ML20082E357

Forwards Rev 2 to PLG-0507, STADIC4 Model for Frequency of Nonrecovery of Electric Power at Seabrook Station for Plant at Power & Shutdown

ML20082E357
Person / Time
Site:	Seabrook
Issue date:	07/23/1991
From:	Feigenbaum T PUBLIC SERVICE CO. OF NEW HAMPSHIRE
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML20082E364	List: ML20082E357 ML20082E381
References
NYN-91116, NUDOCS 9107310374
Download: ML20082E357 (42)

Text

__ _ _ _

e >

New Hampshire Yhhk((

Ted C. Feigenbovm Presdent and CNel becutwe Of f aer NYN 91116 J uly 23,1991 United States Nuclear Regulatory Commission Washington, D.C. 20555 Attention: Document Control Desk

References:

(a) Facility Operating License No. NPF 86, Docket No. 50 443 (b) USNRC Generic Letter 88 20, dated November 23,1988, " Individual Plant Examination for Sescre Accident Vulnerabilitics" (c) NilY Letter NYN.89136, dated November 1,1989, " Response to Generie Letter 88 20", T.C. I cigenbaum to USNRC (d) NilY Letter NYN 91034, dated hiarch 1,1991, ' Supplementary Response to Generic Letter 88 20,* II. L. Drav bridge to USNRC (c) USNRC Letter dated .l u n e 5, 1991, 'Scabrook - Indisidual Plant Examination (IPE) Review Request for additional Information (TAC No. 74466)," G. E Edison to T. C. Feigenbaum

Subject:

Response to Request for Additional Information llegarding the Scabrook Station IPE Repo."

Gentlemen:

In Reference (d), New llampshire Yankee (NilY) submitted the Report on the Individual Plant Examination for Severe Accident Vulnerabilities (IPE) for Scabrook Station.

In Reference (c), the NRC requested additional information regarding this IPE Report.

Enclosure 1 to this letter contains the NilY responses to the NRC questions on the Scabrook IPE Report. Additionally, Enclosure 2 transmits a copy without technical appendices of Report No. PLG-0507, Resision 2, *$T ADIC 1 hiodel for Frequency of Nonrecovery of Electric Power at Seabrook Station for Plant at Power and Shutdown." This report is referenced in the response to NRC Ouestion No. 26.

If you have any queations regarding the enclosed information, please contact Alt. Kenneth

1. Kiper at (603) 474 9521, extension 4049 Very truly yours, g/$h S ed C. Feigenb m TCF:GK/ tad 9107310374 710723 Enclo" ' ~ POR ADOCK 03000443 P PDR ,

n- New Hampshire Yankee Division of Public Service Company of New Hampshire 3

i' { ' 1

'}' U  ;!

Va UUJJ P.O. Box 300

• Seabrook, NH 03874

• Telephone (603) 474 9521  !

1 United States Nuclear Regulatory Commission July 23,1991 Attention: Document Control Desk Page two ec: Mr. Thomas T. Martin Regional Administrator United States Nuclear Regulatory Commission Region 1 475 Allendale Road King of Prussia, PA 19406 Mr. Gordon E. Edison, Sr. Project Manager Project Directorate 13 Division of Reactor Projects U.S. Nuclear Regulatory Commission Washington, DC 20555 Mr. Noel Dudley NRC Senior Resident inspector P.O. Box 1149 Seabrook, NH 03874 cc: (without enclosure)

Mr. Dave Modeen Nuclear Management and Resources Council 1776 Eye Street N.W., Suite 300 Washington, D.C. 20006-2496

. i i

l Enclosure 1 4

Responses to RAls Regarding the "Seabrook Station IPE Report" I

l I

i l

Response to RAls Regarding the Seabrook Station IPE Submittal RAI 1. The success criterion of emergency feedwater (EFW) states that the EFW system supplies sufficient water to cool the reactor coolant system (RCS) allowing the operation of the residual heat removal (RHR) system within nine hours. Can Seabrook cool down on atmospheric relief valves (ARVs) and EfW in nine hours?

Response

With all four ARVs available, the RCS can be cooled to allow RHR cooling in less than nine hours. The design basis time (Reference 1) to RHR cut in is 8.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> consisting of a cooldown period of 4.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> hold at hot standby. The basis of the 4.9 hour1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> cooldown is a maximum cooldown rate of 50'F/hr from 588'T (normal operating temperature) to 350*T (RHR system maxirnum temperature).

i i

i l

I 1'

I l

l l

l Page1

a RAI 2. 'Once air gets to the common supply headers, it is assumed that its path is unob.structed to the equipment it serves due to the very small failure rate attributable to piping and to valves transferring closed"(p.E 71). Please discuss concisely why the failure rate would be very small. Your discussion should include the consideration of a failure of an air line to a valve controller, such as the main feedwater isolation valves (which would close on loss of air and initiate a loss of main feedwater transient).

Response

The failure rate data is derived from Reference 2. Based on this data source, failures due to piping and valves transferring closed have low probabilities relative to active components (e.g. compressors fall to start run):

pipe (less than 3 Inch diameter) rupture or plug mean value = 8.6E 9 per hour per section range factor = 30 basis WASH 1400 estimate.

manual valve transfer closed mean value = 4.2 E 8 per hour range factor = 10 basis generic estimates and data from similar plants In addition to the low failure rate, most piping and valve failures would be local to the device requiring instrument air because of the presence of check valves which prevent the common supply headers from depressurizing. Only a pipe rupture in the common supply header would cause a system wide failure - loss of IA. (for example, a loss of main feedwater reactor trip recently occurred at Seabrook due to loss ofinstrument air to a main feedwater valve. The loss of air occurred due to vibration /fotigue failure of the air line to the feedwater valve because of the way the air line was supported. This failure caused the feedwater valve to go closed but did not affect the rest of the air system because of check valves that isolated the failure.

Finally, the frequency of loss of instrument air is not very critical because instrument air is not important to risk at Seabrook. This is due to the fact that important air operated valves and dampers either:

have air accumulators which provide backup supply of air (e.g., the atmospheric relief valves).

fall safe on loss of air (e.g. containment on-line purge valves)

See responses to RAls 3 and 4 for further details.

l l' age 2 l

l

4 RAl 3. Several emergency air handling (EAH) dampers are normally open, but fall closed on loss ofinstrument air. (p.E 68)" Failure of the EAH system to operate for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is conservatively assumed to cause long term failure of the charging, safety injection (SI),

RHR, and containment building spray (CBS) pumps." (p E 65) "The steam dump valves (SDVs)... are assumed unavailable if instrument air (IA) is not available." (p.E-69) "The loss ofinstrument air (IA) leads to an initiating event loss of main feedwater which has been includcd implicitly in the data analysis for initiating events." (p.E 69) "The system llA] is assumed to be operating normally prior to the occurrence of any of the initiating events."(p.E-70) Please provide a brief explanation of the reasons for assuming that modeling loss ofinstrument air as only a loss of main feedwater is a conservative approach.

Response

Dampers: The " closed" position is tl- tired (success) position for the dampers in question. These dampers isolate no .al PAB ventilation to prevent air born contamination from spreading from the RHR vaults to the PAB. Since no credit is taken for these dampers failing closed (safe) on loss of instrument air, the modeling is conservative.

Steam Dump Valves: The unavailability ofinstrument air (IA)is used in the quantification of the condenser steam dump system (Reference 3, Appendix E, Section E.15). In fact, as shown in Section E.15.3, the failure of IA dominates the unavailability of tne steam dump system. For the conditions wriere lA is not available due to loss of support systems (e.g., isolation of cooling to compressors that occurs during loss of offsite power or 'S' signal), the steam dumps are not

credited for secondary cooling. Loss ofinstrument air results in failure of the steam l dump valves to open on demand. Thus, the modeling adequately accounts for steam dump volve dependency on IA.

