IIII BEE PESCES i/
///GGG GGGG ET H C/EI MC c
f n
//
TTT///
////
MMC
/RM/E/
f o TT SSSTTT TTTT
///
II /I/I SS EEESSS SSSS EEE SSESES Oih DD DDDUDD DDDD DDD DDDDDD sc din
// ////// //// /// //////
ava RR RRRRRE RRRR RRR RSERRR MRR MRMRMM E
eir CCCC C
LDB GGGG G
GG NN NMNNMN NNNM n
S o
M s
r yi r E
wn e
n tt e T
ea h
e I
i ae run tttt t
tt tt tttttt tttt th m tttc l
oli iiii i ii N
ii iiiiii iiii itt iiit o
iag rrrr r
rr A
r rrrrrr rrrr rtt rrra M x'siY rvn eeee e ee L
ee eeeeee eeee eai eeeh PEE EEEE E
EE P
EE EEEEtE EEEE EMP EtET
'V
)
N N
O
)
I s
n I
I S
f
/1 e a T
S U
o c
m C
U i
r A
t r
nn n
r e
oo f
i f
a s
K a
e m
i i m
r r
tt O hsn S
l Cno A
o -
e o
e o
aa C
oi T
o e
)
r
)t a
f uc sR fi t C
f)I e
I c e
(
l i sN ot c (IS T
Sa t
af e
an y
SU Ue S
ns vi ce sru r
yU g
R ot El oh eeF a
t r
n
) r d
in a
rt l p m
ire o
I ed n ta
- u i
re L
Smn a
ul Q
P f oOe gmm ffR s
r Ura bP t
i nt doa rn P
ero) s o
n n
t eoo t ofI)d rf r o rr en asSvf p r
nf(SI a e( o i
t e me i
s o
I(
USo m
t t
sw nm n
eootre n
t y Ul rsa) a io m
ip ritcoR r
c a yt r osrI n
DP e
ai i
t t u ut et ee a
btierc f eeS Ti e
uirmei
( nnU m
yr s
nq tcypc
%S r
R T rgr mn h e a
aa yeoE cnt se N
ge georn g gG r e t
- e Sl C uuier O
nt n
retf oa nu ec n
pl a c
r rF rRi T
t o
D y
I on o
otn(f y iommn o gS c i n y e o N
Sdhe T
LI t nI (D
kT ara cn u
oCdf E
nth e A
) s aI m
c eor e i e N ei i
M t, aut v r
C 1d r
eaml astf u Dnr ttl ss A
iEe O
nn 5a eebrao rlS( s aonicenn E
G 4 n nt n
L oo Uo nbegro Ca s
meCireuI o A
of eueo ii l
euT o gP if sA el CtF i
C tt r
)GT ro
)
erot tCRs o
kt
+,i o h N
nti as R
aa enI rPrtI t e ry s Wnnrl ai A
t t
wSmro PnS zt sot yl B o gP aed moUaotm eU) raspi Sa ii orn as yxgs N
cc M
nzn E ei oo I o M e pl cntsrCBo aiomdem l m F
Lt ed etarem D
O f wrt arernrSh nui ti ocee C
Mni N
eU l hSbnnm aDt ee A
att nDo ee
( oeSreT
- i l
en T am reg aoaesr uh nl rBmenet pgaSa C
N l l
- t rresupril hteepti a N
org o
O gg O
TDed
,t e I
nn e
oseGrgnoet somet oCct rm l t I
l nn l
T ii mcf uG onof maeT upco enuof mn T
Ceeaoyg A SS mi( o eh oC( rwV POeCrfI tCoae A
R nD itn D
ar h maSl od e
t of p
em Z
Ni ysii I
ee Htsgae I mf errt r e yt E s u l st n I
mef srS L
vv emnetIII a( eouneDra mR atSo
)
e N
yasiio O
ee rmeitS r
Ftt ab arme t c r
emttS kkk gS ccl b wmeat eiani l
A dxirmha S
ii l
a t
G uevamt N
hh t yss WrrroWR a a o u a i n e s p g pi v u
i R
t eel ouo O
cc asyeE&aaarT W eronl ret yii man n
T O
SRRCCAt C
AA WASWCBMMMPABRF CSFPGSSPDIME i
t n
o C
(
/
m I
eo
_ %)I.
I tN nI E
o e 1234 S.
12 012 345 678901 L
i nu F.
JV G G.
12 345678 9111 111 111122 M
F F.F.F.
B tas
/('
A cl s V
AA AAAAAA AAAA AAA AAAAAA vVV V T
API UDeye
- s.
- gmr?gw" i
w r
TABLE II (Continued)
U D
Action Priority lead Office /
Safety Latest ea Plan Item /
Evaluation Division /
Priority /
Latest Issuance NPA y
Issue No.
Title Engineer Branch Status Revision Date No.
e A-22 PWR Main Steamline Breat - Cow, Reactor Vessel and V'Noten NRR/DSI/CSB DROP 11/30/83 NA Containment Building Response A-23 Containment Leak Testing Matthews hrR/DSI/CSB RI (NOTE 5) 11/30/83 A-24 Qualification of Class IE Safety-Related Equipment Eerit NRR/ DST /GIB NOTE 3(a) 1 6/30/85 B-60 (former USI)
A-25 Mon-Safety Loads on Class IE Power Sources Thatcher NRR/DSI/PS8 NOTE 3(a) 11/30/33 A-26 Reactor vessel Pressure Transient Protection (former U51) Eerit NRR/ DST /GIB NOTE 3(a) 1 6/30/85 B-04 A-27 Reload Applications NRR/DSI/CPB LI (NOTE 5) 11/30/83 NA A-28 Increase in Spent Fuel Fool Storage Capacity Colmar NRR/DE/SGEB NOTE 3(a) 11/30/83
/.-29 Nuclear Power Plant Design for the Reduction of Colmar RES/DRPS/RPSI NOTE 3(b) 1 12/31/89 NA Vulnerability to Industrial Sabotage A-30 Adequacy of Safety-Related DC Power Supplies Sege NRR/DSI/PSB 128 1
12/31/86 NA A-31 RHR Shutdown Requirements (former USI)
Eerit NRR/ DST /GIB NOTE 3(a) 1 6/30/85 A-32 Missfie Effects Pittman NRR/DE/MTEB A-37 A-38, 11/30/83 NA 848 A-33 NEPA Review of Accidert Risks NRR/DSI/AEB EI(NOTE 3) 11/30/83 NA A-34 Instruments for Monitoring Radiation and Process V'Molen NRR/DSI/ICS8 II.T.3 11/30/83 NA Variables During Accidents A-35 Adequacy of Offsite Power Systems Enrit NRR/DSI/PSB NOTE 3(a) 11/30/83 A-36 Control of Heavy Loads Near Spent Fuel (former USI)
Imrit NRR/DSI/GIB NOTE 3(a) 1 6/30/85 C-10. C-15 A-37 Turbine Missiles Pittman NRR/DE/MTEB DROP 11/30/83 NA A-38 Tornado Missiles Sege NRR/DSI/AS8 LOW 11/30/83 NA A-39 Determination of Safety Relief Valve Pool Dynamic Emrit NRR/ DST /GIB NOTE 3(a) 1 6/30/85 Loads and Temperature timits (former USI)
A-40 Seismic Design Criteria - Short Tem Program (former USI) terit RES/DSIR/EIB NOTE 3(a) 1 12/31/89 NA A-41 Long Ters Seismic Program Colmar NRR/DE/MEB NOTE 3(b) 1 12/31/84 NA A-42 Pipe Cracks in Boiling Water Reactors (former USI)
Enrit NRR/ DST /GIB NOTE 3(a) 1 6/30/85 B-05 A-43 Containment Emergency Sump Performance (fomer USI)
Emrit NRR/D%T/GIB NOTE 3(a) 1 12/31/87 A-44 Station Blackout (former USI)
Eerit RES/DRPS/RPSI NOTE 3(a) 1 06/30/88 A-45 Shutdown Decay Heat Renoval Requirements (forwer USI)
Emrit RES/DRPS/RPSI NOTE 3(b)
I 12/31/88 NA A-46 Seismic Qualification of Equipment in Operating Plants Eerit NRR/DSCO/EtB NOTE 3(a) 1 12/31/87 (former USI)
A-47 Safety Implications of Control Systems (fo ser USI)
Eerit REL/DSIR/EIB NOTE 3(a) 2 12/31/89 A-48 Hydrogen Control Measures and Effects of Hydrogen Burns terit NRR/DSIR/SAIB NOTE 3(a) 1 06/30/89 on Safety Equipment A-49 Pressurized Thermal Shod *(fo-mer USI)
Emrit NRR/DSR0/RSIB NOTE 3(a) 1 12/31/87 A-21 B-1 Environmental Technica) Specifications NER/DE/EHEB EI (NOTC 3) 11/30/83 NA B-2 Forecasting Electricity Demand NRR EI (NOTE 3) 11/30/83 NA B-3 Event Categorizatior NRR/DSI/RSB LI (DROP) 11/30/83 NA B-4 ECCS Re11abliity Enrit NRR/DSI/RSB II.E.3.2 11/30/83 NA b
B-5 Ductility of Two-fay Slabs and Shells and Buckling Thatcher RES/DE/EIB NOTE 3(b) 1 06/30/88 NA N
Behavior of Steel Containments B-6 Loads. Load Combinations. Stress Limits Pittman MRR/DSR0/EIB 119.1 12/31/87 NA 7
f B-7 Secondary Accident Consequence Modeling NRR/DSI/AEB LI (DROP) 11/30/83 NA w
B-8 Locking Out of ECCS Power OperatcJ Valves Riggs NRR/DSI/RSB DROP 11/30/83 NA
~W B-9 Electrical Cable Penetrations of Containment Eerit NRR/DSI/PS8 NOTE 3(b) 11/30/83 NA B-10 Behavior of BWR Mark III Containments V*Molen NRR/DSI/CSB NOTE 3(a) 1 12/31/84 NA U
B-11 Subcompartment Standard Problems NRR/DSI/CSB LI (NOTE 5) 11/30/83 NA O
O O
7< 7 g> HH
(, j A
1\\Q FN A
AA A
A A
- MAMA N NN AA A
MAA MM NN N
AM n
N N
NN o
N N
NN N
e 633 33 63 33333 34333393333 3
33333333 33 c
888 88 88588888 88888888888 8
88888888 88 tn
/// //
//8/////
///////////
/
//////// //
sa 100 00 10/00000 0100000000t 0
00000000 00 eue 333 31 33033333 33333333333 3
33333333 33
//U // //3U//// //U//U/U//U U/////// //
/
t st 21 11 21/
1111 12 11 6
11 1
1111111 11 asa LID 11I 11 116I1111 11I11I0I11I 1
I1111111 11 m
no tiss ei 1
2 I
1 t v ae tR
)
)
)
))
)
)
)
)
)))
5 5
5 53 5
3 5
5 353
)
))))
)
/
)
)
)
)
)
)
)
y bE P
bEP P
EbEE EP E1. E a
EPPPPEEE
)P
(
T OOOOTTT 2O t
(T O
(TO O
T(TT TO T 3. T O
3 ORRRROOO
- R yi s 3O R
M 3OR4R O3OO4OR4O t ru N
D t
ND D
N NN ND N D.(N NDDDDNNN BD eot E(8 (8
i3E((E(6 (E((E((E(
E
((((((((
((
fi a T
4 1
D4T T
4 T
T T
I T
art OI -
I -
E - OIIOI -
IOIIOI1OIII O
IIIIIIII II SPS NLA LA mANLLNLA LNLENL1NLIL N
EEEEEEEE EE B
/
F R
B B
e BBB B
HBBBBBB B
BBBBBBBT T
BBBBB B
c SSI S B' RIPMPPP BEBEEEEEAAE E
EEEEE8EB BB i/
CCG CE
/GCACCC ETEHHHCMRRM M
HHHHHAHA AA M
/
EEEEESE5 5S f n
/// U/
S//////
MMMEEESE//U EEUEEEUE5S5 EEUUEUU/ /U
//
/
// ///
/1I I
f o IIT PT1EII1 S
E E
Dih SS5 SE RS5A5S5 sc DDD DD DD0DDUD DDDDDDUDDDD D
DDDDDDDD DD din
/// // ///////
///////////
/
//////// //
ava RRR RR SRRSRRRR RRRMRRRRRRR R
ER ERRRU R
NMW PM RWWRNNWN MMWMMMRRMRM ei r NN NN N
N NW N
N lDB no yi r d
dd tt e a
n n
aa i ae e r e
a-ee run t't t
tta l
t s
m tt t
t
_t}/
sim -
o i g
t ss' i i
eli i i i
ll -
r-r i aa r
r
- r l rl M-r
- iR P
Mf E-E g-
- t - i i e
e e
rvn ee e
i eo
'V i
MEC E
a FEE E
E E
[I\\
d n
i o
id s
f u ri u
p oq ot l
m i
f pr t
F u
l sL ro n
S a
n aof r
e n
c s
o d si s a
m i
t i
n inrrdd ne n
n n
o taoeAn n
ol i
s e
a i
a tt a
o i c a
e sm h
t s
l scid t
t u n
C o
l ia M
t ie uuarns k
aN g
) ^ t r
nn c
a A
n u
oi e
r coeCae n
u i
l nl eR e
a l d s
O C
i tt e
p oas ent l
an e
L
.a cn d
nF m p iCarcos s
P va D
9 F
Ao n
eN a u
t Geniy r E
n 1
C a
P r
S cr wats e
n l
l o~
g r
ngs uonona t
o ea na N
y n or l
took y.r dfiPere as st o ot t
ei to a
nirnt e e tt r Wn t
tic i-.
( - i cp af c
etPii t
R ssd a
I u o n cS t
s l
ni r
i mc Sl a
ll e t
gi e a f
a W
eeal
- ea nt m
pro v
i aP es r
net t.
i b
n p t.
t isrtb rdio e
ia n mo r
na ed O c
aboaa
.d uoro* rF vg i If s e
si a op t e e
tupeb e
sMeCdi ii a
t si nttd y
l nSsHo t yo t
nAy et r
l ss nv E
o n r
agpI ara t scs t
aho on
, tis' sCf aeP l J x Me'eemee n
- t. pC CE tC iane ia al et i
f s
ort e!E x t
ef eR v E
a uug M u m ail rg yn ql n t nl uis o
ef T ad R o i eagt at n
gn gi eai e si e qb y l oe mn
- dndvWnsSsoI t'
. oi r
R vx doaR eal n
b sti a yooni iy yt n
Ei opt Rt a o o yU n t thietttSdS l
as ett' es g M C
ny Sn i
rt el s ett pchs e se l eroa ne n?
tot n A'
t PidmUd f eapageprnevsPiihr Ev i t n rsCeoc a
rni ol aMiAoiT ueogee rvPe i
.neirLnren n
t l ae en fii m c
kgadf oeS d
iL ant a iehEl e a
oDg ti easl e i
re eol d tafd o o uadSsul f
at nS F o n n R o a m n ei a h eL ws aG rn mno/s Moe R o gl gl cc oi ci er Ctr p gi eab i
l hIi ess ml n ri C ni s n n P Fi rf we sd mAsr rros a
c t d ei e s s a of f s Eti ao meo ot
%d r c tey o t o yPi l usnl ai n s r t s ni o ee nDsif noA Pl NTH Cnuf H
s eQteatl eauceot sDr-e ssoon s
A e
A oD mnfrTi a5-d yl u nBrncvBl esiast eoVli s oft r _
i f st m e n ph f a ai s s c o s of neo0Ftsi l rh eF ce ueui ik LMcmrxaaPu i n gt m n t n a f A arseop l cnmtte asf o
)
e ai y E e e e e m d F R m o n c e o c gF E pi a u l s s ai n s c c o e c t v mi m m o n e ai u e n d t d
l tvdtT tttt ne B s pi u li ei euf el eot ecaf pcl raes e
t n r u s N o si r e a r R F i m p r pd f ssescnl f oatoOryroht o W M e oit maf eacocoef et noherf moaol eo u
i n
T CMSPCPSCVTSCILsCPSIREDDIDOCREDAUNCRTEISVFPMC i
tno C
/.
(
m
)1Id I
eo I
tN nI E
o e t
inu 2I4 56 78901234 56789012345 6
/8901234 56 f
8 tas 1I1 11 11122222 22222333333 3
33344444 44 A
cl s i\\
T API BBB BB B8BBBB8B BBBBBBBBBBB B
BBBBBBBB BB gNNw(e a8 ZEr?gw t
e
" <7gU WW 50 E,
O 9
4 A
1 0
P o.
A A
A A
A 4AA AA 4
MN M
MM M
MNN NN m
m MMM M
N D
NEN N
e 3
33 53 3343 3355433 3
3433333 33 3
3 3
366 c
8 88 d8 8888 8888888 8
8888888 88 8
8 8
888 t n
/ // //
//
/ /////// // / / /
///
//U0 00U/U//
0 0100000 00 0
0 0
000
/
sa 0
00 00 00 0
00 eue 3
33 33 3333 3333333 3
3333333 33 3
3 3
333
/////
U /////// // U U U
///
t st
/ // /U 1U//
/
11262U/1 1211111 11 166 asa 1
11 6
21 LID 1
11 0I 1I11 111 1I1 I
1111111 11 I
I 1
100 no tiss ei 1
1 11I 2
11 t v ae LR
)
)
)
)
1
)
))
5 3
3
(
5 33
/
)
)
)
)
)
)
)1
- 1. )b
- 1. E
)
)
a b
EE y
bE
)
Eb bEb P
a a
t (T
W T(
(T(
O
(
(2 I. 3
- 3. O
(
T
(
(
TT yi s 3O C
O3M 3O3MR 3
I 3
3 3
OO t ru N
L N
U N
t D D. P D. E A. (N 2
E E
3((NN eot P
E(
(0 (EI H4E(EI(
E EPE fi a O
T 4
2 TD G4T TD T
TOTIOIT I
1 T
T 4
art R
OI I -
- IGE I - OIOEI O
OROI RIO II O
O
- II SPS D
NL RA ARNM HANRNML N
NDNIDIN IL C
N N
ARR I
B BB
/
S A
B B
EE e
B B
B BBB PB BERB BBTBTB B
B BPP c
E E
ES ISSB RIBSPPP B
BEEESES A
B B
S ISS i/
T T
GE GPCI
/GQRC/C E
EAAMAMP R
E Q
C G//
f n M N SM S/E//A N
/IIIIIU U
M E
M/////
U
/O0 TU/E
/
PT/IIAU f o
/ /
//
I/
/ /
TRR
/
Oih E
E EE SSSE RSESSRS E
ESSSSSS S
E E
S SSS sc D
D DD DDDD DDDDDDD D
DDDDDDD D D D D DDD s in
/ /
// //// / ////// / ///////
/ / / /
///
tava R
RR RR RRRS SRRRRSR R
SRRRRRR RR R
R R
RRR RMRE RNNWNRN N RNMMRMM MM N
N M
MWN ERR RER R
EP R
LDB N
N N
MR N
no yi-d d
ds r
d an a
n aw e
a itt u r
r ee e rr a
reer h
e a
ru.
a t
at t
tl ttaatm t
ath aiit i
c t
t tss ol i mi ieso simmit i
mstmnni n
t s i i
m gg i
iag l
r-l e r gl M l rl l rt -
r il tl aar a-a l
r rgg O.
rvn o e om eei eooei e
ciaoiie i
h e
eii i
i PEE C
E CE E S M 'V MfCCEP E
CMMCRRE R
T M
E ERR c
- i g
n t
r a
d o
s n
i L
a o o tt 7
a t
Ss m
d t
r nn n
na i
n c
ee e
f goh r
a a Httm 3
v e
nit P
e nrn e
r i
it n
m R
f eei r
o l
hco o
n u
omva e
pdt 2
P f
e snt i
o i
R t u t
n h
yi a n
,)
n s
iFd a
t a
t t uno 1
go ne y
b e
t c
r i
qIC ni ou t
apt n
e U
e lE yf s
is iq s
e ti c e
f d
i e
so ti e
f ssre m
f m
i bl bo s
ur cn s
a dET n su E
o s
aa s
or eh n
S s
o n
r r
n pcny s
a Ho pc o
R i reo
- t. t d
f I
aioc i
n l
C se p
k W
roeC s
n cria ts a
g n
ttu ny C
t nT s
c P
eft I
n o mcaq el ed I
e o
P ssy s
l n s
R R
d s ym r n
i i reze ma t
l a ei n
eeSea og o
n t
eli d nn r
o k s A t
a gs td sn i
e a
TERA iA o
Ca ay C e
maansn ai t
t r
u a
p (i
ul O
g setBoyu ar a
r b
gdse tS p
r qa L
r sRt u iSos Mo td e
nnsn nC i
u ee h n sa e W sol t Br tAna v
oaei oC S
rt stA d
tT rBy ace a
nicer M
l rm CE uit r sn n
u Stcere.
onOmg e
npre o ernr f
l rnact a ef l n nit urc i oL ne e
v aiDt o
iCeEi n mo iigenosua tM iD f
i ui o a
m t ec n
a nmhrsse a
ga i
s et eshf n
F nnssni y
F nipcPesR rsnty L
s r~ t.atDst i
o oiiaom at orie re t s i n c.
e n
ei s i
li asl ps ti y
li ouT rPrf l ero-d c i -
eorwd t
att aamihnl t
att q o
P o i cuC
. en x
t mtP oe w
osl sasE n-n eht c
ccnBnoecoi i tcaiEft w f oD-n e l o ;i n n gt a eo ICStCb l uirn ocotg nr x
e i reCraogaed p
n pC g a i oneoS aL n n gI P d E i
ssas n f d y w ri bk a pM C n e ain rspt cos ttii sMp nth n ri o nlS el achO C o R fl nimd* eF p s c yf sf sntsU U ot ab se i ac sEi oook onpg meeC eonoae l
acI I
e pt td oii o a s a d u R f gV ICrDnat a
f at mknR l l e
.Me rnt eae e B M o r e a n n C s pR rkiP fl n e
e oca c
~
caeensedd R
oal nao sS tear t E ei e c n f pliie l nv eGt n urrnooOattH
. Dii p m e s r n e neLPbi
.iri i
t omaoeOt nehF oua nas
.R vrOsmABovsl ov am v
)
e r
vCre-sp C o e eii) ewasat mnru radt t srsyyrl i y d
l eC etteil d rvst s1 soxSl coitl pSel il l i sul daeut a e
t s
R sissueaepl eas-ol eSoacdnf mCwocaanesaurt sac n C W n r o s q u o c m ai t aNol eSseeoof uCooneoorset pxnt e u
i n
T IMBICPAEFtIIVDSP(LARLIRDlCEPEPCIHCMPASSSEISD i
tno C(
/m.
I eo I
tN O
nI E
o e L
inu 7
89 01 2345 6789012 3
4567890 12 3
B tas 4
44 55 5555 5555666 6
6666667 77 7
1 2
345 A
cl s T
API 8
BB BB BBBB BBBBBBB B
BBBBBBB BB B
C C
CCC DW)o
,m zc" oEtWN o
t
ng. e [3 WH
/
p-A m mamma mmmm mm m 4
WN mm mmm mmmJm m mm m o
A 8
N N
8 i
e 633335 33833 3
38 3
3 36333 3333 34 3
59 c
888888 88888 8
88 8
8 89888 8888 88 8
88 tn
////// ///// / /U /
/ ///// //// // / //
sa 000001 00000 0
0 0
0 00000 0000 01 0
11 eue 333333 33333 3
33 3
3 33333 3333 33 3
33
/1UU/ // / //
//
/ /////
1161U / // U
//
/U////
t st 1
12 1
22 1
12 1
16111 6
1112 asa LID 0I1111 1101I 1
11 I
1 10111 1II1 11 1
11 n
o ti ss ei 1
1 1
12 t v ae LR
)
3
/
)
))
)
)))
)
)
))
)
)
)
)
y Eb ab b
- PP a
b bb b
5 b
b t
T(
((
(
O0O
(
(
((
(
(
(
(
3 3
yis O3 33 3
ReR 3
3 433 3
3 t re N
DDD
- 1. E P 1. K P 7E P
EH eot (EHPEE E7(((
E P
E P
EEE
.O 3T O i G fi a TGOTT T1 T
WD T
O TTTF.T OC.IR 4IROO O
III O
OR D
R OOO O
R O
R 0I art I
HDNN NALLE N
LD N
D NNNfN DIIC AN D
NH SPS R t B
I B
B
/
E S
B BI 8
8I B
e PBP8B SBBB T
EG B
T 5S 8B 888S BB 8 BB c
SER5EB BIEEE E
5R E
CR85P 555C EES5 EE i/
/T/9AE EGMMM M
WA D
M I/QAC RRRI TTER ' TT
//// MMN/ MM U0E//
f n OMS //N N/EEE
/ // U
/
R/1I I1II 1/
1
//
f e R/P1I/
/T///
1 TA 1
Oih SER5SE ESEEE 5
ER S
5 5SE5S S5SS EE 5
EE sc DDDDDD DDDDD D
DD D D
DDDDU DDDD DD D
DD din
//// f/
///// / // /
/ ///// //// // / //
eva RRSRRR RRRRR R
SS 8
R RRRRR 8RRR RR R
RR R
RR i
8MRRNN RM N
NN MReMR M
N R
eir
- REMMM MoMMM R
EE W
NN N
N NNR N
N RR lDB n -
o d
r r
S r
w yi an e
e E
enn n n
tt ee h
h U
r h ae er e
i a i
tt r
t ats e
rr-sttl tt ctt t
ct t
S t
atcml o1i gi s o i i tii i
ti i
S i
mitt o o mi g te n ii rr arr- -
r ar r
I r
l ratM Nl rg t g a
rr e
3\\
i ag grl 8 ee ei ne h ee e he e e
oehi'V
'VCER PS R
EE oei ie i
rvn i
PEE R E M 'V E E TEE E
TE E
C E
CETP I
(
R EN
~
l E
s G
h r
t t
tg s
A e n e
W n
ni e
Cd w
a e
E
=
eH av On o
g w
N e
m sil iM WeV' p
R ra La P
A t
p u
i as so n F
u uB Pt it o
d q
q in f
nm s
i r
n E
Ed nro o
s n
iCi t.
i u yn t
o a. l ta t
g P
l o a
f
, a n
npa n
s ainc yf ntoi y
g i ae oil i
s ao Aaif t
n t
l v si r o t
n Pi ntTs a
e r
l ti i
i e
py eecd l
n e r oc I
e 5
i ep h
t St rR ei i
a s
afD s
i t
su l l b
e s
io tjmP r
t y
tl n
el neo a
l Enr-s anuI e
e S
ni e
tiiSS p
C oeet rIPT v
s seb m
ia a
nit cI b
o s
ytf e
l ema s
SFd*r mC r
oti n i
aram Vt no d
v orni s
n*o a
i ruil e
l ketf rm A
st o
ea e
e.clar dfl e d
r tl ae s
ants sce
. eBf eaoc n
o nitR s
ta yaeSt
. c i
c cSon e
t oan A
sTlSit s
g CF od a
a rscy t
n v -
nfd u Ca t
c df n
s a
n o s r g e aiS n
i ee aoo nore' eCn E
e a o CauntWm e
r Dt n R
gbf i
itii sg d o
set I
ot y
R aeoe t
rull rdin i
t entil
- ntn gt m
i vI ndo woci ni o
n kT r
a oquoCi ei c
a nu rsfi co lsl c
nsi iur oi a a ir rs o
erol be LiCeo o
A omt naAt l tem k g f r s gt e ii i rl r
cSao MeciM n
F aR sce e
s en gt a V u e r gd n C
p t e dos u
deat' At t
doAnaef o
rsttdnCt otf ngrn Casc ci e n a f l
rpnar miof at voe r
iyof na ntcoarCI Oek e uii h e f eaM f
pi r
D Asria f e A a
LHcf oPLcpo tF togetyo Pr kove nehcp af s
ncctC d
ng Dec E utocCsm k rrE S
xO S e r wti c ai yeg o
i nf f en Dnin iu aeC meE t
n t A ol y R i otih oh etabDP et n
tea en du ei ii c st nLCitstaii rieo atet ve est aim ynSR mSedbn l
eaei-t rerul uet Brpi H yS e t s s r a s i aaeso rl rof naorel qne uit l
)
e S
HcseaR e G s t r R s gt r uiuP ogrWuvaeSiJ l sP a d
l A
n eevm rE ene irnt l tl ia l dvv b
l s i e
t CRiRf sli noR sat rvean i
ni t d s pdi a e r d r R aeRd OWaHf sarotUsl nodml o aeaeneeoaneunuW mrWa u
i n
T (PMREAvPNSNAPIfAEPC FVFSEDSRFIRSaTB SPPR i
t n
o C
(
/
m.
I eo v
I tN nI E
o e t
i nu 01 23456 7
8 tas 678911 11111 1
12 3
yi T
API CCCCCC CCCCC C
DD D 1
23456 7891 11 1
11 A
cl s 0
12 3
45
=
UDwyo y=yegw t
m
y<7 O3 NN
~
e 5
8 A.
MA 6
5 P o AA MA N
NN N
NNN NN N
N N
B 8N N
A AA A
AAA AA A
A A
- 4 A
A MN NN N
N N
e 33 33 4
6433 33 3335 333 45 6
5 3
3 4
3588 c
88 8S 8
8888 88 8888 888 88 8
8 8
8 8
8888 tn
// // / //// // //// /// // /
/ /
/ / ////
sa 00 00 0
010 333N 00 0001 000 00 0
0 0
0 0
0011 eue 33 33 3
33 3333 333 33 3
3 3
3 3
3333 t st
// // / //// // ///'
/// // /
/ /
/ / ////
asa 11 11 6
6211 11 1111 111 66 6
6 1
1 6
1622 LID 11 11 0
0111 11 1111 111 00 0
0 1
1 0
1011 no tiss ei 1
11 1
1I 2
1 1
121 t v ae LR
/
)
)
)
)
)
)
)
y b
b a
b
)
a a a t
(
(
(
(
2
(
(
(
yi s 3
3 4
3 3
(4 3
3 3
t ru eet P
- 1. 7 1
,1
- 1. E E
PEHE E
77NP 7
P E
7
.E E
E fi a 8G C. 4 0
T 14GU C.1 4 OW T
". T G TOIO O7 IR 4 C. T T C.T T
T art
- R O
RO O
O O
CNHN N1 BAHD I5A DL N
AIN 2
N NIN4
~
B I
/
,B B
B R,
S e
BBS8B S
B B
8B 8B 8BS SB88BBB8 B
B 88P8 c
SSC5I C
BSB5 55 5IBS 5SC PP55E5I5 S
5 55R5 i/
/CRAARGR A
A RR/A f n
// // /
E/E/
//
//Em
///
5/
/
//
/ /
//R/
f o II 1T I
/I/I 1I IT//
1II FI 1
TI I
1 IIII Oih S5 5S S
ESES 5S 55EE 5S5 HS 5
S5 5
5 S5SS sc DD 0D D
DDCD 0U 0DDD DDD DD D
DD D
D D0DD din
// // / //// // //// /// // /
//
/ / ////
ava RR RR R
RRS R
R RRSR eir RR RW RE RRER RPE CR R
RRE R
R RRER R
RRER lDB NN N
N NNRN N
NNRN NNN NN N
NNR N
N NWRN no yi r d
r d
d dd tt e a
e n n a
n nn n
n a
n n
aa iae er h
e e e
a ea a
e r r
e a
r e
ee run t a s
c sl sl tt mtl m st m sl a
a t
m a
l stt sm ge t
gogo si ti ot gi t qo m
m s
t m
ogss ol i o
iag l l gg a
o M gM iME P E'V P REP RV C
C i
i o
- VRMM l r t rMt grt oM l
l l
t l
M gll rvn io ie h
e i*i e
iei i'
o o
iii i
i R V R 'v M
P C
PEE MC RS T
a l
l e
s o
t s
uf ce D
R m
r e
t co nn R
W e
t s
n i
ei C
B t
n e
a bs uF s
o R
l rs q
e e y
C r
o P
oo d
er h
h S
e t
5 Ct n
se t
t d
w 1
r a
nh l
An o
h 5
er yn ot n n o
Ca P
c m
wo bo s
y CO e i r
O t
L t.
r it eo ot p
R r
e tt Po dU W
a ar wms n
a w
s R
e L
m o
t ek al o
l e
S yd r
sg i
s eta A
CA Se ar un n
r as Bse C
l c
m t
eo ai i
P e
yr O
C a
eO mr u
e ma l t Cn ek nSB L
gL St N
t al ca e
s d
ra o
a s
t.
s re ur tp e
e ul i
re m
n o l n n
sS S
n e
n i i y cR Ne nO c
n l F ti p e
m at aI o
cAi st e
mtrg e
i se s
ne me a
b at a
P ms t
Lt ty e
R m iG pv n
m F n rl ey s n
nt s
i nen We eoh tS y
il r e
o i
ee ee l
ueli Bl e-uae t
C ma trt s
S vu uf u
qvil b
qV w r
eP nti yy l q qa P
EEao no s nE o u d
t I nw Sr g
ae es F o or n
F w
pP p
n st o
a n
Vs sn c
f n C P
o i ol m p
a yn ecd edsi b
no i ool p
ik ai daum A
Se l
e mnel nu oM t
iae mgrtcF s l
iDe l
m bl t uoeo oS C
e nter uneco s
ot t
l l
nn aaa l ct o i
f n
ouSo DiwAh ri oncs a
i oi tii oesC t r : o g
il C
do S oM C ei y n r f
i a ptc VSy ae t
a ti p raFd srS r
e r
tt eno
/Sr i s m
aDmy eo el nr nse e
t e
an ces ey e w
loo wn o c
u c.
dLet aoo oehl. t a
vnl o css grrt sP o r inP-.
e t amit po n W OwuC asA raia i
I kist f o e
erimrta t nsr I
oc nE amAw e
at uc i rt y Hosoearsaiot e
rdrf U-s hi t
mt eaBe l on t f t h d e gl mn f
c o wi o nn crfl ai rc l
aBaenraf uT annuet o o i t oc ror sPoa es B i yE u
l moirOA r e i c gA C v
al en o N e mi S
QtoEiAe
. d gG R r a n r rBR o f
ceDny tf ll sf e p pf no t
nf ee i k. gd o e e
i dnt otf O
nmpo neCcaceoszDl gC c n e i S
n yl t l
n o s mii o n
iI u ot ili G vi an oitkt erac aaCyatl if l
Ss i rrt ut s
r gi i l l t aaa f
G ai e i
S r ai e ao y tsteoacal sl unt naBcred o
dtjst my cnbr
)
e M
mt rct a v t m r m e o a si ni r e gt a mnnninet mSi au d
l s
aeeenrdcoiost usteauwre r s
aoeI ret ea bil e
t Rs ef wf abaat ct e nel ttt ortSg s
ect bt sf rRmli u
i Wo t aofli neueuinarooeal onCe o t eof eoyacWoea n
T BL SSPEPVIRARADoMPBPRNFCIRD L
SSP oDPSSSBCRF i
tno C
(
/.
m I
eo B
tas
.. 0 1234 56 1890 123 45 6
7.
8 9
0 1234.
e I
tN nI E
o e L
inu A
cl s 6T 89 T
API 1I 11 2
2732 22 2223 333 33 3
3 3
3 4
4444
- UDND0 go zC$o$o%
5 t
IIi
- l:
l
[
m
(.,-.,h f
I,,-
\\
'v)
U'l
\\
\\
\\'v TABLE II (Continued)
UD Action Priority Lead Office /
Safety latest em Plan Item /
Evaluation Division /
Priority /
tatest Issuance MRA g
Issue No.
Title Engineer Branch Status Revisten Date No.
e 45.
Inoperablitty of Instrumentation Due to Entreme Cold M11 stead MR/DSUICSB NOTE 3(a) 1 06/30/84 Weather 46.
' Loss of 125 volt DC 8us Sege NRR/55UPS8 76 1U30/83 MA
~7.
Loss of Off-Site Power Thatcher MRR/DSI/RSS.
NOTE 3(b) 11/30/83 AS8 48.
LCO for Class IE vital Instrument Buses in Operating
$ege WRR/DSI/PSB 128 1
12/3UB6 M
Reactors 49.
Interlocks and LCOs for Reduneant Class IE Tie Breakers Sege NeR/DSI/PS8 128 2
12/3U86
- A
- 50.
- Reactor Vestel Level Instrumentation in 8WRs Thatcher MRE/DSURSS.
NOTE 3(b) 1 12/31/84 NA ICSB 51.
Proposed Requirements for leproving the Reliability of En-it RES/DUEIB NOTE 3(a) 1 12/31/89 Open Cycle Service Water Systems 52.
SSW Flow Blockage by Blue f*ussels Eerft MR/DSI/ASB 51 IU30/83 MA 53.
Consequences of a Postulated Flow Blockage Incident V*Molen MRR/DSUCFB.
DROP 1
12/31/84 M
in a BWR RS8 54 Valve Operatcc-Related Events occurring During 1978 Colmar NRR/DE/MEB II.E.6.1 1
06/30/85 M
1979, and 1980 55.
Failure of Class IE Safety-Related Switchgear Circuit Enrit MRR/DSI/PSB DROP 1
12/3 U85 MA Breakers to Close on Demand 56.
Abnormal Transient Operating Guidelines as Applied to Colmar NRR/DHFS/HFEB A-47 IU30/83 NA a Steam Generator Overft11 Event I.D.1 57.
Effects of Fire Protection System Actuation Milstead RES/DRA/ARGIB MEDIUM 1
OE/30/88 on Safety-Related Equipment
$8.
Inadvertent Containment Flooding Sege MRR/DSI/ASB.
DROP IU30/83 CS8 59.
Technical Specification Requirements for Plant Shutdow, Eerit NRR/ DST /TSIP RI (NOTE 5) 1 06/30/85 MA
- en Equipr=nt for Safe Shutdown is Degraded or Inoperable 60.
Lamellar Tearing of Reactor Systems Structural Supports Colmar hRR/ DST /GIB A-12 1U30/83 M
61.
SRV Line Break Inside the CWR Wetwell Airspace of Mark I Milstead MRR/DSI/CSB N0?E 3(b) 2 12/31/8G M
and 11 Containments 62.
Reector Systems Bolting Applications Riggs RES/DSIR/EIB 29 1
12/3U88 M
63.
Use of Equipment Not Classified as Essential to Safety Pittman RES te0TE 4 1U30/83 in BWR Transient Analysis 64 Identification of Protection System Instrumer,t Sensing Thatchee M R/DSI/ICS8 NOTE 3(b)
IU30/83 Lines 65.
Probability of Core-Melt Due to Ccaponent Cooling Water V*Melen NRR/DSI/AS8 21 1
12/31/86 MA System Failures 66.
Steam Generator Requirements Riggs ME/ DEST /EMTB NOTE 3(b) 2 12/31/88 M
67.
Steam Generator Staff Actions m
7c-67.2.1 Integrity of Steam Generator Tuba Sleeves Riggs hRR/DE/MEB RI (135) 1 06/30/85 NA e
N 67.3.1 Steam Generator Overft11 Riggs MR/ DST /GIB A-47 1
06/30/85
- 4 1
o M R/DSI/RS8 I.C.1 en f
67.3.2 Pressurized Thermal Shock Riggs MR/ DST /GIB A-49 1
06/30/85 MA g
e 67.3.3 Improved Accident Monitoring Riggs 18RR/DSUICSB NOTE 3(a) 1 06/30/85 A-17 z
wW p.e
>8
am mm__
- TABLE II (Continued) to
' D - Action
. Priority Lead Office /
Safety-Latest-t' Plan Item /
Evaluation Division /.
Priority /
Latest Issuance MPA co 15 se No.
Title Engineer Branch Status Revision Date No.
t.o 67.1.4 Reactor Vessel Inven+arv Maasurement Riggs NRR/DSI/CPB II.F.2 2
12/31/97 NA 67.4.1 RCP Trip Riggs NRR/DSI/RSB II.K.3(5) 2 12/31/e7 NA Riggs NRR/DHF5/HrEB I.P.1 2
12/31/87 NA 67.4.2
-Control Room Design a~.
67.4.3 Emergency Operating Proce'ves Riggs NRC/DHF5/P5RB 1.C.1 2
12/31/87 NA 67.5.1 Reassessment of SGIR Desigt. a. "s Riggs RES/DRPS/RPSI LI (NOTE 5) 2' 12/31/87 NA 67.5.2 Reevaluation of SGTR Design Basis Riggs RES/DRPS/RPSI LI (NOTE 5)
?
12/31/87 NA 67.5.3 Secondary System Isolation Piggs NRR/DSI/RSB DROP 2
12/31/87 NA 67.6.0 Organizational Responses Riggs CIE/DEPER/IRDB III.A.3 2
12/31/87 NA 67.7.0 Improved Eddy Current Tests Riggs RES/DE/EIB 135 2
12/31/87 NA 67.8.0 Denting Criteria Riggs NRR/DE/MTEB RI (135) 2 12/31/87 NA 67.9.0 Reactor Coolant System Pressure Control Riggs NRR/DSI/GIB A-45, 2
12/31/87 NA NRR/D57/R58-I.C.1 (2,3) 67.10.0 Supplement Tube Inspections Riggs NRR/DL/ORAB LI (NOTE 5) 2 12/31/87 NA 58.
Postulated loss of Auxiliary Feet. water System Resulting Pittman NRR/DSI/ASB 124 2
12/31/86 NA from Turbine-Driven Auxiliary Feet' water Pump Steam Supply Line Rupture 69.
Make-t:p Nozzle Cracking in B&W Pica's Coisar NRR/DE/MEB.
NOTE 3(b) 1 12/31/84 B-43 MTEB 70.
PORV and Block Valve Reliability Riogs RES/DE/EIB MEDIUM 1
6/30/84 ro 71.
Failure of Resin Demineralizer Systems and Their Pittman 2E5 NOTE 4 11/30/83 gy, Ef fects on Nuclear Power Plard Safety 72.
Control Rod Drive Guide Tube Sepre t Pin Tail'sres Riggs RES NOTE 4 11/30/83 73.
Detached Thermal Sleeves Riggs RES NOTE 4 11/30/83 74.
Reactor Coolant Activity Lbits for Oper.+ ting Reactors Milstead NRR/D31/AEB DROP 1
06 30/86 NA 75.
Generic Implications of fsW5 Events at th* Salem Thatcher RES/DRA/ARGIB NOTE 1 11/30/83 B-76,8-77 B-78,B-79 Nuclear Plant B-80,8-81 8-82.8-85 B-86.8-87 B-88.8-89 B-90,B-91 B-92.8-93 76.
Instrumentation and Cor: trol Power Interactions Pittman RES/DRA/ARGIB NOTE 4 11/30/83 77.
' Flooding of Safety Equipment Compartments by Back-flow Colmar RES/DE/EIB A-17 12/31/87 NA Through Floor Drains 78.
Monitoring of Fatigue Tran'sient limits for Reactor Riggs 47liDRA/ARGIB NOTE 4 11/30/83 Coolant System 79.
Unanalyzed Reactor Vessel Thermal Stress During Colmar h5/DE/EIB MEDItM 1
12/31/84 Natural Convection Cooldown 2
80.
Pipe Break Effects on Control Rod Drive Hydraulic Lines V'Molen NRR/DSI/RSB, LOW 11/30/83 NA E
g in the Drywells of BWR Mark I and II Containments A58 CPB
?
81.
Impact of Locked Doors ard Barriers on Plant and Colmar NRR/DHF5/PSRB DROP 1
12/31/84 NA 7
rn 82.
Beyond Design Basis Accidents in Spent Fuel Poo1*
v'Molen RES/DRPS/RPSI NOTE 3(b) 1-06/30/89 NA o
Personnel Safety w
83.
Control Roos P.soitability Emrit
-RES/DRAA/5AIB NOTE I 1
12/31/86-84.
CE PORVs Riggs NRR/ DEST /SRXB NOTE 1 1
06/30/85 U
85.
Reliability of Vacuum Breakers Connected to Steam Milstead NRR/DSI/CSB DROP 1
12/31/15 NA Discharge Lines Inside BWR Containments
y-(-
{
t a
s
/
kj TABLE II (Continued)
NN N
Actior.
Priority Lead Office /
Safety latest' N-Plan Itect/
3 Evaluation Division /
Priority /
Latest Issaarce NPA g
Issue No.
Title Engineer Branch Status-Revision Date No.
so -
86.
Long Range Plan for Dealing with Stress Corrosion Enrit NRR/ DEST /EMTB NOTE 3(a) 1 06/30/88 B-84 Cracking in BWR Piping 87.
Failure of HPCI Steam Line Without Isolation Pittman RES/DRPS/RPSI HIGF 12/31/85 88.
Earthquakes and Emergency Planning Riggs RES/DRA/ARGIB NOTE 3(b) 12/31/87 NA 89.
Stiff Pipe Clamps Riggs RES NOTE 4 (later) 90.
Technical Specifications for Anticipatory Trips V*Molen W 9%I/RSB.
LOW 12/31/84 NA IrSB 91.
Main Crankshaft Failures in Transamerica DeLaval Enri' RES/DRA/ARtJB NOTE 3(b) 12/31/87 MA Emergency Diesel Generators 92.
Fuel Crumbling During LOCA vh en NRR/DSI/RS9, LOW 12/31/84 NA CPB 93.
Steam Binding of Aux 111ary Feedwater Pumps Pittman RES/DRPS/RPII NOTE 3(a) 06/30/88 94 Additional Low Temperature Overp mssure Protect 8 w Pittman RES/DRPS/RP(I HIGH 13/31/85 Issues for Light Water Reectors 95.
Loss of Ef fective Volume for C,ntainment Recirculation Milstead RES/DRA/ARGIB NOTE 4 (later)
Spray 06.
RHR Suction Valve Testing Milstead RES/DRA/ARGIB NOTE 4 (later) 97.
PWR Reactor Cavity Uncontrolled Exposures V'Molen NRR/DSi/RA8 III.D.3.1 06/30/85 NA 98.
CRD Accumulator Check Valve terkage Pittman NRR/DSI/ASB DROP 06/30/85 NA cp 99.
RCS/RHR Suction Line Valve Interlock on PWRs Pittman RES/DRPS/RPSi NOTE 3(a) 2 12/31/88 100.
OTSG Level Riggs RES/DRA/ARG'.B NOTE 4 (later) 101.
BWR Water Level Redundaxy V'Molen RES/DE/EIB NOTE 3(b) 1 C6/30/89 NA 102.
Human Error in Events Involving Wrong Unit or Wrong Enrit NRR/DLPQ/LPEB NOTE 3(b) 2 12/31/88 NA Train 103.
Design for Probable Maximum Precipitation Eerit RES/DE/EIB NOTE 3(a) 1 12/31/89 NA 104 Reduction of Boron Dilution Requirements Pittman RES/DRA/fRGIB DROP 12/31/88 NA 105.
Interfacing Systems LOCA at LWRs Milstead RES/DE/EIB HIGH 06/30/85 106.
Piping and Use of Highly Combustible Gases in Vital Milstead.RES/DRPS MEDIUM 12/31/87 Areas 107.
. Main Transformer Failures Milstead RES NOTE-4 (later) 108.
BWR Suppression Pool Temperature Linits Colmar NRR/DSI/CSB RI (LOW) 06/30/85 NA 109.
Reactor Vessel Closure Failure Riggs RES/DRA/ARGIB NOTE 4' (later) 110.
Equipment Protective Devices on Engineered Safety Milstead RES/DRA/ARGIB NOTE 4 (later)
Features 111.
Stress Corrosion Cracking of Pressure Boundary Riggs NRR/DE/MTEB LI (N0(E 5) 12/31/85 NA Ferritic Steels in Selected Environmants 112.
Westinghouse RPS Surveillance Frequencies and Pittman NRR/DSI/ICSB RI (NOTE 3) 12/31/85 NA Out-of-Service Times 113.
Dynamic Qualification Testing of Large Bore Riggs RES/DE/EIB HIGH 12/31/87 Hydraulic Snubbers my 114 Seismic-Induced Relay Chatter Riggs NRR/DSRO/SPEB A-46 06/30/86 NA g
- n 115.
Enhancement of the Reliability of Westinghouse Milstead RES/DRPS/RPSI NOTE 3(b)
M/30/89 MA Q
Solid State Protection System i
e 116.
Accident Management Pittman RES/DRA/ARGIP MOTE 4 (later) o S
U wW 98
.r.
TABLE II (Continued) w to D.
Action Priority Lead Office /
Safety Latest Plan Item /
Evaluation Division /
Priority /
Latest' Issuance NPA y
' Issue No.
Title.
Engineer Branch Status Revision Date No.
u) 117.
Allowable Outage Times for Diverse Simultaneous Pittman RES/DRA/ARGIB NOTE 4 (later)
Equipeent Outages 118.'
Tendon _ Anchorage Failure M11 stead RES/DRA/ARGIB NOTE 4 (later) 119.
Piping Review Committee Re. wnendations 119.1 Piping Rupture Requirements and Decoupling of Riggs NRR,DE-RI (NOTE 5) 12/3UBS NA Seismic and LOCA Loads 119.2 Piping Damping Values Riggs NRR/DE R1 (NOTE 5) 12/31/85 NA 119.3 Decoupling the CBE 1 rom the SSE Riggs NRR/DE RI (NOTE 5) 12/31/85 NA 119 4 BWR Piping Materials Riggs NRR/DE RI (NOTE 5) 12/3U85 NA 119.5 Leak Detection Requirements Raggs NRR/DE.
RI (NOTE 5) 12/31/85 NA 120.
On-Line Testability of Protection Systems Milstead RES/DRA/ARGIB NOTE 4 (later) 121.
Hydrogen Control for large Dry PWR Containments Emrit RES/DRA/RDB HIGH 12/3U85 122.
Davis-Besse Loss of All Feedwater Event of June 9 1985: Short-Tern Actions 122.1 Potential Inability to Remove Reactor Decay Heat 122.1.a Failure of Isolation Valves in Closed Position V%1en NRR/DSR0/RSIB 124 2
06/30/89 NA 122.1.b Recovery of Auxiliary Feedwater V'Molen NRR/DSRO/RSIB 124 2
06/30/89 NA 122.1.c.
- terruption of Auxiliary Feedwater Flow V'Molen NRR/DSRO/RSIB 124 2
06/30/89 NA n
122.2 Initiating Feed and-Bleed V'Molen NRR/ DEST /SRXB NOTE 3(b) 2 06/30/89 NA T
122.3 Physical Security System Constraints V'Molen NRR/DSR0/SPEB LOW 2
06/30/89 NA 123.
Deficiencies in the Regulations Governing DBA and Riggs RES/DRA/ARGIB NOTE 4 (later)
Single-Failure Criteria Suggested by the Davis-Besse Event of June 9,1985 124 Auxiliary Feedwater System Reliability Eerit NRR/ DEST /SRXB NOTE 3(a) 2 06/30/89 125.
Davis-Besse loss of All Feedwater Event of June 9. 1985: Long-Term Actions 125.1.1 Availability of the STA V'Molen RES/DRA/ARGIB DROP 6
12/3U89 NA 125.I.2 PORY Reliability 6
12/31/89 125.I.2.a Need for a Test Program to Establish Reifability of V'Molen NRR/DSR0/SPEB
. 70 6
12/31/89 NA the PORY 12'.I.2.b Need for PORY Surveillance Tests to Confirm V'Molen NRR/DSRO/SPE9 70 6
12/31/B9 NA Operational Readiness 125.I.2.c Need fer Addition) Protection Against PORY Failure V'Molen NRR/DSRO/SPEB DRC' 6
12/3U89 NA 125.I.2.d Capability of:the PORV to Support Feed-and-Bleed V'Molen NRR/DSRO/SPEB A-45 6
12/31/89 NA 125.I.3 SPDS Availability.
Milstead - RES/DRA/ARGIB NOTE 3(b) 6 12/3UB9 NA 125.I.4 Plant-Specific Simulator Riggs RES/DRA/ARGIB
. DROP 6
12/31/89 NA 125 I.5 Safety Systems Tested in All Conditions Required by Riggs RES/DRA/ARGIB DROP 6
12/31/89 NA Design Basis Analysis 125.I.6 Valve Torgoe Limit and Bypass Switch Settings V'Molen RES/DRA/ARGIB DROP 6
12/3U89 NA 125.I.7 Operator Training Adequacy so O
m
$d me.
o'
_O 4
w
~
p-W G
G G
m M.. -
.G O
O O
TABLE II (Continued)
N 1
D.
Priority lead Office /
- Safety Latest Action c-Plan stem /
Evaluation Division /
Priority /
Latest Issuance MPA g
-Issue No.