Loss ofMain feedwater: Loss ofinstrument air is implicitly included in the imtlating event frequency for the Mss of main feedwater (LOMF) initiating event; i.e., the data collected include. u causes of LOMF including loss of IA if such events are in the data base. This moceling neglects the dependency between the loss of main feedwater and the SDVs, i.e., the likelihood that the LOMF is due to loss of IA which also falls steam dump valves. However, this is a small contribution to the frequency for loss of main feedwater. The frequency ofloss of main feedwater (TLMITV and PLMFW from Table 3.11 in Reference 3)is 1.29 per year; the l frequency of loss of instrument air (from Reference 2) is 2.0E-3 per year. Thus, only

about 0.2% of the loss of main feedwater initiators is expected to be caused by loss l of IA initiator. The loss of feedwater initiator does include events local to the feedwater valves involving loss of IA which do not affect the lA system. (For example, see description of Seabrook event in response to RAI 1).

Also, steam dump valve unavailability is not critical to seconAi ry cooling (top event EF) because of the presence of the atmospheric relief valves, which are normally operated with IA but have backup air accumulators. The ARVs can also be manually, locally operated.

l l Page 3

e i

Thus, the failure to account for the joint dependence of main feedwater and SDVs i on IA is insignificant to the results.

1 i

i l

i l-

[

4 Page 4

_ .. .- __ _ ._ _ . . _ . . . . _ . . _ . _ . _ . . ~ _ _ . ._. _

1

• RAl 4. There seems to be a considerable number of recovery actions (or potential actions not actually credited) involving the lA system (e.g., providing fire water to cool instrument air compressors during loss of secondary component coollng (SCC) [not credited], and

, providing a path for the startup feedwater pump to feed the steam generators after loss of j IA. In light of these discussions of IA interactions, why wasn't IA included on the vertical axis of the dependency matrices?

I

Response

Instrument air 1: a suppcirt system and, in that sense, does belong on the vertical axis of the dependency matrix. However, since IA is not modeled explicitly in the Support System event wee, it was not included on the vertical axis of the dependency matrix. It was not modeled explicitly because IA has a limited impact on plant response as discassed in response to RAl 3. In many cases, loss of IA results in components failing safe. For other applications, air accumulators have been added to reduce the impact of loss of IA.

Since the issuance of the IPE Report and as a part of continuing update of the model and analyses, a more detailed dependency matrix has been developed which includes the IA system on the vertical axis. This documents the impact of IA failures on other suppon and frontline systems.

Based on this analysis of depenJencies, loss of IA has the following plant impacts:

1. Loss of main feedwater and subsequent reactor trip due to closure of the feedwater isolation volves.

2. The ARVs would fall closed but are provided with backup air accumulators which provides for 10 complete cycles in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />; thus, they are not offected.

3. The SDVs fait closed. (However, the availability of ARVs supports secondary cooling to allow RHR operation within 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> (see response to RAl.1]).

4. The turbine driven Env pump steam supply valves fail open (safe). The common supply valve has a backup accumulator that allows 4 complete cycles in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. This results in start of the turbine-driven ERV pump.

5. Several containment isolation valves are air-operated and fait closed (safe) on loss of IA.

5. The PCC temperature control valves fall open (sofe) on loss of IA but have a backup air supply which allows 10 complete cycles in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

7. Several dampers in the EAH system are normally open but fail closed (safe) of loss of IA.

Thus, loss of IA results in " successes" without the need for signals.

These dependencies are modeled conservatively (except as described in response to RAl 3) to give no credit for failures (i.e., loss of IA) giving success (signals). Thus, for loss of offsite power, IA is assumed unavailable with regard to its irnpoct of SDVs (unavailable); 1A is assumed available with regard to components that fail safe on loss of IA (i.e., the component must receive another signal to close when it Page5 ,

- .. . - - - .-. - _.-..- _ _ ~... - -

t is modeled). While this modeling approach is inconsistent with regard to the status i of IA, it is conservative.  ;

IA recovery on 1.OSP or loss of secondary component cooling is highly reliable t because IA compressors can be aligned to emergency AC and cooled via the  !

diesel driven fire water pumps: also, these actions are proceduralized (ERP ES 0,1 i Step 7 of Reference 5). However, thses recovery actions have not been modeled i and are not considered important to the overall results. ,

i l

i t

e t

L

+

9 0

l l~

Page 6

. - _ - ,-,=._.-,,.--..-.--.._......__..-_-.-..-_._._;_...-.-....-.-.-.-w

l I RAI 5 Failure of elastomer seals, resulting in Types B and C containment leakage, has been assigned a low probability of occurrence, thereby increasing the conditional probabilities ofintact containment and Type A containment leakage. Discuss the results of sensitivity analyses performed for less optimistic assumptions regarding the survivability of elastomer seals, such as purge valve seats, equipment and personnel hatch seels, and electrical penetration seals and potting as well as other non. metallic sealing suimces such as the sight glasses in personnel access hatch covers. Particular attention should be directed to the equipment hatch seals, both of which are physically located in the containrrant building environment. Discu s the impact of the seal failures on the containment failure probabilities.

Response

The following containment sool failure modes have been explicitly analyzed, as summarized below: 4 Womal penetration failure, (2) failure of valve seal, (3) failure of equipment IwMrs and personnel airlock seals, and (4) failure of the sify Chyes in the pand hC es. For these potential failure modes, while tuaare passure distribt@wwe not explicitly calculated, scoping analyses or other technical reasonley had that either the expected follure pressure was well above those calculated for other failure modes, or that the failure mode was not likely to crist at that it woult yield only a smallleak area. Nonetheless, these failure modes (with the exception of the sight glass failure) were each assigned a 5% probability of occurring before the wall hoop failure mode. (Reference 6, Sectior.

4.2.5.1 and Reference 4, Appendix H.1, Section 5).

If the seals were assumed to fall at lower temperature and pressure than analyzed, the leak area would be expected to be small since the penetrations tend to seal metal to metal with higher pressure. This would be a type A failure (based on the definition of failure types in SSPSA Section 11.3). The lowest pressure type A failures are a set of penetrations that are expected to fall at 181 psia due to displacement of the containment wall (SSPSA, Table 11.31). Type A failures result in increased leakage early but the leak rate is not sufficient to prevent ultimate containment overpressurization and failure (assuming no recovery). This failure is mapped to release category S2. The small leakage contributes to the small source term early in the release. The significant quantity of radionuclides is not released until late in the scenario, similar to S3 releases.

If the seals were arbitrarily assumed to fail as a type B or C failure (i.e., large leakage / gross containment failure) at a low pressure (e.g., just above the test pressure of 55 psig), the conditional probability of poor containment performance would be 1.0. However, there was no evidence to indicate that the present analysis was not conservative. Therefore, further sensitivity studies were not performed.