Title Engineer Branch Status Revision Date No.
so 125.I.7.a Recover Failed Equipment Pittman RES/DRA/ARb!B DROP 6
12/31/89 NA 125.I.7.b Realistic Hands-On Training V'Molen RES/DRA/ARGIB DROP 6
12/31/89 NA 125 I.8 Procedures and Staffing for Reporting to NRC Emergency V'Molen PES /DRA/ARGIB DROP 6-
'12/31/89 NA Response Center 125.11.1 AFW System Evaluation 125.II.I.a Two-Train AFW Unavailability V'Molen NRR/DSRO/SPEB DROP G
12/31/89 NA 125.II.I.b Review Existing AFW Systems for Single Failure V*Molen NRR/DSRO/SPEB 124 6
12/31/89 NA 125.II.1.c NUREG-0737 Reliability Improvements V*Molen NRR/DSRO/SPEB DROP 6
12/31/89 NA
.i 125.II.1.d AFW/ Steam and Feed c ter Rupture Control System /ICS V'Molen NRR/DSRO/SPEB DROP 6
12/31/89 NA Interactions in B&W Plants i
125.11.2
. Adequacy of Existing Maintenance Requirements for Riggs RES/DRA/ARGIB DROP 6
12/31/89 NA i
Safety-Related Systems 125.11.3 Review Steam /feedline Break Mitigation Systems for V'Molen NRR/DSRO/SPEB DROP 6
12/31/89 NA j
Single Failure i
125.11.4 Thermal Stress of OTSG Components Riggs NRR/DSRO/SPEB DROP 6
12/31/89 NA j
125.11.5 Thermal-Hydraulic Effecte of Loss and Restoration kiggs RES/DRA/ARGIB DROP 6
12/31/89 of Feedwater on Primary System Components 125.II.6 Reexamine PRA-Based Estimates of the titelihood of V'Molen RES/DRA/ARGIB DROP 6
12/31/89 NA a Severe Core Damage Accident Based on toss of All W
Feedwater 125.II.7 Reevaluate Provision to Automatically Isolate V'Malen RES/DRPS/RPSI NOTE 3(b) 6 12/31/89 NA Feedwater from Steam Geserator During a Line Break 125.II.8 Reassess Criteria for Feed-and-Bieed Initiation V'Molen RES/DRA/ARGIB DROP 6
12/31/89 NA 125.11.9 Enhanced Feed-and-Bleed Capability V'Molen NRR/DSR0/SPEB DROP 6
12/31/89 NA 125.11.10 Hierarchy of Impromptu Operator Actions Riggs RES/DRA/ARGIB DROP 6
12/31/89 NA 125,II.11 Recovery of Main Feedwater as Alternative to AFW Riggs RES/DRA/ARGIB DROP 6
12/31/89 NA 125.11.12 Adequacy of Training Regarding PORY Opeeation Riggs RES/DRA/ARGIB DROP 6
12/31/89 NA 125.11.13 Operator Job Aids Pittman NRR/DRA/ARGIB DROP 6
12/31/89 NA 125.II.14 Remote Operation of Equipment Which Must Now Be V'Molen NRR/DSR0/SPEB LOW 6
12/31/89 NA Operated Locally 126.
Reliability of PWR Main Steam Safety Valves Riggs RES/DRA/ARGIB LI (NOTE 3) 06/30/88 NA 127 Testing and Maintenance of Manual Valves in Safety-Pittman RES/DRA/ARGIB LOW 12/31/87 NA Relatec Systems 128.
Electrical Power Reliability Enrit RES/DE/EIB HIGH 12/31/86 129.
Valve Interlocks to Prevent Vessel Drainage During Milstead RES/DRA/ARGIB NOTE 4 (later)
Shutdown Cooling 130.
Essential Service Water Pump Failures at Multiplant Riggs RES/DRPS/RPSI HIGH 12/31/87 Sites ~
131.
biential Seismic Interaction Involving the Movable Riggs RES/DRA/ARGIB 5
12/31/89 NA In-Core Flux Mapping System in Westinghouse Plants W
132.
RHR Pumps Inside Containment Riggs RES/DRA/ARGIB NOTE 4 (later)
- m 133.
Update Policy Statement on Puclear Plant Staff Pittman NRR/DLPQ/LHFB LI (NOTE 5) 12/31/87 NA a.
Working Hours E
134 Rule on Degree and Experience Requirement Pittman RES/DRA/RDB NOTE 3(b) 12/31/89 NA o
135.
Integrated Steam Generator Issues Eerit RES/DE/EIB MEDIUM 12/31/87 3
ta) 136.
Storage and Use of Large Quantities of Cryogenic Milstead RES/DRA/ARGIB LI (NOTE 3) 06/33/88 NA ea Combustibles On Site
a-'
TAPtE II (Continued)-
->a Q
Action Priority Leid Of fice/
Safety latest Plaa Item /
Evaluation Division /
Priority /
Latest Issuance NPA t,.q Issue No.
Title Engineer Franch Status Revision Date No.
cp 137.
Refueling Cavity Seal Failure Milstead RES/DRA/ARGIB NOTE 4 (later) 138.
Deinerting upon Discovery of RCS Leakage Milstead RES/DRA/ARGIB NOTE 4 (later) 139.
Thinning of Carbon Steel Piping in LWRs Riggs RES/DRA/ARGIB
'RI (NOTE 3) 12/31/88. NA 140 Fission Product Removal by Containment Sprays Riggs RES/DRA/ARGIB NOTE 4 (later) 141.
LBLOCA With Consequential SGTR Riggs RES/DRA/ARGIB NOTE 4 (later) 142.
Leakage Through Electrical Isolators Milsteal-RES/DRA/ARGIB NOTE 4 (later) 143.
Availability of Chilled Water Systems 144 Scram Without a Turbine / Generator Trip.
Milstead
~ RES/DRA/ARGIB NOTE 4 (later)
Riggs RES/DRA/ARGIB NOTE 4 (later) 145.
Improve Surveillance and Startup Testing Programs Riggs RES/DRA/ARGIB
' NOTE 4 (later) 146.
Support Flexibility of Equipment and Components Riggs RES/DRA/ARGIB NOTE 4
.(later) 147 Fire-Induced Alternate Shutdown Control Room Panel Milstead RES/DRA/ARGIB NOTE 4 (later)
Interactions 148.
Smoke Control and Manual Fire-Fighting Ef fectiveness.
Milstead RES/DRA/ARGIBl NOTt 4 (later) 149.
Adequacy of Fire Barriers Nil..tead RES/DRA/ARGIB NOTE 4 (later) 150.
Overpressurization of Containment Penetrations Mil tead RES/DRA/ARGIB NOTE 4 (later) 151.
Reliability of Recirculation Pump Trip During an ATWS Ceggs RES/DRA/ARGIB NOTE 4 (later)
HUMAN FACTORS ISSUES m
HF1 STAFFING AND QUALIFICATIONS cn
=
HF 1.1 Shift Staffing Pittman RES/DRPS/RHFB NOTE 3(a)
-2 06/30/89 HF1.2 Engineering Expertise on Shift Pittman NRR/DHFT/HFIB NOTE 3(b) 2 06/30/89 HF1.3 Guidance on Limits and Conditions of Shift Work Pittman NRR/DHFT/HFIB NOTE 3(b) 2 06/30/09 HB TRAIN!NG HF2.1 Evaluate Industry Training Pittman NRR/DHFT/HFIB L1 (NOTE 5) 1 12/31/86 NA HF2.2 Evaluate INPO Accreditation Pittman NRR/DHFT/HFIB L1 (NOTE 5) 1 12/31/86 NA HF2.3 Revise SRP Section 13.2 Pittman NRR/DHFT/HFIB LI (NOTE 5) 1 12/31/86 NA HF_3 OPERATOR LICENSING EXAMINATIONS _
HF3.1 Develop Job Rnowledge Catalog Pittman NRR/DHFT/HFIB LI (NOTE 3) 2 12/31/87 NA HF3.2 Develop License Examination Handbook Pittman NRR/DHFT/HFIB LI (NOTE 3) 2 12/31/87 NA HF3.3 Develop Criteria for Nuclear Power Plant Simulators Pittman NRR/DHFT/HFIS I.A.4.2(4) 2 12/31/87 NA HF3.4 Examination Requirements
~Pittman NRR/3HFT/HFIB I. A. 2. 6(1) 2 12/31/87 NA HF3.5 Develop Computerized Exam System Pittman NRR/DHFT/HFIB LI (NOTE 3) 2 12/31/87 NA 2
2 HF4 c
PROCEDURES O
e HF4.1 Inspection Procedure for Uparaded Emergency Pittman NRR/DLPQ/LHFB HIGH 2
06/30/89 p
O Operating Procedures 3
w HF4.2 Procedures Generatio, Package Effectiveness Evaluatica Pittman NRR/DHFT/HFIB L1 (NOTE 5) 2 06/30/89 NA w
HF4.3 Criteria for Safet'-Related Operator Actions Pittman NRR/DHFT/HFIB B-17 2
06/30/89 NA U
HF4.4
. Guidelines for Upgrading Other Procedures Pittman RF.5/DRPS/RHFB NOTE 3(b) 2 06 30/89 NA HF4.5 Application of Automation and Artificial Intelligence Pittman NRR/DHF T/HFIB HF5.2 2
06/30/89 NA O
O O
Y
~
. TABLE ~II (Continued)
N t:2 Action Priority Lead Office /
Safety latest td Plan Ites/
Evaluation' Division /
Priority /
Latest Issuance MrA co Issue No.-
Title Engineer Branch Status Revision Date No.
u)
HF5 MAN-MACHINE INTERFACE HF5.1 Local Control Stations
~
Pittman RES/DRPS/RHFB HIGH I
12/31/86 HF5.2 Review Criteria for Human Factors Aspects of Advanced Pittman
.RES/DRPS/RHFB HIGH 1
12/31/86 Controls and Instrumentation HFS.3 Evaluation of Operational Aid Systems Pittman NRR/DHFT/HFIB HF5.2 '
1 12/31/86 MA HF5.4 Computers and Computer Displays.
'Pittman NRR/DHFT/HFIB HFS.2 1
12/31/86 NA MANAGEMENT AND ORGANIZATION HF6.1 Develop Regulatory Position on Management and Pittman NRR/DHTT/HFIB I.B. I.1 1
12/31/86 NA Organization (1.2 ".=)
HF6.2 Regulatory Position on Management and Organization Pittman NRR/DHFT/HFIB I. R 1.1 1
12/31/86 NA
.at Operating Reactors (1,2.3.4) hF7 HUMAN RELIABILITY ut HF7.1 Human Error Data Acquisition Pittman NRR/DHFT/HFIB LI (NOTE 5)
I 12/31/86 NA HF 7. 2 Human Error Data Storage and Retrieval Pittman NRR/DHFT/hflB LI (NOTE 5) 1 12/31/86 NA HF7.3 Reliability Evaluation Specialist Aids Pittman NRR/DHFT/HFIB LI (NOTE 5) 1 12/31/86 NA HF7.4 Safety Event Analysis Results Applications Pittman NRR/DHFT/HFIB LI (NOTE 5) 1 12/31/86 NA HF8 Maintenance and Surveillance Program Pittman NRR/DLPQ/LPEB NOTE 3(b) 2 M/30/88 NA CHERNOBYL ISSUES CHI
~ ADMINISTRATIVE CONTR3tS AND OPERATIONAL PRACTICES CH1.1 Administrative Controls to Ensure That Procedures Are Fo11cwed and That Procet'ures Are Adequate CHl.1A Symptem-Based EOPs Emrit NRR/DLPQ/LHFB LI (NOTE 5) 06/30/89 ~
NA ~
CHl.1B Procedure Violations Emrit RES/DSR/HFRB LI (NOTE 5) 06/30/89 NA CHl.2 Approval of Tests a d 9'hei Unusual Operations CHl.2A Test, Change, and Experiment Review Guidelines.
Enrit NRR/DOEA/0 TSP LI (NOTE 5).
06/30/89 NA CHl.28 NRC Testing Requirements Eerit RES'DSR/F'-
- (NOTE 5) 06/30/89 NA CHl.3 Bypassing Safety Systems E
CHl.3A Revise Regulatory Guide 1.47 Enrit RE!
IMEb (NOTE 5) 06/30/89 NA m
- o CHl.4 Availability of Engineered Safety Features CH1.4A Engineered Safety Feature Availability.
Eerit NRR/1,JEA/O
_ (NOTE 5) 06/30/89 NA 1
e CHl.4B Technical Specifications Bases Eerit NRR/DOLA/01 LI (NOTE 5) 06/30/89 NA e
CHl.4C Low Power and Shutdown-Eerit RES/D5R/P"t LI (NOTE 5) 06/30/89 NA g
to CHl. 5 Operating Staff Attitudes Toward Safety-Eerit RES/DRA/ M u_
LI (NOTE 3) 06/30/89 NA
.s W
CHl.6 Management Systems Emrit RES/DSR/HFPB LI (NOTE'5)
C6/30/89 NA w
p -
CHl.6A Assessment of NRC Requirements on Management CH1.7 Accident Management CHl.7A Accident Management Eerit RES/D5R/HFRB LI (NOTE 5) 06/30/89 NA
.~
TABLE II (Continued)
Action Priority
-Lead Office /
Safety latest to Plan Item /
Evaluation Divisien/
Friority/
Latest Issuance MPA
(
' Issue No.
Title Engineer Branch Ststus-Revision Date No.
oo e
CR DESIr3 CH2.1 Reactivity Accidents CH2.lA Reactivity Transients _
Emrit RES/DSR/RP58 LI (NOTE 5) 06 30/89 NA CH2.2 Accidents at Low Power and at Zero Power Enrit RES/DRA/SRGIB CHl.4 06/30/89 NA CH2.3 Miltiple-Unit Protection CH2.3A Control Room Habitability Emrit RES/DRA/ARGIB 83 06/30/89 NA CH2.38
-Contamination Outside Control Roca Eerit RES/DRA/ARGIB LI (NOTE 5) 06/30/89 NA CH2.3C Smoke Control Emrit RES/DSIR/5AIB LI (NOTE 5) 06 30/89 M
CH2.3D Shared Shutdown Systems Emrit RES/DRA/ARGIB LI (NOTE 5) 06/30/89 NA CH2.4
' Fire Protection Eerit RES/D51R/SAIB L1 (NOTE 5) 06/30/89 NA CH2.4A Firefighting With Radiation Present CH3 CONTAINMENT CH3.1 Containment Performance During Severe Accidents CH3.1A Containment Performance Eerit RES/DSIR/SAIB L1 (NOTE 5) 06/30/89 NA CH3.2 Filtered Venting us CH3.2A Filtered Venting Eerit RES/051R/5AIB L1 (NOTE 5) 06/30/e9 NA co CH_4 EMERGENCY PLANNING CH4.1 Size of the Emergency Planning Zones Eerit RES/DRA/ARGIB LI (DROP) 06/30/89 NA CH4.2 Medical Services.
Emrit RES/DRA/ARGIB 11 (DROP) 06/30/89 NA CH4.3 Ingestion Pathway Measures CH4.3A Ingestion Pathway Protective Measures Eerit RES/DSIR/SAIB L1 (NOTE 5) 06/30/89 NA CH4.4 Decontamination and Relocation CH4.4A Decontamination Eerit RE5/05!R/5AIB LI (NOTE 5) 06/30/89 NA CH4 48 Relocation Enrit RES/D51R/5AIB L1 (NOTE 5) 06/30/89 NA CH5 SEVERE ACCIDENT PHENOMENA CHS.1 Source Term CHS.)A Mechanical Dispersal in Fission Product Release Emrit RES/D5R/AEB LI (NOTE 5) 06/30/89 NA CHS.1B Stripping in Fission Product Release Enrit RES/D5R/AEB LI (NOTE 5) 06/30/89 NA CHS.2 Steam Explc,sions CHS.2A Steam Fxplosions Eerit RES/DSR/AEB LI (NOTE 5'.
06/30/89 NA CHS.3 Combustible Gas Eerit RES/DRA/ARGIB LI (NOTE 3) 06/30/89 NA 2
E CH6 GRAPHITE-MODERATED REACTORS E
8 1
e CH6.lA The Fort St. Vrain Reactor and the Modular HIGR.
E f
CH6.1 Graphite-Moderated Reactors RES/DRA/ARGIB LI (DROP) 06/30/89 NA o
Eerit NA 3
y CH6.1B Structural Graphite Experiments Eerit RES/DRA/ARGIB LI (NOTE 3) 06/30/89 ~
NA -
CH6.2 Assessment Enrit RES/DRA/ARGIB LI (NOTE 3) 06/30/89 O
O O
i-
-;/
,3 f~
- [
1
.( j N,
' (,.[
H N
- N m
W Nm
. e TABLE III SUPMARY OF THE PRIORITIZATION OF ALL TMI ACTION PLAN ITEMS, TASK ACTION PLAN ITEMS, NEW GENERIC I55UES, HtMAN FACTOR 5 ISSUES, AND CHERNOBYL ISSUES D'd NOTES: I - Possible Resolution Identified for Evaluation 2 - Resolution Available 3 --Resolution Resulted in either the Establishment of New Requirements or No New Requirements 4 - Issues to be Prioritized in the Future 5 - Issue that is not a Generic Safety Issue but should be Assigned Resources for Completion DROP
- Issue Dropped as a Generic Issue m
EI
- Environmental Issue-W GSI
- Generic Safety Issue f.IGH
- High Safety Priority I
- TMI Action Plan Item with Implementatici of Resolution Mandated by NUREG-0737ss LI
- Licensing Issue LOW
- Low Safety Priority MEDIUM'
- Medium Safety Priority RI
- Regulatory Impact Issue USI
- Unresolv A Safety Issue Z
- =3 C
e
- X3 FT1 l
C) em o
8 m
~.
1.
W 1
i L
m d#*#
""'*N'
g TABLE III (Continued)
NO
-D COVERED RESOLVED STAGES ACTI0ft ITEM / ISSUE GROUP IN OTHER NOTE NOTE-NOTE NOTE NOTE I
ISSUES I
2 3
4 5
TOTAL 1.
TMI ACTION PLAN ITEMS (369)
(1)
GSI 88 46 1
1 127 0
1 1
12 -
9 286 (ii)
LI 0
1 74 -
0 0
8 83 2.
TASK ACTION PLAN ITEMS (142)
- (i) USI 0
0 27 0
27 (ii) GSI 19 0
1 30 2
3 3
10 4
72 (iii) RI 0
0 0
5 1
0 0
1 7
(iv) LI 0
0 0
1 9
0 11 21 (v) EI 1
0 0
6 6
0 2
15 cn 3.
NEW GENERIC ISSUES (202)
(i) GSI 47 3
0 36 0
10 5
7 39 37 184 (ii) RI 2
0 0
2 1
0 0
6 11 (iii) LI 0
0 0-2 0
0 5
7 4.
HUMAN FACTORS ISSUES (27)
(i) GSI 8
0 0
5 0
3 0
0 0
0 16 (ii) LI 0
-0 0
3 0
8 11 5.
CHERNOBYL ISSUES (32)
(i)
LI 2
0 0
4 3
0 23 32 TOTAL:
88 ~
125 4
3 322 0
16 9
24 76 41 64 772 E
I h
E.
g.-
eWO
- g.
.t O
O O
Revision 5 r
' TASK I.D:
CONTROL ROOM DESIGN i
The objective of this task is to improve the ability of nuclear power plant control room operators to prevent accidents or cope with accidents if they occur by improving the information provided to them.
ITEM I.D.1:- CONTROL ROOM DESIGN REVIEWS This item was clarified in NUREG-0737,88 requirements were issued, and MPA F-08 was established by DL for implementation purposes, j
ITEM I.D.2:
PLANT SAFETY PARAMETER DISPLAY CONSOLE 1
i DESCRIPTION i
This item was clarified in NUREG-0737,88 requirements were issued, and MPA F-09 was established by DL for implementation purpose:
Generic. Letter No.
82-33878 transmitted Supplement 1 to NUREG-0737 to furti cr clarify the TMI action items related to emergency response capability, including Item I.D.2.
' This Supplement 1 included the fundamental requirements for emergency response capability from the wide range of regulctory documents issued on the' subject.
It was written at the conceptual level to allow for
- high degree of flexibi-lity:in scheduling and design.
In recognition of.ne interrelationships among the action items addressed in Supplement 1,88 tb staff made allowance for each licensee to negotiate a reasonable schedule for
,plementing its emergency response capability.
However, the staff identified the SPDS as an improvement to the control room that should not be delayed by progress on other initiatives..
CONCLUSION The staff evaluated licensee / applicant implementation of the SPDS requirements at 57 units and found that a large percentage of designs did not satisfy requirements identified in Supplement 1 to NUREG-0737.
Generic Letter 89-06120s(enclosing NUREG-1342120s).was issued to inform licensees of the staff's findings to aid in implementing SPDS requirements.
NUREG-1342120s a
describes methods used by some licensees / applicants to implement SPDS requirements in a manner found acceptable by.the staff.
NUREG-1342 also documents design features that the staff found unacceptable and gives the staff's reason for finding them unacceptable.
The information in NUREG-1342 does not constitute new requirements; Supplement 1 to NUREG-0737 contains NRC's requirements for SPDS.
4 O
12/31/89 1.I.D-1 NUREG-0933
Revision 5 l
ITEM I.O.3:
SAFETY SYSTEM STATUS MONITORING DESCRIPTION Historical Background This TMI Action Plan item *8 recommended that a study be undertaken to determine the need for all licensees and applicants not committed to Regulatory Guide L 47150 to install a bypass and inoperable status indication system or similar system.
Safety Significance Implementation of a well-engineered bypass and inoperable status indication sys -
tem could provide the operator with timely information on the status of the plant safety systems.
This operator aid could help eliminate operator errors such as those resulting from valve misalignment due to maintenance or testing errors.
Possible Solutions A study of current industry (nuclear and others) practices could be undertaken to evaluate possible metnods/ systems for verifying correct system alignment.
In.
conjunctionwiththis,astudyoffailuresofsystemsduetopumporvalveun-availability could be undertaken.
Based on the results, a requirement to backfit or not backfit Regulatory Guide 1.47150 (or a revision thereof) would be set forth PRIORITY DETERMINATION Assumptions If the system.is integrated with the overall control room, then it could be
= expected that it would reduce operator error, which in turn will lower the risk associated with operation of the monitored safety systems.
For some utilities this "new" system may result in a modest but significant reduction in operator error during an emergency whereas in'others the system may have no discernible effect.
An average of about 2% was applied to all pres-ently operating plants.
Plants not committedtoRegulatoryGuide'1.47.1g0et licensed or undergoing licensing are In an analysis of this issue performed by PNL,84 Oconee 3 was selected as the i
representative PWR.
It was assumed that the fractional risk and core-melt frequency reductions for a representative BWR (Grand Gulf 1) will be equivalent to those calculated for the representative PWR.
Frequency / Consequence Estimate-The reduction in core-melt frequency (3F) for Oconee was calculated to be-8.7 x 10 7/RY,. based on adjustment to the risk equation parameters affected by issue resolution and then a calculation of a core-melt frequency and comparison to the base core-melt frequency.
Based on a scaling calculation (see NUREG/CR-280084), the frequency reduction l-(oF) for-Grand Gulf was 3.9 x 10 7/RY.
The reduction in public risk was L
12/31/89 1.I.D-2 NUREG-0933 1
l H
Revision 5' calculated (assuming. WASH-140026 release categories, typical midwest-site dl3 t
meteorology, and a uniform ponulation density of 340 people per square-mile) to be 5.9. man-rem /RY for Oconee and 7.1' man-rem /RY for Grand Gulf.
The total risk reduction for this issue was calculated-to be 1.2 x 104 man-rem, based on.5.9 man-rem /RY for 47 PWRs, 7.1 man-rem /RY for 24 BWRs, and average remaining lives of 28 years and 25 years for PWRs and BWRs, respectively.
Cost Estimate-Industry Cost:
Installation costs (including labor and equipment) were esti-n.;ted as follows:
-t Equipment Cost
.(a) Cable 30 miles @ $6.00/100 Lft
$ 9,500 (b) Elec. Penetration Limitations 300,000-(c) Cable tray and Additional
. Termination 10,000 (d) Intermediate Logic Panel 100,000 (e) Control Room Alarms,' Indications 10,000 Total:
5429,500 0ther Cost
.(a, Design labor 9 12 man-months
$ 75,000
.(
(b) Installation Labor = 17 man-months 100,000 (c) QA 40,000 Total:
5215,000
'Therefore, the total industry implementation cost is $644,500/ plant.
Maintenance' of the solution by industry is estimated to require 1 man-week /
plant.
At-a cost of $1,000/RY, this amounts to a total industry. cost of $1.9M.
1 Therefore,'the total industry cost is $48M.
NRC Cost:
NRC labor for development of the resolution is estimated to be 0.5
- man year. ' Review and implementation of-the solution is estimated to take 4 man-weeks / plant.
Therefore, the total NRC cost is $0.6M.
Total Cost:. The total. cost associated with the possible solution to this issue is 5(48 + 0.6)M or'.$48.6M.
'Value/ Impact Assessment Based on a public risk' reduction of 1.2 x 104 man-rem, the value/ impact score.
is given by:
3 _ 1.2 x 104 man-rem 548.6M
/
= 240 man-rem /$M
(
12/31/89 1.1.0-3 NUREG-0933
Revision 5 I
h Uncertainty t
Because the estimate of the value/ impact score relies heavily on the estimated value of the possible reduction in human error, there may be wide variance in the effective improvement.
Additional.Consideratiom (1) To resolve this' issue effectively, it should be done in conjunction with Item I.D.1 which aildresses control room design review.
This issue was not explicitly inc'uded in the present Commission requirement for Control-Room Design SECY-82-1111[ Item'..D.1)whichistobeimplementedinaccordancewith 1 and a letter 878 issued to licensees of all operating plants.
(2) As another potentially significant consideration, resolution of this issue
-may provids e reduction in safety system unavailability due to the contri-bution of maintenance and testing.-
1 (3) DHFS-is presently-contracting with various groups to study this issue.ts2,tsa Tnt 2 studies could better define the assumptions (for risk reduction) used in the calculation.
This would then provide better data for a bene-U fit / cost study to. determine implementation.
CONCLUSION Based on the estimated public risk reduction and the value/ impact score, this issue was-given a MEDIUM priority ranking.
ITEM I.D.4:
CONTROL ROOM DESIGN STANDARD DESCRIPTION Historical Background 1
i This issue was documented in NUREG-066048 and emphasized a need for guidar.ce on-the design of control rooms to incorporate human-factor considerations.
Safety Significance Control-rooms and control panels which incorporate human-factor considerations can greatly enhance operator performance.
This could contribute to a reduction in operator error and,-therefore, a potential _ reduction-in.the frequency of core-melt accidents.
Possible Solution An NRC Regulatory Guide endorsing industry standard (s) could be developed with the intention of providing:
(1) guidance for the design of control rooms and, (2) the evaluation criteria for use in the licensing process.
O 12/31/89 1.I.D-4 NUREG-0933 J
Revision 5 PRIORITY DETERMINATION
'l Assumptions PNL did an assessment of this issue.84 From the_ representative PWR (0conee) and BWR (Grand Gulf), those parameters in the risk equations requiring direct operator actions were considered affected.
That is, it was assumed that the probability of operator error for these parameters were decreased by 3% based on resolution of this safety issue.
It was assumed that only plants to be licensed beyond 1986 would be affected.
Frequency / Consequence Estimate The affected accident sequences and associated base-case frequencies were deter-mined.
From these frequencies, the (Affected Release Categories) base case fre-quencies were determined and a new base case core melt frequency was calculated.
This was 3.1 x 10 5/RY for the PWRs and 6.1 x 10 8/RY for the BWRs.
In addi-tion, a new base case public risk was calculated for the affected parameters.
This was 79.1 man-rem /RY for PWRs and 40.4 man-rem /RY for BWRs.
To determine a change in public risk due to issue resolution, the affected parameters were ad-justed by 3% and the frequencies of the associated sequences and release cate-gories were determined.
A new overall core-melt frequency was then determined.
The new core-melt frequency was 3.01 x 10 5/RY for PWRs and 5.95 x 10 8/RY for BWRs.
Also a new public risk was then calculated:
76.9 man-rem /RY for PWRs and 39.2 man-rem /RY for BWRs.
From the above numbers, the reduction in core-melt frequency (due to issue O
BWRs._ The public risk reduction was calculated to be 2.2 man-rem /RY for PWRs resolution) was calculated to be 9 x 10 7/RY for PWRs and 1.8 x 10 7/RY for and:1.2 man-rem /RY for-BWRs.
Therefore, the_ total public risk reduction, based on_10 PWRs and 5 BWRs and an average remaining life of 30 years, was-calculated to be 840 man-rem.
Cost Estimate Industry Cost:
It was assumed that for those plants expected to be completed after 1990, the cost to implement the standard will be part of the basic cost.
For those plants expected to be completed between 1987 and 1990, the cost to redesign the control room was estimated to be $100,000/ plant.
This is based on the assumption that, in all likelihood, draft standards will be available and will be used and then only' minor changes will be needed.
Also, it is assumed that the standards will not require.significant equipment additions, but only reworking of preliminary designs.
Since there are about 10 plants to be completed-between 1987 and 1990, total industry cost for implementation is
$1M.
No additional cost for yearly industry operation and maintenance was -
assumed.
NRC Cost:
The NRC cost estimate was based on an assumed $300,000 expenditure for regulatory guide development.
It was assumed that additional NRC labor of about 4 man-weeks / plant would be necessary to review the modifications that-would be required for the 10 plants completed between 1987 and 1990.
This equals a cost of about $9,000/ plant or $90,000 total.
The total NRC cost is then $390,000.
12/31/89 1.I.0-5 NUREG-0933 l
l
Revision 5 Total Cost:
The total cost associated with th* possible solution to this issue is 5(1 + 0.39)M or $1.39M.
Value/ Impact Assessment Based on a total public risk reduction of 840 man-rem, the value/ impact score is given by:
b _ 840 man-rem 51.39M
= 600 man-rem /$M Uncertainty l
The human error reduction is not easily quantifiable.
Three percent was used here, but it is subject to large uncertainty.
Other Considerations (1) The issue was assumed to affect only future plants.
NRC guidelines in NUREG-0700474 were to be applied to all existing plants and NT0Ls.
(2)
IEEE Standards are under development.
CONCLUSION Based on the above value/ impact score, this issue was given a medium priority ranking. Although no action was taken on Item I.D.4, all commercial nuclear power plants in the United States, whether operational or under construction, are being-subjected to a Detailed Control Room Design Review (DCRDR) in response to TMI Item I.0.1.
NUREG-0700474 and acceptable substitutes (e.g.,
L the Boiling Water Reactor Owners' Group " Control Room Survey Program" and--
i l-
" Checklist Supplement") are being.used as control room design standards.
In-s accordance with 10 CFR 50.34(g), all future applications for LWRs shall include an evaluation of the proposed facility against SRP11 Section 18.1 which addresses control room design and references NUREG-0700474 as appropriate guidance for control room design.
m Thus, staff actions have negated the need for evaluation of-industry control l
room design standards and forlthe development of a Regulatory Guide endorsing those standards.
NUREG-0700 and acceptable substitutes are the de facto
. control room design standards for evaluating commercial nuclear power plants in the United States.
Design standards for advanced control rooms will be addressed'as a research issue under the Human Factors Research Program.-
Therefore, this issue was RESOLVED and no new requirements were established.11oi O
12/31/89-1.I.0-6 NUREG-0933
.. ~
w{ {
T,,
Revision 5 ITEM I.D.5:
IMPROVED CONTROL ROOM INSTRUMENTATION RESEARCil 9
ITEM 1.D.5(1):
3 OPERATOR-PROCESS COMMUNICATION DESCRIPTION Historical Background This issue was documented in the TMI Action Plan 48 and focused on the need to evaluate the operator machine interface in reactor control rooms.
The emphasis of this portion of the overall issue was the use of lights, alarms, and annun-ciators.
Safety Significance The method of presentation of information can significantly enhance the performance of the control room operators and thereby potentially affect operator error.
Possible.c lation o
It was proposed that current practice and use of lights, alarms, and annunciators be reviewed to assess how well they facilitate operator-machine interaction and minimize errors.
RES has studied the area of control room alarms and annunciators (through a contractor) and the results were reported in NUREG/CR-2147.244 Based on this report, RES issued a Research Information p
' Letter:46 (RIL-124) which provided a recommendation for further action.
CONCLUSION This item was RESOLVED and no new requirements were established.
ITEM I.D.5(2):
PLANT STATUS AND POSTACCIDENT MONITORING DESCRIPTION l
Historical Background This issue was documented in the TMI Action Plan 48 and focused on the need to improve the ability of reactor operators to prevent, diagnose, and properly respond to accidents.
The emphasis was on the information needs (i.e.,
indication of plant status) of the operator.
Safety Significance In order for the operators to perform their functions it is necessary that they receive all the necessary information on the plant status.
This can enhance operator performance (and therefore reduce operator error).
Possible Solution
()
Accident sequences should be analyzed to determine the information required to
.. ' ()
provide unambiguous indication of plant status.
Specific instrumentation and L
ESF status monitoring needs would then be determined.
PWR instrumentation 1
12/31/89 1.I.D-7 NUREG-0933 i
u
Revision 5 requirements were analyzed in NUREG/CR-1440' 1 and BWR instrumentation require-ments were analyzed in NUREG/CR-2100.242 Jr Status Monitoring requirements were also studied in NUREG/CR-2278.848 Research Information Letter (RIL) No.
98246 was issued in August 1980.
This RIL transmitted "the results of com-pleted research describing an improved method for analyzing accident-sequences."
Revision 2 to Regulatory Guide 1.9755 was issued in December 1980.
(See also Item II.F.3, " Instrumentation for Monitoring Accident Conditions.") Present plans include implementation of this guide at all plants.151'870 CONCLUSION This item was RESOLVED and new requirements were established.
ITEM I.D.5(3):
ON-LINE REACTOR 3URVEILLANCE SYSTEM DESCRIPTION This item was documented in the TMI Action Plants based on the work being per formed by ORNL.
A continuous on-line automated surveillance system was installed at Sequoyah-1 (PWR) and information has been obtained throughout the first fuel cycle.
The demonstration at Sequoyah was to continue through the second fuel cycle (mid-1984).
A similar demonstration at an operating BWR was planned for initiation in 1984.
The system has the potential to provide-diagnostic infor-mation to predict anomalous behavior of operating reactors which could be esed
~,
to maintain safe conditions.
Noise surveillance and diagnostic techniques associated with the on-line reactor
'i surveillance system have shown their safety significance and.the results of the research'have been and are being used by NRC in regulatory activities as dis-cussed below.
Monitoring of neutron noise in BWRs was used to detect and moni-tor the impacting of instrument tubes against fuel. boxes.
The technique was used by NRC and its consultants to verify that partial power operation was safe until the next scheduled fuel outages for some 10 BWRs.
Pressure noise sur--
veillance was used at TMI-2 to monitor and guide degassification of the primary loop.
The data obtained from the on-line surveillance demonstrated at Sequoyah-1 were used by NRC and its-consultants'in the assessment of loose thermal shields in Oconee Units-1, 2, and 3.
In yet another example, NRR used results of this research in BWR stability determinations associated with regulatory actions pertaining to Dresden.
CONCLUSION Based on the ongoing programs, we conclude that the technical resolution of this issue has been identified.
ITEM I.D.5(4):
PROCESS MONITORING INSTRUMENTATION DESCRIPTION is item was documented in the TMI Action Plan 48 and was to e?plore the feasibility of using new concepts for measuring certain reactor parameters.
A-12/31/89 1.I.0-8 NUREG-0933 l
i Revision 5-r]=
directly related issue, Item II.F.2 in NUREG-0737,ss mandated that industry devel'.,p and implement PWR liquid level detection systems.
NRC evaluated
[D a n%eber of systems at the LOCA experiment facilities at ORNL and INEL.
i CONCLUSION l-This item has been RESOLVED and no new requirements were established.
ITEM I.D.5(5): -DISTURBANCE ANALYSIS SYSTEMS DESCRIPTION Historical Background This issue was documented in the TMI Action Plan 48 and its objective was to explore advanced disturbance analysis systems for possible application to nuclear power plants.
Safety Significance
.If potential transient events could be anticipated and terminated earlier and if operator response could be enhanced, then the core melt frequency may be reduced.' Advanced disturbance analysis systems could possibly provide the capabilities to achieve this.
O Possible Solution
'b The purpose of this item was to assess the need, feasibility, and adequacy of advanced' disturbance. analysis systems.
EPRI is-presently doing research in this area.
PRIORITY DETERMINATION i
Assumptions To evaluate this item, we assumed.that the advanced disturbance analysis system would include the implementation of a continuous on-line surveillance system, as discussed in Item I.D.5(3).
[A liquid level detection system was assumed available because it is already required - Items I.D.5(4) and II.F.2.]
In a PNL assessment of this issue,84 it was decided that a risk reduction could be estimated by assuming a reduction in operator errors.
Operator error was assumed to be-reduced by 2% due to the implementation of this additional operator aid. Also, a reduction in the number of transients requiring shutdown was assumed based on the potential that the operators will be able to terminate some transients before the need for shutdown.
Reduced transient frequencies
- were calculated based on a recent EPRI analysis.807' The basis for choosing the transients was that either the detection time leading up to the transient or the-time from the transient occurrence to shutdown was perceived to be longer l
than 30 minutes, enabling the advanced diagnostic system to diagnose the prob-
'lem and provide possible solutions for the operator.
Q l
12/31/89 1.I.D-9 NUREG-0933
Revision 5' Furthermore, for purposes of this study, it was assumed that the operator could only respond with actions to 80% of the transients listed that would occur during the remaining lifetimes of the subject plants.
Of the 80%, only 25% of the operator's actions was assumed to prevent the need for shutdown.
The.
average plant shutdown was assumed to last 0.75 day.
Therefore, reduction in unscheduled outages is calculated as follows:
j PWR:
(4.63 transients /RY)(0.80)(0.25)(0.75 day / shutdown) = 0.69 day /RY BWR:
(5.20 transients /RY)(0.80)(0.25)(0.75 day / shutdown) = 0.78 day /RY Frequency Estimate U
The parameters which included direct operator action were adjusted based on the 2% operator error reduction.
In addition, the reduced transient frequency cal-
.culated from above were divided by the total PWR and BWR transient frequencies (i.e., 9.8 events /RY for PWRs and 8.9 events /RY fer BWRs) to give a percent transient reduction.
Then the parameters for transients (Tg and T for PWRs 3
and Tas for BWRs) were adjusted.
1 Combining the reduction in operator error and the reduction in transient fre-quencies, the reductions in core-melt frequencies are 4.4 x 10 8 event /RY for PWRs and 2.6 x 10 8 event /RY for BWRs.
Consequence Estimate The associated per plant reduction in public risk was calculated (assuming 340 people per square mile) to be 12 man-rem /RY for PWRs and 18 man-rem /RY for BWRs.
Assuming 90 PWRs=and 44 BWRs with remaining lives of 28.8 and 27.4 years, respectively, the-total public risk reduction was calculated to be 53,000 man-rem.
Cost Estimate Industry Cost:
For the advanced diagnostic system, implementation costs (hardware and installation), were estimated to be $1.5M/ plant.
The on-line surveillance system was estimated to cost $125,000/ plant for hardware and
$375,000/ plant for installation.
For 134 plants, the total implementation cost
.t is approximately $270M.
Industry labor for operation and maintenance was estimated to be about 10 man-weeks /RY beyond that currently required for control room instrumentation.
Therefore, this cost would be:
(10 man-wk/RY)($2,270/ man-wk)(134 plar.ts)(30 years) = $91M.
Therefore, the total industry cost was estimated to be $360M.
NRC Cost:' NRC costs for issue resolution were considered to be relatively minor (52M), based on the assumption that EPRI would continue to do the major portion of the research on this issue.
NRC costs for labor to approve and monitor hardware changes to backfit plants were based on an average of 4 man-wk/backfit per plant.
This cost is given by:
(4 man-wk/backfit plant)($2,270/ man-wk)(71 plants) = $650,000.
12/31/89 1.I.0-10 NUREG-0933
Revision 5 Therefore, the total NRC cost is $2,65M.
p)
, January 15-17, 1980, Washington, D.C."
Institute of Electrical and Electronics Engineers.
307. EPRI NP-2230, "ATWS:
A Reappraisal, Part 3," Electric Power Research Institute, 1982, i
376. NRC Letter to All Licensees of Operating Reactors, Applicants _for l
Operating Licenses, and Holders of Construction Permits, " Supplement 1 to NUREG-0737, Requirements for Emergency Response-Capability (Generic Letter No. 82-33)," December 17, 1982.
)
474. NUREG-0700, " Guidelines for Control Room Design Reviews," U.S. Nuclear V-Regulatory Commission, September 1981.
1099. Memorandum for B. Morris from B. Sheron, " Updated GIMCS for GI-I.D.5(5)," February 2, 1988.
1100. Memorandum for V. Stello from E. Beckjord, "Redesignation of Generic Issue I.D.5(5) ' Disturbance Analysis Systems,'" February 22, 1988.
1101.MemorandumforV.StellofromE.Beckp'ord,"ClosureofGenericIssue I.D.4 ' Control Room Design. Standard,'
March 28, 1988.
,1 1205.NRC Letter to All Licensees of Operating Plants, Applicants-for Operating i
Licenses, and Holders of Construction Permits, " Task Action Plan I.D.2 -
Safety Parameter Display System - 10 CFR 950.54(f) - (Generic Letter No.'89-06)," April 12, 1989.
1206.NUREG-1342, "A Status Report Regarding Industry Implementation of Safety Parameter Display Systems, "U.S. Nuclear Regulatory Commission, April 1989.
1
~1 12/31/89 1.I.D-13 NUREG-0933
Revision 1 OV.
ITEM A-17:
SYSTEMS INTERACTIONS IN NUCLEAR POWER PLANTS, DESCRIPTION Nuclear power plants contain many structures, systems, and components (SSCs),
some of which are safety-related.
Certain SSCs are designed to interact to perform their intended functions.
These " systems interactions" are usually well recognized and, therefore, accounted for in the evaluation of plant safety by designers and in plant safety assessments.
A number of significant, plant-specific events have involved unintended or unrecognized dependen::les among the SSCs.
Some of these events have involved subtle dependencies between safety-related SCCs and other SCCs.
Some events have also involved subtle dependencies between redundant safety-related SSCs that were believed to be independent.
This issue was originally identified in NUREG-03712 and was later determined to be a USI in NUREG-0510.lse CONCLUSION The purpose of USI A-17 was to investigate the potential that unrecognized, subtle dependencies among SSCs have remained hidden and that they could lead
.to safety-significant events.
The term used to describe these' unrecognized, subtle dependencies is adverse systems interactions (ASIS).
In resolving this (q
issue, the staff did not recommend that licensees conduct further broad V) searches s)ecifically to identify all ASIS because such searches have not proved to 3e cost-effective in the past and there is no guarantee after such studies that all ASIS have been uncovered.- Rather, in its study, the staff concluded that certain'more specific actions, together with other ongoing activities, could reduce the risk from ASIS.
The staff concluded from its investigations that the following' actions should be taken:
(1)
Issuance of a generic letter that includes:
(a) the bases for resolution of USI A-17; and (b) a summary of information relevant to ongoing operating experience reviews.
(2) Recognition that the IPE Program already includes the evaluation of i
internal flooding and.the insights from USI A-17 will be referred in the IPE guidance documents.
If. licensee action.regarding flooding-and water hitrusion is implemented as proposed, there would be no further action on Issue 77 which was integrated into the resolution of USI A-17.
(3) Recognition that the USI A-46 implementation will address seismically-induced systems interactions to verify that components and systems needed to safely shut down a plant are protected, given loss of offsite power.
(New plants, not covered by USI A-46, have been
(
reviewed to current requirements that address seismically-induced systems interactions.)
s 12/31/89 2.A.17-1 NUREG-0933
Revision 1 (4) Communication of information regarding ASIS for staff review of PRAs and for staff evaluation of electric power supplies as part of Issue 128, " Electric Power Reliability."
(5)- Identification and definition of concerns related to USI A-17 and other programs that have not been specifically addressed in this or in other generic issues.
The staff has established the Multiple System Responses Program (NUREG/CR-5420)1237 the objective of which will be to define the concerns with sufficient specificit be evaluated as potential generic safety issues. y to permit them to (6) Development of an SRP for future olents that would include guidance regarding protection from internal flooding and water intrusion events.
The staff's techaical findings were published in NUREG-1174;t:
the regulatory 32 analysis associa.ed with the resolution of this-issue was published in NUREG-1229.12ss The Commission was informed of the staff's resolution in SECY-89-2301234 and Generic Letter 89-18123s was later issued to licensees.
Thus, this issue was RESOLVED and no new requirements were established.123e REFERENCES 2.
NUREG-0371, " Task Action Plans for Generic Activities (Category A),"
U.S. Nuclear Regulatory Commission, November 1978.
186. NUREG-0510, " Identification of Unresolved Safety Issues Relating to Nuclear Power Plants," U.S. Nuclear Regulatory Commission,-January 1979.
i.~
1232.NUREG-1174, " Evaluation of Systems Interactions in Nuclear Power Plants," U.S. Nuclear Regulatory Commission, May 1989.-
1233.NUKtG-1229, " Regulatory Analysis for Resolution of USI A-17," U.S.
Nuclear Regulatory Comission, August 1989.
1234.SECY-89-230, " Unresolved Safety Issue A-17, ' Systems Interactions in p
Nuclear ~ Power Plants,'" August 1,-1989.
I 1235.NRC Letter to All Holders of Operating Licenses or Construction Permits I
for Nuclear Power Plants, " Resolution of Unresolved Safety Issue A-17,
' Systems Interactions in Nuclear Power Plants' (Generic Letter 89-18),"
September 6, 1989.
11236. Federal Register Notice 54 FR 34836, " Issuance and Availability of NUREG-1174, ' Evaluation of Systems Interactions in Nuclear Power Plants:
-Technical Findings Related to Unresolved Safety Issue A-17,' and NUREG-1229, ' Regulatory Analysis for Resolution of USI A-17, - Systems Interactions in Nuclear Power Plants,'" August 22, 1989.
1237.NUREG/CR-5420, " Multiple System Responses Program - Identification of Concerns Related to a Number of Specific Regulatory Issues," U.S.
Nuclear Regulatory Commission, October 1989.
O 12/31/89 2.A.17-2 NUREG-0933 1
Revision 1 i
I 1
ITEM A-29:
NUCLEAR POWER PLANT DESIGN FOR THE REDUCTION OF VULNERABILITY TO INDUSTRIAL SABOTAGE DESCRIPTION Historical Background i
The safety concern of this NUREG-03712 item deals with the consideration of alternatives to the basic design of nuclear power plants with the emphasis primarily on reduction of the vulnerability of reactors to industrial sabo-tage.
Extensive efforts and resources are expended in designing nuclear i
plants to minimize the risk to the public health and safety from equipment or system malfunction or failure.
However, reduction of the vulnerability of I
reactors to industrial sabotage is treated as a plant physical security func-l tion and not as a plant design requirement.
Although present reactor designs do provide a great deal of inherent protection against industrial sabotage,
-extensive physical security measures are still required to provide an acceptable level of protection.
An alternate approach would b to more fully consider.
reactor vulnerabilities to sabotage along with economy, operability, reliability, maintainability, and safety during the preliminary design phase.
Since emphasis is being placed on standardizing plants, it is especially important to consider measures which could reduce the vulnerability of reactors to sabotage.
Design features to enhance physical protection must be consistent with present and future system safety requirements.
Possible Solution
.theaddi!nchangeassumedforthebeneddecayheatremovalsystemwhichisurpose of analy b
The desi ion of an independent har
' designed to be only used in a sabotage incident or other extreme emergeocy as determined by plant operators.
This proposed design change is based on cun-siderations and recommendations in a NUREG/CR-1345.170 Several other design changes were considered in the report.
The design chosen for development and-for estimating cost uses electric power for its operation.
Power is supplied by a diesel generator -located (with the remainder of the equipment required for the system) in a hardened building.
Heat loads associated with the diesel-generator and other mechanical eq ipment are transferred to the atmosphere by an air-cooled heat exchanger.
A p pe tunnel connects the hardened decay heat removal building with the conta nment building.
Thesystemisasingle,completesystemwithoutredundancyorsing0le-failure capability.
The design period of unattended operation is 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.1 The-independent hardened decay heat removal system is assumed to be added only to'new PWRs and BWRs, based on information in the NUREG/CR-1345.170 l
PRIORITY DETERMINATION Frequency Estimate l
This issue affects all new PWRs and BWRs.
The cut-sets for Oconee (B&W) are
'used for the PWR analysis.
The results from the PWR analysis were used to 12/31/89 2.A.29-1 NUREG-0933
Revision 1 modify the accident frequencies of the Grand Gulf (GE) plant to obtain results for the BWR analysis.64 In an evaluation of this issue by PNL,64 certain parameters were modified, or
" redefined," in order to account for the acts of sabotage.
The parameters involved are the frequency of the loss of offsite power (T ), the probability 3
of failure of both emergency electrical generators (8 ), and the probability of 3
the failure to restore offsite AC power within approximately 40 minutes (LOPRE).
These changes result in a new base case for the Oconee assessment which was originally formulated to account for natural event failure probabilities only" and did not include failures arising out of acts of sabotage.
The " redefined parameters for Ti and B3 were expanded to include sabotage, which established a more comprehensive base case for the Oconee assessment.
Moreover, because of the particular resolution identified here for this issue (a hardened, independent decay heat removal system), the redefined parameters for Ti and 83 are not affected in the adjusted case (that is, they remain unchanged).
This occurs because the add-on decay heat removal system does not deter the 30tential act(s) of sabotage and the potential for the loss of AC power remains tie same in this case.
The particular resolution for this issue does, however, affect those parameters and/or sequences that are related to decay heat removal, namely, T MLU and T MLU, through the dependence on CONST1 and CONST2.
In this issue, 2
i the reduction in the core-melt frequency is entirely attributable to thc com-plex changes in the sequences T MLU and T MLU as a result of their dependence 3
2 on CONST1 and CONST2.
The parameters Ti and B3 were modified to add to the base case probabilities the additional values attributed to the acts of sabotage, i.e., Ti was increased by 0.02/RY to a value of 0.22/RY, based on three acts of sabotage out of 189 RY of operation,371 and B was increased from 0.0005 to 0.0007, based on the judgment that sabotage of the d,iesel generators is 100 times less likely than sabotage of offsite power.
The value of LOPRE was increased from 0.2 to 1.0 since it was assumed that the sabotage attack precludes restoration of power within 40 minutes.
This resulted in a calculated reduction in core-melt frequencies of 4 x 10 6/RY for a PWR and 1.9 x 10 6/RY for a BWR.
.In addition the following additional assumptions were made:
(1) Applicable Plants:
All 71 new plants were affected, 48 PWRs and 23 BWRs (2) Affected Release Categories and Base Case Frequencies:
Release Cate-gories 3, 5, and 7 have new base-case frequencies due to the changes in Ti and 8.
Categories 1, 2, 4, and 6 remain unchanged.
3 (3) For forward-fit plants, the average life is 30 years.
Consequence Estimate l
1 Based on the calculations performed by PNL,64 the base case public risk is 79 1-man rem /RY for a PWR and 96 man-rem /RY for a BWR.
As a result of the resolu-tion of this issue, the public risk reduction was estimated to be 10 man-rem /RY
[
l and 14 man-rem /RY for a PWR and a BWR, respectively.
Assuming a typical midwest-type meteorology and an average population density for U.S. reactor sites of l
l 12/31/89 2.A.29-2 NUREG-0933
Revision 1 340 people per square mile, the total public risk reduction was calculated to be 24,140 man-rem and the occupational risk reduction was estimated to be 140 man-rem.
Cost Estimate Industry Cost:
Based on NUREG/CR-1345,170 the industry cost for the addition of an-independent, hardened decay heat removal system was estimated to be $10M.
For the 71 forward-fit plants, the total estimated cost was $710M.
For an estimated effort of 2.5 man-weeks / year to check the diesel power source each month and the pumps every 3 months as routine maintenance, the estimated cost was (71 plants)(30 yrs)(2.5 man-wk/yr)($100,000/52 man-wk) or $10.24M.
NRC Cost:
NRC effort to review the initial add-on decay heat removal designs in each plant was estimated to be about 4 man-weeks.
The total cosc for this effort was (4 man-wk/ plant)(71 plants)($100,000/52 man-wk) = $0,546M.
For the review of the operation and maintenance of the hardened decay heat removal system, it was estimated that 1 man-wk/RY will be recuired.
The total cost for this effort was estimated to be (30 yrs)(71 plants)(1 man-wk/RY)($100,000/52)/
man-wk = $4.1M.
Total Cost:
The total cost associated with the possible solution to this issue was estimated to be $(710 + 10.24 + 0.55 + 4.1)M or approximately $725M.
Value/ Impact Assessment Based on a total potential risk reduction of 24,140 man-rem and an estimated cost of $725M, the value/ impact score is given by:
24,140 man-rem 3_
5725M
= 34 man-rem /$M l
CONCLUSION The above value/ impact score indicated a low priority ranking for this issue.
However, because of the relatively large risk reduction, the large uncertainty in determining the risk, and the possibility of developing a lower cost solu-tion, the issue was given a medium priority ranking.
In resolving this issue, the staff concluded that insider sabotage at operating nuclear power plants has not been a significant problem in the U.S.
Existing requirements (10 CFR 73.55) dealing with plant physical security, controlled access to vital areas, screening for reliable personnel, etc.,
appear to be effective.
The staff found no design modification that would completely eliminate or mitigate the threat of insider sabotage.
The staff believed that licensees should continue-to monitor and assess' security practices in terms of:
(1) hiring reliable personnel; and (2) surveillance procedures to prevent, detect, and mitigate adverse insider i
acts.
NRC monitoring and assessment of the effectiveness of licensees' security practices are accomplished in the Systematic Assessment of Licensee Performance (SALP) program.
The staff's technical findings were published in 12/31/89 2.A.29-3 NUREG-0933
Revision 1 NUREG-1267,1287 Thus, this issue was RESOLVED and no new requirements were established.12ss REFERENCES 2.
NUREG-0371, " Task Action Plans for Generic Activities (Category A)," U.S.
Nuclear Regulatory Comission, November 1978.
4 64.
NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioriti-zation Information Development," U.S. Nuclear Regulatory Comission, i
February 1983, (Supplement 1) May 1983, (Supplement 2) December 1983,
'l (Supplement 3) September 1985, (Supplement 4) July 1986, 170. NUREG/CR-1345, " Nuclear Power Plant Design Concepts for Sabotage Protec-
. tion," U.S. Nuclear Regulatory Comission,1981.
171. Bulletin of the Atomic Scientists, Volume 32, No. 8, pp. 29-36, " Nuclear Sabotage," M. Flood, October 1976.
~
1267.NUREG-1267, " Technical Resclution of Generic Safety Issue A-29," U.S.
Nuclear Regulatory Comission, September 1989.
j 1268. Memorandum for J. Taylor from E. Beckjord, " Resolution of Generic Safety Issue A-29, ' Nuclear Power Plant Design for Reduction of Vulnerability to Industrial Sabotage,'" October 6, 1989, O
1
\\
O
.12/31/89 2.A.29-4 NUREG-0933
..va Revision 1 ITEM A-40:
SEISMIC DESIGN CRITERIA DESCRIPTION Structures, systems, and components important to the safety of nuclear power Clants are required to withstand the effects of natural phenomena such as earthquakes.
Broad requirements for earthquake resistance are specified in 10 CFR Parts 50 and 100 and detailed guidance on acceptable ways of meeting these requirements are docuniented in varicus regulatory guides.
Safety analysis reports for each plant are reviewed in accordance with the review and acceptance criteria described in SRP11 Sections 2.5.2, 3.7.1, 3.7.2, and 3.7.3.
Over the years, there has been an evolution of seismic design requirements and technology.
Early nuclear power plants were designed without specific seismic p
design requirements.
In the early 1970s, the requirement for resistance to e
eeismic, events was included in the regulations.
The state of knowledge has
=
advarced rapidly and the methods of seismic design vary with the vintage of the nuclear ?ower plant.
Also, the complex process of ueismic design and analysis ir.volved many engineering disciplines:
seismic, geotechnical, struc-tural, mechanical, electrit:al, and nuclear.
Each discipline in the design procen controlled the design parameters in its domain.
As the total seismic design process evolved, two questions emerged:
(a) How adequate are the plants in earlier generations with respect to current safety requirements 7 and (b) What is the margin of safety in the overall seismic design process? This USI in NUREG-0510.1b dentified in NUREG-03712 and was later determined t issue was origina11 i
CONCWSION I
Theobjectivesofthisissueweretoinvestigateselectedareasoftheseismic design sequerce to determine their conservatism for all types of sites, to investigata alternate approaches to parts of the design sequence, to quantify the overall consorsatism of the design sequence, and to modify the SRP11 cri-teriaifchangeswerefoundtobejustified.
Studies under USI A-40 included 5
the following:
(1) quantification of c0nservatism in seismic design; (2) elastmplastic seismic analysis methods; (3) site-specific response spectra; (4) nonlinear structural dynamic analysis procedures; and (5) soil-E structure interaction (SSI).
One key area in seisaic design is SSI analysis which is complex and has been controverbial in the past.
To examine some of the areas of c7mplexity and to obtain an expert consensus, NRC sponsored an SSI workshop in June 1986.
The technical areas covered during this workshop were:
(1) definition of free field ground motion; (2) ground motion input needed for site-specific SSI analysis; (3) SSI methodology; and (4) experience and experimental verification.
Workshop discussions were focused on improving SRP11 criteria.
Reasonable consensus was achieved in the four' technical areas and was incorporated into the proposed O
revisions to SRP11 Sections 2.5.2, 3.7.1, 3.7.2, and 3.7.3.
12/31/89 2.A.40-1 NUREG-0933
-.-.m
__.____:__m._---_-_.-_____.___.rc.-_-___m_m.
Revision 1 Significant results have become available from the joint EPRI/NRC/ Taiwan Power l
Company (TPC) SSI Lotang experiment in Taiwan.
These results ware presented in an EPRI/NRC/TPC-sponsored workshop in December 1987.
The staff therefore formulated specific questions on the Lotung results and solicited comments on them during the public comment period.
The resolution of public cotaments (NUREG/CR-5347)2sa helped the staff to finalize a position on SSI which was reflected in the revised SRP11 Section 3.7.2, published as part of the final resolution of USI A 40.
Although some older sites were designed to seismic criteria less rigorous than i
current requirements, significant upgrading has been or will be achieved by the Systematic Evaluation Program conducted on the oldest plants, the imple-mentation of USI A-46 and by staff bulletins and information notices such as IE Bulletin 79-02.1234 IE Bulletin 79-14,1240 and IE Bulletin 80-11.1241 The staff has therefore concluded that backfit of the proposed seismic design provisions is not necessary except for the design of safety-related large, above ground tanks at some plants.
The implementation of USI A-46 will result in the review of large, above ground tanks at about 70 of the older plants.
The remainder of the plants fall into two groups:
(1) plants that were subject to licensing review by the staff af ter about 1984; and (2) plants that were reviewed by the staf f during the period beginning in the latter part of the 1970s up to 1984.
For the plants in the first group, the NRC staff licensing review confirmed that no further action was needed.
A survey of the plants in the second group was conducted by the NRC and it was found that tanks for many of these plants were designed using the new criteria.
However, the staff was unable to determine the status of large tanks at four sites (Watts Bar, Callaway,icensees.
Wolf Creek, and Harris) and information request letters were issued to these l Early activities on USI A-40 consisted of specific technical studies which concentrated on improvaments in seismic design criteria.
A technical overview and specific recommenoetions for changes to seismic design criteria were docu-mented in NUREG/CR-1131. 4242 The value/ impact assessment for the proposed changes was documentyd 'n NUREG/CR-3480.12'3 Based on the recommendations maoe in NUREG/CR-1161, NU E /CR-3480 additional staff work discussed in the regula-tory analysis (NUREG-1.!33),1244,and resolution of public comments (NUREG/CR-5347),
l the staff revised SRP12 Sections 2.5.2, 3.7.1, 3.7.2, and 3.7.3.
These SRP sections are for use in the review of future cps, PDAs, FDAs, and combined CP/0L applications under 10 CFR 52.
In addition to the SRP revisions, the staff will review the seismic adequacy of the large, above ground vertical tanks at the four nuclear stations outlined above.
A discussion of the basis for the selection of these sites is included S NUREG-1233.
If the licensee reponses to the NRC's request indicate that tt2se tanks do not meet the pro-posed criteria, plant-specific backfits will be considered under 10 CFR 50.109, The Commission was informed of the staff's resolution in SECY-89-296.224s Thus, the issue was RESOLVED and new requirements were established.124c REFERENCES 2,
NUREC-0371, " Task Action Plans for Generic Activities (Category A),"
U.S. Nuclear Regulatory Comtrission, Noveniber 1978.
12/31/89 2.A.40-2 NUREG-0933
Revision 1
N 11.
NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Commist. ion, (1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition)
July 1981, 186. NUREG-0510, " Identification of Unresolved Safety Issues Relating to Nuclear Power Plants," U.S. Nuclear Regulatory Commission, January 1979, 1237.NUREG/CR-5420, " Multiple System Responses Program - Identification 57 Concerns Related to a Number of Specific Regulatory Issues," U.S.
Nuclear Regulatory Commission, October 1989.
1238.NUREG/CR-5347, " Recommendations Mr Resolution of Public Comments on USI A-40, ' Seismic Design Criteria,'" U.S. Nuclear Regulatory Commission, June 1989.
1239.IE Bullet.in No. 79-02, " Pipe Support Base Plate Designs Using Concrete 1979, (Revision 1) June 20, 1979, (Revision 2) y Commission, March 8, Expansion Anchor Bolts," U.S. Nuclear Regulator November 8, 1979.
1240.IE Bulletin No. 79-14, " Seismic Analysis for As-Built Safety-Related Piping, Systems," U.S. Nucleac Regulatory Commission, July 2,1979, (Revision 1) July 18, 1979.
1241.IE Bulletin No. 80-11, " Masonry Wall Design,d U.S. Nuclear Regulatory Commission, May 8, 1980, 1242.NUREG/CR-1161, " Recommended Revisions to Nuclear Regulatory Commission Seismic Design Criteria," U.S. Nuclear Regulatory Commission, May 1980, 1243.NUREG/CR-3480, "Value/ Impact Assessment for Seismic Design Criteria USI A-40," U.S. Nuclear Regulatory Commission, August 1984.
1244.NUREG-1233, "Negulatory Analysis for USI A-40, ' Seismic Design Criteria,'"
U.S. Nuclear Regulatory Commission, September 1989.
1245.SECY-89-296, " Unresolved Safety Issue A-40, ' Seismic Design Criteria,'"
September 22, 1989.
4246. Federal Register Notice 54 FR 40220, " Issuance and Availability Final Resolution of Unresolved Safety Issue (USI) A-40; Seismic Design Criteria," September 29, 1989.
OO 12/31/89 2.A.40-2 NUREG-0933
Revision 1
,.e t
)
'V ITEM A-47:
SAF_ETY IMPLICATIONS OF CONTROL SYSTEMS I
DESCRIPTION Nuclear power plant instrumentation and control systems are composed of safety-related protection systems and non-safety-related control systems.
The safety-related protection systems are designed to satisfy the General Design Criteria identified in Appendix A to 10 CFR 50.
They are used in part to trip the reactor when certain plant parameters exceed allowable limits and to protect the core from overheating by actuating euergency core cooling systems.
Non-safety-related control systems are used to maintain the plant within prescribed pressure and temperature limits during shutdown, startup, and normal power operation.
The non-ssfety-related contr:1 systems are not relied on to perform any safety functio 9s during or following postulated transients or accidents.
They are used, nowever, to control plant processes that could have an impact on plant dynamics.
This issue was cr hinally identified in NUREG-03712 and was later determined to be a USI in NURl!G-0705.44 l
l CONCLUSION The purpose of USI A-47 was to perform an in-depth review of the non-safety-related control systems and to assess the effect of control system failures on p) plant safety.
To this end, tasks were istablished to identify potential control (V
system failures that, either singly or m selected ccmbinations could cause overpressure, evercooling overheating, overfilling,orreactivItyevents.
ThestaffconcludedfromItsinvestigationsthatcertainactionsshouldbe l
l taken to enhance safety 'in LWRs and re',ommended that plants:
(1) provide systems to protect against rmtm v:,ssel/ steam ganerator overfill events and i
l to prevent steam generator dryout; (2) include in their plant procedures and l
their Technical Specifications provisions to periodically verify the operability of these systems; and (3) modify selected emergene,y procedures to ensure safe plant shutdown following a small-break LOCA.
Mest deaign protection against control system failures. plants already have substantial The recommended safety l
improvements would apply to those plants for %ich additional or enhanced l
protection is warranted.
The staff's technical findings were published in NUREG-1217;2847 the regulatory l
analysis associated with the resolution of this issue was published in NUREG-1218.tasa The Commission was informed of the staff's resolution in SECY-89-2551249 and Generic Letter 89-1912so was later issued to licensees.
Thus, this issue was RESOLVED and new requirements were established.1261 1
REFERENCES 1
2.
NUREG-0371, " Task Action Plans for Generic Activities (Category A),"
U.S. Nuclear Regulatory Commission, November 1978, 44.
NUREG-0705, " Identification of New Unresolved Safety Issues Relating to O
Nuclear Power Plant Stations," U.S. Nuclear Regulatory Commission, (j
March 1981.
12/31/89 2.A.47-1 NUREG-0933
Revision 1 1247.NUREG-1217. " Evaluation of Safety Implications of Control Systems in LWR Nuclear Power Plants," U.S. Nuclear Regulatory Commission, June 1989.
1248.NUREG-1218 " Regulatory Analysis for Resolution of USI A-47," U.S.
Nuclear Regulatory Commission, July 1989, 1249.SECY-89-255, " Unresolved Safety Issue A-47, ' Safety Implications of Control Systems,'" August 23, 1989.
1250.NRC Letter to All Licensees of Operating Reactors, Applicants for Operating Licenses and Holders of Construction Permits for Light Water Reactor Nuclear Power Plants, "Re of Unresolved Safety Issue A-47 ' quest for Action Related to Resolution Safety Implication of Control Systems in LWR Nuclear Power Plants' Pursuant to 10 CFR 50.54(f) - Generic Letter 89-19," September 20, 1989.
1251. Federal Register Notice 54 FR 36922. " Issuance nd Availability of NUREG-1217, ' Evaluation of Safety Implications of Control Systems in LWR Nuclear Pcwer Plants - Technical findings Related to USI A-47,' and NUREG-1218, ' Regulatory Analysis for Resolution of USI A-47,'"
September 5, 1989.
O O
12/31/89 2.A.47-2 NUREG-0933 M
1 Revision 2 Q
ISSUE 15: RADIATION EFFECTS ON REACTOR VESSEL SUPPORTS i
f DESCRIPTION l
HiscoricalBackground This issue addresses the potential problem of radiation embrittlement of l
reactor vessel support structures (RVSS).
It was originally identified as a
(
Candidate USI in NUREG-0705 where it was recommended for further study before ajudgmentwasmadeonitsdesignationasaUSI.
In a prioritization of the issue in November 1983, it was concluded that the ORE associated with resolving the issue far outweighed the potential decrease in public risk.
As a result, the issue was assigned a low priority until additional data on the problem became available that would warrant a reevaluation of the issue.
In April I
1988, data developed by ORNLissa,1264 suggested that the potential embrittle-ment of the RVSS, as a result of neutron irradiation damage, could be signifi-cantly greater than was previously anticipated.
Based on this new information, RES/MEB requested a reevaluation of the issue in September 1988.12s2 i
Neutron damage of structural materials causes embrittlement that may increase the potential for propagation of flaws that might exist in the materials.
The
(
potential for brittle fracture of these materials is typically measured in terms of the material's nil ductility transition temperature (NDTT), which is the lowest temperature at which the material would not be susceptible to failure by brittle fracture.
As long as the operating environment in wn:ch the materials are used has a higher temperature than the materials' NDTT, no failure by brittle fracture would be expected.
Manymaterials,whensubjected to neutron irradiation, experience an upward shift in the NDTT, i.e., they become more susceptible to brittle fracture at the operating temperatures of interest.
This effect should have been accounted for in the design and fabri-l cation of RVSS.
However, the ORNL research indicated that the upward shift in NDTT with increased exposure to neutron irradiation has been underestimated.
The loss in fracture toughness may result in failure of the RVSS and consequent movement of the reactor vessel, given the occurrence of a transient stress or shock such as wonid be experienced in an earthquake.
ORNL su'rveyed RVSS designs at LWRs and categorized each plant into one of five categories or types of RVSS:
(1) skirt; (2) long-column;-(3) shield-tank; (4) short-column; and (5) suspension.
Skirt type supports are located away from the core with a large volume of intervening metal and water.
Radiation l
embrittlement of skirt type RVSS is not anticipated.
Long-column type supports are located in a zone of potentially high neutron fluence and are thus l
susceptible to radiation damage.
Similarly, shield-tank supports are also located in a potentially high radiation damage zone.
Short-column type supports include several subcategories that are located in various regions relative to the reactor core.
Thus, they appear to have a wide variability in f
susceptibility to radiation damage.
Many plants with this type of support have s
special designs for heat dissipation, including natural convection, forced 12/31/89 3.15-1 NUREG-0933
Revision 2 9
convection, and water / cooling-coil designs.
The fifth category, suspension supports are employed at only one plant and, although these supports are locatedInaregionofpotentiallyhighirradiationdamage,thetemperaturemay be high enough to preclude brittle fracture.
However, for this analysis, plants employing the long-column, shield-tank, short-column, and suspension type supports are assumed to be susceptible to irradiation damage.
Safety Sianificance A large seismic event can cause failure of auxiliary piping which can result in an embrittled RVSS to fracture thereby allowing the reactor vessel to move.
Such movement can then worsen the LOCA from the rupture of auxiliary piping by ru)turing otht, piping attached to the primary coolant loop and instrument tu)ing attached to the bottom head of the reactor vessel.
Possible Solutions The proposed resolution for some plants involves the application of local heaters and insulation for the RVSS to maintain operating temperatures well above the NDTT of the potentially embrittled support.
This resolution would only involve those plants that employ long-column and shield-tank supports.
Short-column and suspension supports are in a higher temperature environment and thus heaters are not necessary to maintain the temperatures above the NDTT.
How;. r, minor design and equipment changes would be needed to control the amount of heat dissipation applied to the short-column and suspension supports to ensure the NDTT of the structural materials do not exceed the environmental temperature.
In all cases, appropriate safeguards must be installed to prevent overheating of the concrete around and in contact with the supports.
PRIORITY DETERMINATION Assumptions i
The number of potentially susceptible plaats (78) was determined from the results of the ORNL survey and are summarized below:
Number of Affected Plants Plant Type RVSS Type Operating Under Construction PWR Short-column 45 13 Long-column 10 1
Shield-tank 8
0 Sub-Total:
63 14 BWR Suspension 1
0 Total:
64 14 O
12/31/89 3.15-2 NUREG-0933 D
Revision 2 l
O The ORNL report also provided the basis for estimates of the length of ti m a plant could potentially operate in a vulnerable condition, i.e., with embrittled reactor vessel supports. The radiation embrittlement of RYSS l
materials from two operating LWRs (Turkey Point and Trojan) were investigated and data on the change in NOTT over time were developed.
The approximate time when the RVSS material is believed to become susceptible to brittle fracture occurs after 23 effective full power years.
Therefore, the potential suscepti-bility of the RVSS to brittle fracture exists for 7 years at the end of a reat. tor's operating lifetime, assuming an average operating lifetime of 30 effective full power years.
Data from the Oconee 3 and Grand Gulf 1 RSSMAP l
studies were used in this analysis to determine the estimated risk for PWRs and BWRs, respectively.
Frequency Estimate The assumed accident scenario is occurrence of a seismic event of sufficient magnitude to case fracture of an embrittled RVSS, subsequent movement of the reactor vessel, and a corresponding LOCA as attached piping ruptures.
The analogous accident sequences are those involving LOCA initiators S, Se, and 53 i
for Oconee (different initiator frequencies for three pipe diameters) and S for Grand Gulf.
These are the corresponding LOCA initiators for pipe ruptures.
However, this issue is concerned with only seismically-induced pipe ruptures, which were not addressed in the original Oconee and Grand Gulf studies.
As a O
resuit, seismically-induced LOCAs are defined here and incorporated into the base case.
The base-case frequencies of seismically-induced LOCA initiators SS, SS, SSa, 3
2 and SS are assumed to be equal, i.e., the conditional probabilities of fracturing different sizes of pipe, given an earthquake, are assumed to be equal.
Their base-case frequencies are estimated as follows:
f(SS ) = f(S$ ) = f(SSa) = f(S) = f(PGA > 0.2g) x p(NDTT) x p(PR) i 2
frequency of a seismic event with peak ground where f(PGA > 0.2g)
=
acceleration greater than or equal to 0.2g; frequency = 7 x 10 4/yr.18 conditional probability that a RVSS is p(NDTT)
=
sui,ceptible to radiation damage and fails as a result of reactor vessel movement (this value is derived below).
conditional probability of pipe rupture given p(PR)
=
movement of the reactor vessel [ assumed to be accountec for in estimate of p(NDTT);
effectively 1.0 for pipes of all diameters).
The conditional probability of failure of an embrittled RVSS as a result of a seismic event [p(NDTT)) is a function of the NDTT at the time the seismic event occurs, the number and size of preexisting flaws in the support material, and 12/31/89 3.15-3 NUREG-0933 L
Revision 2 O
the safety factor built into the design of the supports and selection of the material.
As discussed above, the RVS$ materials at some plants may exceed operating temperatures during the last 7 years of reactor operation.
Assuming that this occurs, the safety factor built into the RVSS may not exceed I whereas, using previous predictions of radiation damage, this safety factor may be as much as 20.
Using a ccerelation 2ss between safety factor and failure I
probability, PNL determined that the conditional probability of failure leading to reactor core damage for a safety factor of 1 is 0.5.
Using this value, the frequency of seismically induced LOCAs is:
f(SS ) = f(SS ) = f(SSa) = f(S) = (7 x 10 4/RY)(6 5)(1) t 2
= 3.5 x 10 4/RY PNL derived the base case frequencies by substituting the above frequency of the seismically-induced initiators into the minimal cut sets given in NUREG/CR-2800.S* The results are as follows:
Oconee SS H 3
y (PWR-3) = 1.4 x 10 8/RY s (PWR-5) = 2.0 x 10.s/RY c (PWR-7) = 1.4 x 10 6/RY SS D 2
a (PWR-1) = 2.4 x 10 7/RY y (PWR-3) = 4.8 x 10 8/RY p (PWR-5) = 1.8 x 10 7/RY c (PWR-7) = 1.9 x 10 5/RY SS FH -
y (PWR-21 2 6.0 x 10 7/RY 3
p (PWR-4; e 8.8 x 10 8/RY c (PWR-6) = 6.0 x 10 7/RY S$ FH -
a (PWR-1) = 1.1 x 10 8/RY 2
p (PWR-4) = 8.0 x 10 8/RY l
c (PWR-6) = 8.8 x 10 7/RY 55 0 2
a (PWR-1) = 1.8 x 10.s/RY y (PWR-3) = 3.6 x 10 7/RY p (PWR-5) = 1.3 x 10.s/RY c (PWR-7) = 1.4 x 10 6/RY SSs0 y (PWR-3) = 1.9 x 10 7/RY p (PWR-5) = 2.7 x 10 8/RY c (PWR-7) = 1.9 x 10 7/RY Grand Gulf S t a (BWR-1) = 1.2 x 10 8/RY 6 (BWR-2) = 1.2 x 10 8/RY O
12/31/89 3.15-4 NUREG-0933
_ _9
Revision 2
(
Summing the base case frequencies for the affected release categories, we get the following:
Oconee Grand Gulf PWR-1 = 2.7 x 10 7/RY BWR-1 = 1.2 x 10 8/RY PWR-2 = 6.0 x 10 7/RY BWR-2 = 1.2 x 10 8/RY PWR-3 = 6.8 x 10 8/RY PWR-4 = 1.7 x 10 8/RY PWR-5 = 2.2 x 10 7/RY PWR-6 = 1.5 x 10 8/RY PWR-7 = 2.2 x 10 5/RY Based on the above data, tha base case affected core-melt frecuency is 3.1 x 10 5/RY for PWRs and 1.2'x 10 8/RY for BWRs.
The possible solutions were assumed to eliminate the potential for radiation embrP tlement of RVSS materials.
Thus,theadjustedcasecore-meltfrequency is essentially zero and the potential reduction in core-melt frequency is 3.1 x 10 5/RY for PWRs and 1.2 x 10 8/RY for BWRs.
Consequence Estimate i
In order to obtain the conrequences associated with this issue, the CRAC Code 84 was used.
An average population density of 340 persons per square mile was assumed (the average for U.S. domestic sites) from an exclusion area one-half mile about the reactor out to a 50-mile radius.
A typical midwest site meteorology was also assumed.
Based on these assumptions, the risk for each Release Category is stated in Appendix 0 of NUREG/CR-2800.84 Using the frequency estimates derived above, the total estimated risk from the base case is 41.6 man-rem /RY from PWRs and 8.6 man-rem /RY for BWRS.
Since the possible solutions are assumed to eliminate the potential for radiation embrittlement of RVSS materials, the adjusted case risk is essentially zero.
The risk reduction associated with this issue is as follows:
PWRs:
(41.6 man-rem /RY)(77 reactors)(7 years)
= 22,400 man-rem BWRs:
(8.6 man-rem /RY)(1 reactor)(7 years)
= 60 man-rem j
Therefore, the total potential risk reduction is 2.24 x 104 man-rem.
Cost Estimate Industry Cost:
At operating plants, the solution consists of controlling the temperature of the RVSS, either through application of local heaters and 12/31/89 3.15-5 NUREG-0933
Revision 2 2
insulation or through controlling cooling systems that are already in place, to ensure that the temperatures of the structural materials do not fall below the
~
materials' NOTT af ter irradiation embrittlement.
At future plants, the use of nonsusceptible materials is the proposed resolution.
Since this can be accommodated during the design and construction stages of a plant, no additional costs are foreseen beyond those normally incurred during design and 4
construction.
Affected backfit plants are assumed to implement the resolution after about ten years of reactor operation.
It is furthea assumed that only plants with u
long-column and shield-tank type supports will install and operate local heaters and insulation on their RVSS.
The plants with suspension ana short-column type supports are assumed to implement measures to control or limit cooling of the RVSS.
Affected forward-fit plants wili implement the
-=
solution before fuel is loaded into the core.
The following is a break-down l
of the solutions at the 78 affected plants:
W PWRs:
(1) Backfit Heaters 18 Cooling Control 45 (2) Forward-fit 14 BWRs:
Backfit (cooling) 1 For plants with long-column and shield-tank type supports, it is assumed that heaters will be attached to four rev. tor vessel support columns and that mounting hardware, metal-sheathed heating cables, switchgear, transformers, and a power controller will be installed.
It is also assumed that the equipment will be installed during scheduled reactor outages.
Therefore, no additional replacement power costs would be necessary, It is further assumed that access to the reactor cavity is possible for heater installation.
PNL estimated the E:;uipment cost to be $52 000/ plant; labor associated with installation of this equipment was estimated to be 105 man-weeks / plant.
At a cost $2,270/ man seek, the installation cost for heaters will be (105 man-week / plant)($2,270/ man-week)=$245,000/ plant.
An additional cost of
=
$26,000/ plant is estimated for a Class V amendment.
Therefore, the total implementation cost for those plants that will use heaters is $320,000/ plant.
For plants with short-column and suspension type supports that will utilize cooling methods, it is assumed that equipment and labor requirements are 10%
of that estimated for application of local heaters and insulation.
In this case, PNL estimated the equipment cost to be $5,200/ plant; labor associated with installation of this equipment was estimated to be 10.5 man-weeks / plant.
At a cost of $2,270/ man-week, the installation cost for cooling will be (10.5 man-weeks / plant)($2,270/ man-week) = $25,000/ plant.
The Class V licence amendment fee of $26,000/ plant will also be applicable.
Therefore, the total implementation cost for those plants that will use cooling is $56,000/ plant.
Therefore, the total industry implementation cost is given by:
(18 plants)($320,000/ plant) + (46 plants)($56,000/ plant) = $8.34M.
12/31/89 3.15-6 NUREG-0933
Revision 2 O
PNL calculated that operation and maintenance costs will be $130,000/RY for those plants that use heaters and $7,100/RY for those that use cooling.
Therefore, the total operation and maintenance cost over the 7-year vulnerability period for the affected reactors is given by:
(18 plants)(7 years)($130,000/RY) + (46 plants)(7 years)($7,100/RY) = $18.7M.
The total industry cost for implementation, operation, and maintenance of the possible solutions is $(8.34 + 18.7)M or $27M.
NRC Cost: PNL estimated that it would require 16 man-weeks of staff effort to l
develop the possible solutions.
At a rate of $2,270/ man-week, this amounts to
$36,000; contractor support is expected to cost an additional $500,000.
Therefore, the total NRC development cost is estimated to be $536,000, i
NRC effort to support industry implementation of the solutions is estimated to be 15 man-weeks / plant for those with heaters and 2 man-weeks / plant for those with cooling.
Assuming a rate of $2,270/ man-week, the total NRC implementation costs are:
$2,270((18 plants)(15 man-wk/ plant) + (46 plants)(2 man-wk/ plant)] = $822,000.
NRC review time for operation and maintenance is estimated to be 1 man-week /RY for all affected plants.
At a cost of $2,270/ man-week, the total NRC cost for review of operation and maintenance of the possible solutions over the 7-year A
vulnerability period is g(iven by:(64 plants)(7 years) $2,270/RY) = $1.02M
! )
Therefore, the total NRC cost for development, implementation, operation, and maintenance of the possible solutions is given by:
$(536,000 + 822,000 + 1,020,000) = $2.4M Value/ Impact Assessment Based on a potential risk public reduction of 2.24 x 104 man-rem and a co eived industry and NRC cost of $22.1M, the value/ impact score is given by:
g _ 2.24 x 104 man-rem
~
529.4M 762 man-rem /$M
=
Other Considerations No occupational dose will be incurred during implementation, operation, and maintenance of the solutions at forward-fit plants.
Based on a radiation field of 100 millirem /hr in the vicinity of the reacter vessel, PNL estimated the I
total occupational dose increase of the 64 backfit plants to be 1880 man-rem.
Operation and maintenance of the solutions at these plants are estimated to result in an additional risk of 5100 man-rem.
Thus, the total occupational dose
~
increase from implemeatation, operation, and maintenance of the possible y
solutions is estimated to be 7000 man-rem.
l 12/31/89 3.15-7 NUREG-0933 l
r-m.
Revision 2 I
O Occupational dose reduction due to accident avoidance will be realized at the forward-fit plants, as well as at backfit plants, over the last 7 years of reactor operation.
The occupational dose reduction due to accident avoidance was calculated to be 330 man-rem for all 78 affected plants.
CONCLUSION Based on the potential public risk reduction and value/ impact score, the issue would have a medium priority ranking.
Consideration of the net occupational dose increase associated with the possible solutions does not change tfis coa-clusion.
However, because the change in core-melt frequency from implementation of the proposed solutions was estimated to be 3.1 x 10 5/RY for 99% of the affected plants (PWRs), this issue was given a HIGH priority ranking.
Work completed by the staff in resolving this issue has led to the preliminary conclusion that the potential problem does not pose an immediate threat to public health and safety.
This conclusion was reported to the Commission in SECY-89-180"56 in June 1989.
Further studies performed by the staff since that time have supported this position.
Preliminary results from a new theoretical model for determining damage by low energy neutrons show that the large NDTT shifts previously observed may be a function of the particular neutron energy specturm to which the steel sampes were exposed.
Data from the High flux Isotope Reactor (HFIR) surveillance program and from the neutron shield tank of the decommissioned Shippingport reactor were normalized to the same trend curve established from samples irradiated in materials test reactors.
Extrapolation along the trend curve of NOTT change against exposure suggests that end-of-life values for RVSS would be on the order of one-third or one-fourth the value obtained by extrapolation of the HFIR data when plotted against traditional measures of neutron exposure.
Substantiation of t1ese results would allow the staff to conclude that the predicted degradation in RVSS toughness (fracture resistance) will be insufficient to cause concern during the current 40 year license lifetime.
The situation during possible life extension is unclear at this time.
Additionally, preliminary results from the analysis of the Trojan plant indicate that RVSS failure will not cause failure of the reactor coolant system piping or reactor vessel in the event of an SSE or guillotine break in the pressurizer surge line.
However, the ability of the control rods to scram and the integrity of instrument lines connected to the bottom of the reactor vessel under these conditions are yet to be confirmed.
TheTrojanRVSSis bein studied because of its configuration and certain significant design and fabr. cation details.
The staff considers the Trojan RVSS to be among the most vulnerable to failure under accident loads.
The above tentative results indicate that this issue will be resolved on the basis that plant safety can be maintained despite RVSS radiation damage.
- However,
. extensive confirmatory analyses need to be performed to support this preliminary conclusion.
12/31/89 3.15-8 NUREG-0933
i
/
Revision 2 d
i REFERENCES WASH-1400 (NUREG-75/014), " Reactor Safety Study',U.S. Nuclear Regul 16.
An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, Commission, October 1975.
44.
NUREG-0705, " Identification of New Unresolved Safety Issues Relating to Nuclear Power Plant Stations," U.S. Nuclear Regulatory Commission, June 1981.
64.
NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," U.S. Nuclear Regulatory Commission, February 1983, (Supplement 1) May 1983, (Supplement 2)
December 1983, (Supplement 3) September 1985, (Supplement 4) July 1986, 1252. Memorandum for T. King from C. Serpan, " Reevaluation of It, sue 15,
' Radiation Effects on Reactor Vessel Supports,'" September 30, 1988.
1253.0RNL/TM-10444, " Evaluation of HFIR Pressure-Vessel Integrity Considering Radiation Embrittlement," Oak Ridge National Laboratory, April 1988.
1254.NUREG/CR-5320, " Impact of Radiation Embrittlement on Integrity of Pressure Vessel Supports for Two PWR Plants," U.S. Nuclear Regulatory Commission, January 1989.
V 1255.UCLA-ENG-76113. "Some Probabilistic Aspects of the Seismic Risk of Nuclear Reactors," University of California, Los Angeles, December 1976.
1256.SECY-89-180, " Generic' Safety Issue 15, ' Radiation Effects on Reactor l
Vessel Supports,'" June 13, 1989.
Ib.
12/31/89 3.15-9 NUREG-0933
Revision 1 O
ISSUti 51:
PROPOSED REQUIREMENTS FOR IMPROVING THE RELIABILITY OF OPEN CYCLE SERVICE WATER SYSTEMS DESCRIPTION Historical Backaround This issue was raised in a DL memorandumM to DST in March 1982 and addrei, sed the subject of service water system (SWS) fouling at operating plants primat ily by aquatic bivalves.
Prior to and following this memorandum, AE00 reports on fouling of open cycle water systems were prepared for Arkansas Nuclear One and Brunswick,72 Pilgrim,75 and Sequoyah.480 The following is a summary of reported events of serious fouling in open cycle water sytems:
(1) Arkansas Nuclear One, Unit 1 (ANO-1) failed a technical specification surveillance test of a containment fan cooler unit d9e to buildup of Asiatic clams (corbicula).
(2) Brunswick 1 and 2 reported that 3 of the 4 RHR heat exchangers had experienced baffle plate displacement due to a buildup of oysters.
Pilgrim reported that the baffle plate of a component cooling) water j
(3) heat exchanger was displaced by a buildup of mussels (mytilus.
(4) San Onofre 1 reported that a buildup of barnacles prevented proper
,A cooling of a component cooling water heat exchanger.
(5) Rancho Seco reported that a buildup of corrosion products prevented proper cooling of a diesel generator lube oil cooler, j
(6) Sequoyah Unit I reported flow blockage in the emergency raw coolir.g water system due to Asiatic clams.
As a result of the NRC concern for the effects on safety of o>en cycle water system fouling, IE Bulletin 81-03 was issued.
Responses to t11s bulletin revealed that bivalves were observed at approximately 45% of all sites.
The following related issues have been combined with the issue of whether or not the staff should develop requirements for improving the reliability of open cycle water systems:
Issue 32, " Flow Blockage in Essential Equipment Caused by Corbicula," and Issue 52, "SSW Flow Blockage by Blue Mussels."
Safety Sionificance The SWS is the ultimate heat sink that, during an accident or transient, cools the reactor building component cooling water heat exchangers, which in turn cool the RHR heat exchangers as well as provide cooling for safety-related pumps and area cooling coils.
Fouling of the safety-related SWS either by mud, silt, corrosion products, or aquatic bivalves has led to plant shutdowns, 12/31/89 3.51-1 NUREG-0933
Revisien 1 reduced power operation for repairs and modifications, and degraded modes of rperation.
Possible Solution The AE00 report?2 on ANO-1 and Brumwick concluded that improvements of surveil-lance and preventive maintenance programs at sites where bivalves are known to exist could significantly improve SWS reliability.
PRIORITY DETERMINATION Assumptions In the analysis of this issue, the following assumptions were made:
(1) The total number of affacted plants include those plants that contain any of the following organisms in their water body:
Asiatic clams, blue mussels, American oysters, or barnacles.
Plants both with and without biofouling detection and prevention methods are included.
(2) Fouling conditions anywhere within the SWS would increase the proba-bility of failure of the entire system, probability being based on the historical rate of shutdown at operating plants due to biofouling.
This systematic approach does not directly address the problems of fouling locations.
Frequency Estimate An RES study 428 of biofouling shows that there are 108 plants affected by this issue:
48 backfit and 60 forward-fit.
Of the 48 backfit plants, the
$ are 31 PWRs with an average remaining life of 27.7 years and 17 BWRs with an average remaining life of 25.2 years.
Of the 60 forward-fit plants with a remaining life of 30 years, there are 39 PWRs and 21 BWRs.
A review <2s of LER data performed by RES shows that 7 observed failures of both redundant SWS trains have been recorded.
These failures occurred at ANO-1 (2), Brunswick (2), Pilgrim (1), Browns Ferry (1), and Millstone (1).
An additional 19 biofouling events have been reported but not in both trains.
Based on the 48 operating plants (31 PWRs and 17 BWRs) affected by this issue, I
the failure probability due to biofouling (A) is given by
{
A = 7/[(31)(30 - 27.7)+(17)(30 - 25.2)]RY
= 4.58 x 10 2/RY Data from Brunswick and Pilgrim show that the time (t) to observe a failure in the SWS has a mean value of 3 months or 0.25 year.
From the ANO-1 risk study, a common-cause parameter (Z), representing loss of SWS due to biofouling, was defined as the affected parameter for the resolution of this issue.84 Therefore, re-defining Z, based on the above RES data, Z = (A)(t)
= (4.58 x 10 2/RY)(0.25 yr)
= 1.145 x 10 2 12/31/89 3.51-2 NUREG-0933
Revision 1 p
RES calculations ts show that the affected accident sequences in the ANO-1 4
(v) risk study are B(1.2)D, B(1.2)D 0, B(4)H, T (001)L0 YC, and B(1.66)H.
i i
i t
i Substitution of the above Z value in the affected minimal cut sets for these accident sequences yields a base case core-melt frequency of 2.1 x 10 8/RY.
In a PNL analysit N O this issue, data from ANO-1 and Grand Gulf 1 were scaled in order to obtain th quency data for BWRs.
This resulted in a BWR core-melt frequency of 0.74 of that for PWRs.
Thus, the base case core-melt frequency for BWRs is (0.74)(2.1 x 10 8/RY) or 1.6 x 10 6/RY.
It is assumed that the proposed solution will effectively eliminate the problem of SWS failure due to biofouling.
Therefore, the total reduction in core-melt frequency is then 2.1 x 10 8/RY and 1.6 x 10 8/RY for PWRs and BWRs, respectively.
Consequence Estima>
The affected release categories in the ANO-1 risk study are PWR-1, 2, 4,is 5,
6, and 7.
From the RES analysis,4 s the base case public risk for PWRs 4.65 man-rem /RY assuming a typical midwest plain meteorology and a uniformpopulatIondensit data performed by PNL S* y of 340 people per square mile.From the scaling of the affected public risk for BWRs was calculated to be greater than that for PWRs by a factor of 2.5.
Thus, the affected public public risk for BWRs is (2.5)(4.65) man-rem /RY or 11.63 man-rem /RY.
Assuming that the proposed solution would effectively eliminate the problem of SWS failure due to biofouling at all affected plants, the total public risk (6W) for each type of plant is as follows:
(G, (a) For PWRs, AW = [(31)(27.7)+(39)(30)]RY x 4.65 man rem /RY
= 9,433 man-rem (b) For BWRs, 6W = [(17)(25.2)+(21)(30)]RY x 11.63 man-rem /RY
= 12,309 man-rem Therefore, the total public risk reduction associated with this issue is esti-mated to be approximately 22,000 man-rem.
Cost Estimate Industry Cost:
From the PNL analysis,64 the cost of implementing the solution at all 60 forward-fit plants is estimated to be $714,000/ plant.
This estimate includes technical support, installation of strainers chlorination units, monitoring equipment, mechanical cleaning access ways,for coolers where flush-ing i. ineffective, and labor.
The cost of implementing the solution at all 48 backfit plants is estimated to be $256,000/ plant and includes technical support, upgrading of equh ment, and labor.
Therefore, the total industry implementation cost is $[(60)(0.714)+(48)(0.256)]M or approximately $55M.
It is estimated that, as a result of improved biofouling detection methods, indus-try monitoring efforts would have to be increased over their p/RY for resent levels in order to keep SWS biofouling at a minimum.
Assuming 60 man-hr this effort, the total industry cost for increased monitoring is estimated to be $10.5M.
Industry cleaning costs are not expected to change.
l 0v 12/31/89 3.51-3 NVREG-0933
1 Revision 1 NRC Cost:
NRC time for the review and development of the solution is estimated to take 10 man-weeks at a cost of $22,700.
Technical support by a contractor r
is estimated to cost the NRC an additional $251,000.
NRC support for implemen-tation of the solution is estimated to be 2 man-wk/ plant for a total cost of
$490,000 for all 108 plants.
NRC review of the operation and maintenance of l
the solution is expected to take 0.2 aan-wk/RY over an effective average l
plant life of 5 years.
The cost for this effort is $245,000 for all 108 plants.
Therefore, the total NRC cost is $[0.023 + 0.251 + 0.49 + 0.245]M or $1M.
Total Cost:
The total cost associated with the possible solution to this issue Ts s(55 + 30.5 + 1)M or $66.5M.
Value/ Impact Assessment Based on a potential risk reduction of 22,000 man-rem and a cost of 566.5M, the value/impfct score is given by:
3,22,000 man-rem i
566.5M
= 331 man-rem /$M Other Considerations (1) Installation of monitoring equipment is estimated to result in a radiation exposure of approximately 1 man-rem / plant.
For 48 backfit plants, the total occupational dose increase from implementing the solucion is 48 man-rem.
(2) Operation and maintenance doses resulting from increased monitoring are expected to increase approximately 0.15 man-rem /RY after implementa-tion of the solution.
This amounts to a total occupational dose increase of.463 man-rem for the remaining life of the 108 affected plants.
(3)
It is estimated that implementation of the possible solution in the affected plants can produce cost savings to licensees by reducing the 4
down-time that would be caused by SWS flow blockage.
If each of the 108 affected plants were to avert only 3 days of down-time thereby saving about $1M each, the implementation cost would be offset.
CONCLUSION Based on the total public risk reduction and the value/ impact score, this t
issue was given a medium priority ranking.
In resolving the issue, the staff studied the conditions that allow fouling and compared alternative surveiliance and control programs to minimize service water system fouling.
The staff's technical findings were published in NUREG/CR-52101257 and th value/ impact analys:s was published in NUREG/CR-5234.12sa l.
The recommended solution to the issue was the implementation of a baseline fouling program which was issued to licensees in Generic Letter No. 89-13.12ss Thus, this issue was RESOLVED and requirements were established.12eo L
12/31/89 3.51-4 NUREG-0933
Revisien 1 REFERENCES 64.
NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," U.S. Nuclear Regulatory Commission, February 1983, (Supplement 1) May 1983, (Supplement 2)
December 1983, (Supplement 3) September 1985, (Supplement 4) July 1986.
71.
Memorandum for S. Hanauer from D. Eisenhut, " Proposed Recommendations for Improving the Reliability of Open Cycle Service Water Systems,"
March 19, 1982.
72.
AE00/C202, " Report on Service Water System Flow Blockages by Bivi.ite l
i Mollusks at Arkansas Nuclear One and Brunswick," Office for Analysis and j
Evaluation of O February 1982. perational Data. U.S. Nuclear Regulatory Commission.
75.
Memorandum for H. Denton from C. Michelson, " Engineering Evaluation of the Salt Water System (SSWS) Flow Blockage at the Pilgrim Nuclear Power Station by Blue Mussels (Mytilus Edilus)," May 6, 1982.
428. Memorandum for W. Minners from P. Hayes, " Generic Safety Issue No. 51, Improved Reliability of Open Service Water Systems," April 5, 1983.
i 430. Memorandum for K. Seyfrit from E. Imbro " Flow Blockage in Essential Raw Cooling Water System Due to Asiatic Clam Intrusion," March 28, 1983.
r 1257.NUREG/CR-5210. " Technical findings Document for Generic Issue 51:
(
Improving the Reliability of Open-Cycle Service-Water Systems," U.S.
Nuclear Regulatory Commission, August 1988.
1258.NUREG/CR-5234, "Value/ Impact Analysis for Generic Issue 51:
Improving the Reliability of Open-Cycle Service-Water Systems," U.S. Nuclear Regulatory Commission, February 1989.
1259.NRC trtter to All Holders of Operating Licenses or Construction Permits for Nuclear Power Plants, " Service Water System Problems Affecting Safety-Related Equipment (Generic Letter 89-13)," July 18,1989.
1260. Memorandum for J. Taylor from E. Beckjord, " Closeout of GI-51, '"
' Improving the Reliability of Open-Cycle Service Water Systems, August 10, 1989.
L O
12/31/89 3.51-5 NUREG-0933 L
Revision 1 O
ISSUE 103:
DESIGN FOR PROBABLE MAXIMUM PRECIPITATION DESCRIPTION Historical Backaround The issue of tsing the most recent NOAA procedures for determining probable maximum precipitation (PMP) was raised 683 after an OL applicant disputed the NRC use of NOAA Hydrometeorological Report (HMR) Nos. 51 and 52,684 published in June 1978 and August 1982, respectively.
The PHP values are used in estimat-ing design flood levels at reactor sites.
It was the contention of the appli-cant that the use of HMR-52, which in general results in higher flood levels thanthoseobtainedusingearlierreports,wasinagpropriateandconstitutedan unauthorized backiit under NRC procedures. HMR-516 6 issued by NOAA in June 1978 expanded the information previously presented in HMR-33686 (cited in SRP11 Sec-tion 2.4.2).
This expansion extends the precipitation duration from 48 to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and increases the drainage areas from 1,000 to 20,000 square miles.
In addition to other provisions, HMR-52esi provides techniques for analyzing PHP for drainage areas of I square mile and durations of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and less.
GDC-2 requires that design bases for floods reflect consideration of the most severe historical data with sufficient margin for the limited accuracy, quantity, and period of time in which data have been accumulated.
Guidance on what con-stitutes sufficient margin is contained in Regulatory Guides 1.59ss7 and 1.102.ssa These documents state that the appropriate design basis for precipitation-inded flooding is t% probable maximum flood (PMF) as developed by the U.S. Arr/ Corps of Engineers.
This PMF criterion has been used by NRC since 1970.
Thus, in the case of floods, the PMF is the crf %eion that has been used to reet GDC-2.
Procedures for estimating PMFs are given in Appendices A and B of Regulatory Guide 1.59ss7 (Appendix A has since been superseded by ANSI N170-1976). ANSI N170-1976 defines PMF as a hypothetical flood that is considered to be the most severe reasonably possible, based on comprehensive hydrometeorological applica-tion of PHP and other hydrologic factors favorable for maximum flood runoff.
Thus, PMP is an integral component of PMF determination.
Section 5.2 of ANSI N170-1976 states that PMP estimates for the U.S. are available in generalized studies prepared by the National Weather Service (NWS); these estimates are pre-sented in varying degrees of completeness.
Specific PMP estimates for areas not i
adequately covered by thaec studies may be made by using techniques similar to those employed by k.%'5.
Recognizing the importance of using the most recent engineering technology in evaluating the potential impacts on reactor site safety, SRP11 Section 2.4.2 was written to allow "... improvements in calculational methods..." With the publi-cation of HMR-51685 and HMR-52,684 OL applicants were requested by the staff to essess the effects of their use on plant safety.
O 12/31/89 3.103-1 NVREG-0933 l
Revision 1 Safety Significance Improper drainage at reactor sites during heavy rainfalls can lead to flooding that can render safety-related equipment inoperable.
Possible Solutig In all cases reviewed by the staff against HMR-51 and HMR 52, the issue has been resolved by the applicants taking the following actions:
(1) site drain-age has been designed to handle the increased design basis precipitation; (2) commitments were made to develop proceduros to assure that critical entrances to buildings will be closed; and (3) curbs were installed at critical entrances.688 In order to clarify the staff's position and remove ambiguities from the SRP,11 it will be necessary to revise SRP11 Sections 2.4.2 and 2.4.3.
This solution will be a forward-fit and will incorporate the most recent tech-nical advances for determining PHP that are known at the time that the SRP revi-sion is made.
Future technical advances in the determination of PMP will also require revisions to the SRP.
PRIORITY DETERMINATION No quantiative analysis of the issue was made because work on the final solution was underway at the time the issue was evaluated.
CONCLUSION Ouring the course of resolving this issue the staff suspended 680 routine requestsofNTOLapplicantstoreviewtheIrsitefloodingassessmentsunder the updated NWS guidelines of HMR-51 and HMR-52.
Af ter CRGR review,681 SRP11 Sections 2.4.2 and 2.4.3 were revised in 1989 to incorporate the PMP procedures and criteria contained in the latest NWS publications.1261 In addition, Generic Letter 89-22:2c2 was also issued to inform OLs and cps of the resolution of the issue.
Thus, this issue was RESOLVED and new requirements were established.i2sa REFERENCES 11.
NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition) July 1981.
683. Memorandum for W. Johnston from R. Ballard, " Disputed Procedures for Esti-mating Probable Maximum Precipitation," January 13, 1984.
684. Hydrometeorological Report No. 52, " Application of Probable Maximum Pre-l cipitation Estimates - United States East of the 105th Meridian," U.S.
Department of Commerce, National Oceanic and Atmospheric Administration, August 1982.
685. Hydrometeorological Report No. 51, " Probable Maximum Precipitation Esti-mates, United States East of the 105th Meridian," U.S. Department of Commerce, National Oceanic and Atmospheric Administration, June 1978.
O 12/31/89 3.103-2 NUREG-0933
i Revision 1 I
686. Hydrometeorological Report Nu. 33, " Seasonal Variation of the Probable (n
Maximum Precipitation East of the 105th Meridian for Areas from 10 to V) 1,000 Square Miles and Durations of 6, 12, 24 and 48 Hours," U.S. Depart-ment of Commerce, April 1956.
t 687. Regulatory Guide 1.59, " Design Basis floods for Nuclear Power Plants,"
U.S. Nuclear Regulatory Commission, August 1977.
688. Regulatory Guide 1.102, " Flood Protection for Nuclear Power Plants," U.S.
Nuclear Regulatory Commission, September 1976.
689. Memorandum for V. Stello from H. Denton, " Potential Generic Requirement Concerning Design for Probable Maximum Precipitation," June 25, 1984.
t 690. Memorandum for V. Stello from H. Denton, " Generic Requirements Regarding Design for Probable Maximum Precipitation," October 10, 1984.
691. Memorandum for H. Denton fr om V. Stello, "Generb Requirements Regarding Design for Probable Maximum Precipitation," August 8, 1984.
1261. Federal Register Notice 54 Fd 31268, "' Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants;' Issuance and Availability Revised SRP Sections 2.4.2 and 2.4.3," July 27, 1989.
1262.NRC Letter to All Licensees of Operattng Reactors and Holders of Construction Permits, " Potential for Increased Rsof Loads and Plant Area
(]
Flood Runoff Depth at Licensed Nuclear Power Plants Due to Recent Change
, (')
in Probable Maximum Precipitation Criteria Developed by the National i
Weather Service (Generic Letter 89-22)," October 19, 1989.