Following is a summary of the failure analyses for containment seals and sight glass:

1. Electrical Penetrations. Section 11.3.3.4 of the SSPSA analyzes the failure modes for electrical penetrations. This analysis of the effect of temperature and pressure on potting compound and elastomer seal is applicable to other Page 7

4 penetrations with similar material. Four heat transfer mechanisms were considered: (a) heat transport by air and steam mass transport through the ,

inboard l unction box into the penetration, driven by pressure increases in containment and by steam condensation in the penetration: (b) heat conduction to the external bulkhead along the penetration sleeve; (c) free i convection heat losses from the exterior bulkhead exposed to ambient air outside containment; and (d) heat conduction from the penetration sleeve into  ;

the concrete of the containment wall. The heat transfer out of the penetration  ;

is calculated to exceed the heat transfer into the penetration by rnore than a factor of 20. Thus, the temperature of the outer sealis expected to remain well below the temperature at which damage might occur.  ;

2. Valve Seals. The containment online purge and containment air purge suction i cad discharge penetrations each have two isolation valves, one inside and one outside the containment. At elevated temperatures, the seal material on the butterfly valves may deteriorate and lose its sealing function. The valve seal inside containment is assumed to fall due to elevated temperatures. In this

• event, a narrow crack leak path may develop and 'ontainment atrnosphere I may begin to leak into the space between the two . solation valves. A process similar to that described for the analysis of electrical penetrations will develop.

The inleaking steam air mixture will cool and the steam will condense, drawing more air and steam from the cordainment atmosphere mto the penetration until the pressure in the penetration is equal to the containment pressure and air between the two valves is saturated at the penetration temperature. At this ,

point, this heat transfer mechanism would slow to a level corresponding to the l rate of pressure rise in containment, The other three heat transfer mechanisms would also operate as described for electrical penetrations. The condensation heat transfer mechanism is approximately proportional to the square of the penetration diameter, whereas all other mechanisms are expected to be ,

approximately linear with the diameter. The rate of heat transfer out of the penetration is expected to exceed the rate of heat transfer into the penetration by a factor of 10 or more. Thus,it con be concluded that the penetrations can >

transfer substantially more heat from the penetration into concrete and into the enclosure building annulus than heat transferred into the penetration from the containment. The outer valve on any of these penetrations would not heat to a temperature where its seal would fall and a containment leak would not be

! expected to develop even if the seal on the inner valve loses its leak tightness.

l

3. Hatch Seals. The equipment hatch and personnellock penetrations have been evaluated in the SSPSA, Section H.1 with respect to structural failure. Thermal failure of the hatch seals was also addressed as a potential containment failure <

mode. The seal functions as an "O ring in a groove" seal. The ternperature at the seal would lag somewhat behind the containment temperature; however, for dry accident sequences, the seal would experience temperatures well in '

excess of LOCA design temperatures. The seal material would be expected to begin to deform plastically and the pressure forces would force seal material into any cracks that may exist between the machine mating surfaces. The seal would thus be expected to continue its function until the seal r., Wrial melts, if L at this time the seal material all disappears, significant containment leakage is l Page 8

still not likely. Considering the elevated temperatures and the large seating force exerted by the containment pressure on the mating surface, a gap is considertd unlikely. With a containment pressure of 100 psia, the sealing force on the mating surface is on the order of 7000 pounds per inch of circumference.

Any rotation of the hatch flange due to the pressure force would further increase the sealing pressure. Under these conditions, it is difficult to argue that any sign'ficant leak path would exist.

4. Sight Gla35. Regarding the sight glass, the issue of survivability was addressed in RAl 18 of Reference 12. This response describes the temperature, pressure, and radiation testing done by the glass manufacturer. Specifically, the glass is :ested to 150 psig and 550T. In addition, the manufacturer indicates that a conservative allowable working stress for this glass is 300 psi. This information indicates that the sight glass is not a containtnent weakness.

Page 9

RAI.6. Discuss the containment design features that promote the mixing and dispersion of H2 in the containment volumes, which reduce the potential for and effects of

" pocketing"in the compartments below the operating deck and in the near vicinity of the reactor vessel (i.e., reactor cavity, incore instrument tunnel, and instrument room).

Describe the sensitivity of Early Large Containment failure / Bypass and Late Containment failure probabilities (conditional and absolute) to variations in the assumed limits for H2 combustion and detonation in the post accident containment environment.

Response

The issue of H2 "'pocketir'g" was addressed in the SSPSA (Referenre 4)in Sections 11.1 and 11.2. Through a review and analysis of the Seabrook wntainment design, a Seabrook site walkdown, and comparison to the Indian Point 3 (IP3) containment design, it was found that:

the Seabrook and IP3 NSSS and containment buildings are of the some basic design. These large, dry containments con be modeled as a well-mixed, single volume, and intermediate floors in the containment building are largely grated with good mixing paths for the containment atmosphere existing for all regions of the containment.

In addition, local hydrogen def erations or detonations require conditions of nearly stagnant or quiescent a* vspheres which are not considered credible under accident conditions. In a large dry containment, thermal and mass transfer induced mixing of the contamment atmosphere under accident conditions is considered assured particularly on those accident phases where rapid release of hydrogen into the containment are possible such as at vessel breach. (See RAI 26 in Reference 11).

The issue of the sensitivity of containment failure to variations in H2 combustion and detonation was addressed in Sections 11.5.2 and 11.7.1.3 of the SSPSA.

Analysis was performed for a spectrum of hydrogen concentrations, tirning of burn as well as containment atmosphere conditions, from dry to saturated. SSPSA figures 11.5 2,-3, and -4 present nomograms for hydrogen burn for saturated steam,50% saturation, and dry containment atmosphere. These nomograms show the relation among adiabatic flame temperature, hydrogen concentration, steam temperature, adlobatic post burn pressure, and containment failure probability.

With 100% of the zirconium assumed reacted, the peak post burn pressure due to global hydrogen burn is less than 110 psia. At this pressure, the containment failure probability for type B or C failures is less than IE 4. Thus, containment failure probability is not sensitive to changes in hydrogen burn assumptions.

Page 10

4 RAl 7. The descriptions of steamline breaks (p.34) and steam generator tube rupture (SGTR) (p.34) be th contain statements that a reactor coolant pump (RCP) seal LOCA is  !

assumed if a totalloss of primary component cooling (PCC) occurs. Similar staternents do l not occur in the small LOCA description (p. 29 30)? Why was the f ailure of PCC explicitly i considered and discussed for these steam generator related events?

l

Response

For the small LOCA event tree, the RCP seal LOCA top event is not used because a breach in the RCS pressure boundary has already occurred. The additional loss of inventory due to an RCP seal !cak would not have a significant effect on plant response. The small LOCA event tree does include the dependency of high pressure inlection (Top Event H2) on primary component cooling (Top Events PA and PB).

For the steamline break events, the RCP seal LOCA issue is addressed because it results in a loss of coolant from the primary side, in addition to the secondary side break. This is a low frequency event but is modeled as ony other transient.

For the SGTR event, the RCP seal LOCA issue is addressed because the combination of an RCP seal LOCA and no safety injection (ECCS pumps fall due to loss of PCC) ensures that the RCS pressure will drop below the secondary relief valve setpoint.

Thus, Top Event 04 (operator controls the break flow) is not questioned, and Top Event SL (steam leak) is not questioned since there is no challenge to the secondary side because of the depressurization on the primary side (see Reference 4, Section S.3.11).

Page 11

l l

l l

RAI 8. The probability values for event OG1, Loss of Offsite Power, are not provided in the IPE submittal. (PLG-0726 is referenced.) Please provide a graph or table showing the frequency vs duration of LOSP.

Response

The frequency distributions for the initiating event LOSP and for the split fraction OG1, used in the Support Systems event tree to account for losses of offsite power that occur after and because of the reactor trip, are described as follows:

ID Description Mean 5th % S0th % 9Sth %

LOSP Loss of offsite power initiating 6.9E 2 4.8E 3 3.7E 2 2.1E 1 event per year OG1 Conditional frequency of loss of 5.7E 4 4.0E 6 1.3E-4 1.6E 3 offsite power events caused by a unit trip These distributions are based on generic offsite power data reviewed for Seabrook specific applicability, as documented in PLG 0726. Note that the frequency for LOSP is based on units of per operating year and has to be adjusted (multiplied by) the plant availability factor (assumed 0.70) to yield units of per calendar year, consistent with the rest of the events. Also, note that the frequency of reactor trips (about 4.4 per year based on Table 3.1 1 in th 'PE Report) times OG1 yields the frequency ofloss of offsite power due to the grid perturbation resulting from a reactor trip (2.SE 3 per calendar year).