1263. Memorandum for J. Taylor from E. Beckjord, "Close-out of Generic Safety Issue No. 103, ' Design for Probable Maximum Precipitation,'" November 28, 1989.
k V
l 12/31/89 3.103-3 NUREG-0933
Revision 6 n
ISSUE 125:
DAVIS-BESSE LOSS OF ALL FEEDWATER EVENT OF JUNE 9, 1985 - LONG TERM ACTIONS On June 9, 1985, Davis-Besse had a partial loss of feedwater while operating at 90% power, following a reactor trip, the loss of all feedwater occurred.
The two OTSGs became dry and were inef fective as a heat sink.
Consequently, the RCS pressure increased indicating a lack of heat transfer from the primary to secondary coolant systems.
The PORV automatically opened and closed twice during the event upon reaching the approximate pressure setpoints; it opened a third time, but did not close for some unknown amount of time.
The delayed response to close the third time aggravated the recovery of the event and allowed a rapid depressurization of the RCS, In addition to the short-term actions identified and addressed in Issue 122, a staff report on the event was published in NUREG-1154886 and an E00 memoran-dum885 identifying 29 NRR action items was issued on August 5, 1985.
These items became known as long-term generic actions and, in November 1985, were forwarded by DL to OST for prioritization.640 The items were broken down into two groups:
(I) Issues raised in NUREG-1154 and the E00 memorandum; and (II) Other Issues.
These 29 items are prioritized separately below and are identified by the num-bering system established in the DL memorandum.040
/
ITEM 125.1.1:
AVAILABILITY OF THE SHIFT TECHNICAL IDVISOR (O)
DESCRIPTION j
Historical Background This issue was identified as Item 5 in the E00 memorandumaos and is based on finding 14 and Section 6.1.3 of NUREG-1154.88" During the event, neither the shift supervisor nor any of the other licensed operators requested the assist-ance of the shif t technical advisor (STA).
One reason for not doing so was the fact that the STA was not in the control room or immediately available when the event occurred, but rather was on an on-call status.
(Note:
An STA is allowed 10 minutes to reach the control room af ter being called.) Moreover, the event occurred so rapidly that it was essentially over when the STA did arrive.
STAS were first required as part of the TMI Action Plan Item I.A.I.1, " Shift Technical Advisor." The purpose of the STA was to provide readily available technical support to the plant operators.
The STA's expertise was intended to aid in the mitigation of those transients and accidents which involve complex thermal-hydraulic behavior in the primary and secondary coolant systems.
In summary, having the STA available was a post-TMI improvement to provide the shif t supervisor with additional technical expertise, but his potential assistance and guidance was not available nor required during this event.aso G
l 12/31/89 3.125-1 NUREG-0933
Revision 6 Safety Significance The safety question posed t,y this issue is whether the STA should be in the control room, or immediately available, to support the shift supervisor rather than being on an on-call status.
CONCLUSION One year after the Davis-Besse incident, the staff conducted a survey to fulfill a Staff Requirements Memorandum to provide the Commissioners with the implementation results of the Commission Policy Statement on engineering exper-i tise on shift and reported their findings in SECY-86-231. tors This survey found that there were only three plants that did not have "on-shift" STAS.
On-shift STA means that there is an STA, or an STA qualified SRO, in or near the control room on a shift basis during operations.
The STA shift may or ma not ccrrespond to the same shift times and length as the licensed operators' y shift.
It further means that the STA does not work on an extended assignment period, e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, during which-time the STA is provided quarters to rest during a portion of his extended duty and is available on an on-call basis.
Based on the staff's findingt, tora STAS are in the control room or immediately available at the majority of operating plants.
For the three plants identified with a deficiency, licensee action is being reviewed by the staff on a plant-l specific basis.
Thus, this item was DROPPED as a generic issue.
l ITEM 125.I.2:
PORV RELIABILITY The PORV common to most PWRs (with the exception of CE 3410 and 3800 Mwt plants and ANO-2) is designed to limit system pressure if a transient recovery exceeds the capability of the pressurizer spray system.
Davis-Besse has a solenoid-controlled PORV.
However, many other PWRs have PORVs that are operated pneu-matica11y (instrument air or nitrogen).
Both designs have the same purpose.
The PORV is designed to receive an actuation signal to open from the pressurizer pressare instrumentation at a design setpoint (typically 2425 psig) in order to prevent reactor pressure from rising and activatil.g the code safety valves.
-If a PORV is used for feed-and-bleed, it can either be:
(1) set to stay open by the operator dropping the setpoint low enough such that the valve will remain open until reaching the lower setpoint for LPIS or RHR initiation, or (2) cycled open and closed many times, should there be a need for feed-and-l bleed.
Option 1 appears to be the more common practice.
PORVs are also used in other functions such as mitigating SGTR accidents LTOP, or RCS venting.
Its performance is required for plant protection and accident mitigation.
l The following is the evaluation of the four parts of this issue.
O 12/3)/89 3.125-2 NUREG-0933
Revision 6
( ~x ITEM 125.1.2.A:
NEE 0 FOR A TEST PROGRAM TO ESTABLISH RELIABILITY OF THE PORV
~
\\
)
v' DESCRIPTION Historical Background This issue was identified as Item 9c in the EDO memorandumsos and is based on Finding 13 and Section 5.2.8 of NURE0-1154.888 Safety Significance Although the PORV can be used successfully in recovering from certain plant transients, asethere has been no suitable test program established to verify its reliability.
This issue affects all PWRs that can use PORVs.
CONCLUSION The need for improving the reliability of PORVs and block valves, in light of plant protection and accident mitigation requirements, is being addressed in the resolution of Issue 70, "PORV and Block Valve Reliability." Revised licens-ing criteria may be developed, if needed, to include testing requirements.886 Therefore, this issue is covered in Issue 70.
ITEM 125.I.2.B:
NEE 0 FOR PORV SURVEILLANCE TESTS TO CONFIRM OPERATIONAL READINESS
/
DESCRIPTION
-U Historical Background This issue was identified as Item 9d in the EDO memorandum 885 and is based on Finding 13 and Section 5.2.8 of NVREG-1154.sso Safety Significance The review of the PORV maintenance and operating history reveals that the mechanical operation of the valve had not been tested and that the valve had not otherwise been operated for over 2 years and 9 months prior to the June 9, 1985 event.
Therefore, it seems that there exists a need for surveillance tests to confirm operational readiness.
This issue affects all PWRs that can use PORVs.
CONCLUSION The number of times that PORV/ Block Valves are used during a typical fuel cycle will be reviewed in the resolution of Issue 70, "PORV and Block Valve Reliabil-ity," in order to determine if a surveillance program should be initiated to confirm operational readiness.886 Therefore, this issue is covered in Issue 70.
1
\\
O 12/31/89 3.125-3 NUREG-0933 4
Revision 6 l
ITEM 125.I.2.C:
NEED FOR ADDITIONAL PROTECTION AGAINST PORV FAILURE DESCRIPTION j
Historical Background i
This issue was identified as Item 9e in the EDO memorandum 88 and is based on 8
Sections 5.2.8 and 6.2.1 of NUREG-1154.sse The PORV will receive an actuation signal from pressurizer pressure instr ~
g tion at a design setpoint (typically 2425 psig) to open in order to pr'. *r4 reactor pressure from activating the code safety valves.
Af d r the ore has reduced the pressure suf ficiently to reach its closure setpoint ' 4 2375 psig), it is sent a signal to close.
A simultaneous signal is 6.-
mi to the control room indicating to the operator that a close signal was the PORV.
PORV closure can be verified by an acoustic monitor insta11et r
tailpipe downstream of the PORV on all PWRs after the THI-2 accident.
At u -
l Besse, the PORV closure is indicated by a light located on a wall several feet from the operator's control panel.
This was available to the operator at Davis-Besse to verify whether the PORV was closed, but was not looked at.
Addi-tionally, there is the SPDS, also a post-TMI improvement, that displays a summary of the most safety significant plant status information on a TV screen.
Both channels were inoperable prior to the event.sae This left the operators with only the pressurizer pressure indicator as a source of determining if the PORV was open or closed.
Since the indicator appeared steady, the operator assumed that the PORV had closed, but closed the block valve as a precautionary measure.
In actuality, however, the PORV had not closed until some time later into the event.
Safety Significance There have been several stuck open PORVs documented due to a variety of malfunc-tions some of which were identified to be mechanical failure, broken solenoid linkage, inoperability due to corrosion buildup, and sticking caused by foreign material.sso As a precaution, the PORV block valve can be closed to insure no LOCA, but this can only be achieved if the operator closes the block valve by remote-manual operation from the control room.
In the Davis-Besse event, the operator did close the block valve to prevent a further decrease in pressure and loss of primary coolant through the PORV when it did not reseat.
Possible Solution Knowing that a stuck-open PORV may result in a potentially dangerous scenario (i.e., LOCA), this issue addresses the concern of whether there is a need for an automatic block valve closure in plants that have PORVs.
Considering available control room indicators such as an acoustic monitor, a reliable SPDS and the operator's acute sensitivity to the PORV's status because of historical events such as TMI-2 and Davis-Besse, another redundant featt!ra
.(i.e., automating the block valve) would not necessarily result in a significant decrease in core-melt frequency.
The acoustic monitor was available to the operator at Davis-Besse; the SPDS was not.
However, there is an NRC requirement for the installation of "a concise display of critical plant variables to the 12/31/89 3.125-4 NUREG-0933
i Revision 6
/^
control roon operators to aid them in rapidly and reliably determining the
(-
safety status of the plant."878 Additionally, there is a DHFT program underway "to determine the need for and, if necessary, the scope of the NRC's SPDS post-implementation reviews."800 The j
information obtained will dallow an assessment of how well the SPDS objectives are being met and provide the basis for an NRC regulatory position on $POS post-implementation reviews.
Following completion of this program DHFT will, if necessary, work with industry to develop appropriate standards for SPDS ava11 ability."800 The staff performed SAh on the three vendor group responses (CE, B&W, W) to TMI Action Plan Item II.K 3(2), " Report on Overall Safety Effect of Power-Operated Relief Valve (PORV) Isolation System."
(References 897, 898, and 899).
The SARs included an estimate of core-melt frequency due to a stuck open PORV-induced SBLOCA.
The calculations were based on PORV operating data from April 1, 1980 to March 31, 1983 and concluded that post-TMI actions such as lowering the setpoint of the high pressure reactor trip and raising the setpoint of the PORV opening, eliminating the turbine runback feature, and improving operator capability decreased the challenge to the PORV and the probability of a SBLOCA-PORV sufficiently so as not to warrant a requirement for automatic block valve closure.
The Davis-Besse event may be viewed as another "cata point" that should be considered in this determination.
However, upon consideration of the occur-rence of a PORV actuation and the conservative estimates made in the staff's
/^j\\
SARs (References 897, 898, and 899), we conclude that the SBLOCA-PORV fre-i cuency would still remain within the range of the SBLOCA frequencies given in VASH-140018 (10 2 to 10 4/RY).
The opening of the PORV resulted from a loss of all feedwater to the steam generators and is regarded as a legitimate response and fulfillment of the real purpose for incorporating a PORV into the design.
Therefore, the Davis-Besse event does not change the statistics for necessary challenge to the PORV.
Consequently, the staff's SARs (Refer-ences 897, 898 and 899) which concluded that block valve automation is unneces-sary are unaffected.
Also it is clear that the automation of the block valve might red 9ce the initiator (SBLOCA-PORV) frequency, but not necessarily the net core-melt fre-quency.
Since it has the potentit.1 for spurious actuation (e.g., spurious electrical signal sensed by the block valve could force it closed during a transient requiring use of the PORV) which would increase core-melt frequency.
The occurrence at Davis-Besse was the result of an initiator already considered in the SARs, i.e., the failure of the AFW system.
It was an occurrence that would have resulted in no other outcome should an automatic block valve have been available because the operator closed the block valve himself as a result of his sensitivity to the PORV fror post-TMI training.
CONCLUSION In light of the control room indications available to the operators and the results of the staff SARs (References 897, 898 and 899) that concluded that an p ) automatic PORV isolation system is not necessary, the safety concerns of this lV issue have been resolved.
Thus, this issue was DROPPED as a new issue.
12/31/89 3.125-5 NUREG-0933 l
l
Revision 6 I
ITEM 125.I.2.0:
CAPABILITY OF THE PORV TO SUPPORT FEED-AND-BLEED DESCRIPTION Historical Background This issue was identified in the EDO memorandum 89s and Was BIso faised at an ACRS Subcommittee meeting on Emergency Core Cooling Systems held on July 31, 1985.
Safety Sionificance Upon loss of the main 41d auxiilary feedwater systems, the feedwater flow to the steam generators is insufficient to maintain level.
As the level of water in the steam generators decreases, the average temperature of the RCS increases because of the reduced heat transfer from the primary to the secondary coolant systems.
When all steam generators are " dry," the plant emergency requires the initiation of makeup /high pressure injection (MU/HPI) procedure cooling of system.snc This method of decay heat removal is known as " feed-and-the primary' bleed-and-feed" depending on the HPI capability of the injection bleed or purhps and system design.
When this method is initiated, the PORV and high point vents on the RCS, specifically the pressurizer, are locked open breaching one of the plant's radiological barriers and releasing radioactive coolant inside the containment building.8" MU/HPI is often considered a drastic action because of the radioactive contamination of the containment.
Nevertheless, MU/HPI cool-ing provides a diverse method of core cooling if the main and auxiliary feedwater systems should fail.
This issue is based on an ACRS concern that the PORVs are not qualified for the
" hostile" environment in which they are placed when used for feed-and-bleed operation.
There are several reasons for this concern.
PORVs are usually called upon to respond when all other methods of removing decay heat are not available.
The temperature, pressure, and moisture conditions of the containment environment can create a differential thermal expansion of the valve disc and body and may cause the PORV to stick,886 failing open or closed, or the PORV can close shortly after beginning feed-and-bleed because of short circuits.
CONCLUSION Under USI A-45, " Shutdown Decay Heat Removal Requirements," the NRC staff is investigating alternative means of decay heat removal in PWR plants using existing equipment or devising new methods.
The use of the " feed and-bleed" procedure is included in this program as well as the need for environmental qualification of the PORV for this method of emer Therefore, this issue is covered in USI A-45.8" gency decay heat removal.
ITEM 125.I.3:
SPDS AVAILABILITY DESCRIPTION Historical Background This issue was identified as Item 10c in the EDO memorandum 896 and in a September 19, 1985, DHFS memorandum. M0 The issue addresses the concern as to whether NRC requirements should be revised regarding SPDS availability.
12/31/89 3.125-6 NUREG-0933
Revision 6 Investigations subsequent to the THI-2 accident have indicated a need for 9
normal and aonormal conditions.
improving how information is provided to control room operators both d ring TMI Action Plan Item I.0.2, " Safety Parameter Display System (SPDS)," required that licensees-install a system to continuously display information from which the plant safety status can be readily assessed.
Generic Letter 82-33378 (Supplement 1 to NUREG-0737) mandated that licensees install an SPDS.
Licensee implementation of Item I.D.2 is reviewed and tracked as MPA F-09.
The staff requirement imposed on the licensees does not contain specific reliability or availability requirements for the SPDS.
The schedule for operating reactors to meet the requirements of Generic Letter 82-33376 was proposed to the Commission in SECY-83-4842037 and formalized in confirmatory orders or licensing conditions.
Some plants have incorporated the SPDS implementation into their living schedules; however, other plants have not yet installed the SPDS.
Staff actions on MPA F-09 are ongoing to perform NRC post-implementation audits to deterrine the status of the plants that have installed the SPDS and to modify the schedule for those that have not.
A 1985 survey of six operating plants indicated that two of the plants did not I
have an operational SPDS although they ind mated that they met the requirements of Item I.D.2 (MPA F-09).
Three plants were identified as having SPDS avail-ability problems (less than desirable availability).
At some of the plants, the SPDS presented potentially misleading information while others suffered from poor operator acceptaric9 or lack of management support.
Recent post-implementation verification inspectioni, have indicated that, of
.the 37 plants that claimed to have completed the implementation of MPA F-09, less than 1/2 ca W factorily met all the SPDS requirements and were accepted by the E stLff es op0 rational.
Fifty-five plants that claim to have completed the impleraentation of MPA F-09 have not yet been inspected.
Fifteen plants have not yet declared the implementation of the SPDS to be completed and three plants have not yet scheduled the implementation of SPDS.
Safety Sionificance Events such as those that occurred at TMI-2, Davis-Besse,_0conee, Rancho Seco, and others may have been less severe if an operable SPDS had been available to the operators.
For the Davis-Besse event, "...Tne inoperability of the SPDS and lack of adequate indications of steam generator conditions contributed to the control room operators not knowing that the steam generators were dr which, resuited in their failure to follow the appropriate procedures."8gE The requirements of MPA F-09 indicate that each operating reactor should have a_SPDS th n will display to Operating personnel a minimum set of parameters in order to determine tt.: safety status of the plant during normal and abnormal cenditions.
It should provide enough information to. alert the control room operatn s who should then verify the information presented by the SPDS before taking any action to avoid a degraded core event.
The parameters should
- provide, as a minimua, information about the following:
reactivity control; reactor cora cooling and primary system heat removal; reactor coolant system integMty; radioactivity control; and containment conditions.
9 The primary purpose of an available SPCS would be to display a full range of these important plant parameters ia order to aid the control room personnel in 12/31/89
?.125-7 NUREG-0933 s
Revision 6 l
t determining the tafety status of.the plant during abnormal and emergency condi-tions and'in asaessing where abnormal c W itions warrant corrective operator action to-avoid a degraded core event.
We assume that operators need'all avail-able parameter information for their decision-making in avoiding a degraded core event and that a properly fu.ctioning SPDS would result in a lower fre-quency of control room operator errors and a corresponding reduction in core-melt frequency.
Possible Solution For the analysis of this issue, it is assumed that all plants have or will have installed an SPDS.
It is conservatively assumed that, at 75% of the plants, the SPDS is not operational (i.e., not available for use) and that, at the remaining 25%, the SPDS is operational but, due to errors'in design and/or construction, may provide misleading information to plant operators.
For the resolution of this issue, we have assumed that improvements in design and hard-ware charges, as well as improved meintenance and test procedures, will be required to assure the availability of a properly functioning SPDS at all operating plants.
PRIORITY DETERMINATION Assumptions During U1e prioritization of a selected group of MPAs in October 1984, biPA F-09 was analyzed by PNL.lo39 The PNL analysis evaluated the risk reduction benefit obtained by the design, installation, and maintenance of an operating SPDS.
The PNL cost analysis evaluated the NRC and licensee costs expected for the design, procurement, installation, and operation of the SPDS over the expected plant
- lifetime, c
1he PNL risk analysis for MPA F-09 is based on NUREG/CR-32461040 and the IREP risk assessment for Arkansas Nuclear One, Unit 1 (AN0-1). ace NUREG/CR-32461040 deals with the risk reduction related to three improve.nents in the control (1) installation of a SPDS; (2) ir.stallation of a margin to saturation room:
annunciator; and (3) increased control room staffing.
Since the risk reduction associated with the availability of an operrble SPDS is the concern of this issue, the analysis of NUREG/CR-32461040 was used and modified to separate out the effect on core-r.elt frequency due to having an operable SPDS.
The effect on core-melt frequency due to the SPDS was then carried through the appropriate event sequences and minimal cut ' sets in the IrlP risk assessment to determine the potential level of public risk afforded oy an operable SPDS.
For the purpose of the analysis of this issue, we have conservatively assumed
.that'75% of all plants hav~
1 SPDS which is installed but not operationally
.available and 25% of the plants have an operational SPDS whicYprovides mis-
-leading information, it is assumed that resolution of this issue would assure that all plants have a properly operating SPDS available and continuously in use.
Frequency Estimate The level of risk presented by havirg SPDS installed but not available is the same as not having an SPDS.
Therefore the PNL risk analysis for MPA F-09 is 12/31/89 3.125-8 NUREG-0933
Revision 6 used to estimate the risk reduction afforded by resolution of this issue (i.e.,
making the installed SPDS continuously available and correcting any existing-i design or operational deficiencies) for the 75% population of the plants.
For the remaining 25% of the plants, which are assumed to have an SPDS which might mislead the control room operators, we have assumed a two order of magnitude increase in the frequency of failure to notice relevant annunciators, failure to properly diagnose the event, errors of omission in following emergency proce-dures, errors of commission in establishing HPI cooling and recovery factors for operator errors and have repeated the PNL analysis using these modified
. probabilities for specific events in the cut set analysis.
The population of plants (75%) assumed to have an installed but unavailable SPDS was estimated to consist of 60 PWRs and 27 BWRs with remaining life times of 32 years and 30.8 years, respectively.
The event tree (HPI-PUMP-CM), which depicts failure of HPI, was assumed to be affected by the addition of an SPDS.
The event tree includes failure of adequate core cooling as the initiating event and individual probabilities for the failure to notice relevant annuncia-tors, failure to properly diagnose tne event, errors of omission in following emergency procedures, errors of commission in establishing HPI cooling, and recovery factors for various operator errors.
The base case probability from NUREG/CR-3246'040 for the HPI-PUMP-CH event is 2.18 x 10-3 In the SNL study of control room improvements ( EREG/CR-3246),1040 the addition of an SPDS in the control room was assumed to reduce the probability of the operator failing to recognize the loss of margin-to-saturation annunciators frcm 1.3 x 10 2 to 10 4 (an improvement in the recovery factor) and provide a e
capability to detect omission of steps in the emergency procedure (an additional path on the event tree with a failure probability of E- ).
The ad; usted case probability of the HPI-POMP-CH event was determined to be 4.4 x 10 #.
In the MPA F-09 analysis, PNL calculated the change in core-melt frequency using the-ANO-1 IREP analysis with the base case and adjusted ease frequencies for the HPI-PUMP-CM event.
The calculated change in core-melt frequency repre-sented the addition of an SPDS for each dominant sequence of events in which the affected event (HPI-PUMP-CM) appears.
For the purpose of determining the potential-risk reduction for resolution of this issue for the 75% population (i.e, improving availability of existing SPDSs), this $s the same as the MPA F-09 analysis with and without the SPDS as determined by PHL.
The affected base case core-melt frequency (without SPDS) was calculated to be 1.04 x 10 8/RY and the adjusted case affected core-melt frequency (with SPDS) was calculated to be 2.09 x 10 7/RY. The' core-melt frequency reduction (8.3 x 10 7/RY) deter-mined by PNL was assumed to be typical of all PWRs.1038 When the change in core-melt frequency for PWRs was multiplied by the appropriate dose conversion factors, the number of affected PWRs (60) and their averago remaining lifetime (32 years), a risk reduction of 3802 man-rem was estimated.
The estimates of core-melt frequency and risk reduction for BWR plants were determined by pro-portioning the total core-melt frequency and total public risk froa the ANO-1 IREP and Grand Gulf 1 RSSMAP risk assessments and multiplying the ratio to the PWR core-melt frequerzy and risk reduction estimates determined above.
Core-melt frequency and ta al risk reduction estimates, da 5 the addition of an SPDS, of 6.1 x 10 7/RY and 4,116 man-rem, respectively, vere thus calculated 9
for 27 affected BWRs for their average remaining lifetime (30.8 years).
- Thus, samming the BWR and PWR cstimates, we calculated a total public risk reduction 12/31/89 3.125-9 NUREG-0933
Revision 6-t l
of 7,918 man-rem for resolution of this issue for the 75% population of plants
)
assumed to have poor availability,' based on PNL's MPA F-09 calculations.
I We determined that the remaining 25% population of plants, which we assumed had an available SPDS capable of misleading the plant operators during abnormal operations, consists of 20 PWRs and 10 8WRs with a remaining life time of 32 years and 30.8 years, respectively.
Due to the detrimental effect a faulty SPDS
.can have on a situation in the control room, we considered an increase in the probability of two orders of magnitude from the case where no SPDS was consid-L ered for the following parameters:
failure to notice relevant annunciators, misdlagnosis, and errors of omission in the respective steps of the emergency procedures.
Repeating the PNL MPA F-09 analysis of using the higher operator error values, we calculate a PWR HPI-PUMP-CM probability of 1.75 x 10 2 and, using the ANO-1 minimal cut sets, a PWR core-melt frequency of 8.76 x 10 6/RY.
t Using the above ratioing technique we estimate a BWR core-melt frequency of 6.6 x 10 6/RY.
Subtracting the base case ( ood SPDS continually available) estimated core-melt frequencies (2.09 x 10- /RY for PWRs and 1.55 x 10 7/RY forBWa.)fromtheadjusteocasevaluesforthe25%populationofplantswith
" faulty" SPDS, we estimate a coremelt frequency reduction of 8.55 s 10 6/RY for PWRs and 6.44 x 10 6/RY for BWRs.
l Consequence Estimate 1
Multiplying the core-melt frequency by the appropriate dose conversion factors, number of affected plants (20 PWRs and 10 BWRs) and.their respective average remaining lifetimes (32 yrs for PWRs and 30.8 yrs for BWRs) we estimate a.
potential public risk reduction of 13,376 man-rem for the PWRs and 16,301 man rem for the BWRs of the remaining 25% population of plants.
Summing the PWR and BWR estimated risk reductions for the 25% population of plants assumed to have a faulty SPDS we estimate a total risk reduction for this fraction of the total population of plants of (13,376 + 16,031) man-rem or 29,407 man-rem.
Since resolution of the issue is assumed to both greatly'im) rove availabilit of the SPDS and correct the deficiencies in those SPDS whici may be " faulty,y the total risk reduction estimated for the issue is (7,918 +-29,407) man-rem-or 37,325 man-rem.
Cost Estimate Industry Cost:
For the MPA F-09 ost analysis, PNL consulted industry vendors who supplied SPDS systems.
PNL estimated an industry SPDS. implementation cost.
of $3M/ plant e vally divided between vendor procurement costs and-licensee.
design and installation costs.
For the purpose of this. analysis, we assumed that modifications to an existing SPDS to correct either severe availability.
~
problems or design deficiencies cannot be accomplished for less than 10% of the criginal design, procurement, and installation cost We, therefore, estimated a total industry implementation cost for this issue of $35.1M.
In the MPA F-09 analysis, PNL estimated.2 man weeks /yr/ plant of industry effort required to operate, inspect, and maintain the SPDS.
For this analysis, we estimate that one additional man-week of industry maintenance and surveillance effort will be required per year to maintain and demonstrate adequate SPDS availability.
We calculated a total present worth industry cost of $8.4M for 12/31/89 3.125-10 NUREG-0933
l Revision 6 l
operation and maintenance of an improved SPDS at all af fected plants.
We, therefore, estimated a total industry cost'of $43.5M.
NRC Cost:
We estimate thet 32 man-weeks / plant of NRC effort would be needed to review the SAR on a modified SPDS, prepare an SER supplement, inspect the SPDS af ter its modification, and review and issue revised technical specificatw.:s for the operation and surveillance of the SPDS.
The staff estimated the cost to be $270,000/ plant or $3.2M total cost for the safety issue resolution (SIR) implementation su) port.
In addition we estimate that one man-week / plant /yr of NRC effort would se required to review and monitor the licensee's improved (expanded) maintenance and surveillance program.
When costed out a $2,270/ man-week, an NRC present worth cost of $8.4M for SIR operation and maintenance review is estimated. We, therefore, estimate a total NRC cost of $11.6M.
l w / Impact Assessment The value/ impact score derived from the above estimates is as follows:
37,325 man-rem 3-5(43.5 + ll.6)M
= 677 man-rem /$M Cther Considerations Control room instrumentation systems have been designed in compliance with GDC-13 and 19 of Appendix A to 10 CFR 50 and, as such, are required to provide the operators with the information necessary for safe reactor operation under normal, transient, and accident conditions.
The SPDS is used in addition to the control room instrumentation sye to NUREG-0737 required that licensees develop proce-stem to aid and augment the control room instrumentation i
system.
Supplement la dures which describe the timely and correct safety status assessment when the
~SPDS is and is not available.
It also required that operators be trained.to respond to accident conditions both with and without the SPDS available.c The SPDS is therefore viewed as enhancing the operator's perception and under-standing of plant status under ncrmal and abnormal conditions, but the SPDS is not essential to proper and timely diagnosis and effective-recovery from abnormal events.
The' normal plant instrumentation system is a redendant safety grade system.
The SPDS addition provides a diverse and improved diagnostic system but in itself is redundant to the plant instrumentation system, which by the nature of its design requirements, is redundant within itself.
Since all modification, maintenance, and surveillance will be performed in the control room complex, there is no potential ORE expected for this issue. The SPDS-is a redundant (but enhanceo) back-up system for the redundant, safety-
' grade control room plant instrumentation system.
Intuitively, one would, there-J fore, not suspect that the risk sensitivity to SPDS availability (7,918 man-rem)
I would be=so great as to warrant improvements in SPDS evailability regardless of cost.
In addition, the risk. analysis performed for this issue was performed conservatively assuming that poor availability meant 100% unavailability of the SPDS for the population (75%) of plants assumed to suffer from less than desired availability.
'12/31/89 3.125-11 NUREG-0933
Revisien 6 If the availability concern were considered separately, i.e., the total population of plants (100%) was assumed to have an SPDS which is unavailable the maximum public risk contribution (calculated conservatively) would be about 10,400 man-rem.
In this instance, a medium priority would be warranted unless the total cost per plant to increase availability significance were less than
$30,000, which seems highly unlikely.
If the smaller population of plants (30) assumed to have " faulty" SPDS (i.e.,
one which may mislead control room operators during their response.o a tran-sient or LOCA) is considered separately, a much larger potential public risk contribution (29,407 man-rem) is estimated.
This averages out to slightly less than 1,000 man-rem / reactor for this smaller population.
A medium prior-ity is appropriate for this concern unless the cost to modify the SPDS e ment to correct the design faults were less than approximately $300,000/ quip-plant (10% of the SPDS original cost).
We feel that reanalysis of design and equip-ment replacement or modification for less than 10% of the original procurement cost are unlikely.
Conversely, recognizing that tha foregoing treatment of the case of the operator being misled is conservative, if one were to assume that there is no chance of
~ the SPDS misleading the operator (i.e., no public risk impact), the priority assignment would be based solely on the risk potential associated with the availability concern and the issue would still warrant a medium priority assign-ment.
Therefore, considering both the overall risk and cost calculations and the separate effects for the two separate concerns identified by the Davis-Besse event (i.e., availability and design adequacy) and the limited surveys of SPDS status at operating plants, the potential risk reduction and the value/ impact ratio would indicate a medium priority assigment.
CONCLUSION Generic Letter No. 82-33a7s transmitted Supplement I to NUREG-073788 to clarify the THI action items related to emergency' response capability, including Item I.0.2, " Safety Parameter Display System.
The staff evaluated licensee /
applicant implementation of the SPDS requirements at 57 units and found that a largepercentageofdesignsdidnotsatisfyreguirementsidentifiedinSupple-ment 1 to NUREG-0737.
Generic Letter 89-06120 (enclosing NUREG-13421200) was issued to inform licensees of the staff's findings to aid in implementing SPDS requirements.
Based on the staff's efforts in pursuing the implementation of i
TMI Action Plan Item I.D.2, this issue was RESOLVED and no new requirements were established.
l ITEM 125.I.4:
PLANT-SPECIFIC SIMULATOR DESCRIPTION l
Historical ~ Background This issue was identified as Item 10c in the EDO memorandum ses and was based on Findings 10 and 17 and Sections 6.1.1 and 6.1.2 of NUREG-1154.sse Following the Davis-Besse reactor trip, the operator manually initiated actuation of the Steam and Feedwater Rupture Control System (SFRCS) in anticipation of the auto-j matic initiation of the SFRCS; however, the operator pushed the wrong buttons.
This was the first time he had manually actuated the SFRCS and had not received 12/31/89 3.125-12 NUREG-0933 l
Revision 6-specialized classroom or simulator training on correctly initiating the SFRCS.
The buttons pushed by the operator activated the SFRCS on low pressure for each steam generator instead of low level.
By manually actuating the SFRCS on low pressure, the SFRCS was signalled that both steam generatcrs had experienced a steamline break or leak and the system responded, as designed, to isolate both steam generators.
Thus, the operator's anticipatory action defeated the safety function of the AFW system.
The error was corrected within approximately one i
minute by resetting the SFRCS and, therefore, had no significant bearing on the outcome of the event.
However, the lack of plant-specific simulator training was noted by the investigating team.
i This' event however, was not the first event that indicated the need for plant-specificsimulatortraining.
The TMI-2 event on March 28, 1979, clearly focused industry and NRC attention on the need for better human engineering in control room design and for plant-specific simulator training.
TMI Action Plan Task I.A*8 contained a series of requirements related to simulator uses and develop-ments addressing short-term and long-term actiuns centered on simulator training.
Some of the Task I.A items 48 were subsequently integrated into the Human Factors Program Plan (HFPP)651 which was developed in response to NUREG-08852to and Section 306 of the Nuclear Waste Policy Act of 1982 (PL 97-425).
In this regard, Pl 97-425 required NRC to establish simulator training requirements for plant-licensed operators and operator requalification examinations.
Item I. A.4.1, " Initial Simulator Improvement," has been completed; the "Long-Term Training Simulator Upgrade" [ Item I. A 4.2(4)] will be completed upon publica-tion of 10 CFR 55 and related NRC guidance on the evaluation of simulation facilities.
Safety Significan.c_e A plant-specific simuiator would improve operator actions and timing in response to plant transients and accidents.. Thus, plant damage and possible core-melt accidents could be significantly reduced.
This issue affects all licensed o
nuclear power plants.
Possible Solution The use of plant-specific simulators is being addressed in the proposed rule-S57 i
making amendments to 10 CFR 55 [TMI Action Plan Item I.A.4.2(4)].
This action will codify requirements that include the use of nuclear power plant simulators in initial and requalification examinations.
In brief, the proposed rulemaking includes three choices for plants that are not the reference plant for a simulator:
(1) acquire a plant referenced simulator that meets the latory Guide 1.149 *y Guide 1.149; W (2) use a simulator that conforms to Regu-intent of Regulator and has been demonstrated to be suitable; or (3) substi-
.tute any device or combination of devices that meets the requirements of 10 CFR 55.45(b)-and would be approved by-the NRC.
CONCLUSION Based on the above, the resolution of the nrev and use of plant-specific simu-lators is being addressed as part of the m y sed rulemaking amending 10 CFR 55 under Item I.A.4.2(4).
Thus, Issue 125 '4 was DROPPE0 as a separate 4
issue.
12/31/89 3.125-13 NUREG-0933
Revision 6 q
ITEM 125.I.5:- SAFETY SYSTEMS TESTED IN ALL CONDITIONS REQUIRED BY DBA-DESCRIPTION Historical Background The issue is based on Finding 15 of the IIT report.sse which states:
" Thorough integrated system testing under various system configurations and plant condi-tions as near as practical to those for which the system is required to function during an accident is essential for timely detection and correction of common mode design deficiencies."
Safety Significance Section 7 of the IIT report attributed the key safety significance of the Davis-Besse event to the fact that multiple equipment failures occurred, initiating a transient beyond the design basis of the plant.
According to the IIT report, each of the following conditions contain a mix of operating errors, maintenance errors, and design errors that, without corrective operator actions, would have defeated operation of the safety-related AFW system.
These'are as
.ollows:
(1) Operator Error in SFRCS Actuation on Low Pressure Following the loss of main feedwater during the event, the operator, T
in anticipation of Steam and Feedwater Rupture Control System (SFRCS) actuation on low steam generator water level,' inadvertently pushed I
the wrong two buttons which activated the SFRCS on low steam generator pressure instead of low steam generator water level.
By manually actuating the SFRCS on low pressure, the SFRCS was signaled that both steam generators had' experienced a steamline break or-leak.
Thus, the operator's-anticipatory action (human error) defeated the. safety function of the AFW system. -The shift supervisor quickly determined that the AFW system valves were improperly aligned and reset the SFRCS (tripped it on low level) and corrected the operator's error about a minute af ter it occurred.
(2) Failure of the AFW System Containment Isolation Valves to Reopen after Their Inadvertent Closure After the shift supervisor had reset the SFRCS, both AFW containment isolation valves could not be reopened from the control room either automatically or by manually operating the SFRCS reset and block following the inadvertent closure.
This caused the complete loss of the~AFW safety function by blocking flow of the AFW to both steam generators.
The probable root cause of the AFW containment isolation valves irability to reopen was attributed to improperly adjusted torque switch settings on the valve actuator.
Thus, power to the actuator motor was cut off bsfore the valves could open against the high differential pressure across the valves.
The safety function for the AFW isolation valves had been incorrectly specified as only to'close,-not to open or reopen. Thus, the AFW and SFRCS design reviews revealed that neither system met the design single failure criterion with respect to opening an AFW containment isolation 12/31/89 2.125-14 NUREG-0933
>o e
Revision 6 valve to feed an intact steam generator.
The containment isola-L tion valves were opened by dispatching equipment operators to i
the rooms containing the valves where they reopened the valves i
in about 3.5 minutes.
(3) Overspeed Tripping of the AFW Pumps The operator, after returning to the AFW station, expected the AFW to.be actuated and providing the needed feedwater to the steam generators.
Instead, he saw the No.1 AF munn, followed by the No. 2 AFW pump, trip on overspeed.
Had bom systems (the AFWS and the SFRCS) operated properly, the operators mistake in pushing the wrong buttons would have had no significant conse-quences.
A review of the AFW design indicated that the AFW steam crossover lines ( i.e. those associated with the opposite steam
- i generator for each AFW turbine and steam admission valves) have 4
long horizontal runs where saturated how water could accumulate.
Thus, the fluid entering the AFW turbines initially was a mixture of water and steam, but soon was entirely steam.
The turbine governors could not respond quickly enough to the changing energy content of the fluid being provided and the turbines tripped on overspeed.
However, the turbine overspeed trips were cleared by opening the trip throttle valves located in the AFW pump rooms.
The Davis-Besse event demonstrated the susceptibility of reder. dant equipment to various common mode failures and the importance o" " defense-in-depth' and operator training to ensure safety.
The value of redundancy, diversity, and prompt and effective operator action in accomplishing key safety functicas was particularly evident from the Davis-Besse event.
PosiibleSolutions In accordance with Finding 15, an essential solution for timely detection and correction of common mode design deficiences would be to conduct thorough inte-grated system testing under various system configurations and p'. ant conditions 1
(as near as practical) for which the systems are required (designed) to function i
during an accident.-
l To develo;; a Finding 15 test program, tests would have to be devised to simulate various plant conditions, equipment alignments, and plant responses (p ssible functional and spatial coupling mechanisms) to postulated abnormal and accident situations.
To' facilitate identification of unforeseen common-mode desim deficiencies (CMDD-triggers) in equipment or systems, a judicious sel ectf.sr.
induced equipment malfunctions and/or operator errors may need to be.modeir: 'ato the tests.
Because it is virtually impossible to model or test for all corsible off-normal conditions, the problem of devising such tests are similar he problems encountered by the staff during development of the Design' Basis Events (DBEs) used to license plants.
In establishing the DBEs, the staff recognized that it was impractical, if not impossible, to anticipate (postulate) all possible transients, abnormal operations, accident conditions,.
equipment malfunctions, and operator errors that may occur during the. life of a plant.
To overcome these limitations and to provide adequate assurance that
-the plants could operate safely, the staff included DBEs in the SRPM -in an attempt to bound the unforeseen events that might occur.
12/31/89 3.125-15 NUREG-0933-n
Revision 6 For the purposes of estimating the potential scope of this issue, and due to tt.a similarities between the objectives stated in Finding 15 and the licensing DBEs, it was assumed that a thorough integrated system test program might, as near as practical, attempt to simulate the postulated licensing DBEs described.in SRPM Section 15.
Because of the complexities involved in attempting to simu-late all the DBE conditions, the possibilities of inducing some fuel failures under the more severe DBEs, and the physical limitations of actually conducting tests to model many of the DBEs, it does not appear practical or realistic to conduct a test program under all DBE conditions.
For purposes of this analysis, it was assumed that the. closest approach to the Finding 15 recommendation (to conduct a thorough integrated systems / plant test i
program) may be a test program similar to the Rancho Seco restart test program.
However, because plant-specific test programs may vary significantly, the poten-tial range in costs of each plant-specific test program, as discussed herein, reflect a wide range of potential costs which may be dominated by possible extended refueling outages that may result from implementing the test programs.
.The Rancho Seco test program includes component testing, systems integrated functional testing, and plant integrated functional testing. These tests include logic tests of systems interlocks, trips, permissives, and verifications of the annunciators.
Normal operations testing would include cold and hot shutdown conditions, with some testing performed during the power ascension phase.
Dur-ing the normal operations testing, verification of systems functions will be conducted.
Many of these tests are already performed during In-Service Testing (IST) or during normal refueling outages, but improved methods and procedures may be needed and may affect on-line power production.
The integrated Rancho Seco systems / plant testing phase includes, where practicai, emergency /off-normal operations such as the loss of the Integrated Control System (ICS), Non Nuclear Instrumentation (NNI), offsite power, and ECCS testing.
Based on the Rancho Seco test flow diagram, many of the latter tests, such as-cold functional Emergency Feedwater Integrated Control (EFIC), Safety Feature
~ Actuation Systems-(SFAS), diesels, and condenser vacuum tests, can be performed D
in parallel.over approximately 3.5 months.
However, the loss of offsite power, plant heatup, hot shutdown, and power ascension testing would be conducted in series over an additional 3.5 months.
In summary, it is estimated that the Rancho Seco systems / plant-testing phase will require approximately 7 months to
' complete and includes the following major integrated test matrix:
(1) Loss of offsite power (2)
Integrated SFAS (3)
Loss of instrument air (4) EFIC functional (5) _ Loss of ICS/NNI power (6) Condenser vacuum (7)
Integrated leak test L
(8) Flow balance (9) Cold systems functional (10) Hot systems functional (11) Power systems functional l
l (12) Reactor-trip (13) ICS tuning L
~12/31/89 3.125-16 NUREG-0933
Revision 6 It is noted, however, that the integrated systems / plant test matrix does not include all the DBEs.
Nevertheless, the Rancho Seco test program should provide insight into the potential magnitude and scope of an integrated systems / plant testing program, under various systems configurations and plant conditions, that may approach the Finding 15 recommendation.
However, to meet the Finding 15 objective of detecting unforeseen CMDDs, it may be necessary_ to devise and include by judicious selections, off-normal equipment malfunctions and operator errors to provide the coupling mechanism (s) that force detection of the unfore-seen CMDDs.
Because of the infinite combinations of possible equipment or system malfunc-tions and operator errors, the likelihood of success in detecting unforeseen CMDDs by a designed test program, using limited and designed combinations and designed procedures, will likely be plant-specific.
The chance of success may be severely limited by the imagination used in devising the tests and in selecting appropriate coupling mechanisms that will force detection of the unforeseen CMDDs.
The potential complexities in developing a thorough integrated systems / plant test program, especially one designed to detect unforeseen CMDDs, are enormous and siould not be considered a simple engineering task nor a series of simple tests.
Nevertheless, for the purpose of this analysis it will be assumed that the integrated systems / plant testing phase may be reduced by a factor of ten to 0.7 months (3 weeks) beyond the normal refueling outage.
Thus, outage extensions that may range from 3 weeks to 7 months should bound all or most of any plant-specific variabilities in outage extension costs that may be attributed to the test programs.
PRIORITY DETERMINATION The objective of the Finding 15 integrated systems / plant test program i= to detect and correct unforeseen (unknown) CMDDs that may surface as a result of of f-normal or accident conditions during plant operations.
Sinco no specific event or safety system is identified in Finding 15, the problem involves virtually every safety system in a plant.
Because all plants exhibit various degrees of complexities in their safety systems and various susceptibilities to common mode failures, any attempt to identify plant / system' hazards for all possible common mode failures (especially unknown common mode failures) either singly or in combinations is impossible.
Therefore, to a large extent, plant-specific hazards from all common mode failures may vary considerably from plant to plant.
These conditions also apply to the unforeseen CMDDs (a subset of common mode failures) which are considered in this analysis.
Currently, the methods for systematically evaluating equipment or system failures involve the use of operational data.
This data provides equipment and system unavailabilities to estimate the probabilities of dominant accident sequences that may lead to core damage (considered herein as a core-melt condition).
The operational data on equipment and system unavailabilities generally include common mode or common cause events that are not specifically identified in the systemic event tree of the accident sequences.
A fault tree model of the equip-ment or system would contain more specific information on t w on mode or common cause. initiators that af f.ect the specific equipment or system unavailabilities.
12/31/89 3.125-17 NUREG-0933
Revision 6-The items that will be addressed in this analysis are:
(1) the_ likelihood of unforeseen CMODs that have not yet occurred; (2) the chance of success of de-i tecting and correcting unforeseen CMDDs; (3) the likelihood of core-malt-from unforeseen CMDDs; (4) the estimated risk reduction potential associated with detecting and correcting the unforeseen CMMDs; and (5) the esti;aated cost range of implementing possible thorough integrated systems / plant test programs discussed earlier.
Frequency Estimate of Unforeseen CMDDs:
To estimate the frequency of unforeseen common mode failures, information was obtained on the frequency of previous unforeseen comon mode failures that have actually surfaced in operating plants.
The iMormation used in this analysis is based on results of research conducted t
by EPRI.745 The data gathered in the EPRI report was limited to a select group of components covering approximately 400 to 600 RY of experience; 2654 events were evaluated in the EPRI report and each event involved at least one compo-nent in an actual or potential state of being failed or functionally unavail-able.
Of the 2654 events, 2232 were classified as independent events and 422 were classified as dependent events.
Of-the dependent events, 113 were clas-sified as common cause events and 68 were classified as actual common cause events because they involved two or more actual failed or functionally unavail-able' states.
1 The method used in the EPRI report to quantify equipment comon 'cause failure values is the Basic Parameter Method (BPM).
The overall methods included in the EPRI report involved essentially an extension of the Beta Factor Method and the_ Multiple Greek Letter Method. 'These methods provided means for estimating the conditional probabilities from common cause events invelving tw, three, or more units, given that a specific component failure occurs.
l The generic beta basic parameter values calculated by EPRI reflect the compila-tion of all the reviewed data on common mode failures for the componentc-and systems listed below.
In accordance with NUREG-1150,1081 these EPRI values reflect a 95% upper bound of a log normal distribution with an error factor of three.
'The mean values (taken from NVREG-1150) are. listed and are used in this analysis to estimate the potential generic contribution to core-melt frequency-from comon cause failures.
The upper bound beta basic parameter values were used in the NUREG-11501081 sensitivity study to bound the potential effects of comon cause failures (CCFs) on severe core. damage.
The EPRI report includes the.results of extensive data reductions, root-cause determinations, and evaluations of 2654 events that included independent and dependent events over 400 to 600 RY of operation.
Because plant-specific data are scarce even for single failure probabilities (and even more scarce for dependent. failures), use of the EPRI industry-wide data provides a more compre-hensive generic. data base than the Davis-Bessie event that involved multiple component / systems failures.
i O
12/31/89 3.125-18 NUREG-0933 q
1 1
4 Revision 6 Generic Beta Values Component Upper Bound Mean l
Values Values i
Reactor Trip Breakers 0.19 J.079 Diesel Generators 0.05 0.021 MO Valves 0.08 0.033 l
SRVs PWR 0.07 0.029 BWR 0.22 0.09?
Batteries 0.1 0.04 Pumps High Head 0.17 0.071 RHR 0.11 0.046 Cont. Spray 0.05 0.021 AFW 0.03 0.013 Serv. Water 0.03 0.013=
a f)l 0.1 0.042 a = Average of all beta BPM values i
In addition to the-above beta BPM values, the EPRI report grouped.the failure events into two classes.
The Class I failures included all the generic common cause events.
Both classer, were classified as having eight generally related causes (triggers).
Although the Class I events occurred;10 times less frequently
-than the Class II events, the relative frequencies of the cause (trigger) groups suggested that-the causes of dependent events in general,.and common cause events in particular, are not unique.
The fundamental difference between the dependent and independent events is that the former has a coupling mechanism to transmit the effect.of the trigger to two or more components, and the latter exhibits.
no such coupling mechanism (s).
Examples of coupling mechanisms are functional dependence, spatial proximity, and human interactions.
The distribution of the common cause triggers as a fraction of the overall common causer are listed below:
l Common Cause (Trigger) fractional Distributions (1) CMDDs*............................................... 0.25-(2) Erroneous Procedures.................................. 0.10 (3) Other Plant / Staff' Errors (including maintenance)...... 0.16 (4) Testing (not including instrumentation calibrations).. 0.01-(5) Internal Causes....................................... 0.15 (6) Environmental Stress..................................
0.08 (7) Unknown............
.................................. 0.19
- (8) Mul tipl e Cau s e s...................................... 0. 06 CMDDs consist of design, m;nufacturing, construction, and installation errors.
Based on the above common.cause fractional distribution reported in-the EPRI study, CMDDs on an average account for approxinately 25% of the EPRI beta BPM values.
Tha first four common cause triggers listed above are more basically 12/31/89' 3.125-19 NUREG-0933
i Revision 6 grouped in the EPRI report as human-related causes and account for approximately 50% of the overall common cause failure contributions.
It was assumed that the unforeseen CMDDs from plant modifications and equipment replacements will continue at the approximate rate evaluated from the EPRI data
-base of dependent failures that occurred over the 400 to 600 RY of operation.
Since the component / systems unavailabilities used in plant PRA analyses contain various components / systems with various beta (common cause) values, we will assume the average 25% contribution attributed by EPRI to CMDDs is generally applicable to all component / system beta. BPM values.
Core-Melt Frequency Contribution from Unforeseen CMDDs:
NUREG-11502082 provided a sensitivity study of the effects of common cause failures on severe core damage frequencies using four plant PRAs:
Surry, Peach Bottom, Sequoyah, and Grand Gulf.
The results in brief showed that dependent failures are basically plant specific and subject to large variations from plant to plant, and that dependent failures are a major contribution to severe core damage frequency and, in some cases, risk.
The NUREG-11502081 sensitivity study adjusted each of the PRA dc:ninant accident sequences of the 4 plants to account for plant-specific, generic, and upper bound common cause beta values.
The analyses also included base-case core-melt-frequencies with beta set equal to zero to identify the overall contribution and sensitivity of severe core damage to the range of common cause beta values.
The peru lent NUREG-1150tos2 upper bound results and the generic mean value estimates are tabulated in Table 3.125-1.
The mean values of the generic beta values are based on a log normal distribution with an error factor of three.
Based on the results in Table 3.125-1, the average core-melt frequency for the four plants, considering the mean value common cause beta BPM values, is 9.2 x 10 5/RY.
This average core-melt frequency is assumed representative of 3
-the generic core-melt frequency for all operating plants.
Use of average values smooth the outlier.high and low plant-specific vulnerabilities to common.cause failures and is more appropriate for a generic plant analysis (if indeed there is a generic plant).
As evident from the Table 3.125-1 tabulation, the contributions to plant-specific core-melt frequencies from all common cause contributors vary by approximately an order of magnitude, indicating the large pit.. t-specific effect on core-melt frequency from common cause type failures.
The contribution to the average core-melt frequency from common cause failures is (0.427)(9.2 x 10 5/RY) =
3.9 x 10 5/RY.
Using 25% of the common cause contribution to account for only the unforeseen CMDDs yields a core melt frequency contribution of'9.8 x 10 6/RY from unforeseen CMDDs.
Put another way, 42.7% of the generic plant core-melt frequency is attributed to estimated common cause failures (a significant con-tribution), where 10.7% of the core-melt frequency is attributed to estimated unforeseen CMDDs.
Frequency of Detecting Unforeseen CMDDs:
It is expected that in the majority of tests performed to simulate normal or off-normal plant operations, initiation and operation of safety systems, where systems are manually started, stopped, restarted, realigned, throttled, or otherwise operated in ways not easily antic-ipated by the designer, the system will usually work as expected.
O3
.12/31/89 3.125-20 NUREG-0933
Revision 6 Lable 3.125-1 D
Core-Melt Frequency Contributions I
Beta =0 Beta BPM Contributions Upper Bound Mean Values Values C
. Plant (A)
(B)
(C)
(A+C)
+
l Surry 1.5x10 5 2.1x10 5 8.8x10 6 2.4x10 5 0.367 Peach Bottom-3.4x10 6 7.6x10 6 3.1x10 6 6.5x10 6 0.472 Sequoyah 7.1x10 5 5.7x10 4 2.4x10 4 3.1x10 4 0.774 Grand Gulf 2.3x10 5 6.0x10 6 2.5x10 6 2.6x10 5 0.096 9.2x10 5 0.427 Average To. estimate the likelihood of detecting an unforeseen CMOD, the experience of-the Davis-Besse AFW system was considered.