The offsite power recovery distribution is plotted on Figure 81 (Figure 4 from PLG-0726). This figure is based on grid recovery data from the PSNH 34SKV grid through 1988. The 10th and 90th percentiles of the distribution were estimated by assuming complete dependence (10th) and complete independence (90th) for recovery among the three offsite lines. Figure 8 2 (Figure 8 from PLG-0726) provides the generic recovery data from NSAC 144. From a comparison of these figures, it can be seen that the Seabrook data is slightly better than the generic data for recovery greater than about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; for less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, the NSAC data predicts better recovery.

Page 12

..1 a __ - 4- a . *2-O 4

" W fw N

Tu 4

- 2 3

M 2i - =

?

C t .a e -=

l

=

~ " +

x w

h 0

- en u h

W w

=f tt W E C

d

", 0 +@ L

' ll:

, W Y $ c en

_3

h 5 3 =

E 'y -

~7 C

- . :C .*

O

/ M x .C.

. O U

- 4 L

- N ~M

{ i~ a I  ! ,

N NOI10VesAw3ACO3d

e 4

1 s

~

to (4

Y L

- Y  :

~

to h

O

- $ O C

a L

~

26

• U i

- ~ s.

._ .g<,n.

ens esp c.

b h

d 2

W >

.s 6.

N h v v O " " o O V

% 4 W d E d , = "

m. 4.

5 '

2 < t U 5 q* O C $ i W

L c.

F

/ ~'

_ _u L. I.

x0

- ~

I  ! l l e f

,o k k 3 k k rk 3 W $

l - - - - _ _ - - _ _ . _ _ - _ _ - . _ _ _ _ - _ _ _ _ - - _ - _ _ _ _ _ _ _ - - _ _ - - - _ _ _ _ _ _ _ _ - _ - - _ _ _ _ _ _ - --__-_- -__ - - - -

4 RAl 9. According to the IPE submittal, for the back end analysis you refer to Appendix H i of the Seabrook Station Probabilistic Safety Assessment (SSPSA) for 1983. In this appendix I (H.2.2) there is a part titled "Phenomenological Models and Assumptions" which states that the codes used for these analysis were MARCH, COCOCLASS9, MODMESH, and CORCON Mod 1. These codes are from 1980,1974, and 1983. The assumptions and models considered in this appendix may be different from the present knowledge about the severe accident. To what extent have you considered recent developments and i investigated the impact of any new changes in your assumptions and models?

Response

The SSPSA (Reference 4) forms the foundation of the backend analysis that was presented in the IPE Report. The basic analysis of core / containment performance and containment failure modes is unchanged from the SSPSA. However, since its completion, a number of other studies have been completed which ac: dress additional phenomenological issues in question at the time of the studies. These containment issues include:

LOCA outside containment (Reference 6) db 7t containment heating (Reference 7)

.uaced steam generator tube rupture (Reference */)

pre-existing containment leakage (Reference 3) shutdown events and containment performance (Reference 8)

These issues (with the exception of shutdown events) have been incorporated in the current backend analysis documented in the IPE Report. This analysis is believed to be state-of the-art with regard to these issues.

During these follow on studies, comparisons have been made to IDCOR MAAP calculations for Zion. In addition, several Seabrook-specific calculations have been run with MAAP for risk important sequences, including:

LOCA outside centainment (Section 3.1.2 of Reference 6).

station blackout (Sectio:16.0 of Reference 7).

In addition, NRC sponsored research and analysis was reviewed to ensure that the Seabrook analysis is reasonable including its treatment of uncertainties. (See Section 4.2 of Reference 6 and Section 8.6 of Reference 7).

MAAP is now the primary tool used for PRA thermal hydraulic and containmmt response calculations and to support applications such as emergency drill scenario

! development.

l Page 13

i w

__- min w r.)- -.

RAI 10, in the Containment Event Tree (CET), your submittal considers the top event DP (Depressurization). Your submittal states that a single power operated relief valve (PORV) is sufficient to accomplish the depressurization. Please discuss the supporting studies or calculations that have been made.

With respect to the top event VH (Early Hydrogen burning), please discuss the modeling assumptions with the hydrogen generation.

Responses:

Depressurization: Section 4.5 of the IPE Report states that a single PORV is sufficient to accomplish depressurization. In addition, it states that the Containment Event Tree does not credit this action. The top event DP is a " place-holder" in the present model so that it can be expanded in the future to account for proceduralized depressurization. This type of action is best addressed through the integrated accident management process currently under development.

The success criteria for depressurization using a single PORV is based on the results of MAAP calculations contained in Reference 7 (PLG-0550) Section 6.3.

Hydrogen: The modeling, assumptions, and sensitivity analyses regarding hydrogen generation that support the IPE Report are , antained in the SSPSA, ,

Sections 11.5.2 and 11.7.1.3 and Appendix H.2.2, Section 2.2.9.2. The SSPSA accounts for a spectrum of nydrogen concentrattor;, burning, timing of burn, amount of zirconium reacted, as well as containment atmosphere conditions, from dry to saturated. This analysis included the potential for global hydrogen burning and continuous discharge burning. An upper bound limit of 100% zirconium reaction was used to account for all other sources of hydrogen generution. It was also assumed that the containment atmosphere would be agitated with substantial mixing currents and convection. This reduces the potential for " pocketing" of hydrogen (as discussed in response to RAI 6) but can increase the pressure rise due to the hydrogen burn. The burn efficiency is assumed to vary linearly from zero at 4% hydrogen to 100% at 8% hydrogen concentration.

Page 14

l.

l RAl 11. Recording the top event CD (debris dispersion) in the IPE, you consider that this event is true if more than 50% of the core material is relocated to the lower containment floor. Please explain in more detail the basis for your assumptions.

Response.

The dispersal of the debris at the time of vessel failure results in the relocation of core debris from the reactor cavity to the containment floor. The dispersal of the debris has several impacts on containment performance:

1. a rapid pressure spike occurs from quenching the dispersed debris on the containment floor,

2. a pressure sp!ke can occur due to heat transfer from the core melt aerosol directly to containment gases (direct containment heating), and

'. reduced concrete attack in the reactor cavity if the total debris in the cavity is reduced by dispersal.

As discu seC in Appendix H.2.1, Section 2.1.3.3 of the SSPSA, the phenomenon is presure-driven by the blowdown jet for sequences with a high RCS pressure at tessel failure. No credit for debris dispersalis taken in low pressure plant states and for these, the failure fraction is 1.0, For high pressure plant states, the experirnents at Argonne National Laboratory discussed in Appendix H.2.1 has

. cwn tnat dispersal of the debris from the reactor cavity con be expected to be near.y complete. The amount of debris dispersed to the containment floor is then "ery nearly equal to the fraction of the core released to the reactor cavity at the time of vessel failure. With the short vessel failure time model discussed in Appendix H.2.1, the fraction of the core released to the cavity is again very nearly me core slumping fraction or the fraction of the core melted at the time of vessel failure. The debris dispersed fraction is therefore equal to the probability that the core slumping fraction is less than 50%. For high pressure accident sequences, the probability that less than 50% of the core slumps has been judgmentally assessed as 0.5. While there is little solid information available to indicate what the slumping fraction should be, experts generally agree that the value is very likely within the range of 10% to 50%. The 50% fraction is used as a conservative estimate by the experts involved in the analysis.

Page 15

RAl 12. With respect to the top event CY (no hydrogen burn at vessel failure), the impact of simultaneous direct containment heating (DCH) and hydrogen burn has been evaluated and the results of the evaluation indicated that a containment failura is unlikely. Discuss the assumptions that were made about hydrogen concentration available for the burning.

Response

The analysis that supports the definition of top event CY is contained in Reference 7 (PLG-0550 Section 6.5). In this analysis, sensitivity studies were conducted for both direct containment heating (DCH) and DCH with hydrogen burn. In the hydrogen burn case, a global hydrogen burn was " forced" to occur, i.e., assumed to occur even though the analysis did not predict a burn. In this analysis, the total hydrogen production was 220 kg in vessel and 479 kg ex-vessel, or approxirnately 74% clad reacted, corresponding to the total mass available for dispersal. The combined loads of DCH and hydrogen burn resulted in a peak containment pressure of about 98 psia, well below the median failure pressure of 181 psia.

?

's Page 16

d i

RAl 13. Please provide a concise discussion of the method used for estimating the Seabrook release categories related to the early release. The discussion should include source terms for various radionuclides, for example. Te, Ru, and Cs.

Response

As discussed in the IPE submittal, the early release categories have been defined for Seabrook as follows:

an early, large containment failure or bypass (release categories Sl A, S1B, S6, and S7A), and an early, small containment failure or bypass (release categories S2 and S7B).

fhe source terms associated with each release category (RC) have been defined as a conservative and a realistic release. The analysis for these source terms has evolved since the SSPSA (Reference 4) as a result of the EPZ reduction effort that produced PLG-0432 (Reference 6) and PLG 046S (Reference 12). These three documents have been used to define the current source term release fractions, as follows:

Release Basis Reference Category SI A - C MARCH / CORRAL SSPSA, Section 11.6.4.3, RC S1 SI A - R MAPgH/ CORRAL SSPSA, Section 11.6,4.3, RC 5 SIB - C WASH 1400 (PWR 2) PLG-046S, RC SlW SIB R MARCH / CORRAL with SSPSA Section ll.6.6.S, RC T6V-d enhancements

~

S2 - C MARCH / CORRAL with SSPSA, Section 11.6.6.4, RC 5'2V c enhancements S2 - R MARCH / CORRAL with SSPSA, Section 11.6.6.4, RC S2V-d enhancements S6 - C MARCH / CORRAL with SSPSA, Section 11.6.6.5, RC EV-a enhancements S6 - R MAAP/IDCOR Zion PLC-0432, Table 4 13, RC S6B S7A - R WASH 1400 (PWR-2) PLG-046S, Section 4, RC SlW S7A C WASH-1400 (PWR-2) PLG-046S, Section 4, RC SIW S7B - R

• WASH 1400 (PWR-2 PLG-046S, Section 4, RC S7W times with DF=10) 100 S7B - C

• WASH 1400 (PWR 2 PLC-046S, Section 4, RC S7W with DF=1000) l The documents referenced in the above tchle provide the details of the method used to estimate the source terms.

Page 17

• For release category S7B, Seabrook-specific source terms have been developed using the

- MAAP code. These source terms are documented in Section 4.4 of PLG-0432 and are, in general, less conservative than the source terms used in the IPE Report.

e j

Page 18 J

- , - - - + + , , . . - ,r- m,, e vy _,_ ,. - . w- .. ,,y,, w.. y 3- ,- . , , ,. -,..y,, , m. , ,_ .,y__-_. , , m..

RAI 14. Your IPE submittal states "The major contributors to unusually poor containment performance, i.e., large early release are . ." Please provide rationale for your definition of " unusually poor containment performance". How do you define "large early release"?

Response

" Unusually poor containment performance" is used in the IPE Report to refer to those release categories that are expected to have a " Major" significance to early health effects as shown below:

Relative Contribution to Sequence Release Containment Early Latent Occurrence Group Category Response Effects Effects Frequency 1 SlA Large (>3") Early Major Major Minor S1B Leakage S6 S7A 11 S2 Small (<3") Early Minor Major Minor S7B Leakage III S3A Long Term None Major Major S3B Overpressure IV S5 Long Term None None Major Intact From this table, it can be seen that the only group of release categories that have

" major" early health effects is Group I. Based on this, the definition for "unus:tahy poor containment performance" is applied solely to the release categories shown in Group 1, with large, early containment leakage. Note that "large" leakage 15 defined as greater than 3" diameter opening, which encompasses openings trom a containment penetration not isolated to gross structural failure of containment.

As shown in Table 4 3 of the IPE Report, large early releases are generally those that release substantial fission product (e.g. >20% noble gases) within 2 to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of the beginning of the event.

Page 19

d RAl-15. The report PLG 550 states that benchmarking between MAAP and RELAP calculdtions (1984) provides an assurance that t'ie timing of RCS depressurization is predictable and well understood. Were insights associated with the timing of RCS depressurization integrated into operator training and procedure upgrading?

Response

PLG 0550 was performed to investigate the benefits of depressurizing in reducing the potential for direct containment heating (DCH) and induced steam generator tube rupture (ISGTR). As described in PLG-0550, depressurization has a high likelihood of success and is included in the EOP Functional Restoration Guidelines except for station blackout sequences without steam generator cooling. The insights and conclusions described in PLG-0550 have not been incorporated because the risk results a:e very small without these improvements. They will be considered further as part of an integrated accident management program. These insights have been discussed with operations, training, and the Westinghouse Owners Group (WOG) for future considerations.

Page 20

RAI 16. Table 21 for defining the plant damage state (PDS) in the PLG-05S0 report uses 300 psia as the primary pressure at the time of vessel penetration. How was this pressure estimated?

Response

Table 2-1 is taken from the original SSPF A. Two broad categories of RCS pressure at time of vessel failure were defined in the SSPSA, with a break point of 300 psi.

Above this pressure, it was assessed that significant core debris dispersal out of the reactor cavity would occur (see SSPSA Sections P.4,11.7.1.5, and Appendix H.2.1).

The thermal / hydraulic analysis of accident sequences in the SSPSA resulted in two distinct classes:

high pressure - between approximately 10 2400 psia for transients and small LOCAs where the RCS does not ae urize, and low pressure - at the containment pressure c ; tue time of the melt, fer medium and large OCA sequences wheie the RCS completely depressurizes.

In PLG-OSSO, three pressure ranges were considered (<300,300 to 1000, and >1000 psia)in consideration of the effects of direct containment heating (DCH). The probability of containment failure at vessel breach was assessed for these three pressures (PLG-0550, Section 8.6.8 and Tab'e 8-14). Hcwever, the results for DCH were obtained assuming two ranges, high and Icw pressure, because as described above, accident sequences tended to end up in either of these two ranges.

The choice of precisely 300 psia is arbitrary; the results of the analysis would not be different if the break point were chosen as 200 psia or 400 psia. It is a pressure clearly above the low pressure and clearly below the high pressure scenarios.

l l

l l

l Page 21

RAI-17. In the report PLG-0550, some blackout sequences have been analyzed with MAAP code. Which assumptions have been considered related to core blockage, in vessel and ex-vessel hydrogen generation, and hydrogen burning?

Response

The standard assumption in MAAP modeling in PLG-0550 was that core blockage would occur in a core node when melting began in that node. A MAAP "no blockage case" sensitivity was performed (PLG-0550, Section 6.5) which indicates that the hot leg temperatures are affected much more than steam generator tubes.