At the time of the June 9, 1985 event,-this plant had accumulated about 6.8 calendar years of operation.'
Loss
- (n V) of main = feedwater (LMFW) events occur roughly three times per reactor year, so the June 9,1985 LMFW event was preceded by roughly 15 AFW system actuations (assuming a 25% average outage time).
Note that these actuations are only sys-tem initiations.
Three loss of feedwater events per year corresponds to all feedwater losses, most of which are partially or_ easily recoverable.
At the same time, the problems in the Davis-Besse AFW system and its associated con-trols and volving were there all along, but were not discovered (detected) until about 15-actuations had occurred.
This limited plant-specific (Davis-Besse)
-information would infer that the probability of detecting an unforeseen CMDD, with the coupling mechanism (s) attributed to off-normal or unusual operation, is approximately 1/15 or 0.067 per event.
7 Alternately, if we consider the information contained in the EFRI report 45 involving 255-AFW failure events, we note _that only three of the events' exhibited the necessary coupling mechanisms to detect common cause failures.
Combining the Davis-Besse event with the 255 EPRI events indicates that the
- chance of detecting a common cause failure in PWR AFW systems per event.is small (on.the order of 0.01/ event).
Additional evidence.of the CMDD detection chance is suggested by-other EPRI.
data.
As discussed earlier, the fundamental difference.between independent and dependent event ~ failures is-that the dependent, and common cause event failures in particular, must include a coupling. mechanism (s) to transmit the effect of the trigger (cause) to two or mor 9 components..Therefore,-the 68 events in the EPRI data base of 2654 events that involved two or more actual failed or function-4 p
ally unavailable states must have inci d d some form of coupling mechanism (s).
- This would also suggest a detection (coupiing) chance of approximately 0.03/ event 12/31/89 3.125-21 NUREG-0933 i
's t
Revision 6 for a broader range of equipment and causes.
Averaging the above operating experiences, we estimate the chance of detecting a significant number of CMDDs during each plant-specific test program at 0.035.
Because the above estimates are based on data of events involving failures, they should not be confused with a per demand rate of components / systems.
If a demand rate of components / system were considered, it would need to be factored into the above estimate to obtain the ch m e of common cause failures per test demand.
Therefore, use of the above ratius to estimate the chance of detecting unforeseen CMDDs during a one-time series of tests may be biased toward a con-servative estimate, since it is conditional on the given occurrence of some j
random or induced human / component / system failure during the test.
Normally, we would not expect either independent or dependent failures to occur during the course of a transient or test.
However, this estimate should be sufficirnt for p.rposes of this generic issue analysis.
Reduction in Core-Melt Frequency:
Based on the previous calculations, the potential core melt frequency contribution from unforeseen CMDDs, prior to-the test program, was estimated to be 9.8 x 10 8/RY.
After the tests, the core-melt frequency is weighted by the probability of the CMDDs not detected (1 - 0.035)
= 0.965. Therefore, the reduction in core melt frequency from detecting and correcting the unforeseen CMDDs is:
ACMF = (1 - 0.965)(9.8 x 10 8)/RY = 3.4 x 10 7/RY Consequence Estimet,e The conditional release doses used in this analysis are based on the fission product inventory of a 1120 MWe PWR, meteorology typical of a midwest site, a surrounding uniform population density of 340 persons per square' mile within a 50-mile radius of the plant, an exclusion radius of one-half mile from the plant, no evacuation, and no ingestion pathways.
Therefore, the estimated change in risk is representative of the hypothetical generic PWR plant and not representative of any specific plant. -For BWR plants, the results are not expected to be greatly different.
Based on NUREG/CR-2300,187 the probability of a large release'(5.1 x 108 man-rem /CM) is 0.2 and the probability of a basemat melt-through type release (1.5 x 105 man-rem /CM) is 0.8.
Over a plant lifetime of 30 years, the resulting estimated risk reduction associated with %is issuse is (3.4 x 10 7/RY) x
.(1.2 x 108 man-rem)(30 years) = 12 man rem / reactor.
Cost Estimate A thorough integrated systems / plant test program that models various-systems /
plant responses to off normal and DBE accident events would be a ma,jor under-taking and' highly plant-specific for all operating plants.
The dominant costs are likely to be replacement power costs that may result' from a test-extended outage.
Design, engineering, plant hazard analysis, labor, and modification costs to ready the plant for such a test program would be significant.
These costs are also highly plant-specific, but are not estimated.
However, prior to implementation of the test program, a long lead time can be expected to be required for-the licensee to develop,-and for the NRC to review and approve, the test programs.
A less rigorous test program may be possible and less costly 12/31/89 3.125-22 NUREG-0933
Revision 6
- (]
if the test program can be accommodated largely within the nt;w l refueling Q
outage (7 weeks) with an estimated additional 3 week (0.7 month) outage extension.
The long lead time for a thorcugh test program, and the assumed necessity to phase-in all the plant (approxi..:tely 100 reactors) test programs over a speci-fied time, to reduce the potential impact of lost electrical generation produc-tion from multiplant outages, are further considerations that would need to be considered in a more complete value/ impact assessment of this issue-because simultaneous (multiplant) outages teld to increase the cfFts of replaCGment power.
Replacement Power Costs:
Based on the discussion provided before, a test program similar to the Rancho Seco restart test program may be needed to approach the Finding 15 recommendation that initiated this issue.
We assume that the test programs will be a one-time series of tests for each plant and that the test programs may extend a plant refueling outage by 3 weeks (0.7 month) to 7 months, depending on the plant-specific test program and other tests scheduled to be performed during each plant's refueling outage.
Using an average replacement power cost of $500,000 per day, the replacement power costs are estimated to be $11M to $110M per plant.
Plant Costs During Test-Extended Outace:
It is difficult to provide detailed cost estimates of plant costs incurrec during the test-extended outage period.
These costs would involve engineering, management, labor, maintenance, and possibly some repair or modification costs.
To estimate the plant costs during the test-extended outage period alone, it was assumed that the plant costs can p
be approximated by plant costs typically experienced from a forced outage.
V Based on NUREG/CR-3673, toss this cost is estimated at $1000/ hour.
For a test-extended outage of 3 weeks to 7 months, the plant costs are estimated at $0.5M to-$5M per plant.-
Combined Costs:
The combined cost of replacement power and plant costs during
-a test-extended outage may range from $11.5M to $115M per plant.
These combined costs do not include the significant but unquantified pre-implementation costs of the test program.
However, this incomplete cost estimate provides insight into the large expense that may be involved in conducting.a thorough integrated systems / plant test program for each operating plant.
In addition, the NRC costs to review,.spprove, and follow the test programs in all operating plants would likely involve a large expenditure of NRC resources.
For the optimistic outage extension of 3 weeks, the combined industry and NRC' pre-implementation costs may approach the $11.5M cost of a short extended outage.
Value/ Impact Ass'essment (a) long Extended Outage:
Based on the risk reduction estimated to result from-probable test identification and correction of unforeseen CMDDs (which is the focused goal of Finding 15) and the estimated range of the per plant extended outage costs from the test programs, the range of the value/ impact scores for this issue resolution is:
b < 12 man-rem
- S
$115M
< 0.1 man-rem /$M 12/31/89 3.125-23 NUREG-0933 i
Revision 6 (b) Short Extended Outale:
If we assume that the integrated systems / plant DBE testing phase can be c6Mucted in 10% of the time estimated by Rancho Seco for their integrated systen.s/ plant testing, then the value/ impact score is given by:
b < 12 man rem 511.5M
< 1 man-rem /$M However, the.latter priority score may be overly optimistic because pre-implementation costs will take on more significance and may approach the $11.5M estimated for only-the replacement power costs and plant costs.
Other Considerations Due to the-involved complexities and the long lead time before these test programs could be implemented, the test programs would not likely commence until the mid-3990s.
Even if the programs for the 100 operating plants were phased over the following five year time period (20 plants / year), the test programs would not be completed until the year 2000.
During these time periods, a significant amount of operational experience would significantly expand the data base and =
corrections for many of the unforeseen CMDDs through other ongoing industry and NRC programs, e.g., improved LER requirements, Bulletins, Information Notices, NRC Generic Issues Program, the Safety Systems Functional Inspections ($$FI)
Program, and the Individual Plant Examinations (IPE)_ Program, would be made.
Therefore, the goal of Finding 15 to detect and correct unforeseen CMCDs may, to a significant degree, be achieved before the test programs can be initiated and completed. - CMDDs that may result from plant modifications or equipment.
replacements that follow the-test. programs would also not be eliminated by the one-time test programs.
CONCLUSION The stated _ goal of the proposed integrated systems / plant test programs of-Finding 15 is'to detect and correct unforeseen CMD9s.
The Finding 15 recommen-dation to use integral plant / system testing, as near as practical to DBA condit-ions, to detect CMDDs seems too limited in its goal, considering the potentially-large expenditure of time and' resources that may be needed-to develop the program.
As evident by this analysis, the current' state-of-the-art on CCFs is lacking sufficient information (data) and knowledge concerning coupling mechanisms.that trigger _CCFs.
Without sufficient information (data) on the individual plants and a better understanding of the_CCF coupling mechanisms, the successful result of-the Finding 15 recommendation appears unlikely.
The estimated success-probability of the tests to detect all unforeseen CMDDs results in a potential reduction in core-melt frequency of 3.4 x 10 7/RY.
This reduction in core-melt frequency borders between a drop and low on the priority ranking matrix.
The' risk reduction, not considering a time-averaged dilution before the tests would yield any benefits-(risk and core-melt frequency reductions) as discussed above, is estimated at 12 man-rem / plant.
This reduction borders between a drop and' low on the priority' matrix.
O:
'12/31/89 3.125-24 NUREG-0933 o
Revision 6 l
l The above risk reduction, when divided by the large costs that may be involved in such a program, yields an estimated priority score in the range of less than 1 to 0.1 man-rem /$M.
This value/ impact range is approximately three to four orders of magnitude less cost-effective than the 1000 man-rem /$M that is generally considered to be a cost effective resolution.
However, due to the low risk reduction, the priority ranking is not affected by the estimated range of the priority scores for this issue.
The above results are based on mean generic beta values applied to four plant PRAs and the resultant average core-melt frequency of the four plants.
This approach smooths out high and low plant-specific vulnerabilities to common cause type failures and is more representative of a hypothetical generic plant.
Therefore, the results of this hypothetical generic plant analysis should not be construed to be representative of any specific plant, since plant-specific j
vulnerabilities to common cause type failures vary significantly from plant to plant.
It must also be recognized that the analysis of this issue is directed toward using thorough integrated systems / plant testing of DBE conditions (as near as practical) to detect and correct unforeseen CMDDs.
In this regard, Finding 15 explicitly stated that thorough integrated systems / plant tests under these conditions is essential for the detection and correction of unforeseen CMDDs.
This analysis does not support Finding 15 as an essential and practical solu-tion for detecting and correcting unforeseen CMDDs.
This-is true even con-sidering that the analysis done in this prioritization evaluates a wide range of time (3 weeks to 7 months) and cost ($11.5M to $115M) that would be incurred by a utility in doing integral testing.
These estimates do not include consider-able engineering, procedure development, and training costs that would also be incurred in preparing to run such tests.
In addition, it has been proposed that such testa may be valuable in uncovering uther CCFs from the triggers shown before.. While it is theoretically possible to use integral testing for
-this purpose, the test program required would have to be more extensive and be done at periodic intervals to be effective in uncovering other common cause triggers.
Such a test program CMDD (a one-time test program) goes far beyond what was evaluated for addressing and, based upon the work done in prioritizing-this issue, woulo have even less justification for pursuing.
We have al m considered the potential time that may be needed-to develop, imple-inent', and reach the Finding'15 resolution.
Based on this timing consideration and the apparent and expected continued success of other NRC actions such as improved LER-requirements, Bulletins, Information Notices, the Generic Issues Program,1the SSFI Program, and the IPE Program, the detection and correction of unforeseen CMDDs may, to a significant degree, be achieved before the Finding 15 resolution can be achieved.
Thus, the poteatial benefit in detecting and-correcting unforeseen CMDDs through the Finding 15 resolution could be further l
reduced by the above timing considerations and success of other ongoing actions and programs. ~In addition, it should be recognized that these other ongoing actions and programs represent a way of uncovering and correcting CMDDs short of an integral testing program.
Based on the results and other considerations discussed above, the proposed solution to develop and implement thorough integrated systems / plant test programs under abnormal or accident conditions, as an essential and practical 12/31/89 3.125-25 NUREG-0933
=
Revision 6 solution to detect and correct unforeseen CMDDs in all operating reactors, has a DROP priority ranking.
However, an alternate approach to the Finding 15 recommendation would be to assess the benefit of improvements in existing in-service, refueling, and sur-veillance testing programs in operating reactors, and improved startup testing for future plants.
Such an as:;essment would focus on improvements in testing components and systems under conditions more representative of operational and DBE expectations, with emphasis directed toward detection of all types of CCFs, and not singularly CMDDs.
This alternate approach, however, would be more effective as a long-term program.
In this regard, the alternate approach would make use of results from the IPE program and other ongoing programs identified-above.
In brief, the IPE program PRA methods will include specific guide-lines 1119 and procedures for treating CCFs it the plant-specific PRAs.
These IPE-PRA results could be a valuable tool for_ identifying potential CCFs,'in structuring surveillance testing strategies, and in the design of hardware and modifications, or improving operating procedures.
It is planned to assess this alternateapproachasanindy'endentissue, Issue 145,"ImprovedSurveillance and Startup Testing Programs.
ITEM 125.I.6:
VALVE TORQUE, LIMIT, AND BYPASS SWITCH SETTINGS DESCRIPTION Historical Background One of the primary sources of failure of the Davis-Besse AFW isolation valves to reopen (see Issue 122.1) was ultimately tracedito the torque, limit, and bypass switches which control the motor operators of the valves 940 During the event, these valves were closed due to an operator error, shutting off all AFW flow.
Once closed, the resulting high differential pressure across the closed valves necessitated a relatively large force to start valve motion.
The valve motor-operator torque bypass switches were not adjusted to accommodate such a force and manual operation was needed to reopen the valves.
Issue 122.1.a, " Failure of Isolation Valves in Closed Position," deals specifi-cally_ with the case of AFW isolation valves.
However, at least some of the other motor-operated valves in the plant are designed by the same people that designed the AFW system and virtually all the valves in the plant are maintained by the same crews.
Therefore, the problems with-torque, limit, and bypass switch set-tings are not limited to AFW systems, but may affect any motor-operated valve in the plant.- Moreover, such problems have a high potential for causing corr. mon mode failures since redundant trains are probably maintdned by the same main-tenance personnel.
Safety Significance The safety concern of this issue is exactly that of IE Bulletin No. 85-03,103s
" Motor-Operated Valve Common Mode Failures During Plant Transients. Due to Im-proper Switch Settings." This Bulletin required all licensees to develtp and implement a program to ensure that valve operator witches are selected, set, and maintained properly for all valves in the high pressure injection, core 12/31/89 3.125-26 HUREG-0933
e Revision 6
)
spray and emergency feedwater systems (including BWR RCIC), that are reouired
_ [
to be tested for operational readiness in accordance with 10 CFR 50.55a(g).
Possible Solution i
4 IE Bulletin 85-031086 should resolve the safety concern of this issue for switch settings on valve operators in these specific safety _ systems.
The extension of this issue to other valves and/or extension of the issue to more general testing adequacy also needs to be considered.
However, the general question of test adequacy for all safety-related valves is the subject of Issue II.E.6.1,
" Test Adequacy Study." Given the existence of II.E.6.1, there is no need to extend or generalize Issue 125.I.6.
CONCLUSION
- The safety concern of this issue is being addressed by IE Bulletin 85-032088 and in the resolution of Issue II.E.6.1.
Thus, Item 125.I 6 was DROPPED as a separate issue.
ITEM 125.I.7:
OPERATOR TRAINING ADEQUACY This item was broken down into two parts that were e,aluated separately as shown below.
ITEM 125.I.7A: ' RECOVER FAILED EQUIPMENT V
DESCRIPTION Historical Background This issue-is based upon Finding 8 of the Incident Investigation Team's (IIT) 886 which states:
report L
The operators tenderstanding of procedures, plant system designs, and specific equipment' operation, and operator training all played a crucial role in their success in mitigating the consequences of ' e R
event.
However, if the equipment operators had been more fami'-
l with the operation of the auxiliary feedwater pump turbine tr1 l
throttle valve, auxiliary feedwater could have been restored averal minutes sooner."
l During the Davis-Besse event,'both AFW turbines tripped on overspeed.
These L
trips are not remotely resettable from the control room, but instead must be
[
reset manually at the turbines.
Two equipment o>erators were dispatched to the AFW turbines, but were unable to get the turaines running because they had never performed this opsration before.
(Hands-on practice of this task is not now a part of operator training.) The turbines were not started until atter the arrival of a more experienced operator.
l L
O i V L
12/31/89-3.125-27 NUREG-0933 1
E Revision 6 Safety Significance The safety significance of this issue lies in the probability of nonrecover-ability of safety systems.
In many cases, a given train of a given system may
- trip or otherwise fail to start on first demand, but may still successfully be placed in operation by prompt, knowledgeable human intervention.
Possible Solution TMI Action Plan Items I.A.2.2 and I.A'2.6 have addressed the issue of training and resulted in a policy statements " that endorsed the Institute of Nuclear Power Operations-managed training accreditation program which includes an ele-ment.to ensure that feedback from operating events is included in all utility training programs, NRC monitors and evaluates industry implementation of the INP0 accreditation program to ensure that:
(1) plant personnel are able to meet job performance requirements; (2) training properly accounts for pertinent safety issues; and (3) mechanisms exist for upgrading and assuring the quality of training programs.
Criterie to evcluate the industry training programs have been developed in NUREG-1220888 in' the resolution of Human Factors Issue HF2.1.
CONCLUSION This issue has been resolved by the issuance of the Commission Policy State-mentosa on Training and Qualifications and by Issue HF2.1.
Therefore, a new L
. and separate issue for this concern is not warranted and the issue was DROPPED from further consideration.
l ITEM 125.I.7.B:
REALISTIC HANDS-ON TRAINING L
DESCRIPTION Historical Background The issue calls for an assessment of the adequacy of hands-on training with respect to conditions that may be encountered in realistic situations, such as the loss of feedwater event-that occurred at the Davis-Besse plant on June 9,
-1985.940 The assessment may involve the operator's understanding of procedures, plant systems designs, specific equipment operations, and hands-on training in handling plant transient and upset conditions.
The issue stems from Findings-8 and 16 of the NRC investigationsse of the Davis-Besse event in which the NRC staff noted that the post-THI improvements that
- i focused on E0Ps and training played a crucial role in mitigatiag the Davis +Besse event.
However, if the equipment operators had been-more familiar with the operations of the AFW pump-turbine trip throttle valve,-AFW could have been restored several minutes sooner.
Also, for events' such as the Davis-Besse event-involving conditions outside the plant design basis (multiple equipment failures), operator training and operator understanding of systems and equip-ment are crucial'to the likelihood that plant operators can successfully handle L
. similar events.
i O
12/31/89 3.125-28 NUREG-0933 s--
L.
Revision 6 4
(
Safety Significance i
Assessments of the hands-on experience, referred to as performance-based training or Systems Approach to Training (SAT), are considered essential to providing as-surance that nuclear power plants are operated in a safe state under all operat-ing conditions.
This issue effects all operating nuclear power plants.
Possible Solution TMI Action Plan 48 items I.A.2.2 and I.A.2.6 included development of procedures to pro"ide assurance that:
(1) plant personnel are able to meet job perfor-mance requirements; (2) training properly account for pertinent safety issues, and (3) mechanisms exist for upgrading and assuring the quality of training programs.
I To help meet these objectives, NUREG-1220N was developed for use by NRC person-nel to review the INP0-managed performance-based training programs in nuclear power plants.
NRC will continue to closely monitor the process (INP0 Accredita-tion) and its results to. independently evaluate im lementation of these programs.
j The NRC review procedures developed in NUREG-12209 3 considered the following five elements as essential to these training programs:
(1) systematic analysis of the jobs to be performed; (2) learning objectives that are derived from the analysis and that describe desired performance after training; (3) training design and implementation based on the learning objectives; (4) evaluation of trainee mastery of the objectives during training; and (5) evaluation and revi-sions of the training based on the performance of trained personnel in job Q
settings (hands-on experience).
In accordance with NUREG-0985 851 the training issues included the closeout of the following TMI Action Plan 48 items:
I.A.2.2, " Training and Qualifications of-Operations Personnel"; I. A.2.7, " Training Accreditation"; I. A.2.5, " Plant Drills";
and I.A.2.3,." Administration of Training Programs." The specific issue of real-istic hands on training on equipment such as AFW pumps-is a performance-based element of.on-the-job training (0JT).
As such, mastery is determined by comple-tionofajobqualificationcardtothesatisfactionofaqualifiedOJTinstruc-tor using approved ovaluation criteria.
The INP0 Accreditation Program is in-tended to provide assurance that such training is included in industry programs.
NRC evaluates industry implementation of the Accreditation Program in accordance
-with the Policy Statement on Training and Qualification.888 i
CONCLUSION j
Based on the above discussion, this issue is covered by the Pol'cy Statement
- on Training and Qualifications and by the Human Factors Issue HF3.1.
Therefore, a new and separate issue for this concern is not warranted and the issue was DROPPED from futher consideration.
i O
V 12/31/89 2 125-29 NUREG-0933
Revision 6-ITEM 125.I.8:
PROCEDURES AND STAFFING FOR REPORTING TO NRC EMERGENCY RESPONSE l
CENTER
' DESCRIPTION HistoricalBackgroug i
This issue is based upon Finding 12 of the IIT reportass which states:
"The 6 vent was not reported to the NRC Operations Center in a manner reflecting the safety significance of the event.
The more serious the event, the more operator involvement required to i
maintain. plant safety.
For example, if the June 9 event had been protracted, knot ledgeable personnel would not have been available te maintain an open telephone line with the NRC."
Safety Significance It is evident from the IIT report 86 of the event that there were two problems:-
8 one associated with staffing and one associated with procedures.
The staffing problem was that all knowledgeable personnel were kept busy in dealing with the 3
event.
No one could be spared to keep the NRC Operations, Center informed.
Moreover, even if more plant staff had been available, it is likely that these 1 additional persons would have been pressed into service for plant operations.
Of course, bringing the plant to a safe condition does and should have priority.
But this also calls into question the usefulness of the dedicated phone lines to the NRC Operations Center.
1 The procedural problem was - ident in the fact that there was confesion because j
the emergency plan was sile on how'to determineLthe emergency action level if-the emergency classifica. ion changed during the event.
Obviously, the emergency procedures contained some ambiguity.
j For both problems, the result is a delay in notification of the NRC Operations Center.
Although it can be argued that notification of the NRC can have.little or no effect on plant events in the short term, the NRC can provide technical support and assistance over a period of several hours.
Moreover, the NRC can assist in coordinating evacuations, etc., if such should ever prove necessary.
Finally, the NRC.has other responsibilities not directly related to plant safety but nevertheless of importance, such as providing accurate and timely.-
information to the public, other government agencies, and the governments of.
l-other nations.
CONCLUSION The staffing problem is a duplicationtoos of the concern of TMI Action Plan 48 Item III. A.3.4, " Nuclear Data Link." in addition, the procedural problem has already.been addressed in existing regulatory requirements (10 CFR 50.72) and IE'Information Notice No. 85-80.
Furthermore, the IE Manual addresses the NRC
. regional responsibility for assuring that these reporting requirements are met. loo 3 This issue consists of two problems:
the first is a duplication of TMI Action Plan 48. Item III.A.3.4 (which has been resolved) and the second has been resolved 12/31/89 3.125-30 NUREG-0933
Revision 6
('N '
independently.1008 Therefore, this issue was' DROPPED from further consideration (V) as a separate issue.
ITEM 125.11.1:
NEED FOR ADDITIONAL ACTIONS ON AFW SYSTEMS During the event, the main feedwater system was lost and the reactor scrammed.
The AFW system should have activated and supplied feedwater to the steam genera-turs to enable them to remove decay heat.
However, during the course of the event, several failures occurred-(see Issue 122) that precluded using the steam generators to remove decay heat from the primary system.
The event highlighted the importance of the AFW system and also demonstrated that the AFW system might not have a reliability e.ommensurate with its importance. H 0 If the main feedwater system shuts down for any reason, the AFW system will supply sufficient feedwater to the steam generators to remove reactor decay heat.
If the AFW system were to fail also, there would be no feedwater supply at all.
The steam generators would beil off their remaining liquid water inven-tory and then dry out.
Depending on specific plant design, core uncovery will take place rougnly 30 to 90 minutes after the transient begins.
After steam s
generator dryout, there would be no decay heat removal and the continuing thermal energy production in the core would result in primary system heatup.
In most cases, the only means of decay heat removal involve use of the AFW sys-tem, recovery of the main feedwater system, or the use of feed-and-bleed tech-niques.
Of the three means, the use of the AFW system is subject to the highest O) availability.
The failure of the main feedwater system has roughly a 20% prob-s ability of not being recoverable in time.
Moreover, use of feed-and-bleed tecn-niques will release primary coolant to the containment necessitating extensive (and expensive) cleanup. The use of feed-and-bleed techniques, which remove decay-heat by venting hot primary coolaat to the containment and replacing the lost inventory in the primary system by means of the high pressure ECCS, could still prevent core uncovery.
If feed-and-bleed fails, the primary system will increase in temperature and pressure to'the point where the primary system safety valves open.
The pressure increase will then terminate, but the primary coolant will boil off until the core is uncovered and melts.
AFW systems are safety grade systems.
In addition, the availability of_ feed-and-bleed techniques provides a diverse backup.
Nevertheless, AFW reliability is very important for two reasons.
First, loss of main feedwater is a relatively common event, occurring roughly three orders of magnitude more often than (for example) small break LOCAs.
Thu., the AFW system is challenged far more often tnan the high pressure ECCS and therefore has a commensurately greater need for high reliability.
Second, although feed-and-bleed techniques provide a backup to AFW for removing reactor decay heat, feed-and-bleed is a means of core cool-ing for which the plant was not designed and may have a relatively high failure probability (see Item 125.II.9).
Because of these two reasons (frequent challenges and poor backup capability), it is very important that the AFW system have very high reliability.
Because loss of feedwater events are relatively frequent, the AFW system is g
subject to frequent challenges.
Therefore, the AFW system must be character-t ized by very high availability.
This issue consists of four parts, each of d '
which seeks to ensure adequate AFW reliability:
12/3V89 3.125-31 NUREG-0933
L r
Revision 6 (a) Two-Train AFW Unavailability This issue is concerned that AFW systems consisting of only two-trains may not have adequate reliabilicy.
(b) Review Existina AFW Systems for Single Failures This issue see(s confirmatory deterministic reviews of AFW systems at operating plants to ensure that they meet the single failure criterion.
(c) NUREG-0737 keliability Im)rovements This issue proposes that )RA analyses (i.e. fault trees) be performed on AFW systems at operating plants to ensure adequate reliability.
(d) AFW Steam anu Feedwater Rupture Control System /ICS Interactions in B&W Plants
.This issue is concerned explicitly with a possible design problem at B&W plants.
These four parts of the issue are prioritized separately below.
ITEM 125.II.1.A:
TWO-TRAIN AFW UNAVAILABILITY DESCRIPTION There are seven older PWRs that have two-train AFW systems.
(Originally,there were more but some plants have since added a third train or made other equiva-lent upgrades).
These AFW systems generally consist of one motor-driven train and one turbine-driven train and thus possess some diversity as well as redun-dancy.
However, the turbine-driven tidns have not proven to be as reliable as the motor-driven trains (except, of course, for the case where all AC power is lost).
The more modern practice has been to use a three-train system where twa trains are motor-driven and one is driven by a steam turbine.
Such a system will, in principle, be more reliable than the two-train systems described above, both because of the greater redundancy of the three vs. two trains and because of the lower reliance on the steam turbine.
CONCLUSION This issue is the same as Issue 124, "AFW System Reliability." Issue 124 will consider whether AFW system unavailability needs to be improved for plants with two-train designs.947 Therefore *is issue was DROPPED as a separate issue.
ITEM 125.II.1.B:
REVIEW EXISTING AFW SYSTEMS FOR SINGLE FAILURE DESCRIPTION Historical Background, The AFW system is considered an engineered safety feature and thus is required to meet the single failure criterion which can be considered a very primitive reliability requirement.
An unsuspected single failure susceptibility could increase the AFW-system failure probability by two orders of magnitude or more.
12/31/89 3.125-32 NUREG-0933
Revision 6 Safety Sionificance The issue addresses the concern that there may be some unsuspected single fail-ures which were not detected during the licensing process.
Therefore, this.
1 issue proposes to re-review the AFW systems of all operating PWRs to make doubly sure that no single failures exist which by themselves could cause all AFW trains to fail.
Possible Solution I
The systems to be examined have already been subjected to licensing review.
'Therefore, any single failures are not going to be obvious, but instead are likely to be quite subtle.
Very thorough reviews will be required.
It must-also be remembered that AFW trains are intentionally designed to be independent.
Any single failure found is most likely to be a subtle design anomaly which the
-designer (as well as all subsequent reviewers) failed to notice, i
Several AFW systems have been examined by OIE in the course of the Safety System Functional Inspection (SSFI) program.
Conversations with the SSFI team I
have indicated that some single failure problems as well as other potential common mode failures have been found by thir program.
However, these problems were not discovered by examining system des,gn, but instead arose in the course of very thorough investigations involving extended site visits, equipment in-spection, and interviews as well as design reviews.
Therefore, the proposed solution is not a simple design review, but instead is a more thorough investi-gation along the lines of the SSFI program.
Frequency Estimate The sequence of interest is straightforward.
It is initiated by a non-recoverable loss of main feedwater.
If the AFW system fails, the SUFP is not re-enabled in time, and feed-and-bleed techniques fail, core-melt will ensue.
i For the initiating event frequency (non-recoverable loss of main feedwater willuse0,64 event /RY,basedupontheOconeePRAconebyDukePowerCo.84),we This figure is based upon fault tree analysis and should be reasonably v
representative of most main feedwater system designs.
For a three-train AFW system, a " typical" unavailability is 1.8 x 10 5/ demand.894 The presence of a single failure susceptibility will greatly increasu this.
figure to perhaps the square root of the original figures because half the redundancy would be removed.
The change in AFW unavailability would then be about 4.2 x 10 3 failure / demand.
W will assume a typical value of 0.20 for the failure probability of feed-and-bleed cooling, based upon the calculations presented under Issue 125.II.9, " Enhanced Feed-and-Bleed Capability." Multi-plying these figures out, the change in core-melt frequency is:
(0.64/ year)(4.2 x 10.a)(0.20) = 5.4 x 10 4/ year Consequence Estimate The core-melt sequence under consideration here involves a core-melt with no large breaks initially in the reactor coolant pressure boundary.
The reactor is likely to be at high pressure (until the core melts through the lower vessel 12/31/89 3.125-33 NUREG-0933 1
Revision 6 l
l head) with a steady discharge of steam and gases through the PORV(s).
These are conditions likely to produce significant hydrogen generation and combustion.
]
The Zion and Indian Point PRA studies used a 3% probability of containment failure due to hydrogen burn (the " gamma" failure).
We will follow this example i
and use 3%, bearing in mind that specific containment designs may differ signif-icantl (the "y from this figure.
In addition, the containment can fail to isolate-i beta" failure).
Here, the Oconee PRA figure of 0.0053 will be used.
If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to fail by basemat melt-through (the " epsilon" failure).
Using the usual prioritization assumptions of a central midwest plains meteorology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are' i';
i Failure Percent Release Consequences Mode Probability Category (man-rem) gamma 3.0%
PWR-2 4.8 x 108 beta 0.5%
PWR-5 1.0 x 108 epsilon 96.5%
PWR-7 2.3 x 103 1
The " weighted-average" core-melt will have consequences of 1.5 x 105 man-rem.
There are 80 PWRs operating or under construction.
As of March 1988 (the earliest that any hardware changes are likely to be made), these 80 plants will have a combined remaining license lifetime of 2508.4 calendar years.
At a 75%
capacity factor, this is about 23.5 years of operation per plant.
Thus, the estimated risk reduction associated with.the possible solution to this issue is (5.4 x 10 4)(23.5)(1.5 x 10 5) man-rem / reactor or 1904 man-rem / reactor.
Cost Estimate The SSFI program has required about 1000 :taff-hours per plant and system, i
This is about $50,000 of salary and overhead.
In addition, hardware changes are likely to cost on the order of $100,000 per plant (i.e. more than $10,000 but less than $1,000,000) plus another $50,000 in paperwork.
Thus, wa will assume a cost on the order of $200,000/ plant.
Value/ Impact Assessment Based on a potential risk reduction of 1,904 man-rem / reactor and a cost of
$0.2M/ reactor, the value/ impact score is given by:
3 _ 1,904 man-rem /raactor j
50.2M/reactoe 9,520 man-rem /$M L
Other Considerations (1) The AFW system and its support systems do not contain contaminated fluids and are located outside of containment.
Thus, there is no ORE associated with the fix for this issue.
j 12/31/89 3.125-34 NUREG-0933 1
l
(2) Averted accident costs and averted cleanup exposure are considerations, but will only drive the priority figures still higher.
Thus, they will change no conclusions and will not be treated here.
(3) The high values of the parameters are predicated on finding at least one plant that needs upgrading.
The SSFI personnel emphasized that this is not likely to happen without an approach similar to that of the SSFI, but such an approach is likely to bear fruit.
It may be feasible to incorpo-rate this issue into the SSFI program.
CONCLUSION Based upon the figures generated above, this issue was given a high priority, but was later integrated into the Phase 11 activities scheduled for the resolu-tion of Issue 124.873 Thus, this issue is now covered in Issue 124.
I1EM 125.II.1.C:
NUREG-0737 RELIABILITY IMPROVEMENTS DESCRIPTION Historical Background After the TMI-2 accident, all PWR licensees were asked to perform an unavailabil-ity analysis of their AFW systems.
This information is now somewhat out of date partly because the AFW systems were subject to some (NUREG-0737)S8 modifi-846 cations after the analyses were made and partly because the analyses them-O' selves are rather primitive by modern standards.
Safety Significance This item seeks to upgrade the AFW unavailability analyses to reflect the NUREG-073798 modifications and improvements and to ensure that the AFW system reliability is commensurate with the system's safety importance.
Proposed Solution The proposed solution for this issue is to perform a PRA of all AFW systems and require modification of any systems which have an unacceptably high failure probability.
PRIORITY DETERMINATION Issue 124 "AFW System Reliability," will consider whether seven PWRs with two-train AFW systems have AFW system unavailabilities that need to be improved.
Therefore, this issue need cover only the three-train AFW systems.
To prioritize this issue, several questions need to be answered.
First, how reliable must the AFW system be to have reliability commensurate with its safety importance? Generic Issue 124 has selected an unavailability of 10 4 failure /
demand as the upper limit of acceptability.947 We will _se this same figure.
The second question is, how many plants are likely to be found which cannot meet the 10 4 failure / demand cutoff? Analyses of ten three-train AFW designs are summarized-in an RRAB memorandum 884 as follows:
12/31/89 3.125-35 NUREG-0933
Revision 6 Desion-Failure /Dranand log (failure / demand)
Summer l' 1.2 x 10 5
-4.92 McGuire 2.0 x 10 5
-4.70 Comanche Peak 2.0 x 10 5
-4.70 Diablo Canyon 3.7 x 10 5
-4.43 San Onofre-2&3 2.2 x 10 5
-4.66 SNVPPS 2.0 x 10 5
-4.70 Waterford' 1.4 x 10 5
-4.85 Midland 1.0 x 10 5
-5.00 Seabrook 2.0 x 10 5
-4.70 Catawba 0.7 x 10 5
-5.15 i
Arithmetic'Hean:
1.8 x 10 5
- Arithmetic Standard Deviation:
8.4 x 10 8 Logarithmic Mean:.
-4,78 Logarithmic Standard Deviation:
0.22 These 10 analyses can be considered a statistical sample.
The cutoff of 10 4 failure / demand is 9.76 standard deviations above the mean on a linear scale and 3.55 standard deviations above the mean on a logarithmic scale.
The shape of the distribution is unknown, of course, but we will examine both a normal and a log normal distribution and use the worst case.
Based upon these distributions and in the absence of any other information, if another three-train AFW design were evaluated, the probability of this new design being above the cutoff is:
Normal Distribution:
essentially zero Log Normal Distribution:
2 x 10 4 What-this means is that 10 sample designs are all well below the cutoff.
Had the sample average been close to just below 10 4, one would be confident of finding a plant or two over the limit.
However, the mean is far below the limit (where "far" is defined in terms of the width of the distribution) and the per-plant probability of being over the limit is small.
There are 80 PWRs operating or under construction.
Seven of these have two-train AFW systems and are covered by Issue 124; this leaves 73 plants.
The probability of detecting one or more of these plants with an AFW unavailability L
greater than 10 4/ demand is:
L 1 - (1 - 2 x 10 4)78 m (73)(2 x 10 4) = 0.014 That is, based upon the available knowledge regarding three-train AFW designs and in-the absence of other information, a PRA of all three-train AFW systems has only a few percent chance of finding a system that'needs upgrading.
(This does not mean that these AFW systems are problem free.
It does mean that the problems probably will not be found by means of PRA, unless considerably more information is available.)
Frequency Estimate The sequence of interest is straightforward.
It is initiated by a non-recoverable loss of main feedwater.
If the AFW system fails and feed-and-bleed techniques fail, core-melt will ensue.
12/31/89 3.125-36 NUREG-0933
Revision 6 For the initiating event frequency (non-recoverable loss of main feedwater willuse0.64 event /RY,basedupontheOconeePRAdonebyDukePowerCo.84),we This figure is based upon fault tree analysis and should be reasonably representative of most main feedwater system designs.
Next, the change in AFW failure probability must be estimated. We will assume that the AFW system "as is" has an unavailability equal to that of a " typical" two-trainAFWsgstemwhichwouldbeabout6.7x104/ demand,theaverageofthe seven plants.94 The AFW system failure probability after upgrading would be at most 10 4 Therefore, the change in probability would be about 5.7 x 10 4 We will assume a typical value of 0.20 for the failure probability of feed-and-bleed cooling, based upon the calculation < nresented under Issue 125.I1.9,
" Enhanced Feed-and-Bleed Capability." MR, alying these figures, the change in core-melt frequency is:
(0.64/ year)(5.7 x 10 4)(0.20) = 7.3 x 10 5/ year The number of hypothetical plants needing modification (expectation value) is 0.014. -Thus, the change in core-melt frequency for all reactors is 10 8/ year.
-Consequence Estimate The core-melt sequence under consideration here involves a core-melt with no large breaks initially in the reactor coolant pressure boundary.
The reactor is likely to be at high pressure (until the core melts through the lower vessel O
head) with a steady discharge of steam and gases through the PORV(s).
These are conditions likely to produce significant hydrogen generation and combustion.
The Zion and Indian Point PRA studies used a 3% probability of containment fail-ure due to hydrogen burn (the " gamma" failure). We will follow this example and use 3%, bearing in mind that specific containment designs may differ signif-icantly from this figure.
In addition, the containment can fail to isolate (the " beta" failure).
Here, the Oconee PRA figure of 0.0053 will be used.
If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to fail by basemat melt-through (the " epsilon" failure).
Using the usual prioritization assumptions of a central midwest plains meteor-ology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are:
Failure Percent Release Consequences Mode Probability Category (man-rem) gamma 0.3%
PWR-2 4.8 x 108 beta 0.5%
PWR-5 1.0 x 108 epsilon 96.5%
PWR-7 2.3 x 103 The " weighted-average" core-melt will have consequences of 1.5 x 105 man rem.
.Because this issue deals with only an expectation value for the number of plants, but does not necessarily expect to affect any specific plant, the per plant parameters (core-melt /RYandman-rem / reactor)arenotmeaningful.
Instead, the O
' aggregate" parameters (core-melt / year and total man-rem) are appropriate.
12/31/89 3.125-37 NUREG-0933
Revision 6 i
As of March 1988 (the earliest that any changes are likely to be made), the 73-subject plants will have a combined remaining life of 2317.8 calendar years.
At a 75% capacity factor, this works out to an average of 23.8 years of opera-tion remaining per plant.
Therefore, the change in risk for the hypothetical plant is 11 man-rem / year and the total tisk reduction for all reactors is 3.7 man-rem.
Cost Estimate 1
The costs involved would include administrative charges, the costs of the PRAs, and possibly costs of hardware changes, should they be required.
It is not clear at this point whether the PRAs would be done by the licensees or the NRC.
In any case, the cost of the PRA of one AFW system is likely to be on the order of $50,000 or more (half a staff year).
For 73 plants, this is $3.65M.
We will not calculate the administrative and hardware costs, but instead will use the $3.65M as a minimum figure.
Value/ Impact Assessment Based on an estimated risk reduction of 3.7 man-rem and a minimum cost of $3.65M associated with the possible solution, the value/ impact score is given by:
3.7 man-rem bI 53.65M 5 1 man rem /$M Other Considerations (1) The statistical logic presented above does not rule out specific systems needing attention. The proper conclusion is that, unless more information is forthcoming (for example, specific design or performance problems), a non-specific general search such as this is difficult' to justify because there is no specific reason to believe a problem will be found this way, based on past experience.
Also, the continuous distribution assumption implies that design anomalies, such as the single failures of Item 125.11.1.8, have been fixed.
This item must not be viewed in isolation.
(2)
Issue 124, "AFW System Reliability," in addition to its attention to plants with two-train AFW systems, also is considering whether to require confir-mation that the remaining PWRs have AFW system reliabilities that are less than 10 4/ demand.
However, Issue 124 has not produced a decision at this time, nor does a decision appear to be forthcoming in the near future.
Therefore, this issue cannot be subsumed within Issue 124.
(3) In most cases, the fix will not involve work within radiation fields and thus will not involve ORE.
(4) The ORE averted due to post-feed-and-bleed cleanup and post-core-melt cleanup is a minor consideration.
ORE associated with cleanup is esti-mated to be 1800 man rem after a primary coolant spill and 20,000 man-rem after a core-melt accident.64 If the frequency of feed-and-bleed events 12/31/89 3.125-38 NUREG-0933 l
Revision 6 is 5 x:10 6/ year, the actuarial cleanup ORE averted-is only 0.2 man-rem..
c.
-(
'Similarly, a total core-melt frequency of 10 6/ year corresponds to an
-(
actuarial averted cleanup ORE of only 0.5 man-rem.
If averted ORE wen added to the man-rem / reactor and man-rem /$M, figures above, no conclusions would change.
(5)- The proposed fix would reduce core-melt frequency and the frequency of feed-and-bleed events and, therefore, would avert cleanup costs and re-placement power costs.
The cost of a feed-and-bleed usage is dominated by roughly six months of replacement power while the cleanup is in progress.
.If the average frequency of such events is 5 x 10 6/ year and the average remaining lifetime is 31.7 calendar years at 75% utilization, then making the usual assumptions of a 5% annual discount rate and a replacement power cost of.$300,000/ day, the actuarial savings for feed-and-bleed cleanup are
$3,300.
Similarly, the actuarial savings of averted core-melt cleanup (which is assumed to cost one billion dollars if it happens) are about.
$12,000. 'The actuarial savings from replacement power after a core-melt-up to the end of the plant life are also about $12,000.
(This last figure represents the lost capital investment in the plant.) If these theoretical cost savings were subtracted from the expense of the fix, the man-rem /$M-would not change significantly.
CONCLUSION Based upon the figures above, this issue was DROPPED from further consideration.
O ITEM 125. II.1.D: AFW STEAM AND FEEDWATER RUPTURE CONTROL SYSTEM /ICS INTERAC-J i'G TIONS IN B&W PLANTS DESCRIPTION This issue is centered upon the subject of the reliability of the AFW system 940 and wt.lch is safety grade.
This item is targeted specifically at B&W plants l
would require a reexamination of the AFW system reliability.848 The reasons given are two-fold.
First, assessments made shortly after the TMI accident i
y indicated that the AFW system in B&W plants had (at that time) an unavailabili-ty approximately.an order of magnitude higher than those in most other PWRs.848 (This does not account for the subsequent modifications to these AFW systems.)
Second, this item calls for explicit attention to the interactions between the AFW system and the Steam and Feedwater Rupture Control System (SFRCS) and between the AFc system and the Integrated Control System (ICS).
Such interactions are important because the initiating transient may well be caused by a problem with the ICS and any possible interactions between the ICS and AFW or SFRCS would be a potential source of a common mode failure, defeating the system needed to mitigate the transient.
PRIORITY DETERMINATION On the general question of AFW unavailability, the B&W plants have alread-updated their reliability analyses to reflect the ost-TMI modifications.
- 6 These updates have satisfied the original _ concern. 48 O
V 12/31/89 3.125-39 NUREG-0933
Revision 6 The specific issue of the ICS-SFRCS-AFW interactions deserves more discussion.
The function of an SFRCS is to control the AFW system.
The name (Steam and Feedwater Rupture Control System) is somewhat misleading in that the SFRCS also initiates AFW for loss of main feedwater events.
Those plants with an SFRCS should have no interactions between the ICS and the SFRCS or AFW systems.
There are some B&W plants that have used the ICS to control the AFW system.
Of these, two plants (Crystal River and ANO-1) have installed an " Emergency Feed-water Initiation and Control (EFIC) System" to replace the ICS as the control system-for AFW.
(The EFIC system is an improvement over SFRCS in that the EFIC system will not allow both steam generators to be isolated simultaneously.
The SFRCS at Davis-Besse has also been modified such that it will no longer allow both steam generators to be isolated simultaneously.) Of the two remaining plants, Rancho Seco will install an EFIC system at its next refueling outage and TMI-1 will install a system similar to EFIC,-but designed by the licensee, at its next refueling outage.
Under these circumstances, the concern is not with SFRCS-AFW interactions, but instead reduces to ensuring that there is no interaction between the ICS and the AFW or its control. system that can cause a common mode failure.
For plants with two-train AFW systems, this will be covered by the analyses of Issue 124.S " '849 The remaining plants will be examined under the B&W Reassessment Program which places considerable emphasis on the 10S.850 CONCLUSION This item is covered in Issue 124 and the B&W Reassessment Program and was DROPPED as a separate issue.
ITEM 325.II.2:
ADEQUACY OF EXISTING MAINTENANCE REQUIREMENTS FOR SAFETY-RELATED SYSTEMS DESCRIPTION 1
l Historical Background The objective of this issue is to assess tne adequacy of existing maintenance i
requirements and their impact on -the reliability of safety-related systems.840 The IIT-concluded that the underlying cause of the Davis-Besse went was the licensee's lack of attention to detail in the care of plant equipment.sse l
Safety Significance Inadequate and/or improper maintenance of equipment, components, and systems relied on for safe operations of the plants can lead to loss of safety func-tions.
The loss of safety functions of the safety-related systems can increase the severity of transients and lead to severe core damage and possibly a core-melt.
Given a core-melt and loss of containment integrity, public. radiation l
exposure would result from the release of fission product materials.
The y
issue is applicable to all operating nuclear power plants.
O 12/31/89 3.125-40 NUREG-0933 1.
o
Revision 6
- p
. _P_ossible Solutions For the Davis-Besse plant, the staff conducted a maintenance survey consistent with the NRC Maintenance and Surveillance Program Plan (MSPP) as a result of the IIT conclusions sso As a result of the survey, the staff identified a number of weaknesses impeding the conduct of maintenance activities at the Davis-Besse plant.2011 A subsequent NRC follow-up survey of the Davis-Besse maintenance activities in March 1986 indicated that the licensee had made con-siderable progress in all maintenance areas except maintenance backlog since the previous survey.
Particular strengths noted were in the areas of mainte-nance training, spare parts, and material readiness.
Based on the results of the March 1986 survey, the NRC concluded that the Davis-Besse new maintenance organization was functioning as planned, and no major identifiable weaknesses were evident.
The few remaining problem areas noted by the staff were not con-sidered programmatic weaknesses that would adversely affect the functioning of the maintenance organization.1011 In response to Issue 3 of the Commission Policy and Planning Guidance,21o the staff developed the MSPP that consisted of two phases:
Phase I and Phase II.
The findings of the Phase I activities are reported in NUREG-1212.1013 Essen-tially, the Phase I objectives (which are complete) have addressed the~objec-tives of this issue.
In brief, Phase I of the MSPP was designed to survey current maintenance practices in the nuclear utility industry, evaluate their effectiveness, and address the technical and regulatory issues of nuclear power plant maintenance.
O Thirty-one measures of maintenance were developed for Phase I of the MSPP.
ij These measures were then organized into the following five categories:
(1) overall system / component reliability; (2) overall safety system reliabil-ity; (3) challenges to safety systems; (4) radiological exposure; and (5) regu-latory assessment.
An analysis of the overall trends and patterns across the above five categories of maintenance revealed several important trends.
In general, although plant maintenance performance showed some' improvement from 1980 to 1985, the safety systems reliability for all plants did not signifi-cantly change since 1981.
Thus, the contribution of maintenance to reliabil-ity problems indicated that some maintenance programs _and practices are not effective.
The Phase I findings confirmed that there are wide variations in maintenance practices among utilities and the industry has established a variety of programs aimed at self-improvement that do not appear to be well-integrated or effectively implemented in some cases.
The resolution of the issues identi-fied in Phase I of the MSPP will be addressed in Phase II of the MSPP.
The Phase II activities of the MSPP are being addressed under Issue HF8.
In brief, Phase II of_the MSPP requires the staff to:
(1) gather data to support a definition of the role of maintenance in safety; (2) develop goals for plant reliability in ensuring effective maintenance; (3) assess data to determine performance-oriented maintenance criteria; (4) make recommendations for en-dorsement of good maintenance practices; (5) recommend improvements to the maintenance / operations interface; (6) provide input to draft industry standards for maintenance; and (7) assess industry programs in self-improvement of main-i tenance programs.
O 12/31/89 3.125-41 NUREG-0933
Revision 6 CONCLUSION
-The maintenance-related problems identified by the NRC IIT for the Davis-Besse plant were resolved.1021 For all operating plants, the objectives of this issue were essentially completed by Phase I of the existing MSPP.
Phase II of the MSPP (Issue HF8) will follow up and address problem issues identified in Phase I of the MSPP that warrant further NRC and industry actions.1028 There-fore, this issue was DROPPED as a separate issue.
ITEM 125.II.3:
REVIEW STEAM /FEEDLINE BREAK MITIGATION' SYSTEMS FOR SINGLE FAILURE DESCRIPTION Historical Background During the investigation of the Davis-Besse event, the importance of'the SFRCS became evident.- Although the name of this system implies that its purpose is to mitigate steam and feedwater line breaks, in actual practice this is the AFW control system.
Thus, the functions of this control systera are more general than the name implies.
Safety Significance Steam / feed line break mitigation systems vary in title and in detailed design from plant to plant and from vendor to vendor.
However, they are generally composed of two logic trains in order to meet the single failure criterion, i
The presence of an unsuspected single failure would have the potential to greatly increase the probability of system failure.
This has safety signifi-cance f9 several accident scenarios.
First, the reliability of mitigation of a steam or feedwater line break would be adversely affected.
During such an event, the mitigation system isolates both the steam line and the feedwater (main and auxiliary) lines associated with the depressurizing steam generator.
For most breaks outside containment, this stops the blowdown.
For a break inside containment, the secondary side of the affected steam generator will blow down to the containment atmosphere, but isolation of feedwater to the affected steam generator will prevent continued long-term steaming due to decay heat from the reactor core.
This is necessary to ensure that the containment design pressure is not exceeded.
This scenario is also the concern c; de 125.II.7, " Reevaluate Provision to Automatically Isolate Feedwater from Steam Generator During a Line Break." The safety concern expressed here is not a duplication of Issue 125.II.7; rather, Issue 125.11.7 questions the necessity of having this automatic isolation provi-sion and thus is opposite in its thrust.
Nevertheless, a detailed examination of the significance of this scenario is presented in the prioritization of.
Issue 125.11.7 and will not be treated further here.
The second scenario is the loss of feedwater transient.
If main feedwater is lost and not readily recoverable and a single failure in the AFW controi-system defeats AFW, most plants will have to use feed-and-bleed core cooling techniques to prevent core-melt.
Because the viability of feed-and-bleed cooling is often 12/31/89 3.125-42 NUREG-0933
Revision 6 l
questionable, and because non-recoverable loss of main feedwater events have in fact occurred many times, the reliability of the AFW system and its control system is of considerable importance.