This would reduce the potential for direct containment heating and have a minor impact on the probability of induced steam generator tube rupture. Also, MAAP

" direct containment heating cases" sensitivities were performed including forcing of global hydrogen burns. (See response to RAI-12). In-vessel, ex vessel hydrogen generation, hydrogen burning, and the effects on containment pressure are described in Section 6.5 of PLG-0550. The conclusion from that analysis was that the combined loads are not a significant effect.

i Page 22 l

RAI 18. The report PLG OSSO analyzed the phenomena DCH and SGTR, but only for TMLB' scenarios. Do you expect differences in terms of containment failure probabilities and release categories for other high pressure sequences? If so, please explain.

Response

No significant differences are expected in containment failure probabilities based on different high pressure scenarios. This is based on the judgment that the analysis is conservative i.e., all scenarios with expected pressures greater than 300 psia are treated as high pressure. Also, the availability of steam generator cooling would extend the time to core damage. Since all DCH and ISGTR causes of containment failure are binned to release categories SI A and S7A, respectively, which are large early releases from a source term perspective, any differences are expected to demonstrate conservatism in the present approach.

Page 23

RAl.19. Your IPE states that containment bypass sequences have small contribution to the source term. Please discuss the effort that was involved in identifying all the potential contributors to the bypass scenarios.

Response

The potential for containment bypass was evaluated in the original SSPSA, in the analysis of containment penetrations (Appendix D.13). That evaluation reviewed each mechanical penetration for its potential as a bypass path; the following bypass scenarios were identified:

failure of the RHR suctica line motor operated isolation valves failure of the RHR injection line check valves steam generator tube rupture and steam line release This evaluation is documented in the SSPSA, Section D.13 and is expanded upon in RAl-25 from Reference 11.

The RHR bypass paths were evaluated in detail in PLG-0432 (Reference 6). This involved detailed best-estimate analysis of plant, piping and operator response to a LOCA through the RHR system. This analysis resulted in significant reduction in the public health risk due to this event, because of the opportunities for recovery that were identified and the potential for any release to be scrubbed through a 30-ft pool of water in the RHR pump coults.

Pace 24 1

RAl 20. On page 102 of the Seabrook IPE submittalit states the following: Plant procedures used in the human action analysis include the Westinghouse Emergency Response Guidelines (ERG), generic Westinghouse operating procedures and, wherever possible, the prospective Seabrook operating and emergency procedures.

Please discuss the differences between the procedures used in the human action analysis in the SSPSA and the current Seabrook procedures. If a difference exists, please discuss the impact you feelit will have on the SSPSA results if the current procedures are included.

Response

The present emergency operating procedures (EOPs) are functionally equivalent to the draft EOPs available in 1983 that were used in the development of the SSPSA.

The EOPs have gone through a number of revisions but for the most part the changes were to improve the human factors (e.g. consistent format, caution statements) and to account for plant specific changes (e.g.DC load shedding).

Procedural improvements have been made in the areas of:

enhanced plant trip and LOCA response, better guidance during station blackout, more complete SGTR response guidelines, and enhanced LOCA outside containment response.

For example, the work done in Reference 6 identified a weakness in the logic of the procedures wheroby, given indications of LOCA inside containment (which would occur for an RHh OCA with relief to the PRT), the procedures did not question whether a LOCA outside conteinment might exist. The EOPs have been changed to provide the proper logic.

The EOPs were reviewed as part of the 1989 model update. The emphasis was to assure that the event trees correctly modeled the operator response. No significant changes were identified in that review with regard to EOPs that would have a negative impact on the model.

As part of the continuing model use and development, the operator action analyses are being evaluated and insights provided to the operator training program. This will include a review of the applicable EOPs in order to take advantage in the operator modeling of procedural enhancements.

l l

l

Page 25 l

A l

RAl-21. On page 23 it states that "a number of walkdowns have been performed.. " How many walkdowns have been performed? Which walkdowns were performed for the follow-on studies done by Seabrook?

Did the human factors analysts and human reliability analysis (HRA) practitioners participate in the plant walkdowns? If so, please provide additionalinformation about what was done and what insights were gained from there activities.

Response

Walkdowns. The following is a partiallist of the walkdowns that were performed as part of the original SSPSA. These walkdowns were gererally multi-day and involved several technical consultant specialists and one or more utility personnel -

engineers, operators, and/or training instructors.

spatial interaction walkdown -- (technical specialist - M. Kazarians, PLG),

Complete plant walkdown to identify potential spatial impacts - e.g. fire, smoke, flood, missiles, steam, pipe whip, falling objects (seismic). The results of this walkuown, documented in SSPSA Appendix E, were used to develop accident initiators and scenarios.

containment walkdown - (technical specialists - F. Torri, PLG and B. Henry, FAI). Walkdown of containment, enclosure, penetration areas, equipment vault.

containment structural walkdown - (technical specialists - F. Torri, PLG and D.

Wesley, SMA). Walkdown of containment and enclosure structure (Unit 1 and

2) including all major penetrations - fuel transfer tube, equipment / personnel hatch, mechanical penetrations, electrical penetration.

seismic walkdown -(technical specialist - D. Wesley, SMA). Walkdown of major structures and equipment.

systems walkdowns - (technical specialists - J.Stetkor, PLG and W. Stillwell, PLG). Walkdown of all important safety systems. including major equipment and piping paths.

In addition, personnel at NHY and YAEC involved with the original SSPSA (the utility PRA team) performed numerous walkdowns to ensure familiarity with systems and as part of reviewing the draft SSPSA sections.

Since the SSPSA wcs completed (1983), a number of follow-on studies have been performed that involved plant walkdowns. These walkdowns generally involved several technical consultant specialists and one or more members of the utility PRA team - engineers, operators, and/or training instructors. Following is a partial list of walkdowns:

PLG-0432 (Reference 6)

RHR equipment vault -(technical specialists - F. Torri, PLG, B. Henri, FAI, and B. Lutz, Westinghouse). The vault was walkdown as part of the V-sequence reevaluation. The walkdown confirmed the system / structure Page 26

. . - - _ _ . - . =- .

design that would allow a pool of water to form in the vault if an intersystem LOCA through the RHR system were to occur. This results in a >

scrubbed release which significantly reduced the offsite effects.

_ containment - (technical specialists - F. Torri, PLG, B. Henri, FAl, and B.

Lutz,-Westinghouse). The area under the vessel and the instrument tube keyway were walked-down to identify the potential for high pressure release leading to direct containment heating.

Shutdown Study (Reference 8) - (technical specialist - T. Casey, NHY consultant).

Walked down shutdown evolution proceduces with operations as well as important operator actions associated with mitigating initiating events.

Fire Analysis update -(technical specialists A. Klein, YAEC and T. Trump, NHY' - An update to the fire analysis is currently underway. As part of that updote, detailed walkdowns of the plant were conducted to verify fire area borders, seppression, transient combustibles, etc.

Seismic Anc. lysis update - P. O'Regan (YAEC). An ugdate to the seismic analysis is currently underway. As part of that update, walkdowns have been and will be conductect to confirm seismic anchoring and to look for any seismic 11/1 interactions.

The PRA team has partit,ated in w alkr.hwns with the NRC and its contractors during reviews of the original SSPSA (NRC/LLNL) and the PLG-0432 and PLG-0465 studies (NRC/BNL). This last review invoh ed a structural walkdown including the Unit 2 structures and the Unit 1 structural models, simulator and procedure reviews at the Seabrook training simulator, and a general plant walkdown.

- Additional walkdowns are routinely performed are part of other activities that the PRA team is involved in e.g. root cause evaluations, design reviews, engineering evaluations.