This is exactly the safety concern of 4
Issue 125.II.1.b, " Review Existing AFW Systems far Single Failure." Thus, this safety concern is a duplicate of Issue 125.II.1.b.
The third scenario is specific to B&W plants.
These plants provide AFW to the steam generators by means of a special AFW sparger.
This sparger is located high in the steam generator end sprays water onto the steam generator tubes.
The advantage of this arrangement is that it enharces natural convection through the primary system when forced circulation is lost.
If a loss of forced circu-lation (i.e. trip of all four reactor coolant pumps) transient were to occur and AFW were to fail, natural circulation might not provide sufficient core i
cooling to prevent cladding failure, even if some feedwater were being supplied i
to the secondary side of the steam generators.
This is somewhat different from the safety concern of Issue 125 II.1.b which is concerned with AFW reli-ability during loss of feedwater transients.
Nevertheless, any upgrades brought about by the resolution of Issue 125.II.1.b should address the loss of forced circulation concern as well.
Therefore, this concern is also covered by Issue 125.II.1.b.
CONCLUSION This issue has three aspects:
(1) line break mitigation, which is covered in j
Issue 125.11.7; (2) loss of feedwater, which is covered in Issue 125.II.1.b; and (3) loss of forced circulation, which is also covered in Issue 125.11.1.b.
Therefore, this item was DROPPED as a new and separate issue.
ITEM 125.II.4:
THERMAL STRESS OF OTSG COMPONENTS DESCRIPTION Historical Background This issue addresses the effects of thermal stresses induced on the OTSG from a loss of feedwater transient and was based on RES concerns.841'942 l
Safety Significance The safety concern raised was that the introduction of the recovered feedwater to the dry OTSG, following the Davis-Besse transient, may have degraded the structural integrity of the OTSG and the steam generator tubes.
Tlie resulting transient-induced thermal-stresses might lead to increased rupture frequencies for the steam generator components which, in turn, would increase the plant's core-melt frequency and the potential radiological risks to the public.
PRIORITY DETERMINATION Following the Davis-Besse transient, the staff reviewedS43 the B&W analysis regarding the possible effects of the transient to the structural integrity of the Davis-Besse OTSG.
Comparisons were made between the Davis-Besse event and the B&W design basis analyses.
Therefore, the conclusions reached herein are considered applicable to similar transients of similar OTSGs (B&W) plants.
12/31/89 3.125-43 NUREG-0933 k
0 Revision 6 This issue is not applicable to CE or W PWR plants that have U-Tube heat exchanger designs and AFW injection'that does not spray directly on the steam generator tubes.
The following components were consideted to be the most highly stressed during transients involving boiled-dry OTSGs and subsequent recovery of auxiliary and main feedwater:
(1) AFW Nozzle, (2) Main Feedwater Nozzle, (3) AFW Jet Impinge-ment on Steam Generator Tubes, (4) Strasses on Steam Generator Tubes Due to Steam Generator Shell/ Tube Thermal Stress, (5) Degraded Steam Generator Tubes, I
and (6) Thermal Shock of Lower Tube Sheet.
AFW Nozzle: The stress and fatigue analyses of the AFW nozzle resulting from j
the Davis-besse transient were compared to the original design basis temperature i
difference of 530 F between the hot steam generator shell and the AFW injection 1
temperature.
During the transient, the temperature difference was 501'F which is within the design basis analyses.
The fatigue usage factor that was predi-cated on 875 AFW initiations, was also considered acceptable.843 Similar design basis analyses are conducted for all B&W OTSG designs except that the numbers of transients and nozzle designs are plant-specific.845 There-fore, the thermal stresses and fetigue component resulting from similar events are bounded by the original B&W design basis analyses.
Main Feedwater Nozzle:
The original design basis stress analysis for the Davis-Besse OT5G was based on a temperature difference of 445'F between the main feed-water nozzle and the feedwater.
Durin ture difference was approximately 162'g the Davis-Besse transient, the tempera-F.948 Therefore, the thermal stresses i
and fatigue factor resulting from the transient were considered bounded by the original B&W design basis.
Similar design analyses are conducted for all B&W OTSG designs with the same exceptions as noted for the AFW nozzles.845 AFW Jet Impingement on Steam Generator Tubes:
The original design basis assumed a temperature difference of 586"F between the AFW coolant and the steam genera-tor tube surfaces.
Based on thermocouple data, the temperature difference between the steam generator tubes and the AFW was determined to be approximately 523'F.943 Therefore, the thermal stresses and the fatigue factor (based on 29,400 cycles in the original Davis-Besse OTSG design basis) resulting from the transient were considered bounded by the original B&W design basis.
Similar analyses (with the exception of the number of transients) have been conducted for all'B&W OTSGs.945 Steam Generator Shell/ Tube Thermal Stress:
Temperature differences between both steam generator shells and their tubes and the pressure differences across the tube sheets were analyzed based on thermocouple readings. The maximum temperature difference in one of the two steam generators was estimated to be approximately 72 F.
The resulting stresses and fatigue component were deter-mined to be acceptable by_the staff.943 Degraded Steam Generator Tubes:
In NUREG-0565,98 the staff aiscussed its evaluation of B&W's analyses of potential defective steam generator tubes with up to 70% through-wall defects.
The B&W thermal stress conditions included ten transients with maximum flaw orientations following a SBLOCA.
The O
12/31/89 3.125-44 NUREG-0933 1
Revision 6 em secondary side was postulated to have boiled dry and the primary system was l f significantly voided.
The cold AFW impinging on the steam generator tubes and U
the pressure loads resulting from the tube-to-shell temperature differences, in combination with the potential effects of slug flow in the steam generator tubes from the voiding primary system, was evaluated.
The staff concluded that the combination of conservative analyses and the test results provided assur-ance that structural integrity of the primary coolant pressure boundary (steam generator tubes) would be maintained.
Thermal Shock of Lower Tube Sheet:
The stress and fatigue analyses relative to thermal shock of the lower tube sheet from the Davis-Besse transient were reviewed by the staff.
The stresses and fatigue usage factor resulting from i
the transient were determined to be negligible.
Therefore, it was concluded that the tube sheet was essentially unaffected by the Davis-Besse transient.848 CONCLUSION The staff has raised concerns relative to potential beyond design basis condi-tions that may increase the primary system temperatures above those previously analyzed.
The higher superheat ttmperatures will lower the steam generator tube strength or, in combination with injected cold AFW temperature, might increase the thermal stresses.
These conditions might then further degrade or fail-the primarg44 pressure boundary.
This potential phenomenon is being studied by the staff.
The staff concluded that transients similar to the Davis-Besse transient are o
bounded by the original B&W design basis analyses.
design basis adequately accounts for such anticipated operational occurrences.
A Based on the staff findings, this issue involves no increase in risk to the public and was DROPPED from further consideration.
The potential superheat phenomena being studied by the staff is beyond the current design basis.
Should the results of the superheat studies indicate a need for changes in the design basis of the primary and secondary pressure boundaries, it is recommended that any follow-up effort be prioritized as a new and separate issue.
ITEM 125.11.5:
THERMAL-HYDRAULIC EFFECTS OF LOSS AND RESTORATION OF FEEDWATER ON PRIMARY SYSTEM COMPONENTS DESCRIPTION Historical Background The Davis-Besse plant recovered feedwater flow following the loss of feedwater transient on June 9, 1985.
With the loss of feedwater to the steam generators, heatup of the reactor coolant system peaked at about 592 F and then, following recovery of the feedwater, decreased to 540 F in approximately six minutes (normal post-trip average temperature is 550 F).
Thus, the reactor coolant system experienced an overcooling transient rate of 520 F/hr for the 6-minute time interval.
12/31/89 3.125-45 NUREG-0933
Revision 6 Due to concerns identified,9415942 the staff was requested 04o to review and evaluate the safety significance of the thermal-hydraulic effects (potential pressurized thermal shock) to reactor pressure vessels, nozzles, and downcomer surface areas,from such overcooling transients.
Safety Significance The potential for pressurized thermal shock (PTS) to the reactor pressure vessel (RPV) and components from overcooling transients is more critical to PWRs by virtue of their designs.
Therefore, this issue is applicable to all PWRs.
With increased neutron radiation exposure, the temperature at which the RPV materials fracture toughness decreases to unacceptable limits increases.
Thus, with time (neutron radiation exposure), the magnitude of the thermal stresses which are also compounded by pressure-induced stresse during over-cooling transients, could approach reduced fracture toughness capabilities of L'
the RPV materials.
Structural failure (fracture) of the RPV, to an extent that would make the RPV unable to contain sufficient water to cover the reactor core, would result in a core-melt.
Given a core-melt and subsequent loss of containment integrity, public radiation exposure would result from the release of fission product materials.
Possible Solutions For the Davis-Besse plant, the staff reviewed and evaluated the licensee's PTS calculations and r'esults related to the June 9, 1985 event.
Based on the i
staff's findings,1011 the temperature of the limiting weld in the Davis-Besse l
RPV would have had to drop an additional 377 F to cause crack-initiation to become a significant PTS event.
4 To ensure that nuclear power plants do not operate with unacceptable PTS risks, the NRC promulgated a final ruletot2 in July 1985 that amended its regulations to:
(1) establish a screening criterion related to the fracture-resistance of PWR vessels; (2) require analyses and a schedule for implementation of neutron flux reduction programs to avoid exceeding the screening criterion; and (3) require detailed safety evaluations to be performed before plants commence operations beyond the screening criterion.
The final PTS rule was a result of extensive analyses performed by the NRC staff (USI A-49, " Pressurized Thermal Shock") and several industry groups. The analyses covered all conceivable PTS events, including RPV overcooling transients, tnat were more severe than the Davis-Besse event.
CONCLUSION The PTS concern from the Davis-Besse event was resolved in NUREG-1177.2011 All other conceivable PTS concerns were addressed in the resolution of USI A-49 and the final PTS rule.1o12 Therefore, this issue was DROPPED as a separate issue.
O 12/31/89 3.125-46 NUREG-0933 l
Revision 6 A
ITEMS 125.11.6:
REEXAMINE PRA ESTIMATES OF CORE DAMAGE RISK FROM LOSS OF ALL f
FEEDWATER DESCRIPTION The memorandum which initiated this action recommends that plant-specific reliability data be solicited from Toledo Edison Company (the licensee for Davis-Besse).3004 This information would then be used by de NRC staff to formulate a new and revised model for estimating the frequenev of severe acci-dents involving loss of main feedwater at the Davis-Besse plant.
The purpose of this effort was to provide information, in addition to the refults of deterministic reviews, to aid in decision-making concerning the t tstart of the Davis-Besse plant.
CONCLUSION This task is a legitimate action on the Davis-Besse unit, but is not intend-ed to address other plants since they are not in need of a restart decision.
Therefore, the issue is not generic but is specific to one unit.
- However, before dismissing the issue, its generic potential should be explored:
What benefits would be reaped if other plants were investigated and modeled with
.l plant-specific data? Evaluations of plants with two-train AFW systems are being made in the resolution of Issue 124, "AFW System Reliability," and investigations along this line for all plants are also being considered.
In addition, Issue 125.II.1.b, " Review Existing AFW Systems for Single Failure,"
deals with gathering of plant-specific information and Issue 125.II,1.c.
O "NUREG-0737 Reliability Improvements," rieals with specific AFW system reliabil-ities.
Finally, USI A-45, " Shutdown Decay Heat Removal Requirements," deals with the question of plant safety for events (such as loss of all feedwater) where the plant's heat sink is lost.
In view of the existence of all these issues, there is little to be gained by generalizing this new proposed action to form an additional generic task.
As a result, this issue was placed in the DROP category.
ITEM 125.11.7:
REEVALUATE PROVISION TO AUTOMATICALLY ISOLATE FEEDWATER FROM 1
STEAM GENERATOR DURING A LINE BREAK DESCRIPTION Historical Background During the course of the investigation of the event, it was pointed out that the. benefits of AFW isolation are probably more than outweighed by the negative aspects of this feature.940'851 l
Safety Significance The automatic isolation of AFW from a steam generator is provided to mitigate the consequences of a steam or feedwater line break.
The isolation logic, usually triggered by a low steam generator pressure signal, closes all main steam isolation valves and also isolates AFW from the depressurizing steam O
generator.
(The AFW flow is diverted to an intact steam generator.) The V
purposes of the AFW isolation are three-fold:
12/31/89 3.125-47 NUREG-0933
Revision 6 (1)= The break blowdown is minimized.
Shutting off AFW will not prevent the initial secondary side inventory from blowing down.
However, the isola-tion will prevent continued steaming out of the break as decay heat continues to produce thermal energy.
(2) Overcooling of the primary system is reduced.
As the depressurizing steam generator blows down to atmospheric pressure, the primary system is cooled down, causing primary coolant shrinkage and (if the event occurs near the end of the fuel cycle) a return to criticality, which adds a modest amount of thermal energy to the transient.
Shutting off feedwater to the faulted steam generator will reduce this effect, although once again the initial i
blowdown will be the dominant factor.
I The significance of these first two considerations is in containment pressure.
The containment is designed to accommodate a primary system blowdown followed by decay heat boiloff (the large break LOCA).
A steam or feedwater line break within containment might cause the containment design pressure to be exceeded if the AFW isolation were not present.
(3) The AFW isolation is needed to divert AFW flow to the intact steam genera-tor (s).
For the case of a two-loop. plant with a two-train AFW system, this is needed to meet the single failure criterion in supplying feedwater to the intact steam generator.
(The situation becomes more complex for other cases, e.g. a four-loop plant with a three-train AFW system.) Note that, unless the line break is in the AFW line, core cooling would still meet the single failure criterion even without the isolation, since *.he faulted steam generator would still be capable of heat transfer.
i In summary, the automatic isolation is neeotd only to help mitigate a relatively rare event (steam or feedwater line break) rnd even then is only remotely connected with sequences leading to core-melt.
In contrast, this isolation has definite disatvantages.
If both channels of the controlling system were to spontaneously ac+.uate during normal operation, all AFW would be lost and the MSIVs would close.
Most newer plants use turbine-driven main feedwater pumps.
Thus, main feedwater would be lost also.
If the j
plant operators fail to correctly diagnose and correct the problem, only feed-l and-bleed cooling would be available to prevent core-melt.
Similarly, if spur-ious AFW isolation were to occur during the course of another transient, once again only feed-and-bleed cooling would be available to prevent core-melt.
The long-term success of AFW for main feedwater transients, steam generator tube ruptures, and small LOCAs may also be comprcmised.861 During controlled cooldown, the thresholds for automatic AFW isolation are crossed.
Procedures call for operators to lock out the isolation logic as the steam generator pres-sure approaches the isolation setpoint.
Under the circumstances, the accompany-ing distractions make it possible that the operators will forget to override the AFW isolation logic in the permissive window.
Thus, AFW reliability in these scenarios may be significantly degraded.
The safety significance of this issue arises from the fact that the negative aspects involve accident sequences which have more frequent initiators, and more significant consequences, than those of the positive aspects.
12/31/89 3.125-48 NUREG-0933
Revision 6 4
[]
Possible Solution A very straightforward solution has been proposed:
simply disconnect the AFW isolation valve actuators from the automatic logic and depend on plant proce-duras, i.e., have the operators close the AFW isolation valves operationfromthecontrolroom)intheeventofalinebreak.'(byremotemanual 1
These proce-dures would require careful verification of the existence of a line break before isolating a steam generator from AFW.
_ PRIORITY DETERMINATION Frequency Estimate It is necessary to calculate estimates of both the positive and negative aspects of disabling the automatic AFW isolation.
The positive aspects are due to a decrease in the frequency of loss of all feedwater events.
There are three accident sequences of interest.
(1) The first sequence is initiated by a spontaneous actuation of both chan-nels of the isolation lo prioritiration purposes.gic.
(We will assume a two-loop plant design for
) There is no cata readily available for such actuations.
However, it is possible to make an educated guess.
EPRI NP-2230307 provides some perspective, based upon actual experience with other systems:
Inadvertent Safety Injection Signal, PWR 0.06/RY (O
~)
Steam Relief Valve Open, PWR 0.04/RY Inadvertent Startup of BWR HPCI 0.01/RY Based upon these figures, it is expected that spontaneous actuations will occur with a frequency on the order of 0.03/RY.
Of course, this would isolate only one steam generator.
However, such systems generally have a common mode failure probability on the order of 5%.
(In addition, the second train of AFW has an unavailability due to other causes of roughly 1%.
However, the main feedwater system would still be available in this case.) Thus, the frequency of both steam generators isolating is (0.03/RY)
(0.05), or 1.5 x 10 3/RY.
Of course, the plant operators.are likely to reset the logic and turn the transient around. We will assume a 1% (mini-mum) failure probability for recovery by operator action.
This leaves feed-and-bleed cooling for which we will assign a typical failure probabil-ity value of 0.20 and a maximum failure probability of 0.60, based on the calculations presented under Item 125.11.9, " Enhanced Feed-and-Bleed Capability." Multiplying these figures gives a core-melt frequency of 3 x 10 6/RY typical, 9 x 10 6/RY maximum.
(2) The second sequence is initiated by another, independent transient.
During L
the course of this transient, and the consequent perturbation of a great many plant systems, the AFW isolation logic is triggered.
The MSIVs close, l
causing a loss of main feedwater (if main feedwater has not previously l
been lost), and tht. AFW isolates.
Again, unlesc the AFK isolation valves
! ' fm are reopened, only feed-and-bleed is available as a means of core cooling.
l l
)
1 v l
l 12/31/89 3.125-49 NUREG-0933
Revision S The AFW isolation logic can be triggered during a transient in two ways.
The first is by some type of inadvertent systems interaction, e.g., elec-tromagnetic coupling.
The proper fix for this problem is to eliminate the systems interaction which may well have other consequences in addition to AFW isolation.
Therefore, this effect will not be considered here.
The second way to trigger AFW isolation is by the actual existence of low pressure in the secondary system caused by the initiating transient.
In thiscase,theisolationisworkIngasdesigned(butnotasintended).
Low pressure transients are relatively rare, since the steam space in question is usually right on top of a significant quantity of water at saturation temperature.
Low pressure will occur only if steam is vented at a rapid rate in sufficient quantity to cool the water inventory via boiloff to the point where saturation pressure drops below the AFW isola-tion setpoint.
The other possibility is a dryout of the steam generator.
This is possible for B&W plants because of the relatively low water inven-tory in the steam generators.
However, such an event in a Westinghouse or CE plant would probably imply that the main feedwater and AFW had already failed.
There is no readily available way of aatimating the probability of a pressure drop, given a transient.
However, EPRI NP-2230807 gives a fre-quency of 0.04/RY for events where PWR steam relief valves open.
- Thus, we can assume that depressurization events occur with at least this fre-quency.
If we further assume that perhaps 10% of these pressure drops are deep enough to trigger AFW isolation, and again assume a 1% probabil-ity of failure of the o erators to recover AFW the resulting core-melt frequenciesare8x10g/RYtypical,2.4x105 i
/RY maximum.
(3) The third sequence involves the long term success of AFW for main feedwater transients.
During controlled cooldown, the thresholds for automatic AFW isolation are crossed.
Procedures call for the operators to lock out the isolation logic as the steam generator pressure approaches the setpoint.
If the operators fail to do so, both trains of AFW will isolate.
Main feedwater is also unavailable, since its loss initiated the transient.
Again, only feed-and-bleed would be available. for core cooling.
Non-recoverable loss of main feedwater events are estimated to occur with a frequency of 0.64/RY.9s2 We will assume a 1% minimum probability of operator failure to bypass the isolation logic and another 1% minimum pro-bability of failure of the operators to recover the AFW system.
In addi-tion, there is still feed-and-bleed cooling which, because the plant is already partially cooled down, should have a better than usual chance of succeeding. We will therefore assume 10% instead of 20% or 60% for feed-and-bleed failure probability.
The result is a core-melt frequency of 6.4 x 10 8/RY.
The three sequences above add up to a " typical" core-melt frequency of 1.7 x 10 5/RY and as much as 3.9 x 10 5/RY for a plant with marginal feed-and-bleed capability.
Now we must estimate the negative aspects of the proposed fix.
O 12/31/89 3.125-50 NUREG-0933 L
f
, _. ~ _..
Revision 6
.fm The first negative scenario is the-feedwater line break.
Here, a break in the
-l V feedwater line to one steaa generator initietes the sequence.
With the pro-1 posed fix, the line is not isolated and one t ain of AFW simply pumps water out of the break.
If the operator fails to manually isolate the break, the remain-ing AFW train fails, and feed-and-bleed techniqua fail, core-melt will result.
Steam and feedwater line breaks are estimated to oc cur at a combined rate of 10 3/RY (see Issue A-22).
Becausesteamlinesarelargerandnotassubject to break than the steam lines. feedwater lines are expected to be more likely to water hammer phenomena the i
We will therefore arsume that feedwater lines will break with a frequency of 9 x 10 4/RY, i.e. 90% of the total line break frequency.
The unaffected single train of AFW should have a failure probability on the order of 0.01 or less.
Consistent with the positive scenario calculations, we will assume a 1% probability of operator failure to manually isolate the affected steam generator and a 20% typical, 60% maximum feed-and-bleed failure probability.
The product is a core-melt frequency of 1.8 x 10 8/RY typical and 5.4 x 10 8/RY maximum.
The remaining scenario is a steam line break.
This scenario may involve the theoretical possibility of containment failure by overpressure, but does not lead to core-melt.
We will assume a 10 3/RY frequency of line break as before and a 10% probability that the line break is.in the steam lines as opposed to the feedwater line breaks of the previous scenario.
Once again, the probabil-ity of the operator to fail to manually isolate is assumed to be 1%.
The fre-A' quency of higher than expected containment pressure due to long term-steaming (J
in the faulted steam generator is then 10 6/RY.
The change in core-melt frequency is the algebraic sum of the various scenarios:
Core-melt Averted /RY Typical Maximum Spontaneous Actuation 3.0 x 10 6 9.0 x 10 6 Transient Initiated 8.0 x 10 6 2.4 x 10 5 Cooldown Initiated 6.4 x 10 6 6.4 x 10 6 Feedwater Line Break
-1.8 x 10 8
-5.4 x 10 8 Net change in core-melt frequency 1.7 x 10 5 3.9 x 10 6 The estimated reduction in core-melt frequency for all reactors is 3.5 x 10 4/ year.
Consequence Estimate The core-melt sequences under consideration here involve a core-melt with no large breaks initially in the reactor coolant pressure boundary.
The reactor o
is likely to be at high pressure (until the core melts through the lower vessel I
head) with a steady discharge of steam and gases through the PORV(s).
These O
are conditions likely to produce significant hydrogen generation and combustion.
12/31/89 3.125-51 NUREG-0933 1
Revision 6 The Zion and Indian Point PRA studies used a 3% probability of containment failure due to hydrogen burn (the " gamma" failure). We will follow this example and use 3%,_ bearing in mind that specific containment designs may differ significantly from this figure.
In addition, the containment can fail to isolate-(the " beta'_' failure).
Here, the Oconee PRA figure of 0.0053 will be used. -If the containment does not fail by isolation failure or hydro burn, it will be assumed to fail by basemat melt-through (the " epsilon" gen failure)..
Using the usual prioritization assumptions of a central midwest plains meteor-ology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are:
Failure Percent Release
_ Consequences Mode Probability Category (man-rem) gamma 3.0%
PWR-2 4.8 x 106 beta 0.5%
PWR-5 1.0 x 106 epsilon 96.5%
PWR-7 2.3 x 103 The." weighted-average" core-melt will have consequences of 1.5 x 106 man-rem /
event.
These figures should cover all PWRs with large dry containments.
They do not.
apply to ice condenser containments.
Because of the low free volume in such a containment, failures due to overpressure are more likely and the averaged con-sequences may be significantly greater.
However, we are not aware of any ice condenser plant which has an automatic AFW isolation affected by this issue.
The steam-line-break / containment-rupture scenario is different.
The contain-ment pressure is unlikely to exceed the design pressure by more than a few per-cent, if at all.
In most cases the containment is calculated to fail at 2 to 2.5 times its design pressure.,Therefore, containment failure by overpressure is at most'a very remote theoretical possibility.
We will assume that the over-pressure failure probability cannot be greater than 3%, the hydrogen burn figure (a highly conservative assumption).
The only radioactive release comes from the contairment atmosphere and any primary coolant leakage or. discharge from the PORV(s).
We have no consequence estimates for such an event.
However, the consequences can be conservatively bounded by those of a PWR-8 event, which is a successfully mitigated LOCA with failure of the containment to isolate.
The PWR-8 consequences are 7.5 x 104 man-rem.
Thus, the steam line break event will have " average" consequences of at most (0.03)(7.5 x 104) or 2250 man-rem, and probably much less.
It is not known how many plants are affected by this issue.
In many plants, the AFW isolation logic has provisions to prevent isolation of feedwater to more than one steam generator.
Others may not even have this isolation lo We will assume that about 25% of the PWRs will be affected by this issue. gic.
There are 83 PWRs and, as of spring 1987 (the earliest that this issue is likely to result in changes), the remaining collective calendar life will be 2571 RY.
At a 75% utilization factor, this is 1928 RY or about 23 operational years per reactor.
O 12/31/89 3.125-52 NUREG-0933 i
. m a
Revision 6 The net change in man-rem /RY is obtained by multiplying the change in core-melt frequency by 1.5 x 105 man-rem (average) per core-melt. Then, the steam line break scenario must be subtracted.
The consequences of the steam line break scenario (upper bound) are simply (10 6 overp/RY.ressure/RY)[2250(average) man-rem / overpressure], or 2.3 x 10 3 man rem Change in man-rem /RY Typical Maximum Core-melt Scenarios 2.6 5.9 Steam Line Break 50.0023 50.0023 Net change:
2.6 5.9 The estimated risk reduction is 140 man-rem / reactor (maximum) and 1,300 man-rem for all reactors.
Cost Estimate The proposed fix for this issue is simply to remove some leads from some equip-ment, an action which is likely to be more than paid for by decreased maintenance i
and testing.
Nevertheless, even a relaxation of requirements as this will require review of each affected plant's isolation logic, to be certain that the net effect is an increase in plant safety.
In addition, technical specifica-tion and procedural changes, with their associated paperwork, will be neces-sary.- We will assume per plant costs of $32,000 to the industry and $25,000 to the NRC which are typical for a complicated and controversial technical
-specificatIonchange.
Thus, the estimated total cost associated with the resolution of this issue is (0.25)(83)($0.057H) or $1.18M.
Value/ Impact Assessment i
Based on an estimated risk reduction of 1,300 man-rem and a cost of $1.18M, the value/ impact score is given by:
3 = 1300 man-rem 51.18M
= 1102 man-rem /$M Other Considerations (1) It should be noted that the maximum values are based upon a plant with marginal feed-and-bleed capability.
The subset of PWRs which are affected by this issue may-not include such a plant.
Thus, the " maximum" plant may not exist.
(2) The proposed fix does not' involve work within radiation fields and thus does not involve ORE.
However, the ORE averted due to post feed-and-bleed cleanup and post-core-melt cleanup is a consideration.
NUREG/CR-280084 estimates the ORE associated with cleanup to be about 1800 man-rem after a primary coolant spill and about 20,000 man-rem af ter a core-melt acci-dent.
The " typical" frequency of feed-and-bleed events is simply the 12/31/89 3.125-53 NUREG-0933
i Revision 6
" typical" core-melt frequency (1.8 x 10 6/RY) divided by the feed-and-bleed failure probability (0.20).
The actuarial figures are:
Averted Feed-and-Bleed Cleanu 3.6 man-rem Averted Core-melt Cleanup ORE /p ORE / plant plant 7.9 man-rem i
Total:
11.5 man-rem
{
The total averted ORE for all plants is 240 man-rem.
Thus, the averted ORE is not dominant, but is still a significant fraction of the averted public risk.
(3) The proposed fix reduces core-melt frequency and the frequency of feed-and-bleed events and therefore averts cleanup costs and replacement power q
costs.
The cost of a feed-and-bleed asage is dominated by rou months of replacement power while tht cleanup is in progress. ghly six If the average frequency of such events is 1.7 x 10 6/0,20 or 8.5 x 10 6/RY and the average remaining lifetime is 23 operational years at 75% utilization, and making the usual assumptions of a 5% annual discount rate and a i
replacement power cost of $300,000/ day, the actuarial savings for feed-and-bleed cleanup works out to be $55,000.
Similarly, the actuarial sav-ings of avert ad core-melt cleanup (which is assumed to cost $1 billion if it happens) are about $200,000.
The actuarial savings from replacement power after a core melt up to the end of the plant life are about $260,000.
(This last figure represents the lost capital investment in the plant.)
Obviously, these savings would more than offset the cost of the fix if they were included.
(4) The analysis of the first negative scenario, the feedwater line break, l
assumed that non-isolation of the ruptured line would cause one AFW train to fail.
A special situation can arise for plants with a limited AFW water supply (e.g. saltwater plants).
In such a case, the continued loss of clean water out of the feedwater line break can in theory cause failure-y of the second AFW train by exhausting the water supply, provided that the loss is not terminated either by the operator or by protective trips (for j
runout protection) on the first AFW train.
In such a case, the scenario's negative contribution (typical) to the averted core-melt frequency of the proposed fix rises from (-1.8 x 10 8) to (-1.8 x 10 6).
The net change in core-melt frequency would then drop from 1.7 x 10 5 to 1.6 x 10 6, which would not change the conclusion.
CONCLUSION Based upon the-figures above particularly the core-melt frequencies, this issue wasplacedinthehighpriorItycategory.
A regulatory analysis of the AFW automatic isolation feature showed that, for the postulated removal of the AFW automatic. isolation feature in the plants analyzed,7(a) the reduction in core damage frequency (CDF) would be in the order of 10- core damage event /RY, and t
(b) the risk reduction would be about 40 man rem / plant.
Furthermore, for some plants, it is expected that removal of the automatic isolation of the AFW system would result in an increase in risk.
This risk increase is particularly appli-cable tc plants with no flow restrictors in the AFW pump discharge lines.
The regulatory analysis was published as NUREG-1332nsa in September 1988.
'12/31/89 3.125-54 NUREG-0933
Revision 6
,m Based on the regulatory analysis and its supporting documentation, the staff concluded that removal of the AFW automatic isolation feature will neither v) result in a substantial safety improvement nor will it be cost-effective.
(
Hence, Alternative Resolution No. 1 "No Action," as recommended in NUREG-1332,2188 was adopted as the appropriate resolution of this issue in accordance with the Backfit Rule, 10 CFR 50.109(a)(3).
Consistent with the SRP,11 the "No Action" alternative does not preclude a licensee from proposing to the NRC staff the removal of the AFW automatic isolation feature, based on-plant-specific considerations.
Thus, this item was RESOLVED and no new require-ments were established.2ta4 ITEM 125.II.8:
REASSESS CRITERIA FOR FEED-AND BLEED INITIATION DESCRIPTION Historical Background During the course of the investigation of this event,840 it was discovered that the Davis-Besse emergency procedures (EOPs) criteria for initiation of feed-and-bleed cooling were inadequate.
The procedures directed the plant operators to initiate feed-and-bleed either if steam generatnr levels were below 8 inches on the startup range or if the steam generator secondary pressures were less
-than 960 psig and decreasing.
The difficulties with these criteria were:
(1) the control room instrumentation was inadequate for the operators to deter-mine that levels were below 8 inches, and (2) there is calculational evidence that steam generator secondary pressures are unlikely to fall below 960 sig
.(AL} before the opportunity for successful feed-and-bleed cooling is past.100 Licensees have been supplied with feed-and-bleed procedures by NSSS vendors.
Safety Significance Feed-and-bleed capabilities are not currently required by the NRC although the techniques, benefits, and costs are being evaluated in the resolution of USI A-45.
Basically, feed-and-bleed cooling is a method of last resort which can avert core damage if main and auxiliary feedwater are lost and other methods of decay
-heat removal are unavailable.
PRAs give considerable credit for feed-and-bleed-cooling.
A failure rate of one or two percent is a typical assumption.
- However, the Davis-Besse event chronology leaves an impression that this failure pro-4 bability may-be overly optimistic.
Possible Solution
.The Davis-Besse E0Ps have been changed; there is now a single criterion for initiating feed-and-bleed which states that feed-and-bleed will be initiated if the primary coolant hot leg temperatu're rises above 610*F.
This parameter is much easier to monitor with existing control room i.nstrumentMion and there-fore the new criterion is much clearer and unambiguous.
The purpose of this proposed generic action is to conf _irm that all of the remaining B&W plants are using the new criterion rather than the two old criteria.too2 12/31/89 3.125-55 NUREG-0933
Revision 6 i
' CONCLUSION The safety concern and possible solution of this issue are covered in Issue 122.2, " Initiating Feed and-Bleed." Issue 122.2 is one of the short-term Davis-Besse issues and is somewhat more general in that it is also concerned with the reluctance of the operators to initiate feed-and-bleed (because of the economic-consequences) in addition to being concerned with inadequacy of the criteria.
(See References 885, 887, and 940).
The two are related; less ambiguity in the written procedures implies less opportunity for reluctance to affect operator actions.
Thus, thir, issue was DROPDED as a new and separate issue.
ITEM 125.II.9:
ENHANCED FEED-AND-BLEED CAPABILITY DESCRIPTION i
Historical Backopund This particular issue arose because of the very limited capability of the Davis-Besse plant to remove decay heat using feed-and-bleed techniques 8" The Davis-Besse plant had a relatively low capacity PORV on the pressurizer and thus limited " bleed" capability.
In addition, the HPI pumps (a part of s
the ECCS) did not develop sufficient discharge pressure to provide injection at operating pressure.
To supply coolant at elevated pressure, the plant operators would have to " piggyback" the makeup pumps on the HPI discharge, a complex procedure which will supply only rather limited flow.
Thus, the
" feed" capability was also limited.
The issue is divided into two parts:
Part A. deals with pressure relief capacity (i.e., enhanced " bleed" capability),
and Part B deals with makeup capacity and pressure (i.e., enhanced " feed" capability).
Safety Significance Feed-and-bleed cooling is normally considered a method of last resort which can i
avert core damage if main and auxiliary feedwater are lost and not recovered.
Nevertheless, main and auxiliary feedwater did both fail (but were recovered) at Davis-Besse and so this need for feed-and-bleed, although remote, is a possibility.
Feed-and-bleed cooling has the advantage of being a redundant and diverse method of core cooling.
Its disadvantage (in addition to the economic consequences of releasing primary coolant to the containment) is that the plants were not designed for this mode of core cooling and thus their capabilities are uncertain.-
An upgrading of the feed-and-bleed capability would benefit the viability of feed and bleed cooling in several ways:
(1) the probability of failure due to component failure would be reduced.
(Feed-and-bleed cooling can fail due to a single failure at most plants); (2) the thermal hydraulic uncertainty would be reduced.
(Feed-and-bleed cooling is often only marginally viable.
A slight change in the thermal hydraulic initial or dynamic conditions may well prevent adequate core cooling); (3) the " window" or time interval during which feed-and-bleed is viable would be lengthened, giving more time to (and less stress upon) the. operating crew; and (4) the procedures for initiating feed-and-bleed would be-simpler, thus reducing the probability of operator error.
12/31/89 3.125-56 NUREG-0933
Revision 6 Possible Solutions
!()-
The possible solutions for this issue are implicit in the definitions of the two parts:
(1) increased pressure relief capacity and (2) increased makeup capacity and pressure.
Increased relief capacity could be accomplished by installing larger PORVs, installing more PORVs, or installing a special valve intended for bleed operations.
Increased makeup capacity would involve upgrad-ing or replacing the pumps (and their motors) with ones of higher discharge pressure.
PRIORITY DETERMINATION Frequency Estimate To estimate changes in core-melt frequency due to the upgrades in pressure relief and makeup capacities, it is first necessary to calculate the change in failure probability of feed-and-bleed cooling.
In the past, the usual assump-tions have been either that the feed-and-bleed failure probability was dominat-ed by the human failure mode (in NRC generated PRAs) or that it was governed only by a few hardware failure probabilities (in industry generated PRAs).
Obviously, there is an inconsistency.
Moreover, the issue to be addressed here affects both hardware and human failure rates.
It is necessary to introduce a (somewhat) more sophisticated treatment of the problem.
To do this, we will define four classes of plants.
Class 1:
In this class, the plant's HPI pumps develop sufficient discharge pressure to lift the pressurizer safety valves.
For such plants, feed-and-bleed
( w) cooling does not need the PORVs.
Moreover, the HPI pumps are capable of raising f
V the coolant level at any time right up to the point of core uncovery.
There is no time interval " window" phenomenon.
Class 2:
In this class, the plant's HPI pum sufficient coolant in at operating pressure,ps and/or charging pumps can force but cannot lift the safety valves.
Here, both PORVs must open for feed-and-bleed cooling to work.
In addition, the /iability of feed-and-bleed techniques is limited in time.
Once the steam l
generators dry out, primary system pressure rises as the primary coolant heats up and expands.
The PORVs will open and help keep pressure down, but eventually the pressure will rise _up to the safety valve tetpoint, by which time the HPI l
l can no longer force coolant into the primary system.
Thus, there is a definite
" window" of time, pressure, and temperature during which feed-and-bleed cooling will work.
Class 3:
In this class, the HPI pumps and/or charging pumps cannot force i
L suf ficient coolant into the primary system at operating pressure.
Such plants must open the PORVs and reduce pressure to below normal in order to force suf-l ficient coolant in.
Of course, the timing is still more critical for such plants. Once the steam generators dry out, the PORV capacity will soon be overcome by primary coolant expansion and heating.
Class 4:
This class is similar to Class 3 except that the PORV or PORVs are small.
Such plants cannot sufficiently depressurize using PORVs after the steam generators dry out, but instead must open the PORVs and depressurize while the steam generators are still removing decay heat.
In some cases, calculations
.O) beginning of the transient for core cooling to be successful.
(
have shown that the PORVs must be opened within 5 to 10 minutes after the L
12/31/89 3.125-57 NUREG-0935
Re ision 6 It aust be emphasized that real plants may not be easily classified into four neat classes.
Nevertheless, these four classes will enable the benefits of enhanced feed-and-bleed to ho scoped out.
The benefit of enhanced pressure relief capacity can be seen by comparing Class 4 with Class 3 and the benefit of enhanced makeup by comparing Classes 2, 3 and 4 with Class 1.
Given the four classes of plants, it is now necessary to discuss the sources of failure for feed-and-bleed.
These may be grouped into equipment, thermal-hydraulic, and human failure probabilities.
For feed-and-bleed to work, there must be both feed and bleed capabilities.
Thus, a source of coolant at sufficient flow and pressure is necessary.
This can be supplied either by the " charging" or " makeup" system (if of sufficient flow capacity) or by the HPI system (if of sufficient discharge pressure).
In either case, the supply will generally be from a two-train system.
Such systems generally have a failJre probability on the order of 1%.
Class 1 plants will discharge through the safety valves which have a failure probability of essentially zero for our purposes.
The other three classes must use (usually two) PORVs for coolant discharge.
Each PORV has a probabil-ity of failure to open of about 1%.54 When used for feed-and-bleed, these valves are not redundant; both must open.
Thermal-hydraulic effects are reasonably straightforward.
For Class 1 plants, the thermal-hydraulic failure probability is essantially zero, since the high head HPI pumps will raise coolant level at any t ae.
For Class 2 and Class 3, we will define two time intervals.
The first is T1, which runs from the begin-ning of the transient up to the point of steam generator dryout.
The second is T2, which starts at steam generator dryout and ends at the point of no return, when feed-and-bleed will no longer work.
During interval T1, the initial con-ditions for feed-and-bleed onset are reasonably stable and there is high con-fidence that feed-and-bleed will work as planned.
Thus, the probability of failure due to thermal-hydraulic effects is assumed to be zero during T1.
During the second interval T2, the dynamic behavior of the reactor coolant system is much more complicated.
In addition, the course of the transient may be significantly affected by a number of fact <>rs such as reactor coolant pump operations, PORV cycling, pressurizer sprays, etc.
We estimate, bascd primar-ily on judgment, that the probability of failure is 50% during this interval.
For Class 4 plants, the point of no return comes well before steam generator dryout.
Thus, it will be assumed that the probability of failure due to thermal-hydraulic effects is essentially zero for the first 10 minutes and unity thereafter.
Finally, we must account for human error.
This will be divided into three parts:
(1) Simple Procedural Error:
Assuming a decision has been made to go ahead with feed-and-bleed, and assuminp also that all equipment is operable, there is still a finite probability that the operator will make a mistake in initiating, monitoring, and controlling the process.
This failure probability is lowest for Class 1 plar.ts since the operator need only ini-tiate HPI and watch.
We will assume 1% failure probability for this class.
For Class 2, the initiation and control of feed-and-bleed are more compli-cated and we will assume 6% for interval T1.
For Class 2 interval T2 and 12/31/89 3.125-58 NUREG-0933
~
Revision 6 O
for Classes 3 and 4, the operator must depressurize first and then feed,
,i being careful to keep pressure low enough to get adequate injection flow V
but high enough to avoid bulk boiling in the core (if possible).
For this situation, we will assume a 10% failure rate.
(2) Time Stress:
For this, we will use Swain's screening model.888 The Class 2 and class 3 interval T1 ends roughly 25 minutes into the transient, for which the screening model estimates a stress failure rate of about 3%.
For the case of Class 4, where the point of no return is 10 minutes after the start of the transient, the screening model predicts a 50% failurs probability.
All the other classes and intervals are well over half an hour and the time stress failure rate is essentially zero.
(3) Simple Reluctance: The use of feed-and-bleed will release primary coolant to the containment atmosphere, contaminating the containment and necessi-tating a long expensive shutdown for purposes of cleanup.
Moreover, feed-and-bleed techniques cause a small 1.0CA and thus have safety implications.
the plant operators will delay the use of feed-and-bleed QuitenaturallyIbleinthehopeofrecoveringeithermainorauxiliary as long as poss feeclwater.
Thus, there is a finite probability that initiation of feed-and-bleed will be delayed into interval T2 (for Classes 2 and 3) or even pastthepointofnoreturn.Onceagain,itisnecessarytousejudgment.
We will assume a 5% probability that the operators will wait until after the point of no return.
For Classes I and 4, this translates directly into a 5% failure probability.
For Classes 2 and 3, we will further assume that there is a 5% chance that feed-and-bleed will be started before the (O
point of no return but after the point of steam generator dryout.
This j
can perhaps best be understood in terms of success probabilities:
there is a 90% chance of initiation during interval T1, a 5% chance of initiation during interval T2, and a 5% chance of either no initiation or initiation after interval T2.
for feed-and-bleed to succeed, all the potential pitfalls discussed above must be successfully overcome.
Thus, tie probability of successful feed-and-bleed is obtained by multiplying the success probabilities (not the failure probabilities) of the various contributors listed above.
This is summarized in Table 3.125-2.
For Classes 1 and 4, the failure probability is calculated by first multiplying the equipment, thermal-hydraulic and o erator success probabilities together toobtainanetsuccessprobabi1Ity.
T is success probability is then subtracted from unity to get a failure probability.
Classes 2 and 3 are more complicated. Within tach time interval, the various success probabilities are multiplied together to get a net success probability for the interval.
The interval success probabilities are then subtracted from unity to get an interval failure probability (i.e., the probability of no feed-and-bleed during that interval).
Both intervals must fail to feed and bleed for feed-and-bleed to not take place at all.
Therefore, the failure probability for the plant class is the product of the two interval failure probabilities.
O With wed-and-bleed failure probabilities available, the next step is to calcu-(/
late the changes in core-melt frequencies from these numbers.
This is relatively 12/31/89 3.125-59 NUREG-0933 l
Revision 6 Table 3.125-2 Class 1
2 3
4 Interval T1 T2 T1 T2 Success Probabilities:
HPI 0.99 0.99 0.99 0.99 0.99 0.99 PORY 0.99 0.99 0.99 0.99 0,99 PORY 0.99 0.99 0.99 0 99 0.99 Thermal-Hydraulic 1.00 1.00 0 50 1.00 0.50 1.00 Operator:
Procedural 0.99 0.95 0.90 0.90 0.90 0.90 Time Stress 1.00 0,97 1.00 0.97 1.00 0.50 Reluctance 0.95 0.90 0.05 0.90 0.05 0.95 Interval Success Probability 0.9311 0.8047 0.0218 0.7624 0.0218 0.4148 Interval Failure Probability 0.0689 0.1953 0.9782 0.2376 0.9782 0.5852 Class Failure Probability 0.0689 0.1910 0.2324 0.5852 straightforward in that the dominant sequence u almost always a transient involving a non-recoverable loss of main feedwater coupled with a failure of the AFW system and (of course) a failure to cool the core by means of feed-and-bleed techniques.
For the initiating event frequency (non-recoverable loss of main feedwater will use 0.64 event /RY, based upon the Oconee PRA done by Duke Power Co. sag, we This figure is based upon fault tree analysis and should be reasonably repre-sentative of most main feedwater system designs.
For a three-train AFW system, a " typical" unavailability is 1.8 x 10 6/ demand. sos The analogous figure for a two-train system is significantly higher.
- However, anexistingprogramisattemptingtoupg/ demand.847rade all AFW systems to a point where the maximum unavailability would be 10-Thus, we will consider 1.8 x 10 5 to be an average unavailability and 10 4 to be the maximum.
With the figures in hand, core-melt frequencies (F) can be estimated by taking the product of the transient frequency, the AFW unavailability, and the change in the feed-and-bleed failure probability.
O 12/31/89 3.125-60 NUREG-0933
r Revision 6 V
From To Change in Core-Melt Frequency
- Class Class Typical Maximum Reason 2
1 1.4 x 10 8 7.8 x 10 6 Enieced makeup capacity 3
1 1.9 x 10 8 1.1 x 10 6 Enhanced makeup cape'.ity 4
3 4.1 x 10 8 2.3 x 10 6 Enhanced relief w nj 4
1 6.0 x 10 8 3.3 x 10 6 Enhanced makeup and relief capacity
- in units of core-melt /RY Consequence Estimate The accident sequence under consideration here involves a core-melt with no large breaks initially in the reactor coolant pressure boundary.
The reactor is likely to be at high pressure (until the core melts through the lower vessel head) with a steady discharge of steam and gases through the PORV(s).
These are conditions likely to produce significant hydrogen generation and combus-tion. The Zion and Indian Point PRA studies used a 3% probability of contain-pl mcnt failure due to hydrogen burn (the " gamma" failure). We will follow this (d
example and use 3%, bearing in mind that specific containment designs may differ significantly from this figure.
In addition, the containment can fail to isolate (the " beta" failure).
- Here, the Oconee PRAsso figure of 0.0053 will be used.
If the containment does not failbyisolationfailureorhydrogenburn,itwillbeassumedtofailbybase mat melt-through (the "eptilon' failure).
Using the usual prioritization assumptions of a central midwest plains meteor-ology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are:
Failure Percent Release Consequences Mode Probability Category (man-rem) l gamma 3.0%
PWR-2 4.8 x 10e beta 0.5%
PWR-5 1.0 x 108 epsilon 96.5%
PWR-7 2,3 x 108 The " weighted-average" core-melt will have consequences of 1.5 x 106 man-rem.
These figures should cover all PWRs with large dry containments.
However, they do not apply to ice condenser containments.
There is no modern PRA currently available for such a plant.
However, because of the low free volume in such a containment, failure due to overpressure is more likely and the average conse-
}
quences may be significantly greater.
V 12/31/89 3.125-61 NVREG-0933
Revision 6 Cost Estimate The core-melt figures for this issue are such that cost considerations will not affect the priority.
Consequently, a quantitative cost analysis has not been attempted.
However, it should be noted that these are not inexpensive fixes.
A new or upgraded high pressure pump is likely to cost between $2M and $5M per train installed.
Replacement PORVs or an additional, dedicated depressuriza-tion valve will not be as expensive, but will probably require replacement dis-i charge piping with stronger bracing.
The quench tank might also require extensive modification.
Value/ Impact Assessment To make the value/ impact assessment, it is necessary to estimate the number of 31 ants in each of the four classes.
The first statement to be made is that all MW plants except Davis-Besse have injection pumps capable of lifting the pres-surizer safety valves.
Thus, these plants are already in Class 1 and are out-side the scope of this issue.
This leaves 71 PWR plants.
The earliest imple-mentation of fixed for this issue is not likely to be before the spring refueling outages in 1988, at which time these plants will have a collective remaining lifetime of about 2240 RY.
At a 75% utilization figure, this is about 23.7 years of operational life per plant.
It is not clear how these 71 plants are distributed among Classes 2, 3 and 4.
A plant-by-plant investigation is beyond the scope of a prioritization.
Therefore, it will be assumed that roughly one-third fall in each class:
24 in Class 2, 24 in Class 3, and 23 in Class 4.
With this data, priority parameters can be estimated, Part (a),
Part(b),
i Enhanced Enhanced Relief Makeup Plant Class 4-3 2-1 3-1 4-1 Number of Plants 23 24 24 23 AF (avera 4.1 x 10 6 1.4 x 10 6 1.9 x 10 6 6.0 x 10 6 AF (max) ge) 2.3 x 10 5 7.8 x 10 0 1.1 x 10 5 3.3 x 10 5 l
Core-Melt /RY (max) 2.3 x 10 5 3.3 x 10 5 l
l Man-rem / reactor (max) 80 120 Core-Melt / year 9.4 x 10 8 2.2 x 10 4 (Total, all plants)
Man-rem (Total, all plants) 330 770 Other Considerations (1) Upgrading the makeup capability would involve work on pumps which are located outside of containment.
This should not result in a significant l
amount of ORE.
However, upgrading the relief capacity involves work adjacent to the pressurizer which would have implications for occupational exposure.
There is no readily available data upon which a direct estimate of this exposure can be based.
However, it should be noted that pres-surizer inservice inspection involves roughly 20 man-rem and pressurizer 12/31/89 3.125-62 NUREG-0933
Revision 6 spray valve repair involves roughly 10 man-rem.
Thus, because the average (not maximum) plant would avert a public risk of about 15 man-rem the
(,')
involvedinthefixmaywellbeequaltoorgreaterthanthepub1IcexORE posure averted.
(2) In addition to ORE associated with the fix, there is averted ORE associated with cleanup of a core-melt.
For prioritization purposes, core-melt cleanup exposure is assumed to be 20,000 man-rem.
Using this and the core-melt frequencies calculated previously, the actuarial values (total, all plants) of averted core-melt cleanup ORE are about 45 man-rem for Part (a) and 100 man-rem for Part (b).
On a per-plant basis, this is 2 man-rem / plant for toth Parts (a) and (b).
Thus, this is not a significant consideration.
(3) There are also averted costs associated with this issue.
There are no avertedprecursoreventsthatinvolvemajorcleanup,butthereareaverted cleanup costs associated with the reduction in core-melt frequency.
In addition, averted core-melt implies averted replacement power costs for the remaining life of the plant.
(Because the plant was built for the purpose of avoiding replacement power costs, this latter iten represents the depreciated capital loss of the plant).
Using the maximum core-melt frequencies above, t. 31.5 calendar year average remaining plant life, and the usual prioritization assumptions of $1 billion for core-melt cleanup,
$300,000 per day for replacement power, and a discount rate of 5%, the actuarial cost credits are:
Part (a)
Part (b)
,m
(
h Core-melt Cleanup
$270,000
$390,000 V
Averted Replacement Power Costs
$350,000
$510,000 Total.
$620,000
$900,000 This is probably not sufficient to offset more than a fraction of the cost of the proposed figures.
(4) The estimates of feed-and-bleed failure probability are based upon a time window assumption.
That is, after continuing decay heat production in the reactor core has caused primary system pressure to rise to a certain point, the HPI pumps can no longer force coolant into the primary system.
In addition, the PORVs are then venting at capacity and thus the primary system cannot be depressurized.
Therefore, feed-and-bleed is assumed to fail if initiated after such conditions are reached.
However, a second opportunity for successful feed-and-bleed may exist.
This would occur after the primary coolant boils away to the point where the core is starting to uncover.
The steaming rate then begins to dimin-i-
ish and the PORVs may be able to depressurize the primary system to the l
point where the HPI pumps can reflood the core.
l O 12/31/89 3.125-63 NUREG-0933 l
l
Revisien 6 1
Of course, this depressurization is only possible because the decay heat i
is causing the uncovered fuel's temperature to rise instead of going into steam production.
The pressure may not drop fast enough for core melt to be averted.
Also, if the uncovered fuel slumps or crumbles and falls into the remaining liquid coolant, pressure will rise again.
It is beyond the scope of a prioritization to address this (theoretical) second window possibility.
However, any subsequent value/ impact analyses should address r
the possibility of a second window.
(5) The analysis assumes a 1% failure probability for the PORV(s).
Some plants have operated for extensive periods with the PORV block valves closed and electrically disabled.
Restoration of power to the block valve operators, i
and subsequent opening of the block valves and PORVs to permit feed-and-bleed cooling, would take a significant amount of time as well as opening new possibilities for equipment malfunction and operator error.
- Thus, i
such plants might have feed-and-bleed failure probabilitier significantly greater than those calculated in the analysis above.
CONCLUSION t
Based upon the above analysis, particularly the maximum core-melt frequencies, thisissuewouldnormallybeplacedinthehig88h priority category.
- However, feed-and-bleed techniques are being evaluated and will be considered as one option in the resolution of USI A-45.ess Therefore, this issue was DROPPED as a separate issue.
ITEM 125.11.10:
HIERARCHY OF IMPROMPTU OPERATOR ACTIONS DESCRIPTION Historical Background During the event, the operators did not initiate feed-and-bleed cooling imme-diately upon reaching plant conditions where feed-and-bleed operations were required by the emergency procedures 840 The feed-and-bleed method of cooling was delayed because of the operators' belief that recovery of feedwater was imminent and their reluctance to release reactor coolant to the containment t
structure.
Even though feedwater flow was recovered before serious damage resulted the event highlighted the need for establishing a hierarchy of actionsIntheproceduresand/ortrainingwhichwouldfocusimpromptuactions during an event to assure that decisions will be in the direction of safety, and not based on potential plant operational difficulties and financial impacts.
Safety Significance Delays in implementing emergency operating procedures (EOPs) in a timely manner could defeat the design safety function of equipment and increase the severity of a transient or accident.
Possible Solution
-Issue HF4.4 is to provide assurance that plant procedures are adequate and can be used effectively; the objective is to provide procedures that will guide the 4
12/31/89 3.125-64 NUREG-0933 l
Revision 6 i
operators in maintaining the plant in a safe state under all operating condi-
_/}
tions, including the ability to control upset conditions without first having
(
/
to diagnose the specific initiating event.
Thisobjectiveistobemetby:
(1) developing guidelines for preparing, and criteria for evaluating, E0Ps, normal operating procedures, and other procedures that affect plant safety; and (2) upgrading procedures, training the operators in their use, and implementing the upgraded procedures.
In accordance with Appendix A of NUREG-0985, Revision 2,661 comparative studies have been completed which examined the impact on operator performance in making the transition from procedure to procedure, using either event-based or func-tion-oriented E0Ps.
The results of these studies are being incorporated into a larger, ongoing project to develop guidance for achieving successful transitions with nuclear power plant operating procedurec.
DHFT concluded that, while the procedural guidance package may develop the correct guidance to place the reac-tor in a safe state, it may not prevent reluctance on the part of supervision or an operator to take action which will invariably result in a financial pen-alty.
The TMI Action Plan Item I.B.1.3 (Loss of Safety Function) resolution to use existing enforcement options (citations, fines, and shutdowns) provides a deterrent to such actions, including willful violations that could effect the health and safety of the public (10 CFR 2, Appendix C).I87 The Commission notedta4 that, while the procedures for enforcement actions may not ensure com-pliance, civil penalties and possibly criminal prosecution for willful viola-tions are strong incentives to com be more expensive than compliance. ply.
NRC policy is that noncompliance should In cases involving individual operators licensed under 10 CFR Part 55, the Commission policy statementra4 states that generally licensees are held responsible for the acts of their employees
[m()T Accordingly, the NRC policy should not be construed as excusing personnel errors.
Thus, enforcement actions involving individuals, including licensed operators, will be determined on a case-by-case basis.
The NRC policy is directed toward encouraging licensee initiatives for self-improvements and identification and correction of such problems.
CONCLUSION The concern raised relative to reluctance of the licensee (or plant operators)'
to proceed with appropriate actions to place the plant in a safe state of operation, based on potential plant operational difficulties and financial impacts, is addressed by existing NRC policies.197,234 Based on the above dis-cussion, the issue involving development of the hierarchy of impromptu operator actions is to be addressed in Issue HF4.4.
Therefore, Issue 125.II.10 was DROPPED as a separate issue.
ITEM 125.11.11:
RECOVERY OF MAIN FEEDWATER AS ALTERNATIVE TO AUXILIARY FEEDWATER DESCRIPTION Historical Background The issue deals with alternate means of recovering feedwater, should the AFW systems fail, and applies to all PWR plants.840 V
12/31/89 3.12'5-65 NUREG-0933
Revision 6 Safety Significance Failure to provide feedwater makeup to the steam generators will cause them to boil dry in approximately 30 minutes or less.
(This time varies for plant type 1
and power level).
As steam generator water level decreases, heat removal rate is impaired and the temperature of the primary side increases.
This leads to an imminent need to initiate feed-and-bleed cooling or find an alternate method i
of steam generator makeup.
If no means of cooling is provided, the resulting loss of primary coolant inventory )ut of the pressurizer relief and safety valves will lead to core uncovery nnd meltdown.
Possible Solution In the resolution of Issue 124, " Auxiliary feedwater System Reliability," the staff evaluated potential alterr. ate recovery methods for both main and auxiliary feedwater systems for those plc.nts (7 plants) with two-train AFW systems.
The staff effort was predicated on the lower AFW reliability associated with only two-train AFW systems as opposed to the majority of plants that have three-train AFW systems.
The staff reviews and evaluations consisted of plant-specific reviews and on-site audits.
Contingent upon implementation of the staff recommendations proposed as the resolution of Issue 124, Issue 125.11.11 should be dropped as a new and separate issue for these plants.
As a more generic approach,tosa previous staff reviews of emergency procedure guidelines (EPGs) recognized that alternate methods to provide flow to the steam generator in the event of a loss of both main feedwater and AFW were desirable.
Therefore, the EPGs for the W and CE plants were revised to include instruction for an alternate means of feedwater recovery.
A similar change was also required for inclusion in the B&W EPGs by Generic Letter No. 83-31.20ss CONCLUSION On the basis of the above, this issue was DROPPED as a separate generic issue.
ITEM 125.11.12:
ADEQUACY OF TRAINING REGARDING PORV OPERATION DESCRIPTION Historical Background This issue affects all operating PWRs with PORVs in the primary coolant loop and calls for an assessment of the adequacy of training regarding PORV opera-tions.840 The issue stems from Findings 8 and 14 of the NRC investigation of the Davis-Besse event 8" of June 9,1985 in which the NRC staff noted that the post-TMI improvements that focused on E0Ps and training played a crucial role in mitigating the event.
Following actuation of the PORV during the event, the operator observed that the PORV open/close indicator showed that the PORV had l
closed.
In fact, the PORV had not completely closed and, as a result, the reactor pressure decreased at a rapid rate for abcut 30 seconds.
The operator however did not verify closure of the PORV by looking at the acoustical monitor installed after the TMI accident; instead, he looked at the indicated pressure level which appeared steady.
As a precautionary measure, the operator closed the PORV block valve.
Fortunately, when the block valve was subsequently opened l
M/31/89 3.125-66 NUREG-0933
Revision 6
(~'j to assure PORV availability, the PORV had closed during the time the block valve
/
was closed.
Had the operator looked at the acoustical monitor, the need to
'd close the block valve may have been factually confirmed and may have precluded 1
the need for relying on the precautionary action taken.
However, it should be noted that the operators have not generally placed high reliance on the acousti-cal monitors because of PORV leakage problems.
Safety Significance Assessments of the adequacy of trair.ing and hands-on experience, referred to as performance-based training or Systems Approach to Training (SAT), is con-sidered essential for providing assurance that nuclear power plants are operated in a safe state under all operating conditions.
The adequacy of training regarding the PORV operation is part of the assessments of the performance-based training evaluations described in Issue 125.I.7.b, " Realistic Hands-on Training."
Possible Solution A possibl9 solution to this issue is to include an assessment of the adequacy of training regarding PORV operations in the job catalog of necessary tasks and functions required to safely operate and control nuclear power plant operations.
PRIORITY DETERMINATION Frequency Estimate
('
approximately 1/RY in Issue 70, "PORV and Block Valve Reliabi,'ty."
PORV Challenge Frequency:
The PORV challenge frequency was determined to be PORV/ Block Valve Failure Frequency:
The frequency of failure of the PORV to close, given that it has opened, is estimated to be 0.01/ demand (See Issue 70).
The frequency of failure of the block valve to function is estimated to be 0.003/ demand (See Issue 70).
Operator Error Frequency:
Based on the information in Issue 70, the human error probability (HEP) to close the PORV after the TMI Action Plan 48 improvements and increased emphasis on operator training is estimated to be 0.05.
PORV-SBLOCA Frequency:
The estimated base-case PORV/ block-valve SBLOCA fre-quency (5.3 x 10 '/RY) is the product of the PORV challenge frequency (1.0), the probability that the PORV sticks open (0.01), and the probability that the operator will not close the PORV or the block valve fails to clohe (0.05 + 0.003).
To assess the potential improvement in HEP for PORV operations that may result from adequate hands-on training in upgraded simulators, a 30% reduction in HEP is assumed.
(See Issue I.A.4.2, "Long-Term Training Simulator Upgrade.")
Adjusting the above HEP = 0.05 to account for the potential reduction in HEP, the adjusted HEP = (0.7)(0.05) = 0.035. The resulting potential reduction in PORV-SBLOCA frequency derived by requiring the PORV training in the job catalog (Issue HF3.1) is therefore estimated to be [(5.3 x 10 4)/RY - (1.0)(0.01) o (0.035 + 0.003] = 2.5 x 10 4/RY. Given the visibility of PORV training since V) the TMI-2 accident, the above 30% reduction in HEP may over-estimate the poten-f tial HEP benefit. However, the assumed 30% reduction is expected to bound the safety significance of this issue.
12/31/89 3.125-67 NUREG-0933
Revision 6 Consequence Estimate Ratioing the above reduction in PORV-SBLOCA frequency (2.5 x 10 */RY) to the PORV-SBLOCA frequency from Issue 70 (1.05 x 10 8/RY) and multiplying by the core-melt frequency from Issue 70 (4.2 x 10 S/RY) yields the potential reduc-tion in core-melt frequency for this issue of (0.24)(4.2 x 10 4/RY) = 10 6/RY.
The public risk reduction is therefore (0.24)(31 man-rem / reactor) = 7.4 man rem /
reactor (See Issue 70).
CONCLUSION Issue HF3.1 evaluated the task selection process for training program content based on the relative importance of operator tasks and requirements.
Tasks involving the use of PORVs for both feed-and-bleed cooling and for identifica-tion of potential LOCAs are included in the generic INPO task analysis listings for PWRs and in NVREG-1122,87* Item EK3.03, " Actions Contained in E0P for PZR Vapor Space Accident /LOCA." This event has one of the highest importance ratings (4.6 of 5.0) for PWRs and is included in both training and NRC exams.
The high frequency of PORV challenges is to be addressed in Issue HF3.1.
There-fore, Issue 125.11.12 was DROPPra as a separate issue.
ITEM 125.II.13:
OPERATOR JOB AIDS DESCRIPTION In a DHFT memorandum 800 on September 19, 1985, it was suggested that an assess-ment be made of the availability of appropriate job aids to obviate operators having to rely heavily on memory in emergency or " crisis" conditions.
In a DSR0 memorandumto72 of June 12, 1986, it was requested that DHFT evaluate this issue for inclusion in the Human Factors Program Plan (HFPP) or perform aii analysis of the issue to determine its priority.
Safety Sionificance In the Davis-Besse occurrence, two operator-related problems were encountered which were involved in the sequence of events that transpired.
The first problem occurred when the secondary side operator, anticipating the automatic trip of the Steam Feedwater Rupture Control system (SFRCS), which would start the AFW system, elected to perform a manual trip.
However, the operator selected and actuated the wrong pair of pushbuttons from a set of five pairs and, instead of initiating an SFRCS trip for low water in the steam generators, obtained a trip for low steam pressure.
This action isolated both steam generators from the AFW system by closing the isolation valves.
At about the same time, both AFW pump turbines tripped on overspeed.
Recovery of AFW pumps due to the overspeed trips could not be accomplished by actions in the control room.
The second problem was encountered when two equipment operators were unable to reset the AFW pump turbine trip throttle valves and promptly restore feedwater delivery to the steam generators.
Both equipment operators, while having a reasonsble amount of nuclear power plant experience, had never previously per-formed the task of resetting, latching and opening the turbine trip throttle valves, particularly under full operating pressure.
One equipment operator 12/31/89 3.125-68 NVREG-0933
Revision 6 C)
had successfully reset and latched the No.2 trip-throttle valve but, due to the
("
high friction caused by large differential pressure across the valve gate, removed only the mechanical slack in the valve mechanism and did not open the valve.
The other operator had latched but did not reset the No. I trip-throttle valve and had partially opened the valve, but was fearful of applying more torque to open the valve further.
The turbine, as a result, was operating at i
2/3 its normal speed, which did not provide enough discharge pressure to inject water into the steam generator.
It was not until the assistant shift supervisor came into the pump room that the operators knew that the trip-throttle valves were not opened enough.
At about the same time, another, more experienced, equipment operator arrived with a valve wrench; using this tool he successfully opened the No.2 valve then also reset and opened the No. I valve.
Possible Solution It is conceivable that operator aids could have reduced the likelihood of the first operator error and decreased the time required for the equipment opera-tors to open the turbine trip-throttle valves.
" Operator aids" is a term which applies to a broad category of items which assist the operators, physically or mentally, in accomplishing their tasks.
Operator aids may be markings or cod-ings, tags, tools or devices to physically assist the operator, the layout or arrangement of equipment items, and the equipment design features including provision for human interface.
Examples of operator aids which could have assisted the control room and equipment operators include, but should not be limited, to the following:
g (a) The markings on the SFRCS pushbuttons could have described the resuits of actuation rather than the trip which they generate.
For example, instead of low steam pressure trip, the inscription might read SG feed-water isolation; and instead of low water level trip, they might be i
labeled AF initiation.
(b) Since a valve wrench is required to open the trip-throttle valves under pressure, a valve wrench might be permanently stored in the AFW pump rooms for use in emergencies.
(c) Since there existed some confusion about resetting and latching the trip-throttle valves, linkage guidance or instructions could be depicted on the AFW pump room walls to guide the unfamiliar. The mechanical link-age could also have been color-coded or conspicuously marked.
Again, the preceding are only examples of operator aids and are not intended to be an exhaustive list of all such operator aids which could have enhanced the operators actions in the Davis-Besse event.
Other generic issues that are related to the safety concern of this issue include:
125.I.7.a. " Recovery of Failed Equipment"; 125.I 7.b. " Realistic cands on Training"; and 125.11.10,
" Hierarchy of Impromptu Operator Actions."
CONCLUSION p
There certainly is no dispute that operator job aids can enhance an operator's ability to perform his task.
However, any attempt to define what job aids are L
needed on a generic basis is very difficult.
Even more difficult are efforts 12/31/89 3.125-69 NUREG-0933
Revision 6 to quantify the risk reduction which can result from efforts to improve or pro-vide absent job aids. Any attempt at quantification would be very arbitrary andwithoutmuchjustification.
Operator job aids is not a solution that stands on its own merit, but is supportive of other human factors elements such as staffing, qualifications, and training.
While the availability of operator job aids may enhance an operator's ability to accomplish his task, the absence of job aids only reduces the reliability of human performance and does not neces-sarily imply operator failure, The presence or absence of operator job aids becomes a factor which is consid-ered in the job task analysis and upon which training requirements are estab-lished.
Provisions are included in the INPO-managed training accreditation
{
program to ensure that the feedback from operating events such as the Davis-Besse event are included in utility training programs.
I, addition, a portion of the operator job aids is to be addressed in the resolution of the man-machine interface Issue HFS.1, " Local Control Stations."
The safety concern of this issue has been addressed by the INPO Training Accreditation Program which was endorsed in March 1985 by the Commission Policy Statement on Training and Qualification of Nuclear Power Plant Personnel.888 Therefore, this issue was DROPPED from further consideration as a separate issue.
ITEM 125.11.14:
REMOTE OPERATION OF EQUIPMENT WHICH MUST NOW BE OPERATED DESCRIPTION Historical Background During the course of the investigation of the event, it was noted that a startup feedwater pump (SUFP), a part of the main feedwater system that would have been very helpful in the mitigation of the transient, had been intentionally disabled because of an NRC concern with hion energy line breaks in the area of essential safety equipment and the ability of ECCS equipment to meet single failure criteria.
Although the Davis-Besse event specifically involved a SUFP, it is intended that this issue cover all equipment that has been disabled such that it is no longer remotely operable from the control room.
Safety Significance The significance of purposely disabled equipment lies primarily in timing.
Generally, it is possible to restore such equipment to an operable status.
However, plant personnel must be dispatched to the equipment to perform local, manual operations such as unlocking and manipulating manual valves, restoring and closing breakers, etc.
This can require considerable time and restoration to operability may well come too late to aid in accident mitigation.
- Moreover, the relatively complex procedures involved, done under emergency conditions, are prone to error.
Finally, the nature of the incident may well be such that the disabled equipment is rendered inaccessible.
O 12/31/89 3.125-70 NUREG-0933
Revision 6 CN Possible Solution
\\
)
The solution proposed 800 is straightforward:
" Review each piece of motor-operated equipment originally designed to be operated from the control room or other panel areas which has been disabled physically such that it can only be operated locally to determine whether such disabling truly is in the interest of overall plant safety."
PRIORITY DETERMINATION Over the years, there '-ave been many instances where equipment has been intentionally disableo.
In the case of the Davis-Besse SUFP, the reason was to ensure that the discharge lines, which are not seismically qualified and which also are routed near essential safety equipment, could not rupture and disable this equipment.
Other reasons also exist.
For example, equipment has in the past been disabled by removal of breakers to permit older ECCS designs to meet the single failure criterion.
This issue is non-specific in the sense that it addresses any of this disabled equipment.
Thus, re-enabling of this equipment may affect LOCA sequences,it transient-initiated sequences, etc.
Because of this very general nature, is impossible to quantify all aspects explicitly.
The approach we will use is to evaluate a SUFP similar to that of Davis-Besse, but (unlike the case of Davis-Besse) capable of providing sufficient flow by itself to permit decay heat removal by means of the steam generators.
Because such a pump would help mitigate transient-initiated sequences, which are relatively frequent compared i
e i
to (for example) LOCA-initiated sequences, this scenario should provide an V
upper bound to the priority parameters.
Frequency Estimate The sequence of interest is straightforward.
It is initiated by a nonrecover-able loss of main feedwater.
If the auxiliary feedwater system fails, the SUFP is not re-enabled in time, and feed-and-bleed techniques fail, core melt will ensue.
For the initiating event frequency (non-recoverable loss of main feedwater) we will use 0.64 event /RY, based upon the Oconee PRA done by Duke Power Co.489 This figure is based upon fault tree analysis and should be reasonably repre-sentative of most main feedwater system designs.
For a three-train AFW system, a " typical" unavailability is 1.8 x 10 5/ demand.894 The analogous figure for a two-train system is significantly higher.
- However, an existing program (Issue 124) is considering whether to upgrade all AFW systems to a point where the maximum unavailability would be 10 4/ demand.
These plants would almost certainly upgrade their SUFPs (if present) to help meet this crite-rion, which makes this issue moot for these plants; thus, we will use 1.8 x 10 5/ demand.
We will assume a typical value of 0.20 for the failure probability of feed-and-bleed cooling, based upon the calculations presented under Issue 125.II.9,
" Enhanced Feed-and-Bleed Capability."
s lV The SUFP non-recovery probability remains to be calculated.
According to the l
Investigation Team's report on the Davis-Besse event,sse restoration of the 12/31/89 3.125-71 NUREG-0933
~
Revision 6 SUFP normally takes 15 to 20 minutes.
Nevertheless, the assistant shift super-visor managed to do it in roughly 4 minutes during the June 9, 1985 event.
Obviously, not all plant personnel are going to go through the procedure as rapidly as the assistant shift supervisor at Davis-Besse even given the extra motivation of a real event.
We will assume that the time needed to restore the I
SUFP to operability can be described by a normal distribution, centered at 17.5 minutes and with a width such that the assistant shift supervisor's performance of 4 minutes is at the first 95 percentile point.
The time intervals above are measured from the start of the restoration proce-dure.
It is desirable for calculational purposes to measure time from the initiation of the transient.
Noting from NUREG-1154sse that the SUFP was restored at t = 16.38 minutes (measured from the start of the transient) after four minutes of rapid work on the part of the assistant shift supervisor, the significant times are:
t
= 0, start of transient t
= 12.38 minutes, start work on SUFP t95 = 16.38 minutes, 95 percentile point t
= 29.88 minutes, mean time for restoration 0
Thus, the probability of the SVFP being restored within the interval from t to (t + dt) is given by:
P(t)dt = (/hi o) 1 exp {- [(t-t )/o] }dt 0
where o = 8.93 minutes (based on t ~l95 = 13.5 minutes) 0 If one is willing to wait long enough, the integrated probability of restora-tion approaches unity.
However, there is a point in time after which restora-tion of the SUFP will no longer save the core.
Although it is not clear just when this time is, it is safe to assume that it occurs after steam generator l
dryout which is typically at least 25 minutes into the transient.
The proba-bility of no restoration is given by:
(
Pp (T) = / P(t) dt, where T 2 25 minutes 1
T There is no closed form solution to this integral.
However, standard statis-l tical tables readily give an answer of P (T) % 0.29.
p One last effect needs to be considered.
Consistent with Issue 122.3, " Physical l
Security System Constraints," an additional 1% probability of the plant per-sonnel being unable to reach the equipment location because of locked doors, etc., must be considered.
The core-melt frequency then becomes:
Core-melt /RY (0.64 loss of main feedwater events /RY) x (1.8 x 10 5 AFW failure probability) x (0.20 feed-and-bleed failure probability) x (0.29 + 0.01 SUFP non-restoration probability) 6.9 x 10 7 12/31/89 3.125-72 NUREG-0933
1 -
Revision 6 Consequence Estimate The core-melt sequence under consideration here involves a core-melt with no large breaks initially in the reactor coolant pressure boundary.
The reactor is likely to be at high pressure (until the core melts through the lower vessel head) with a steady discharge of steam and gases through the PORV(s).
These are conditions likely to produce significant hydrogen generation and combustion.
The Zion and Indian Point PRA studies used a 3% probability of containment failure due to hydrogen burn (the " gamma" failure).
We will follow this example and use 3%, bearing in mind that specific containment designs may differ significantly from this figure.
In addition, the containment can fail to isolate (the " beta" failure).
- Here, the Oconee PRA figure of 0.0053 will be used.
If the containment does not failbyisolationfailareorhydrogenburn,itwillbeassumedtofailbybase-mat melt-through (the " epsilon' failure).
Using the usual prioritization assumptions of a central midwest plains meteor-ology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are:
Failure Percent Release Consequences Mode Probability Category (man-rem) r i
gamma 3.0%
PWR-2 4.8 x 108 O
beta 0.5%
PWR-5 1.0 x 106 i
epsilon 96.5%
PWR-7 2.3 x 108 l
The " weighted-average" core-melt will have consequences of 1.5 x 105 man-rem.
The plants to be examined include all operating plants (presently 94).
As of the fall of 1987 (the earliest that changes are likely to be made), these plants will have an aggregate remaining license lifetime of 2718 RY.
This corresponds to an average lifetime of 29 calendar-years per plant.
At a 75% utilization factor, this is 22 operational years per plant.
It is not known how many plants would be affected by this issue.
We will assume that at least a few plants will be found and will calculate priority parameters on a per plant basis.
Thus the estimated risk reduction per plant is (6.9 x 10 7) (22)(1.5 x 105) man-rem, or 2.3 man-rem.
Cost Estimate The fix for this issue, once equipment is identified, is to do a detailed analysistoseeifthedisablingofthesubjectequipmentistrulyinthe interest of plant safety.
If the analysis indicates that the equipment should not be disabled, the original reason for disabling must still be addressed.
(Alternatives to disabling may be necessary to address the original concern.)
The minimum cost would correspond to a case where the equipment is process O
equipment, which is fully maintained and needs only te have valvis opened and breakers re-installed, which would take (we assume) roughly 17.5 n.?nutes of labor.
If it also turns out that no other alternatives are necessary, the 12/31/89 3.125-73 NUREG-0933
Revision 6 1
cost would be dominated by analysis and paperwork. We estimate that prob-abilistic analyses would require approximately 10 weeks of staff time (NRC and industry combined) per plant, at $100.000/ staff-year.
In addition, per plant costs of $13,000 for NRC and $16,000 for the licensee would be incurred for a typical straightforward technical specification change.
The minimum cost is then about $50,000/ plant.
Value/ Impact Assessment Based on a potential risk reduction of 2.3 man-rem / reactor and a cost of
$50,000/ reactor, the value/ impact score is given by:
3, 2.3 man-rem / reactor 50.05M/ reactor
= 46 man-rem /$M Other Consid,erations The aggregate parameters (total man-rem, all reactors, and total core-melt / year, all reactors) are not calculated here.
An examination of the scale factors for these parameters readily shows that at least 50 plants must be affected before it is possible for these parameters to be limiting.
In most cases, the fix will not involve work within radiation fields and thus t
will not involve ORE.
The ORE averted due to post-feed-and-bleed-cleanup and post-core-melt cleanup is a minor consideration.
The ORE associated with cleanup is estimated to be 1800 man rem, after a primary coolant spill, and 20,000 man-rem, after a core-melt accident.6*
If the frequency of feed-and-bleed events is 3.46 x 10 8/RY, the actuarial cleanup ORE averted is only 0.14 man-rem / reactor.
Similarly, a core-melt frequency of 6.9 x 10 7/RY corresponds to an actuarial averted cleanup ORE of only 0.30 man-rem / reactor.
If averted ORE were added to the man-rem / reactor and man-rem /$M figures above, no conclusions would change.
The proposed fix would reduce core-melt frequency and the frequency of feed-and-bleed events aM therefore would avert cleanup costs and replacement power costs.. The cost of a feed-and-bleed usage is dominated by roughly six months of replacement power while the cleanup is in progress.
If the average frequency of such events is 3.46 x 10 8/RY and the average remaining lifetime is 29 calendar-years at 75% utilization, then making the usual assumptions of I
a 5% annual discount rate and a replacement power cost of $300.000 per day, the actuarial savings for feed-and-bleed cleanup is estimated to be $2,200.
Similarly, the actuarial savings of averted core-melt cleanup (which is assumed to cost one billion dollars if it happens) are about $7,900.
The actuarial savings from replacement power after a core-melt up to the end of the plant life are about $9,600.
(This last figure represents the lost capital invest-ment in the plant.)
If these theoretical cost savings were subtracted from the expense of the fix, the value/ impact score would rise to 76 man-rem /$M and would not change any conclusions.
Some caution is needed in the use of the numbers cciculated above.
It must be i
remembered that these are maximum numbers, calculated for a worst case scenario.
It must also be remembered that equipment has often been disabled for good 12/31/89 3.125-74 NUREG-0933
Revision 6 reasons.
Re-enabling such equipment will generally have drawbacks as well as benefits and the net effect on plant safety is not necessarily positive.
CONCLUSION Based upon the figures presented above, tiils issue was given a LOW priority.
REFERENCES 11.
NUREG 0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition) July 1981.
16.
WASH-1400 (NUREG-75/014), " Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
48.
NVREG-0660, "NRC Action Plan Developed as a Result of the THI-2 Accident,"
U.S. Nuclear Regulatory Commission, May 1980.
54.
NUREG/CR-1659, " Reactor Safety Study Methodology Applications Program,"
U.S. Nuclear Regulatory Commission, 1981.
64.
NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Priori-tization Information Development," U.S. Nuclear Regulatory Commission, O
February 1983, (Supplement 1) May 1983, (Supplement 2) December 1983, (Supplement 3) September 1985.
96.
NUREG-0565, " Staff Report on the Generic Evaluation of Small-Break Loss-of-Coolant Accident Behavior for Babcock and Wilcox Operating Plants,"
U.S. Nuclear Regulatory Commission, January 1980.
98.
NVREG-0737, " Clarification of TMI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980.
187.
NUREG/CR-2300, "PRA Procedures Guide," U.S. Nuclear Regulatory Commission, September 1981.
- 197, Code of Federal Regulations, Title 10. Energy.
210.
NUREG-0885, "U.S. Nuclear Regulatory Commission Policy and Planning Guidance," U.S. Nuclear Regulatory Commission, (Issue 1) January 1982, (Issue 2) January 1983, (Issue 3) January 1984, (Issue 4) February 1985, (Issue 5) February 1986, (Issue 6) September 1987.
234.
Federal Register, Vol. 47, No. 46, "10 CFR Part 2, General Statement of Policy and Procedure for Enforcement Actions," March 9, 1982.
307.
EPRI NP-2230. "ATWS:
A Reappraisal, Part 3," Electric Power Research Institute, 1982.
O 12/31/89 3.125-75 NUREG-0933
Revision 6 339.
NUREG/CR-1278, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," U.S. Nuclear Regulatory Commission, February 1983.
366.
NUREG/CR-2787, " Interim Reliability Evaluation Program:
Analysis of tha Arkansas Nuclear One-Unit 1 Nuclear Power Plant," U.S. Nuclear Regulatory Commission, June 1982.
376.
NRC Letter to All Licensees of Operating Reactors, Applicants for Operating Licenses, and Holders of Construction Permits, " Supplement 1 to NUREG-0737, Requirements for Emergency Response Capability (Generic Letter No. 82-33)," December 17, 1982.
439.
Regulatory Guide 1.149, " Nuclear Power Plant Simulators for Use in Operator Training," U.S. Nuclear Regulatory Commission, April 1981.
651.
NUREG 0985, Revision 2, "U.S. Nuclear Regulatory Commissior. Human Factors Program Plan," U.S. Nuclear Regulatory Commission, April 1986.
738.
NUREG-1044, " Evaluation of the Need for a Rapid Depressurization Capability for CE Plant," U.S. Nuclear Regulatory Commission, December 1984.
745.
EPRI NP-3967, " Classification and Anal sis of Reactor Operating Experience Involving Dependent Events,y' Electric Power Research Institute, June 1985.
885.
Memorandum for H. Thompson from D. Crutchfield, " Potential Immediate Generic Actions as a Result of the Davis-Besse Event of June 9, 1985,"
August 5, 1985, 886.
NUREG-1154, " Loss of Main and Auxiliary Feedwater Event at the Davis-Besse Plant on June 9, 1985," U.S. Nuclear Regulatory Commission, July 1985.
887.
Memorandum for T. Speis from H. Thompson, "Short Term Generic Actions as a Result of the Davis-Besse Event of June 9, 1985," August 19, 1985, 1
889.
NSAC-60, "A Probabilistic Risk Assessment of Oconee Unit 3," Electric l
Power Research Institute, June 1984.
894.
Memorandum for 0. Parr from A. Thadani, " Auxiliary Feedwater System - CRGR l
Package," November 9, 1984.
895.
Memorandum for H. Denton, et al., from W. Dircks, "Staf f Actions Result-l ing from the Investigation of the June 9 Davis-Besse Event (NUREG-1154),"
August 5, 1985.
896.
SECY-86-56, " Status of Staff Study to Determine if PORVs should be Safety l
Grade," February 18, 1986.
897.
Memorandum for G. Lainas from F. Rowsome, " Safety Evaluation of the CE Licensees' Responses to TMI Action Item II.K.3.2," August 26, 1983.
898.
Memurandum for G. Lainac from F. Rowsome, " Safety Evaluation of the B&W Licensees' Responses to TMI Action Item II.K.3.2," August 24, 1983, 12/31/89 3.125-76 NUREG-0933
\\
Revision 6 899.
Memorandum for G. Lainas from F. Rowsome, " Safety Evaluation of the West-inghouse Licensees' Responses to TMI Action Item II.K 3.2 " July 22, 1983.
900.
Memorandum for H. Thompson from W. Russell, " Comments on Draft List of Longer Term Generic Actions as a Result of the Davis-Besse Event of June 9, 1985," September 19, 1985.
940.
Memorandum for T. Speis from H. Thompson, " Longer-Term Generic Actions as a Result of the Davis-Besse Event of June 9, 1985," November 6, 1985.
941.
Memorandum for B. Morris from D. Basdekas, " Concerns Related to the Davis-Besse Incident on June 9, 1985," August 13, 1985.
942.
Memorandum for F. Gillespie from D. Basdekas, " Concerns Related to the Davis-Besse Incident on June 9, 1985," September 27, 1985.
943.
Memorandum for A. DeAgazio from D. Crutchfield, " Davis Besse Restart Safety Evaluation (TAC No. 59702)," December 17, 1985.
944.
Letter to G. Ogeka (BNL) from T. Spek (NRC), "BNL Technical Assistance to the Division of Safety Review and Ovei:icht. Office of Nuclear Reactor l
Regulation, NRC
' Reduction of Risk Uncertai.'.ty' (FIN A-3846)," April 28, 1981 945.
, andum for K. Kniel from R. Riggs, "0TSG Thermal Stress (GI-125.II.4),"
- 17, 1986.
O 946.
Memorandum for H. Thompson from R. Bernero, " Auxiliary Feedwater Systems,"
August 23, 1985.
947.
Memorandum for H. Thompson and T. Jpeis from R. Bernero, " Request for Com-ments on Draft CRGR Package with Requirements for Upgrading Auxiliary Feedwater Systems in Certain Operating Plants," October 3, 1985.
948.
Memorandum for H. Thompson from G. Edison, " Recommendation for Longer Term Generic Action as a Result of Davis-Besse Event of June 9, 1985,"
September 11, 1985.
949. Memorandum for F. Miraglia from G. Edison, "Prioritization of Generic Issue 125.11.1.D," April 25, 1986.
950.
BAW-1919. "B&W Owners' Group Trip Reduction and Transient Response Improvement Program," May 31, 1986.
951.
Memorandum for H. Thompson and W. Minners from F. Rowsome, "Another Generic Safety Issue Suggested by the Davis-Besse Incident of June 9, 1985," September 9, 1985.
952.
Memorandum for W. Minners from K. Kniel, "Value/ Impact Assessment for Draft CRGR Package Requiring Upgrading of Auxiliary feedwater Systems in' Certain Operating Plants," January 16, 1986.
O 953.
Memorandum for G. Mazetis from A. Marchese, " Revised Outline of Regulatory Analysis for USI A-45," January 14, 1986, 12/31/89 3.125-77 NUREG-0933
Revision 6
\\
957.
Federal Register Notice 49 FR 46428, "10 CFR Parts 50 and 55, Operator's Licenses and Conforming Amendment," November 26, 1984.
966.
Federal Register Notice 50 FR 11147, "10 CFR Ch. 1 Commission Policy Statement on Training and Qualification of Nuclear Power Plant Personnel,"
March 20, 1985.
973. Memorandum for T. Spets from W. Minners, " Schedule for Resolving Generic Issue No.125.II.1.b, ' Review Existing AFW Systems for Single Failure,'"
December 10, 1986.
4 993.
NUREG-1220, " Training Review Criteria and Procedures," U.S. Nuclear Regulatory Commission, July 1986.
996.
Feoeral Register Notice 50 FR 43621, " Commission Policy Statement on Engineering Expertise on Shift," October 28, 1985.
1002. Memorandum for H. Clayton from B. Sheron, " Criteria for Initiation of Feed and Bleed," September 13, 1985, 1003. Memorandum for W. Russell from K. Perkins, " Generic Issue 125.I.8,
' Procedures and Staffing for Reporting to NRC Operations Center,'"
November 25, 1986.
1004. Memorandum for G. Lainas and D. Crutchfield from F. Rowsome, " Davis-Besse Restart Considerations," August 13, 1985.
1005 Memorandum for V. Stello from D. Ward "ACRS Comments on Proposed ResolutionofGenericIssue124,'AuxIliaryfeedwaterSystemReliabil-ity,'" September 17, 1986.
1011. NUREG 1177, " Safety Evaluation Report'Related to the Restart of Davis-Besse Nuclear Power Station, Unit 1, Following the Event of June 9, 1985,"
U.S. Nuclear Regulatory Commission, June 1986.
1012. Federal Register Notice 50 FR 29937, "10 CFR Part 50, Analysis of Potential Pressurized Thermal Shock Events," July 23, 1985.
L 1013. NUREG-1212, " Status of Maintenance in the U.S. Nuclear Power Industry 1985," U.S. Nuclear Regulatory Commission, (Volumes 1 and 2), June 1986.
1023. SECY-86-231, " Survey on Engineering Expertise on Shift," August 6, 1986.
1036. lE Bulletin No. 85-03, " Motor-0perated Valve Common Mode Failures During Plant Transients Due to Improper Switch Settings," U.S. Nuclear Regulatory l
Commission, November 15, 1985.
1 1037. SECY-83-484, " Requirements for Emergency Response Capability,"
November 29, 1983, 1038. IE Information Notice No. 86-10, " Safety Parameter Display System Malfunctions,"
U.S. Nuclear Regulatory Commission, February 13, 1986.
O 12/31/89 3.125-78 NUREG-0933
Revision 6 O) 1039. Memorandum for H. Denton from T. Speis, "Prioritization of Selected MPAs
(
(Operating Plan, Item VI.B 6.b)," October 19, 1984.
9/
1040. NUREG/CR-3246, "The Effect of Some Operations and Control Room Improvements on the Safety of the Arkansas Nuclear One, Unit One, Nuclear Power Plant," U.S. Nuclear Regulatory Commission, June 1983.
1072. Memorandum for W. Russell from T. Speis, " Generic Issue 125.11.13 -
Operator Job Aids," June 12, 1986.
1081. NUREG-1150, " Reactor Risk Reference Document," U.S. Nuclear Regulatory Commission, (Draft) February 1987.
1082. NUREG/CR-3673, " Economic Risks of Nuclear Power Reactor Accidents," U.S.
Nuclear Regulatory Commission, April 1984.
1083. Memorandum for T. Speis from F. Gillespie, " Review of RES Proposed Prioritization of Generic Issue (GI) 125.11.11, ' Recovery of Main Feedwater as an Alternative to Auxiliary Feedwater,'" April 27, 1988.
1085. NRC Letter to All Operating Reactor Licensees, Applicants for an Operating License and Holders of Construction Permits for Babcock & Wilcox Pressurized Water Reacto s, " Safety Evaluation of ' Abnormal Transient Operating Guidelines,' (Generic Letter 83-31)," September 19, 1983.
1119. NUREG/CR-4780, " Procedures for Treating Common Cause Failures in Safety
(^
and Reliability Studies," U.S. Nuclear Regulatory Commission, January
(
1988.
v 1133. NUREG-1332 " Regulatory Analysis for the Resolution of Generic Issue 125.11.7, IReevaluate Provision to Automatically Isolate Feedwater from Steam Generator During a Line Break,'" U.S. Nuclear Regulatory Commission, September 1988.
1134. Memorandum for V. Stello from E. Beckjord, " Resolution of Generic Issue 125.11.7, ' Reevaluate Provision to Automatically Isolate Feedwater from Steam Generator During a Line Break,'" September 9, 1988.
1205. NRC Letter to All Licensees of Operating Plants, Applicants for Operating Licenses, and Holders of Construction Permits, " Task Action Plan I.D.2 -
Safety Parameter Display System - 10 CFR 550.54(f) - (Generic Letter No. 89-06)," April 12, 1989.
1206 NUREG-1342, "A Status Report Regarding Industry Implementation of Safety Parameter Display Systems," U.S. Nuclear Regulatory Commission, April 1989.
1207. Memorandum for V. Stello from T. Murley, " Final Resolution of Generic Issue 125.I.3, 'SPDS Availability,'" April 26, 1989.
CN V
12/31/89 3.125-79 NUREG-0933 l
l O
i I
Q ISSUE 131:
POTENTIAL SEISMIC INTERACTION INVOLVING THE MOVABLE IN-CORE FLUX MAPPING SYSTEM USED IN WESTINGHOUSE DESIGNED PLANTS DESCRIPTION Historical Background Potential seismic interaction involving the movable in-core flux mapping systems was identified as a generic issue in August 1985.11" This potential interaction exists because portions of the in-core flux mapping system, which have not been seismically analyzed, are located directly above the seal table.
Failure of this equipment during a seismic event could cause multiple fsilures at the seal table and could produce an equivalent small-break LOCA.
Staff discussions of the issue with W revealed that potential seismic interactions could exist at operating W plaiits.1188 The staff's concerns were outlined in IE Information Notice No. 85-451171 issued in June 1985.
Safety Significance The in-core flux mapping system used in W plants has movable fission chambers.
4 These chambers are mounted at the end of long drive cables and travel in long tubes called " thimbles" which run from a location outside the biological shield, enter the reactor at the bottom of the vessel, lead up through the core, and
(
terminate near the top of the fuel.
The thimbles are simply guide tubes for the y
detectors which are inserted into the core only when a flux map is being taken.
The thimbles are sealed at the reactor end and are dry inside.
They are also retractable and run within larger tubes called " conduits." These conduits are wet inside, sealed to the reactor vessel bottom at one end thus making them 2
I extensions of the RCPB, and terminate at the seal table.
A mechanical compression-type seal attached to the seal table serves as the pressure boundary l
between the thimble tube and the fitting.
The seal table is at the same elevation as the reactor vessel up?er head closure flange.
The advantage of this arrangement is that, at tie beginning and end of a refueling outage with the reactor at atmospheric pressure and the vessel water level at the flange, the seals in the seal table can be unlocked and thimbles can be withdrawn and inserted.
Since the seals at the seal table are part of the RCPB, failing these seals will cause a small LOCA.
- Moreover, the escaping coolant would be drawn from the bottom of the reactor vessel.
For such a break location, as the liquid level in the reactor coolant system drops, the steam space expands until saturation conditions are reached.
After this, as the steam volume increases, the liquid boils and the pressure and temperature may remain high as liquid coolant exits from the bottom of the reactor vessel.
Because virtually all of the reactor coolant system piping is connected directly or indirectly at the reactor vessel nozzles above the top of the core, most breaks are in effect above the core.
For such breaks, once the liquid level has dropped to the point where the break is in the steam space, the pressure drops very rapidly because each pound of steam leaving the system p
carries with it the latent heat of vaporization.
This more typical break therefore results in much greater energy loss with a corresponding rapid (v) _- reduction in both temperature and pressure.
12/31/89 3.131-1 NUREG-0933
In contrast, seal leaks at the seal table will not draw from the steam space until after the core is completely uncovered.
If the leak is greater than the capacity of the high pressure injection, the core may uncover.
The low pressure injection pumps, which would normally be able to mitigate such a leak, may not be able to inject until after the entire liquid inventory is lost, by which time the core could be severely damaged.
In addition, it should be noted that any loss of the RCPB integrity caused by seismically-induced failures in the flux mapping system would be outside the design basis of a plant.
Therefore, such a condition should be unacceptable even if the consequences remain within those for LOCAs analyzed in an SAR.
This issue applies to all W plants.
Some CE plants have movable in-care detectors (in addition to The fixed detectors installed in all CE reactors).
The CE design has the tubes entering from the top rather than the bottom of the vessel.
Thus the issue does not apply to CE plants.
B&W plants use only fixed in-core, detectors; there is no seal table.
Thus, this issue does not apaly to B&W plants. GE plants use movable in-core detectors with bottom-entry tu)es.
The GE design has 0-ring reals in the instrument guide tube housings l
located in the lower vessel head instead of wet conduits leading to a remotely i
located seal table.
Thus,thisIssuedoesnotapplytoGEplants.
Possible Solution The nonseismically qualified B0P equipment 1187'1108 consists of the flux mapping transfer cart which apparently is suspended from a rail car mounted on tracks over the seal table.
This particular design configuration is described as the " worst case found," but still other equipment may be involved at other plants.
The obvious possible fix is to install restraints of some kind.
- However, i
simpler solutions may be possible in some situations.
For example, it may be possible in some instances to simply move the transfer cart out from over the seal table when the equipment is not in use if the tracks are long enough and the plant does not use an Axial Power Distribution Monitoring System (APDMS).
PRIORITY DETERMINATION Frequency Estimate I
l The accident sequence is straightforward: a seismic event occurs that is severe enough to cause the transfer mechanism to fall on the seal table; a sufficient l
number of seals fail such that the leak exceeds the capacity of the high pressure injection system; the core then uncovers and melts with the vessel still at high pressure, l
The first parameter is the frequency of seismic events of sufficient severity to cause the transfer mechanism to fall.
Seismic event frequencies vary considerably from site to site, but the frequency of the SSE is generally in the range of 10 4 to 10.a event /RY.
We will assume a site with above average seismic activity and use 10 8/RY.
O:
12/31/89 3.131-2 NUREG-0933
)
i i
4 o
The next parameter is the aumber of seals which fail.
Mathematically, this is V) a sequence of probabilities, i.e., there is a probability of one seal
(
failing, a probability of two seals failing, etc.
The mathematical formulation of such a sequence of probabilities is reasonably straightforward, but actual calculation is hampered by the f act that we have no readily available informationregardingthesize, shape, height,ormassofthefallingobjector objects.
There is also the question of whether the falling object simply remains where it falls, implying that the initial impact causes seals to fail, or whether the seismic activity (including aftershocks) causes the object to vibrate or roll around on the seal table, causing seal failures.
A W Safety Review Committee conducted a structural evaluation of one rejiresentativeplantdesignandconcludedthatthetransfercartcouldcauseat most three seal failures.
It is not clear from the W information what type of failure (s) was induced to the seals.
The thimble tuSes could perhaps be sheared offandejectedor,morelikely,couldbebentanddistorted.
In either case, the compression-type fitting at the seal table could fail and result in tube ejection similar to the thimble tube ejection event that occurred at Sequoyah.tico However, in either of these cases ejection of the thimble tube, as discussed below,wouldcauselossofintegrItyoftheRCPB.
It is expected that the probability of at least one seal failure should be relatively high, but the probability of all seals failing should be much lower.
In the absence of any other information, we will assume a Poisson distribution.
If the probability of n failures is given by P(n), the Poisson formula becomes:
P(n) = y'(e7 ), where p is the Poisson distribution.
O For this distribution, the average number of failures (p) is given by:
<n> = InP(n)= p n=1 We will assume 95 percent confidence in the W Safety Review Committee's calculation that no more than three seals fail, i.e., we will adjust p such that:
P(0) + P(1) + P(2) + P(3) = 0.95 finding the appropriate value of p involved development of a staff computer programtosolvethetranscendentalep0uation with values of p and the probabilities treated as variables.22 The results are as follows:
p = <n> = 1.37
/
I 12/31/89 3.131-3 NUREG-0933 l
,. -, _ ~ - - _
The d gnificance of this parameter is that the Aver 0ge number of seal failures from a falling transfer cart is 1.37.
Substituting this value in the previous fo m la:
P(0) 2 0.254 P(1) -
0.348 P(2) = 0.238 P(3) = 0.109 Total:
0.95 j
It is necessary to examine the capacity of the high pressure injection system to go with the number of seal failures. We will choose a class of plants similar to Surry for this evaluation.
These plants are equipped with three high pressure centrifugal pumps (one normally in operation), each with an in;ection capacity of 150 gpm at normal operating pressure.
The 10 of the conduits vary from 0.4 to 0.6 inches and is filled with a 0.3 inch OD thimble tube.
However, the thimble tube is not expected to be very effective in throttling fluid flow if seal failure (s) result from a guillotine break of the thimble tube or failure of the compression fitting capability, given i
distorted or bent thimble tube (s), since they are likely to be ejected.
The thimble is designed with sufficient stiffness to be inserted by being pushed at one end and thus is unlikely to jam in place.
After a seal failure, the force that would tend to eject the thimble (due to differential pressure) is about 140 pounds, not including the effect of flowing fluid along the length of the thimble tube.
An actual seal failure at the compression fittin occurred at Sequoyah in 1984 duringmaintenanceinvolvingthimblecleaning.22g8 The thimble was ejected from the conduit and the fluid loss was estimated by the licensee to be between 25 and 35 gpm.
We will assume a 30 gpm break flow in our calculations, based on the Sequoyah experience.
We will further assume (for lack of better information) that a 150 gpm pump will be able to mitigate five broken seal leaks of 30 ypm each.
l However, it must be remembered that as pressure drops, the injection flow from the pump (s) will increase.
Arelatlvelyextensivecalculationwouldbe necessary to determine the actual number of seal leaks a given configuration of pumps could handle.
Depending on the total leakage flow, mitigation may require one, two, or all three pumps.
Calculation of the unavailability of the 1/3, 2/3, and 3/3 configurations is somewhat complex, since there are several permutations and combinations in what is basically a three-train system.
In addition, one of the three pumps is normally kept in operation, which eliminates the fail-to-start failure mode for one pump.
Unavailability for the 1/3 and 2/3 configurations were calculated in WASH-1400.26 These results are 8.6 x 10 8/ demand for 1/3 l
l-and 1.2 x 10 2/ demand for 2/3.
Results for 3/3 were not presented in WASH-1400.28 However, we note that the 3/3 configuration is not single failure proof.
- Thus, the 3/3 unavailability can be approximated as follows:
O singles + 0 maint = (1.1 x 10 8)/ demand + (5.7 x 10 2)/ demand
= (5.8 x 10 2)/ demand.
We will consider four ranges of seal failures.
12/31/89 3.131-4 NUREG-0933
Range Probability Result k
1 to 5 failures P(1) + P(2) +... +P(5) 7.40 x 10 1 6 to 10 failures P(6) +... + P(10) 2.88 x 10 8 11 to 15 failures P(11) +.., + P(15) 2.29 x 10 7 16 or more failures P(16) +... + P(58)
Negligible P(n) = y! (e'P), where p = 1.37 n
Each range corresponds to a pump configuration as shown below:
Number Event of Pumps Pump Core-Melt Probability Needed for Configuration Frequency Range of Range Mitigation Unavailability (per RY)*
1 to 5 7.43 x 10 2 1 of 3 8.6 x 10 3 6.39 x 10 6 6 to 10 2,88 x 10 3 2 of 3 1.2 x 10 2 3.46 x 10 8 11 to 15 2.29 x 10 7 3 of 3 5.8 x 10 2 1.33 x 10 21
(
\\
Total:
6.42 x 10 8 This column is the SSE frequency (10 8/RY) multiplied by the range probability (second column) and the pump configuration unavailability (fourth column).
Consequence Estimate The core-melt sequences under consideration involve a core-melt with no large breaks initially in the RCPB and containment heat removal systems successful or partially successful. The reactor is likely to be at high pressure (until the core melts through the lower vessel head) with a steady discharge of steam and gases through the broken seals and (possibly) the PORVs..These are conditions likely to produce significant hydrogen generation and combustion.
The Zion and Indian Point PRA studies used a 0.03 probability of containment failure due to hydrogen burn (the " gamma" failure).
(See References 1052, 1151, and 1152.) We will follow this example and use 0.03, bearing in mind that specific containment designs may differ significantl In addition, the containment can fail to isolate (the "y from this figure.
beta" failure).
Here, the Oconee PRA54 figure of 0.0053 will be used.
If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to fail by base mat melt-through (the " epsilon" failure).
(*
12/31/89 3.131-5 NUREG-0933 I
i Assuming a central midwest plain meteorology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequence parameters are:
Failure Cont. Failure Release Cond. Release Mode Probability Category (man-rem) gamma 0.030 PWR-3 5.4 x 105 beta 0.005 PWR-5 1.0 x 108 epsilon 0.965 PWR-7 2.3 x 10s The " weighted-average" core-melt results in a public dose of 1.7 x 105 man-rem / event.
Therefore, based on a core-melt frequency of 6.42 x 10 8/RY, a remaining plant lifetime of 30 years, and a weighted dose of 1.7 x 105 man-rem / event, the public risk is estimated to be 32.7 man-rem / reactor.
These results should cover all PWRs with large dry containments.
They do not apply to ice condenser containments.
Because of the low free volume in such containments, failures due to overpressure are more likely and the average consequences may be significantly greater.
Cost Estimate Industry Cost:
Because the exact hardware modifications to the transfer cart and associated equipment are not known and will probably vary from plant to plant a generic cost estimate is difficult to estimate.
H m ver, such modifications are likely to be dominated by labor costs which are unlikely to exceed one staff year / reactor ($100,000).
Licensee administrative costs are likely to be on the order of another $100,000, giving a total licensee cost of
$200,000/ plant.
NRC Cost:
NRC costs are likely to be on the order of one staff-year of generic work.