- As part of updates in the futme, walkdowns will routinely be performed to confirm details of the analysis. The walkdowns that occurred before plant operation had the benefit of bMng able to get to places in the plant that are now inaccessible due to radiation or completed structures / components. Thus, future walkdowns have these restrictions but also have the benefit of a completed, operational plant configuration.

Human factors walkdowns. The HRA technical specialists for the SSPSA received general plant tours but were involved in detailed "walkdowns" in the Seabrook training simulator (see response to RAl-29). These walkdowns consisted of running l a number of accident sequences on the simulator and observing the operator alarms, indications, timing, and actions. These observations are summarized in Appendix D of the SSPSA. The sequences involved some 20 scenarios including:

- ATWS initiated by loss of main feed SGTR total loss of main feedwater

- turbine trip Page 27

reactor trip loss of a single DC bus small, medium, and large LOCA In additloa to the technical specialists, the operators and training staff and utility -

PRA personnel were involved in the simulator scenarios.

Insights:

The simulator observations were used to develop the operator response model. The observations included:

the use of the sy:nptoni based emergency operating procedures to reduce the potential for operator misdiagnosis. This was reflected in the assignment of values in the confusion matrix (SSPSA Table 10.2-1)'

the use of the Visual Alarm System, graphic display, and control board mimics to enhance operator response.

During the follow on studies, there were Interactions with Seabrook operations and simulator training personnel. The emphasis was on interfacing LOCA in PLG-0432 and RPV depressurization to reduce DCH and ISGTR scenarios in PLG-0550.

Insights derived from the plant specific analysis of interfacing LOCAs resulted in a training class in the subject of diagnosing interfacing LOCAs. The more recent EOPs have been revised to improve diagnosing interfacing LOCAs, Page 28

- . _ - . . _ _ _ _ . . . ~ - - . _ _ - _ _ _ . _ _ _ _ . _ . . . _ , . .. , ,__ _._ _ . . _ _ _ _ _

O RAI 22. On page 104 the IPE submittal discussed an anchoring activity for human error probabilities. Please discuss how this was done and the results of this activity.

Response

As discussed on page 10.2 9 of the SSPSA, the event "fallure to stabilize high pressure injection" was chosen as an operator action for which statistical evidence was available. The statistical results were then used to establish a correspondence between the frequency scale and an event that corresponds to moderately high stress and whose misdiagnosis potentialis moderately high. From a number of data sources, evidence of 1 failure in 57 events was gathered. ( See SSPSA, Table 10.2-2) This statistical evidence along with the judgments of the HRA technical specialists was used to determine the Human Error Probability (HEP) distribution, with mean value of 2.2E 2 and error factor (50th/Sth) of 8. (Table 10.2-3)

This HEP was used for other operator actions ofinterest to validate or adjust estimates from the Handbook (Reference 9) and other sources. Each action was accessed by an expert team for time available, potential for misdiagnosis, and stress level. As can be seen in Table 10.1-1 of the SSPSA, actions with high misdiagnosis potential and high stress are generally ordered by the time available.

This is illustrated below with a limited set of operator actions:

Top Operator Action Description Time HEP Event Available (mean)

OP Operator fails to control high pressure 30 min 2.3E-2 injection OM Operator fails to control EFW 20 min 6.2E-2 Al Operator fails to isolate stuck open 60 min 1.0E-2 ARVs For other nuons where the misdiagnosis potential and/or stress are not high, the HEPs are similarly scaled.

Other factors were included in the analysis, such as the complexity of the actions and the dependency of previous actions. All actions are not ordered based simply on these three factors. However, this process did help to some degree to anchor the HEP estimates to statistical data.

Page 29

RAl 23. On page 10.3-14 of SSPSA it states the following (about the simulator): While it was very easy to determine that S1 was initiated, the cause of the SI was not always readily apparent since the annunciators indicating the sou.ce of the Si signal alarmed and they cleared immediately (the failure of these alarms to lock in may be peculiar to the simulator in its present operability state).

What is the current condition at the plant regarding '.here alarms? Do they clear immediately or do they lock in until an operator clears them? Does the simulator represent the current, as-built plant?

Please discuss the use of the simulator in the evaluation of human actions and the HRA.

Were any insights into improving plant safety obtained from there simulator tests? If so, what were they?

Response

The simulator was not fully operable during the time the simulc tor exercises were observed (1983). Fortunately for the analysts, it was sufficiently operable to observe the general operator control board interface. The alarm status was one of the items that was not yet fully operable. The design and the current condition is that the hardwired Si annunciators blink when they come in and go full on when the operator acknowledges them. If multiple SI signals alarm, the operator can determine the first in by looking at the computer sequence of events logger.

However, the symptom-based emergency cperating procedures do not require the operator to determine the source of Si in order to adequately respond.

The simulator is maintained updated with the as-built plant control board.

The simulator evaluations of human action were useful in understanding how the operator interfaced with the information and controls on the main control board.

This evaluation confirmed the value in the symptom based procedures but did not yield any specific and unique safety improvements.

Page 30 l

4 0

RAl 24. Section 5 of the IPE submittal is very brief and locks details about the utilities participation !n the IPE process. The original SSPSA was done about 1984. The submittal states on page 234 that PLG did the original SSPSA and subsequent ones and that the utility has done more in house as the utility PSA team has grown. For the 1990 update of the Seabrook Station Probabilistic Safety Study (SSPSA), please provide answers to the fellowing questions: Who did it? What percent ofinvolvement came from utility personnel? What percent of the total effort was the review?

Response

The SSPSS 1990 Update was done entirely "in house" by the utility PRA team consisting of NHY (K. Kiper) and YAEC engineers (J. Bretti, P.ORegan, D. Kapitz, K.

St. John). The update required approximately 1.5 man years to complete and about 2 man-months for review. The review was performed by the managers of the Safety Assessment Group,YAEC (J. Chapman) and Reliability and Safety Engineering Dept., NHY (LRou) and by consultants (J. Moody and K. Fleming) who had previous involvement with the SSPSA. Future PRA analysis and updates are expected to be performed in-house with advice and review from outside specialists where needed. In order to become self sufficient in most PRA areas, the Safety Assessment Group at YAEC is developing technical specialists that are available to all the plants that they service.

Page 31

O RAl 25. Section 3.3.3 summarizes the human error probabilities used in the original PSA and the IPE analysis. The human actions are grouped into three types - pre-initiating event interactions, initiating event interactions, and post-initiating event related interactions. For the first group the discussion states that "these actions were, in general, quantified using the handbook methods...as documented in the SSPSA." At the meeting on April 24,1991, a copy of Chapter 10 of the original SSPSA was provided which contains the information about the human reliability analysis, especially those used as top events in the event trees.

Please concisely discuss the process used to estimate the HEPs for the human actions documented in Chapter 10, and note any sigmficant deviations from the handbook method.

Discuss any substantial differences in your IPE dndings between the approach using the 1980 draft handbook and the approach using the final handbook published in 1983.

Please provide on example of estimating the HEPs for a typical top event and a concise discussion of the data used in the process.

Response

Process for estimating HEPs: The Handbook was used along with several other sources of estimates of HEPs and the anchoring activity described in response to RAl 22 to subjectively estimate a distribution for each action. The analysis considered three general performance shaping factors, sequence time interval potential for misdiagnosis, and stress level, from routine to very high, asseued for each action by a team of analysts The Handbook was used differently in various actions; for example, action 03 (SSPSA Section 10.3.7.3) was quantified using explicit references to Handbook values (see below for details of this quantification). Handbook values under different assumptions were used to estimate the range of uncertainty.

actions RT and OH (SSPSA Section 10.3.1.4) were quantified subject.vely and then compared to Handbook values for failure to follow procedures to show that the distributions were reasonable.

action OP (SSPSA Section 10.3.4.4) was quantifled based on the anchoring activity described in the response to RAl-22, with a subjectively developed distribution.

action OD (SSPSA 10.3.2.3), operator depressurizes the SGs, was quantified subjectively. No explicit reference is provided to the Handbook or anchoring value but based on Table 10.1-1, the HEPs are clearly in line with OP, the anchored HEP.