In addition, because plant designs vary, roughly two staff-months of effort on each plant will be used.
Thus, NRC costs are estimated to be on the order of $100,000 for the generic effort which is distributed over 34 reactors (53,000/ plant) plus $16,700/ plant for those plants that modify the design.
As indicated above, this equipment is BOP equipment and may vary considerably from plant to plant. Therefore, the estimates of both consequences and costs are expected to represent an upper bound for those plants that approximate the worst case design configuration in their flux mapping systems.
Based on the above considerations, the cost for plants that have sir,ilar design flux mapping systems is approximately $220,000/ plant.
Value/ Impact Assessment The maximum value/ impact score for those plants that may be affected by this issue is given by:
32.7 man-rem / reactor b
~
50.22M/ reactor
= 149 man-rem /$M 12/31/89 3.131-6 NUREG-0933
i 1
o This maximum value/ impact score corresponds to a site with a high SSE frequency.
V) l Other Considerations (1) The fix for this issue involves work within an area where significent radiation fields may be present.
Thus, protection to reduce ORE should be considered in planning the fix.
(2) If a seal should fail, the post-accident cleanup in the seal table area will involve ORE even if the event is successfully mitigated.
After the Sequoyah event,2288 the licensee was able to remove the ejected thimble tui,a and decontaminate the area with only one man-rem of ORE.
Under the assumption of 30 remaining years of actual operation, a seismic event frequency of 10 8/ year a J an average of 1.37 failed seals per event, the actuarialavertedOREIsonly0.04 man-rem / plant.
However, if one or more of the fission chambers is in use and inserted into the thimbles when the event occurs, the cleanup exposure will be far greater.
(3) Averting a core-melt also averts the ORE associated with core-melt cleanup.
Using a value of 20,000 man-rem to clean up af ter a core-melt, the averted ORE is 3.85 man-man over the remaining life of a plant.
The ORE from potential u re-melt for this issue is approximately i
10 percent of the potential public risk.
(4) The proposed fix reduces core-melt frequency and therefore averts cleanup costs and replacement power costs.
The potential plant value (savings) p for averted core-melt cleanup and replacement power costs is determined by the expression:870 0 = mC e rt (3,,,rt)(),,,rm) = $28,400 I
r2 where:
D = discounted time value of money f = 6.42 x 10 8/RY (core-melt frequency)
C = $1.65 billion (current core-melt cost) r = 5% (discount rate) t = 30 years (assumed remaining plant life) m = 10 years (assumed 10 year replacement power cost)
The accident avoida.. 3 costs, if included, would reduce the impact cost by approximately 10 percent.
(5)
In this analysis, it was assumed that the three seal failure limit calculated by the W Safety Review Committee corresponds to a 95 percent confidence limit.
This is a pragmatic rather than a rigorous assumption.
To test the sensitivity of the core-melt frequency to this assumption, additional calculations at 90 percent and 80 percent were performed.
The results were as follows:
m 12/31/89 3.131-7 NUREG-0933
q l
J 3-Pin Probability Sum p
Core-Melt Frequency 95%
1.370 6.4 x 10 6 90%
1.745 7.1 x 10 8 80%
2.295 7.9 x 10 6 The core-melt frequency does increase, but not dramatically, as the percent figure is lowered.
This is because most of the core-melt frequency comes froc th accident sequence where 1 to 5 seals fail and all three high i
pres
..a injection trains fail.
The sequence where a large number of seals fail, w fewer HPI trains need to fail. for core-melt to result, does not contribute greatly to the core-melt frequency.
Therefore, the assumption may not be rigorous, but the final result should be reasonable.
(6) The calculations assumed a Surry class of plants which has three centrifugal charging pumps.
The situation is rather different for the Sequoyah class of plants, which has one lower-capacity reciprocating charging pump, two centrifugal charging pumps, and two intermediate head safety injection pumps.
Such plants have slightly less injection capability at full-pressure.
However, the intermediate head SI pumps have a shutoff head of-1520 psig and seal. failure calculations 1187 show RCS pressure stabilizing around 1200 to 1250 psig, low enough for the SI pumps to inject some coolant.
Therefore, these plants have more mitigation capability than the Surry class of plants and this issue would be less significant for them in terms of core-melt frequency.
However, some of the Sequoyah class of plants have ice condenser containments which may make this issue more significant in terms of man rem.
(7) The assumed seismic event frequency of 10 3/RY is a maximum value.
The nationwide site average would be a factor of 3 or 4 lower than this, but use of the average rather than the maximum value would not change the core-melt frequency enough to alter the conclusion.
F CONCLUSION
.As stated earlier, any loss of RCPB integrity caused by seismically-induced failures in the flux mapping system would be outside the design basis of a plant.
Based upon the above cniculations,. particularly the core-melt frequency estimate, a medium priority ranking was recommended for this issue.
- However, upon further RES management review, it was decided.that the safety concern could be more efficiently addressed as part of the External Event IPE Program.
REFERENCES 16.
WASH-1400 (NUREG-75/014), " Reactor Safety Study, An Assessment of
-Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
54.
NUREG/CR-1659,~" Reactor Safety Study Methodology Applications Program,"
-U.S. Nuclear Regulatory Commission, (Volume 1) April 1981, (Volume 2) May 1981, (Volume 3) June 1982, (Volume 4) November 1981, i
12/31/89 3.131-8 NUREG-0933
970.
NUREG/CR-3568, "A Handbook ror alue-Impact Assessment," U.S. Nuclear Regulatory Comission, Decemb:re 1983, 1052. NUREG/CR-2228 " Containment Response During Degraded Core Accidents Initiated by Transients and Small Break LOCA in the Zion / Indian Point Reactor Plants," U.S. Nuclear Regulatory Comission, July 1981.
1151. NUREG/CR-2934, " Review and Evaluation of the Indian Point Probabilistic Safety Study," U.S. Nuclear Regulatory Comission, December 1982, 1152. NUREG/CR-3300, " Review and Evaluation of the Zion Probabilistic Safety Study," U.S. Nuclear Regulatory Comission, (Vol.1) May 1984.
1167. Memorandum for W. Minners from B. Sheron, " Proposed Generic Issue,
' Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Designed Plants,'" August 27, 1985.
1168. Letter to F. Miraglia (NRC) from G. Goering (Westinghouse Owners Group),
" Potential Seismic Interaction Associated with the Flux Mapping System in Westinghouse Plants," June 10, 1985, 1169. NUREG/CR-2000. (LER 84-030), " Licensee Event Report (LER) Compilation,"
U.S. Nuclear Regulatory Comission, (Vol. 3, No. 7) August 1984, 1170. iiemorandum for T. King from R. Riggs, " Computer Program 'SEALCOM' Used in Generic Issue 131," May 1,1989.
1171. IE Information Notice No. 85-45, " Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse
'd Plants," U.S. Nuclear Regulatory Commission, June 6, 1985.
O 12/31/89 3.131-9 NUREG-0933 I
Revision 1 O
\\
V ISSUE 134:
RULE ON DEGREE AND EXPERIENCE REQUIREMENT DESCRIPTION Since the TMI-2 accident in March 1979, to which human error was a major contrib@ 4 the issue of academic requirements for reactor operators has been # e jor esacern of the NRC.
In October 1985, the NRC issued a Policy Statsnt er Ingineering Expertise on Shif t* which contained two alternetivos for providits, the necessary technical and academic knowledge
~
i to the shift crews in the centrol rooms of nuclear power plants.
Option 1 of the policy statement permits an individual to serve in the combined senior operator / shift technical advisor (50/STA) role if that individual holds either (1) a bachelor's degree in engineering technology or ph accredited institution, or (2) a professional engineer'ysical science from an s license.
Option 2 permits continuation of the. separate STA on each shift who holds a bachelor's degree or equivalent and meets the criteria stated in NUREG-0737.08 In January 1986 the Comission directedt204 the staff to prepare an ANPRM that would require 50 applicants af ter January 1,1991, to have a baccalaureate degree in engineering or physical science from an accredited institution.
The object of this contemplated rule was to upgrade the levels of engineering and accident management expertise on' shift.
(~'N For candidates with a baccalaureate degree, the existing requirement of two
(]
years of nuclear power plant experience would be amended to require at least one of the two years of operating experience to be with a similar comercial nuclear reactor operating at greater than 20% power.
50s licensed prior to January 1, 1991, who did not hold degrees in engineering or physical science would be " grand-fathered." Only one reexamination would be allowed for appli-
+
carts who apply before January 1, 1991.
No degree equivalency would be acceptable af ter January 1,1991.
Based upon Commission direction to prepare an ANPRM on degreed 50s, this issue was given a high priority.
CONCLUSION In April 1987, issues and proposed options concerning degree requirements for l
S0s were presented to the Comission in SECY-87-101.1o42 In 1989, the NRC issued a policy statement 12cs on Edu::ation for Senior Reactor Operators and l
Shift Supervisors at Nuclear Power Plants.
In issuing this policy statement, I
the Commission believed that the level of engineering and technical knowledge l
of shift operating personnel has a direct bearing on the safety of nuclear L
power plants and that this safety is enhanced by having, on each shift, a team of NRC-licensed professionals that combine technical and academic knowledge with plant-specific training and substantial hands-on operating experience.
With the issuance of the policy statement, the proposed rule was withdrawn.12u Thus, this issue was RESOLVED and no new requirements were established.
REFERENCES l O 98.
NUREG-0737, " Clarification of TMI Action Plan Requirements," U.S.
l C/
Nuclear Regulatory Comission, November 1980.
12/31/89.
3.134-1 NUREG-0933
Revision 1 l
996.
Federal Register Notice 50 FR 43621, " Commission Policy Statement on Engineering Expertise on Shift," October 28, 1985.
1042.
SECY-87-101, " Issues and Proposed Options Concerning Degree Requirement for Senior Operators," April 16, 1987.
1264.
Memorandum.for V. Stello from S. Chilk, " Degree Operators:
Advance Notice of Rulemaking," January 23, 1986.
1265.
Federal Register Notice 54 FR 33639, " Education for Senior Reactor Operators and Shift Supervisors at Nuclear Power Plants'; Policy Statement," August 15, 1989.
1266.
Federal Register Notice 54 FR 33568, " Education and Experience Requirements for Senior Reactor Operators and Sugervisors at Nuclear Power Plants; Withdrawal of Proposed Rulemaking, August 15, 1989.
l l
e l
I 1
l 12/31/89 3.134-2 NUREG-0933 L
HNN Les5 m
LD APPEND?X B APPLICABILITY OF NUREG-0933 ISSUES TO OPERATING AND FUTURE PLANTS The priority designations This appendix contains a listing of those safety issues that are applicable to operating plants as well as future plants. Issues that have been resolved with new for all issues are consistent with those listed in Table II of the Introduction. This listing includes:
requirements [ NOTE 3(a)]; USI, HIGH and MEDIUM p-iority issues that are under development; nearly-resolved issues (NOTES 1 and 2) whose not yet known; and issues that are scheduled for prioritization (N0fE 4).
legend 1 - Possible Resolution Identified for Evaluation NOTES:
2 - Resolution Available (Documented in NUREG. NRC Memorandum, SER or equivalent) 3(a)- Resolution Resulted in the Establishment of New Regulatory Requirements (Rule, Regulatory Guide, SRP Anje,
p e
LD or equivalent) 4 - Issue to be Prioritized in the Future B&W
- Babcock & Wilcox Company CE
- Combustion Engineering Company GE
- General Electric Company
- High Safety Priority-Resolved TMI Action Plan Item with Implementation of Resolution Mandated by NUREG-0737'8 HIGH I
MEDIUM
- Medium Safety Priority MPA
- Multiplant Action NA
' - Not Applicable TBD
- To Be Determined USI
- Unresolved Safety. Issue W
- Westinghouse Electric Corporation m"
b
.a.
=
e6 MO o=
8 w
=
I w
Appendix 8 (Continued)
Operating Future' g Action Safety Affected N555 Vendor Operating Plants-Plants-p Plan Item /
Priority /
Plants-Effective Effective g issue No.
Date
.Date to TMI ACTION PLAN ITEMS M
OPERATING PERSONNEL I. A.1 Operating Personnel and Staffing T A L1 Shift Technical Advisor I
'All All F-01 9/13/79 9/27/79 I. A. I.2 Shift Supervisor Administrative Duties I
All All 9/13/79 9/27/79 1.A.I.3 Shift Manning 1
All All F-02 7/31/80 6/26/80 1.A.1.4 Long-Ters Upgrading NOTE 3(a)
All All 4/28/83 4/28/83 I. A. 2 Training and Quailfications of Operating Personnel I.A.2.1 Immediate Upgrading of Operatcr and Senior Operator Training and Qualifications 1.A.2.1(1)
Qualifications - Experience I
All All F-03 3/28/80 3/28/80 I.A.2.I(2)
Iraining i
All All F-03 3/28/80 3/28/80 1.A.2.1(3)
Facility Certification of Competence and Fitness of I
All All F-03 3/28/80 3/28/80 Applicants Dr Operator and Senior Operator Licenses T
I. A.2. 3 Administration of Training Programs I
All All 3/28/80 3/28/80 W
l.A.2.6 Long-Term Upgrading of Training and Qualifications O
I.A.2.6(1)
Revise Regulatory Guide 1.8 NOTE 3(a)
All All I.A.3 Licensing and Requalification of Operating Personnel
- 1. A. 3.1 Revise Scope of Criteria for Licensing Examinations I
All All 3/28/80 3/28/80 1.A.4 Simulator Use and Development I. A.1.1 Initial Simulator Improvement 1.A.4.1(2)
Interim Changes in Training Simulators NOTE 3(a)
All All 4/-/81 3/28/81 1.A.4.2 Long-Term Training Simulator Upgrade I.A.4.2(1)
Research on Training Simulators NOTE 3(a).
All All 4/-/87 4/-/87 I.A.4.2(2)
Upgrade Training Simulator Standards NOTE 3(a)
All All 4/-/81 4/-/81 1.A.4.2(3)
Regula.ory Guide on Training Simulators NOTE 3(a)
All All 4/-/81 4/-/81 1.A.4.2(4)
Review Simulators for Conformance to Criteria NOTE 3(a)
All All 3/25/87 3/25/87 IJ OPERATING PROCEDURES I.C.1 Short-Term Accident Analysis and Procedures Revision z
I.C.1(1)
Small 8reak LOCAs I
All All 9/13/79 9/13/79 m
I.C.l(2)
Inadequate Core Cooling I
All All F-04 9/13/79 9/13/79 rri I.C.1(3)
Transients and Accidents I
All All F-05 9/13/79 9/27/79 1
58
- 1. C. 2 Shift and Relief Turnover Procedures I
All All 9/13/79 9/27/79 o
I.C.3 Shift Supervisor Responsibilities I
-All All 9/13/79 9/27/79 7
I.C.4 Control Room Access I
All All.
9/13/79.
9/27/79 3
to I.C.5 Procedures for feedback of Operating F xperience to I
All All F-06 5/7/80 6/26/80 w
Plant Staff 9
O O
.f
Y
,W' I
)~
\\
l (I
LJ F
g pendix B (Continued)
Oper:, ting -Future to Safety Affected N555 Vendor' Operating Piants-Plants-y Action
- Priority /
Plants-Effective Effective
>a Plan Item /
y Issue No.
Date Date to 1.C 6 Procedures for Verification of Correct Performance of I
All-All F-07 10/31/80 10/31/80 Operating Activities
.I.C.7 N555 Vendor Review of Procedures I
All All NA 6/26/30 I.C.8 Pilot Monitoring of Selected Emergency Procedures for I
All All NA 6/26/80-Near-Tern Operating License' Applicants I.C.9 tong-Tere Program Plan for Upgrading of Procedures NOTE 3(a)
All All 9/13/79 6/-/85 I.D CONTROL ROOM DESIGN I.D.1 Control Room Design Reviews I
All All
-T-08 6/26/80 6/26/80.
I.D.2 Plant Safety Parameter Display Console I
All All F-09 6/26/80 6/26/90 I.D.3 Safety System Status Monitoring.
MEDILM All All I.D.5 Improved Control Roca Instrumentation Research I.D.S(2)
Plant Status and Post-Accicent Monitoring -
N0iE 3(a)
All All' NA 12/-/00
!.D.5(3)
On-Line Reactor Surveillance System NOTE 1-All All M
QUALITY ASSURANCE.
p -
ta I.F.2 Develop More Detailed QA Criteria I.F.2(2)
Include QA Personnel in Review and Approval of Plant NOTE 3(a)
All All NA 7/-/81 Procedures I.F.2(3)
Include QA Personnel in All Design, Construction, NOTE 3(a)
All All NA 7/-/81 Installation, Testing, and Operation Activities I.F.2(6)
Increase the Size of Licensees
- QA Staff NOTE 3(a)
All All NA
.7/-/81 I.F.2(9)
Clarify Organizational Reporting Levels for the QA NOTE 3(a)
All All NA 7/-/81 Organization PREOPERATIONAL AND LOW-POWER TESTING i.G 1 Training Requirements I
All All NA 6/26/80 I.G.2 Scope of Test Program NOTE 3(a)
All All NA 7/-/81 II.B CONSIDERATION OF DEGRADED OR MELTED CORES IN 5AFETY REVIEW II.B.1 Reactor Coolant System Vents-I All All F-10 9/13/79 9/27/79 c-II.B.2 Plant Shielding to Provide Access to Vital Areas and I
All All F-11 9/13/79 9/27/79
- =
z Protect Safety Equipment for Post-Accident Operation m
II.B.3 Post-Accident Sampling 1
All All F-12 9/13/79 9/27/79 j
II.B.4 Training for Mitigating Core Damage I
All All F-13 3/28/80 3/28/80 1
u II.B.6 Risk Reduction for Operating Reactors at Sites with NOTE 3(a)
All -
All TBD NA o
3 y
High Population Densities II.B.8 Rulemaking Proceeding on Degraded Core Accidents NOTE 3(a).
All All TBD 01/25/85 w-
Appendix B (Continued)
U Operating ' Future
' D Action Safety Affected N555 Vendor Operating Plants-
. Plants-e-
Plan Item /
Priority /
. Plants--
Effective' Effective g-IssueNo.
Date Date
'~
so II.D REACTOR COOLANT SYSTEN RELIEF AND SAFETY VALVE 5 II.D.1 Testing Requirements I
All All F-14 9/13/79 9/27/79-II.D.3 Relief and Safety Valve Position Ir.dication I
All All 7/21/79 9/27/79 II.E SYSTEM DESIGN II.E.1 Auxiliary Feedwater System IT EI.1 Auxiliary feedwater System Evaluation I
NA All F-15 3/10/80 3/10/80 II.E.1.2 Auxiliary Feedwater System Automatic Initiation and I
MA All F-16, F-17 9/13/79 9/27/79 Flow Indication II.E.1.3 Update Standard Resiew Plan and Develop Regulatory NOTE 3(a)
All All M
7/-/81 Guide II.E.3 Decay Heat Removal II~T3.1 Reliability of Power Supplies for Natural Circulation I
MA All 9/11/79 9/27/79 3
e H
II.E.4 Containment Design II B.1 Dedicated Penetrations I
All All F-18 9/13/79 9/27/79 I
All All F-19 9/13/79 9/27/79 II.E.4.2 Isolation Dependability II.E.4.4 Purging II.E.4.4(1)
Issue Letter to Licensees Requesting Limited Purging NOTE 3(a)
All All 11/28/78 NA II.E.4.4(2)
Issue Letter to Licensees Requesting Information on NOTE 3(a)
All All 10/22/79 m
Isolation Letter II.E.4.4(3)
Issue Letter to Licensees on valve Operability NOTE 3(a)
All All 9/27/79 m
II.E.5 Design Sensitivity of B&W Reactors TI E5.1 Design Evaluation NOTE 3(a)
NA 8&W II.E.5.2 B&W Reactor Transient Response Task Force NOTE 3(a)
NA B&W II.E.6 In Situ Testing of valves IT EE.1 Test Adequacy Study NOTE 3(at)
All All TBD TBD II.F INSTRL*tENTATION AND CONTROLS II.F.1 Additional Accident Monitoring Instrumentation I
All All F-20, F-21 9/13/79 9/27/79 F-22, F-23 E
F-24. F-25
' e" 2
II.F.2 Identification of and Recovery from Conditions I
All
. All F-26 7/2/79 9/27/79
-7 o
Leading to Inadequate Core Cooling
~g II.F.3 Instruments for Monitoring Accident Conditions NOTE 3(a)
All All m
12/-/80 to O
O O
,/ ~ N r3
.5 t.
z
.g Appendix 8 (Continued) 5 Operating' Future l
e H Plan Item /
Priority /
~
Operating Plants- '; Plants-D Action.
Safety Affected NSSS Vendor Plants-Effective Effective
)-IssueNo.
Title Status '
Date Date to ll.G ELECTRICAL POWER II.G.1 Power Supplies for Pressurizer Relief Valves. Block.
I MA All 9/13/79 9/2U79 Valves, and Level Indicators.
II.H IMI-2 CLEANUP AND EXAMINATION II.H.2 Obtain Technical Data en the Conditions Inside the HIGH NA B&W 5/-/80 NA TMI-2 Containment Structure
!!.J GENERAL' IMPLICATIONS OF TMI FOR DESIGN AND CONSTRUCTION ACTIVITIES 11.J.4 Revise Deficiency Reporting Requirements ITT3.1 Revise Deficiency Reporting Requirements NOTE 2 All All 780 T8D II.K MEASURES TO MITIGATE SMALL-BREAK LOSS-OF-COOLANT d
ACCIDENTS AND LOSS-OF-FELDWATER ACCIDENT 5 w
II.K.1 IE Bulletins II.K.1(1)
Review TNI-2 PNs and Detailed Chronology of the NOTE 3(a)
All All 3/31/80 NA THI-2 Accident II.K.1(2)
Review Transients Similar to TMI-2 That Have.
NOTE 3(a)
NA B&W 3/31/80 NA Occurred at Other Facilities and NRC Evaluation of Davis-Besse Event' II.K.1(3)
Review Operating Procedures for Recognizing, NOTE 3(a)
NA All 3/3U80 NA Preventing and Mitigating void Fonnation in Transients and Accidents' II.K.l(4)
Review Operating Procedures and Training NOTE 3(a)
All All 3/31/80 NA Instructions II.K 1(5)
Safety-Related Valve Pos' tion Description NOTE 3(a)
All All 3/31/80 3/3V80 II.K.1(6)
Review Containment Isolation Initiation Design NOTE 3(a)
All All 3/31/80 MA and Procedures II.K.1(7)
' Implement Positive Position Controls on Valves NOTE 3(a)
NA B&W 3/31/80 NA That Could Compromise or Defeat AFW Flow II.K.1(8)
Implement Procedures That Assure Two Independent NOTE 3(a)
MA B&W 3/31/80 NA 100% AFW Flow Paths c
II.K.l(9)
Review Procedures to Assure That Radioactive NOTE 3(a)
All All 3/31/80 NA -
- =
g Liquids and Gases Are Not Transferred out of
[
ca Containment Inadvertently ll.K.1(10)
Review and Modify Procedures for Removing Safety-NOTE 3(a)
All All 3/31/80 3/31/80 o
no Related Systems from Service W
II.K 1(11)
Make All Operating and Maintenance Personnel NOTE 3(a)
All All 3/31/80 NA 3
w w
Aware of the Seriousness and Consequences of the Erroneous Actions Leading up to, and in Early Phases of, the TMI-2 Accident
~
~
Appendin B (Continued)
W Operating.. Future Q
Safety
.Affected N555 Vendor Operating Plants-Plants-Priority /
Plants-Effective Effective Action wH Plan Item /
h issue No
. Title Status BWR '
Date Date to II.K.1(12)
One Hour Notification Requirement and Continuous NOTE 3(a)
All AII NA Communications Channels II.K.1(13)
Propose Technical Specification Changes Reflecting NOTE 3(a)
All All 1/1/81 1/1/81 Implementation of All Bulletin items
!!.K.1(14)
Review Operating Modes and Procedures to Deal with NOTE 3(a)
GE CE. W 3/31/80 NA Significant Amounts of itydrogen II. K.1(15)
For Facilities with Non-Automatic AFW Initiation, N01E 3(a)_
CE, W NA NA Provide Dedicated Operator in Continuous Communication with CR to Operate AFW II.K.1(16)
Implement Procedures That Identify PRZ PORV "Open" NOTE 3(a)
NA CE. W NA Indications and That Direct Operator to Close Manually at " Reset" 5etpoint II.K.1(17)
Trip PZR Level Bistable so That PZR Low Pressure NOTE 3(a)
NA W
Will Initiate Safety Injection 11.K.1(18)
Develop Procedures and Train Operators on Methods NOTE 3(a)
NA B&W NA of Establishing and Maintaining Natural Circulation II.K.1(19)
Describe Design and Procedure Modifications to NOTE 3(a)
NA B&W 3/31/80 NA Reduce Likelihood of Automatic PZR PORY Actuation
-T
.in Transients y li.K.1(20)
Provide Procedures and Training to Operators'for-NOTE 3(a)
NA B&W 3/31/80 3/31/80-Prompt Manual Reactor Trip for t.0FW, TT, M51V Closure, LOOP, LO5G tevel, and to PZR Level II.K.1(21)
Provide Automatic Safety-Grade Anticipatory Reactor
' NOTE 3(a)
NA B&W 3/31/80 3/31/80 Trip for LDFW, IT, or Sigt.ificant Decrease in SG tevel II.K.1(22)
Describe Automatic and' Manual Actions for. Proper" NOTE 3(a)
All NA 3/31/80 3/31/80 Functioning of Auxiliary Heat Removal Systems When FW System Not Operable II.K.1(23)
Describe Uses and Types of RV Level Indication for-NOTE 3(a)
All NA 3/31/80 3/31/80 Automatic and Manual Initiation Safety Systems-II.K.1(24)
Perfor1s LOCA Analyses for a Range of Small-Break ~
NOTE 3(a)
NA All NA Sizes and a Range of Time Lapses Between Reactor Trip and RCP Trip II.K.1(25)
Develop Operator Action Guidelines NOTE 3(a)
MA All NA II.K_1(26)
Revise Emergency Procedures and Train R0s and SR0s NOTE 3(a)
NA All NA II.K.1(27)
Provide Analyses and Develop Guidelines and.
NOTE 3(a)
NA All NA Procedures for Inadequate Core Cooling Conditions II.K.1(28)
Provide Design That Will Assure Automatic RCP Trip NOTE 3(a)
NA All
'1/1/81 1/1/82 for All Circumstances Where Required m
y II.K.2 Commission Orders on B&W Plants m II.K.2(1)
Upgrade Timeliness and Reliability.of AFW System NOTE 3(a)
MA B&W NA ee -
Q II.K.2(2)
Procedures and Training to Initiate and Control NOTE 3(a)
NA B&W NA 1
m AFW Independent of Integrated Control System g II.K.2(3)
Hard-Wired Control-Grade Anticipatory Reactor Trips NOTE 3(a)
MA B&W NA' g'
a w II.K.2(4) 5 mall-Break LOCA Analysis, Procedures and Operator NOTE 3(a)
NA S&W NA s
w W
Training II.K.2(5)
Complete TMI-2 Simulator Training for All Operators NOTE 3(a)
NA B&W NA O
O O
E,
,m i
I
(
[
%.,/ '
/
w, Appendix B (Continued)
U Operating Future D Action Safety.
Affected N555 Vendor Operating Plants-Plants-w Plan Item /
Priority /
Plants-Effective ' Effective-g Issue No.
-Date Date to II.K.2(6)
Reevaluate Analysis for Dual-tevel Setpoint Control NOTE 3(a)
NA B&W NA II.K.2(7)
Reevaluate Transient of September 24, 1977 NOTE 3(a)
NA B&W NA II.K.2(9)
Analysis and Upgrading of Integrated Control System I
NA B&W F-27 UU81 1/1/81 II.K.2(10)
Hard-Wired Safety-Grade Anticipatory Reactor Trips I
NA B&W F-28 1/1/81 1/1/81 II.K.2(11)
Operator Training and Drilling I
NA B&W. F-29 Ul/81 1/1/81 II.K.2(13)
Thermal-Mechanical Report on fifect of HPl on Vessel I
NA B&W' F-30 UU81 U1/81 Integrity.for Small-Break LOCA With No AFW II.K.2(14)
' Demonstrate That Predicted Lift Frequency of PCRVs 1
NA B&W F-31 1/1/81 1/1/81 and SVs Is Acceptable II.K 2(15)
Analysis of Effects of Slug Flow on Once-Through I
NA B&W 6/1/30 6/U80 Steam Generator-Tubes Af ter Primary System Voiding II.K.2(16)
Impact of RCP Seal Damage Following Small-Breat 1
NA B&W F-32 6/U80 6/1/80 LOCA With Loss of Offsite Power II.K.2(17)
Analysis of Potential Voiding in RCS During I
NA B&W F-33 NA Anticipated Transients II.K.2(19)
Benchmark Analysis of Sequential AfW Flow to Once-1 NA B&W F-34 1/1/81 NA Through Steam Generator II.K.2(20)
Analysis of Steam Response to small-Break LOCA 1
NA B&W F-35 1/1/81 NA T
That Causes System Pressure to Exceed PORV 5etpoint H II.K.2(21)
LOFT L3-1 Predictions
' NOTE 3(a)
NA B&W NA
!!. K. 3 Final Recommendations of Bulletins and Orders Task Force II.K.3(1)
Install Automatic PORV isolation System and Perform I
NA All F-36 7/1/81 7/1/81 Operational Test II.K 3(2)
Report on Overall Safety Effect of PORV Isolation 1
NA All F-37 1/1/81 1/1/81 System II.K.3(3)
Report Safety and Relief Valve Failures Promptly' I
All All F-38 4/1/80 4/U80 and Challenges Annually II.K.3(5)
Automatic Trip of Reactor Coolant Pumps 1
NA All F-39, G-01 U1/81 1/1/81 II.K.3(7)
Evaluation of PORY Opening Probability During I
NA B&W 1/1/81 1/1/81 Overpressure Transient II.K.3(9)
Proportional Integral Derivative Controller I
MA W
F-40 7/1/80 7/1/80 Modification II.K.3(10)
Anticipatory Trip Modification Proposed by Some I
NA W
F-41 Licensees to Confine Range of Use to High Power Levels ll.K.3(11)
Control tJse of PORV Supplied by Control Components, 1
All All Inc. Until Further Review Complete II.K.3(12)
Confirm Existence of Anticipatory Trip Upon Turbine I
NA W
F-42 7/1/80 7/1/80 2
Trip
@ II.K.3(13)
Separation of HPCI and RCIC System Initiation levels I
GE NA F-43 10/1/80 10/U80 7
m II.K.3(14)
Isolation of Isolation Condensers on High Radiation I
GE MA F-44 1/1/81 NA
? 11.K.3(15)
Mudify Break Detection Logic to Prevent Spurious.
I GE NA F-45 1/1/81 1/1/81 7'
o Isolation of HPCI and RCIC Systems
$ II.K.3(16)
Reduction of Cha11erges and failures of Relief I
GE MA
.F-46 1/1/81 1/1/81 Valves - Feasibility Study and Systee Modification W
w ll.K.3(17)
Report on Outage of ECC Systems - Licensee Report I
GE NA F-47 1/1/81 1/1/81 and Technical specification Changes
-~
Appendix B (Continued)
Hro Operating Future
- D Action Safety Affected N555 Vendor Operating Plants-Plants-N Plcn item /
Priority /
Plants-Effective Effective D Issue Na.
Date Date u)
'II.K.3(18)
Modification of A05 Logic - Feasibility Study and.
I GE NA F-48 1/1/81 U1/81 Modification for Increased Diversity for Some Event Sequences II.K.3(19)
Interlock on Recirculation Pump Loops I
GE NA F-49 U1/81 NA II.K.3(20)
Loss of Service Water for Big Rock Point I
GE NA 1/U81.
NA II.K.3(21)
Restart of Core Spray and LPCI Systems on Low I.
- GE ~
NA F-50 1/1/81 U1/81 Level - Design and Modification II.K.3(22)
Automatic Switchover of RCIC System Suction -
I GE NA F-51 1/U81 1/1/81 Verify Procedures and Modify Design II.K.3(24)
Confirm Adequacy of Space Cooling for HPCI and I
GE NA F-52 1/U82 1/1/82 RCIC Systems II.K.3(25)
Effect of Loss of AC Power on Pump Seals I
GE ~
NA F-53 1/1/82 1/U82 II.K.3(27)
Provide Common Reference level for Vessel Level.
I GE NA F-54 10/U80 10/U80 Instrumentation II.K.3(28)
Study and verify Qoalification of Accumulators 1
GE NA F-55 1/1/82 1/1/82 on ADS Valves II.K.3(29)
Study to Demonstrate Performance of Isolation I
GE NA F-56 4/1/81 NA Condensers with Non-Condensibles T II.K.3(30)
Revised Small-Break LOCA Methods to Show Compliance I
All All F-57 1/1/83 1/1/83 y
with 10 CFR 50, Appendix K II.K.3(31)
Plant-Specific Calculations to Show Compilance with I
All All F-58 U1/83 1/ U83 10 CFR 50.46 II.K.3(44)
Evaluation of Anticipated Transients with Single I
GE NA F-59 U1/81 1/U81 Failure to Verify No Significant fuel failure II.K.3(45)
Evaluate Depressurization with Other Than Full ADS I
GE NA F-60 1/1/81 1/1/81 II.K.3(46)
Respense to List of Concerns from ACRS Consultant 1
GE NA F-61 7/1/80 7/1/80 II.K.3(57)
Identify Water Sources Prior to Manual Activation I
GE NA F-62 10/1/80 NA of ADS III.A EMERGENCY PREPAREDNESS AND RADIATION EFFECTS III.A.1 Improve Licensee Emergency Preparedness - Short Tern IITX I.1 Upgrade Emergency Preparedness Ill.A.1.1(1)
Implement Action Plan Requirements for Promptly I
All All 10/10/79 8/19/80 Improving Licensee Emergency Preparedness llI.A.1.1(2)
Perform an Integrated Assessment of the Implementation I
All All 10/10/79 8/19/80 III.A.1.2 Upgrade Licensee Emergency Support Facilities 2 III.A.1.2(1)
-I All All F-63 9/13/79 9/27/79 E III.Q.1.2(2)
On-Site Operational Support Center I
All All F-64 9/13/79 9/27/79 E
g III.A.I.2(3)
Near-Site Emergency Operations facility I
All All F-65 9/13/79 9/27/79 1
e en C)
III.A.2 Improving Licensee Emergency Preparedness-long Tera
8 TTI'.T2.1 Amend 10 CFR 50 and 10 CFR 50, Appendix E y
s W ll!.A.2.1(1)
Publish Proposed Amendments to the Rules I
All All y
III.A.2.1(2)
Conduct Public Regional Meetings I
All All O
O O
.t Appendix B (Continued)
Operating Future U
Safety Affected M555 Vendor Operating Plants-Plants-Plas.Js -
Effective ' Effective y Action Priority /
e4 Plan Item /
Date Date Title g Issue No.
e 1
All All III.A.2.1(3)
Prepare Final Commission Paper Recommending Adoption.
of Rules I
All All F-67 llI.A.2.1(4)
Revise Inspection Program to Cover Upgraded Requirements I
All All F-68 III.A.2.2 Development of Guidance and Criteria III.A.3 leproving NRC Emergency Preparedness III T 3.3 Communications NOTE 3(a)
All All Ill.A.3.3(1)
Install Direct Dedicated Telephone lines III.A.3.3(2)
Obtain Dedicated, Short-Range Radio Communication NOTE 3(a)
All All Systems III.D RADIATION PROTECTION III.D.1 Radiation Source Control W.1
. Primary Coolant Sources Outside the Containment I
All All 7/2/79 9/27/79 j
-Structure T 111.3.1.I(1)
Review Information Submitted by Licensees Pertaining to Reducing Leakage from Operating Systems y
III.D 3 Worker Radiation Protection Improvement I
All All F-69 9/13/79 9/27/79 III U 1.3 Inplant Radiatien Monitoring l
III.D.3.3(1)
Issue Letter Requiring Improved Radiation Sampling l
III.D.3.3(2)
Set Criteria Requiring-Licensees to Evaluate Need for NOTE 3(a)
All All 9/13/79 9/27/79 Instrumentation I
III.D.3.3(3)
Issue a Rule Change Providing Acceptable Methods for NOTE 3(a)
All All-9/13/79 9/27/79 Additional Survey Equipment NOTE 3(a)
All All 9/13/79 9/27/79 Calibration of Radiation-Monitoring Instruments I
All All F-70 5/7/80 6/26/80 III.D.3.3(4)
Issue a Regulatory Guide III.D.3.4 Control Room Habitability t
TASK ACTION PLAN ITEMS NOTE 3(a)
All All NA 3/15/84 NOTE 3(a)
NA All D-10 1/-/81 1/-/81 A-1 Water Hammer (former USI)
A-2 Asymmetric Blowdown Loads on Reactor Primary Coolant Systems (former USI)
NOTE 3(a)
NA W
4/17/85 4/17/85 Westinghouse Steam Generator Tube Integrity (fomer USI)
NOTE 3(a)
MA CE 4/17/85 4/17/85 o
NOTE 3(a)
NA B&W 4/17/85 4/17/85 A-3 CE Steam Generator Tube Integrity (former USI) 2c-A-4 NOTE 3(a)
GE NA 12/-/77 NA B&W Steam Generator Tube Integrity (fomer USI)
I c)
A-6 NOTE 3(a)
GE NA D-01 8/-/82 8/-/82 i
y A-5 Mark I Short-Term Program (former USI)
Mark I Long-Term Program (former USI)
NOTE 3(a)
GE NA 8/-/81 8/-/81 o#
f A-7 Mark 11 Containment Pool Dyannic loads - Long Tem e
A-8 Program (former USI)
NOTE 3(a)
All All 6/26/84 6/26/84 w
W A-9 ATW5 (former USI)
NOTE 3(a)
All NA
'8-25 11/-/80 11/-/80 BWR Feedwater Nozzle Cracking (former USI)
A-10
AppendixB(Continued}
~$
~ g Action Safety Affected NSSS Vendor Operating.
Plants-Plants-Operating Future p
Plan Item /
Priority /
Plants-Effective Effective
. g Issue No.
Date Date to A-11 Reactor Vessel Materials Toughness (former USI)
NOTE 3(a)
.All All 10/-/82 NA A-12 Fracture Toughness of Steam Generator and Reactor NOTE 3(a)
NA All M
TBD Coolant Pump Supports (former USI)-
A-13 Snubber Operability Assurance' NOTE 3(a)
All All 1980 1981 A-16 Steam Effects on BWR Core Spray Distribution NOTE 3(a)
GE NA D-12 NA A-19 Digital Computer Protection System NOTE 4 All All TBD TBD A-24 Qualification of Class 1E Safety Related Equipment NOTE 3(a)
All All.' 8-60 8/-/81 8/-/81 (former USI)
A-25 Non-Safety Loads on Class IE Power Sources NOTE 3(a)
All All 9/-/78 A-26 Reactor Vessel Pressure Transient Protection NOTE 3(a)
NA All 8-04 9/-/78 9/-/78 (former USI)
A-28 Increase in Spent Fuel Pooi Storage Capacity NOTE 3(a)
All All 4/17/78 NA A-31 RHR Shutdown Requirements (former USI)
NOTE 3(a)
AIT All 5/-/78 1/1/79 A-35 Adequacy of Offsite Power Systems NOTE 3(a)
All All 6/2/77 1981 A-36 Control of Heavy Loads Near Spent Fuel (former USI)
NOTE 3(a)
All All C-10, C-15 7/-/80 7/-/80 A-39 Determination of Safety Relief Valve Pool Dynamic NOTE 3(a)
GE NA 2/29/80 9/30/82 Loads.and Temperature Limits (former USI)
A-40 Seismic Design Criteria - Short Term Program (former USI) NOTE 3(a)
All All TBD TBD Y
A-42 Pipe Cracks in Boiling Water Reactors (former USI)
NOTE 3(a)
All NA B-05 2/-/81 2/-/81 N
A-43 Containment Emergency Sump Performance (former USI)
NOTE 3(a)
NA All TBD TBD A-44 Station Blackout (former USI)
NOTE 3(a)
All All TBD TBD A-46 Seismic Qualification of Equipment in Operating Plants NOTE 3(a)
A-47 Safety Implications of Control Systems (former USI)
NOTE 3(a)
All All 09/20/89 09/20/89 A-48 Hydrogen Control Measures and Effects of Hydrogen Burns NOTE 3(a)
All W
on Safety Equipment A-49 Pressurized Thermal Shock (former USI)
NOTE 3(a)
NA All A-21 TBD TBD B-10 Behavior of BWR Mark III Containments NOTE 3(a)
GE NA 9/-/84 B-17 Criteria for Safety-Related Operator Actions MEDIUM All All TBD 10D -
B-22 LWR Fuel NOTE 4 All All TBD TBD B-29 Effectiveness of Ultimate Heat Sinks NOTE 4 All All TBD TBD B-32 Ice Effects on Safety-Related Water Supplies NOTE 4 All
-All TBD TBD B-36 Develop Design. Testing, and Maintenance Criteria for NOTE 3(a)
All All 3/-/78 Atmosphere Cleanup System Air Filtration and Adsorption i
Units for Engineered Safety Feature Systems and for Normal Ventilation Systems B-SS Improved Reliability of Target Rock Safety Relief MEDIUM All NA TBD TBD Valves B-56 Diesel Rellat,ility HIGli All All D-19 TBD TBD z B-61 Allowable ECCS Equipment Outage Periods MEDIUM All All TBD TBD y
@ B-63 Isolation of Low Pressure Systems Connected to the
-NOTE 3(a)
All All 4/20/81 Reactor Coolant Pressure Boundary cri
?,
E ee o
3' W
w e
O O
i,,,
...ii.............
.ii.
._a.
O O
O Appendix B (Continued)
Operating future Safety Affected NSSS Vender Operating Plants-Plants-N Action Priority /
Plants-Effective Effective Plan Item /
Date Date N
Issue No.
Title CD t.o B-64
-Decommissioning of Reactors NOTE 2 All
'All TBD
'NA B-66
. Control Room Infiltration Measurements
' NOTE 3(a)
All All NA 7/-/81 C-1 Assurage of Continuous Long Term Capability of NOTE 3(a)
All All 5/27/80
$/27/80 Hermetic Seals on Instrumentation and Electrical Equipment C-8 Main Steam Line Leakage Control Systems HIGH All NA TBD TBD C-10 Effective Operation of Containment Sprays in a LOCA NOTE 3(a)
All All NA C-17 Interim Acceptance Criteria for Solidification Agents NOTE 3(a)
AII All 12/27/82 12/27/82 for Radioactive Solid Wastes NEW GENERIC ISSUES 2.
Failure of Protective Devices on Essential Equipment NOTE 4 All All TBD 78D 15.
Radiation Ef fects on Reactor Vessel Supports HIGH All All TBD TBD HIGH -
All All TBD TBD 23.
Reacter Coolant Pu=p Seal Failures NOTE 4 All All TBD TBD -
24 Automatic Emergency Core Cooling System Switch to D
Recirculation E
25.
Automatic Air Header Dump on BWR Scram Systes NOTE 3(a)
All NA 1/9/81 1/9/81 SD 29.
Bolting Degradation or failure in Nuclear Power Plants HIGH All All IBD TBD 38.
Potential Recirculation Systes Failure as a Consequence NOTE 4 All All TBD TBD of Injection of Containment Paint Flakes or Other Fine Debris 40.
Safety Concerns Associated with Pipe Breaks in the BWR NOTE 3(a)
All NA B-65 8/31/81 8/31/81 Scram System 41.
BWR Scram Discharge Volume Systems NOTF 3(a)
All MA B-58 12/9/80 NA 43.
Reliability of Air Systems NOTE 3(a)
All All 8/8/88 NA 45.
Inoperability of Instrumentation Due to Extreme Cold NOTE 3(a)
All All NA 9/1/83 51.
Proposed Requirements for leproving the Reliability of NOTE 3(a)
All All 07/18/89 07/18/89 Weather Open Cycle Service Water Systems.
57.
Effects of Fire Protection Systee Actuation MEDIUM All All TBD TBD on Safety-Related Equipment 63.
Use of Equipment Not Classified as Essential to Safety NOTE 4 All NA TBD TBD in BWR Transient Analysis 67.
Steam Generator Staff Actions 67.3.3 Improved Accident Monitoring NOTE 3(a)
All All A-17 12/11/a2 12/17/82 70.
PORV and Block Valve Reliability MEDIUM MA All TBD TBD 71.
Failure of Resin Desineralizer Systems and Their NOTE 4 All All TBD TBD
- xy z
72.
Control Rod Drive Guide Tube Support Pin Failures NOTE 4 NA W
TBD TBD 1
C Effects on Nuclear Power Plant Safety 73.
Detached Thermal Sleeves NOTE 4 All All TBD TBD 1
o 3
o to W
(4 i
g
Appendix B (Continued) 64 g
N Action.
Operating Future Safety Affected NSSS Vendor Operating Plants-Plants-(83 '
Plan Item /
Priority /
Plants-Effective Effective N
lssue No.
Date Date 75.
Generic Implications of ATWS f vents at the Sales N0fE 1 All All 8-76, 8-77, TBD T80 Nuclear Plant 8-78 B-79, 8-80, 8-81, 8-82, 8-85, 8-86, B-87, 8-88, B-89, 8-90, 8-91, 8-92, 8-93 76.
Instrumentation and Control Power Interactions NOTE 4 All All T80 180 78.
Munitoring of Fatigue Transient Limits for Reactor NOTE 4 All All T80 TBD Coolant System 79.
Unanalyzed Reactor vessel Thermal Stress During MEDIUM NA B&W T80 180 Natural Convection Cooldown 83.
Control Room Habitability NOTE 1 All All 180 TBD 84.
CE T80 TOO 86.
Long Range Plan for Dealing with Stress Corrosion NOTE 3(a)
All NA 8-84 780 TBD Cracking in BWR Piping 87.
Failure of HPCI Steam Line Without Isolatfora HIGH All All TBD T80 E
89.
Stiff Pipe Clamps.
NOTE 4 All All 180 780 o
93.
Steam Binding of Auxiliary Fee (Nater Pumps NOTE 3(a)
NA All T80 T80 94.
Additional Low Temperature Overpressure Protection HIGH NA All TBD 180 Issues for Light Water Reactors 95.
Loss of Ef fective Volume for Containment Recirculation NOTE 4 All All TB0 TSO Spray 96.
RHR Suction valve Testing NOTE 4 All All 180 TSO 99.
RCS/RHR Suction Line Valve Interlock on PWRs NOTE 3(a)
NA All 10/17/88 NA 100.
OTSG Level NOTE 4 NA B&W T80 780 103.
Design for Probable Maximum Precipitation NOTE 3(a)
All All 10/19/89 10/19/89 105.
Interfacing Systems LOCA at BWRs HIGH All NA TBD 180 106.
Piping and Use of Hig.?y Combustible Gases in Vital MEDIUM All All TBD TBD Areas 107.
Generic Implications of Main Transformer Failures NOTE 4 All All 180 TBD l
109.
Reactor Vessel Closure Failure NOTE 4 All All T80 T80 l
110.
Equipment Protective Devices on Engineered Safety NOTE 4 All All 180 180 Features 113.
Dynamic Qualification Testing of Large Bore HIGH All All 180 180 Hydraulic $nubters 116.
Accident Management NOTE 4 All All TBD TOO 117.
E Allowable Outage Times for Diverse Simultaneous NOTE 4 All All TBD T80 m
Equipment Outages N
118.
Tendon Anchorage Failure NOTE 4 All All TBD T80 120.
On-Line Testability of Protection Systems.
NOTE 4 All All 180 T80 E
-a-f 121.
Hydrogen Control for targe, Dry PWR Containments HIGH All All T80 TSO o
to 123.
Deficiencies in the Regulations Governing D8A and NOTE 4 All All 100 TBD 3
g Single-Failure Criteria Suggested by the Davis-8 esse Event of June 9,1985 w
124.
Auxiliary Feedwater System Reliability e
- E3(a)
All All 100
(P Appendim 8 (Continued)
Operating Future y
N Action Safety Affected 9e555 Vendor Openting Plants-Plants-W Plan Item /
Priority /
Plants-Effective Effective
(
Issue No.
Date Date CD to 128.
Electrical Power Reliability HIGH All All 180 TBD 129.
Valve Interlocks to Prevent vessel Drainage Ouring te0TE 4 All All T80 T80 Shutdown Cooling 130.
Essential Service Water Pump Failures at Multiplant HIGH All All T80 T80 Sites 132.
RHR Pumps Inside Containment fe0TE 4 All All TSO 780 135.
Integrated Steae Generator Issues 94EDItM All All T80 TBD 137.
Refueling Cavity Seal Failure se0TE 4 All All T80 180 138.
Deintering Upon Discovery of RCS Leakage fe0TE 4 All All 780 780 140.
Fission Product Removal by Containment Sprays NOTE 4 All All TBD T80 141.
LBLOCA with Consequential SGTR NOTE 4 All All T80 TSO 142.
Leakage Th-ough Electrical Isolators NOTE 4 All All TBD T80 143.
Availability of Chilled Water Systems NOTE 4 -
All All 180 T80 144.
Scram Without a Turbine / Generator Trip ~.
NOTE 4 AII AII Te9 780 145.
Improve Survet11ance and Startup Testing Programs N01E 4
Support Fleminility of Equipment and Components te0TE 4 AII All 780 780 147.
Fire-Induced Alternate Shutdown Control Room Panel NOTE 4 All All T80 TBD Interactions 3>
148.
Smoke Control and Manual Fire-Fighting Effectiveness NOTE 4 All All TSO 780 149.
Adequacy of Fire Barriers fe0TE 4 All All T80 180 P
150.
Overpressurization of Containment Penetrations NOTE 4 All
.All T80 T80 151.
Reliability of Recirculation Ptap Trip During an ATWS DIOTE 4 All All T80 T80 HLAAN FACTORS ISSUES HF1 STAFFING AND QUALIFICATIONS-El.1 Shift Staffing NOTE 3(a)
All All TSO TSO Hg PROCEP>RES HF4.4 Guidelines for Upgrading Other Procedures HIGH All All TBD
- 780 Hf5 MAN-MACHINE INTERFACE C
HFS.1 Local Control Stations HIGH All All T80 T80 2
NFS.2 Review Criteria for Human Factors Aspects of Advanced HIGH All All T80 TBD e1 E
Controls and Instrumentation E
m o
o to (4
C.. u.
. coCi s t. u c vi.io., co
...o.
....o.uv....
..,,oc
,n,u..
- T.i,'is'--
- BIBLIOGRAPHIC DATA SHEET NUREG-0933-Supplement 11 m e... ci.e.i o.... vm.
i n......v. i n si 1
A Prioritization of Generic Safety Issues e o...ieo.i co..gilio L
.o.fM 46..
- aviao.**
December 1989
. o.i
...o.
.uvi o R. Emrit, R. Riggs, W. Milstead, 3. Pittman,
l "a*
July 1990 e n.....
...a. i.o. u..
..........oo. u,,.,,, C,
...o,ecin m,o.. von Division of Regulatory Applications Office of Nuclear Regulatory Research
**6*'"'""'
U. S. Nuclear Regulatory Commission Washington, D.C.
20555 i.
- o...mo..a..o.......... n....o......,, C,
...,,, o.
..o.i Division of Regulatory Applications
-Office-of Nuclear Regulatory Research U.- S. Nuclear Regulatory Commission
. n..ooCov m on-. ~ ->
Washington, D.C.
20555 is u si..n....ois.
2. i..c i u.
The report presents the priority rankings for generic safety issues related to nuclear i
q p power plants.- The purpose of these rankings is to assist in the timely and efficient L allocation of NRC resources for the resolution of those safety issues that have a significant potential for reducing risk. The safety priority rankings are HIGH. MEDIUM, LOW, and DROP and have been assigned on the basis of risk significance estimates, the iratio of risk to costs and other impacts estimated to result if resolutions of the safety issues were implemented, and the consideration of uncertainties and other
, quantitative or qualitative factors. To the extent practical, estimates are
-quantitative.
4
- i. ooCu.t n...t. sis,. mi.ao.osioisc *io=s is a v a.. e s,o,
ii.fi e.
Generic Safety issues Unlimited Risk
'o S.CW.i,
- C L.lSi. iC a i.0%
t iine es,e, t 4D Nii8. R1't....Not D ii..s
)
l -
f ra.e o.ee es
~
linc l a u i f i ori o -..o...cis it...t.
Ij.
T
- -