Page 32

l While the quantification of the HEPs in the dSPSA may h< -en more subjective than current methods, the values resulting are internally consistent and tend to be conservative in comparison to more recent studies. The conservatism in operator action quantification is not important to the overall Seabrook model. As shown in Table 3.410 of the IPE Report, operator actions except for recovery actions have a low importance. The most important operator actions, recovery of electric power, is a function of recoverability of equipment rather than explicit operator errors. This action has been evaluated in detail (see response to RAI 26).

Comparison of Draft and Final Handbook' We are aware of no differences between the Draft and Final Handbook that would substantially offect the operator action quantification in the IPE Report. This is because the Handbook was used as guidance and input into the expert judgment that resulted in the HEP values.

Example: Following is an example of the quantincation of an operator action top event. Top event 03, operator falls to perfcan switchover to high pressure recirculation, is analyzed and quantifled in the SSPSA Section 10.3.7. The action is quantified based on the primary-side operator failing to follow the switchover procedura correctly and the rest of the crew falling to detect the error. The median value for the HEP is quantified as follows:

03(median) = OP1

• DT1

• DT2

• DT3 = 1.6E-4 where:

OP1 = 3E-3 (error of omission in using written procedures, from the Handbook, Table 20-20) time 5 (dynamic task under medium stress, from Table 20-23) = 1.5E-2, DT1 = 0.5 (failure of other control room operator to detect the procedural error, assuming high dependence, fram Table 20-17),

DT2 = 0.144 (failure of shift supervisor to detect the error, assuming mocerate dependence, from Table 20-17), and DT3 = 0.144 (failure of technical advisor / shift superintendent to detect the error, assuming moderate dependence, from Table 20-17).

To develop on upper bound estimate for O3, it was assumed that there is complete dependence betw-en the control room operators (DT1 = 1.0) and high dependence between the si.# supervisor and operator and between the shift superintendent and the operator (DT2 = DT3 = 0.5). Thus, 03(upper bound) = 1.5E-2

• 1.0

• 0.5

• 0.5 = 3.7E-3.

The distribution is assumed to be a logr nol with the following statistics:

median = 2E-4 (from above) 95th percentile = 32-3 (from above) mean = 8E-4 (from lognormal)

Page 33

W The mean value 8E-4 is the value used in point estimate calculations i.e., the ,

event tree quantification.

l --

Page 34

.. . ~ . . _ . _ . . _ - _ . . - . . . _ . _ . . . . ~ . . . - . . . _ - . . . , . - . . _ . _ . . _ . _ - , - _ _ , , . _ . . _ . _ . . _ . . . . _ . , . . , . . . - . . - , . ., __ __..-._,.__

t RAl 26. Recovery is handled by an event tree which is shown in Figure 3.1 12 of the IPE submittal. Recovery is limited to station blackout and rnakeup t' the refueling water storage tank (RWST). In the April 24,1991 meeting, the utility said it would provide more detail about the offsite recovery model. Please provide additional information on the process used to treat recovery.

Response

The electric power recovery model has been substantially enhanced since the original SSPSA. The current model is documented in PLG-0S07, Rev 2, included as Enclosure 2 to the letter transmitting these RAls. This report describes the Monte Carlo simulation model that is used to quantify the likelihood of electric power (offsite or onsite) recovery. This model accounts for the time dependence of loss of diesels and DC power (batteries) and recovery of electric power along with the effects of secondary cooling and seal LOCA size. In addition to the computer model, the data input to the recovery curves has been updated. See the response to RAl-8 for a summary of the current offsite power recovery curves.

Electric power recovery has been the focus of modeling update because of the importance of station blackout to the core damage r;sk. The results of this analysis are used to quantify the top event ER in the recovery tree.

Additional recovery has been included in the event trees as follows:

servi .e water recovery - manually actuating the cooling tower - is modeled with service water system in the top events WA and WB in the Support Systems tree; signal recovery - operator manually starting equipmnnt from the control room on loss of signals is modeled in top event OS in the Support Systems tree; emergency feedwater recovery - top event FR in the transient tree models recovering the turbine-driven EFW pump locally or manually starting the Startup feed pump.

makeup to the RWST - modeled in top event RM in the Recovery tree for providing continuing inlection in the event of a small LOCA with failure of recirculation.

Page 3S

RAI-27. On page 2 of the IPE submittalit states "... subsequent studies have been performed using the same contractor team with significant utility personnel involvement."

Please clarify in more detail what you mean by "significant"

Response

A number of studies subsequent to the SSPSA have been done with varying degrees of utility / consultant involvement, as follows:

Tech Spec Study (Reference 10) - about 50% of the analysis was performed by utility personnel.

PLG-0432 and PLG-0550 (References 6 and 7)- These studies were state of the art analyses of severe accident phenomena (e.g. direct containment heating) and thus the involvement of the contractor was high, about 80%. Utility involvement was primarily in providing plant information and reviewing analyses.

Shutdown Study (Reference 8) - This study was directed and performed almost entirely by the PRA tearn, including a long-term contractor at NHY. About 10%-

of the study was performed off-site by consultants, in the areas of data development, uncertainty analysis, and source term / consequence analysis.

SSPSS Updates (1986,1989,1990) These updates have been d!rected and performed with about 90 to 95% utility involvement. Consultants assisted in implementing a software upgrade (from mainframe based to PC-based computer modeling), limited reviews, and analyses of electric power recovery and seal LOCA. See response to RAl.24 for details of the work done on the 1990 update.

l l

l Page 36

)

RAl 28. On page 101 of the submittal it states "These actions were, in general, quantified using the handbook methods (NUREG/CR 1278, Reference 27), as documented in the SSPSA. Please provide a mc,re detailed overview of these methods and the process used to perform the quantification.

Response

The Handbook was used along with several other sources of estimates of HEPs and the anchoring activity described in response to RAl-22 to subjectively estimate a probability distribution for each action. The Handbook was used differe"y in various actions; for example, action 03 (SSPSA Section 10.3.7.3) was quantified ut..tg explicit referrnces to Handbook values (see RAl 25 for details of this action),

actions RT and OH (SSPSA Section 10.3.l A) were quantified subjectively and then comparea to Handbook values for failure to follow procedures to show that the distributions were reasonable, and action OD (SSPSA 10.3.2.3), operator depressurizes the SCs, was quantified subjectively. No explicit reference to the Handbook is included but the results are consistent with other actions and with the anchored action.

See response to RAl 25 for more details regarding operator action quantification.

Page 37

RAI 29. Please discuss the personnel who performed the human factors evaluations and the human reliability for the SSPSA and follow-on studies.

Response

In the SSPSA, John G. Stampelos (PLG) was the lead HRA specialist and the author of Section 10 of the SSPSA. His experience is in military operations and PRA analysis. He was assisted by a number of experts including:

John Stetkar and Dennis Bley (PLG) - both commercial nuclear operations background, were responsible for developing the ev:mt trees in the SSPSA, provided direction and input in the simulator exerc:ses.

Donald Norman (Director of the School of Cognitive Science, University of California at San Diego)- provided guidance in the modeling of human response, specifically operator misdiagnosis, participated in the simulator exercises.

The human reliability work in the EPZ reduction efrort studies (References 6 and 7) was performed by J. Stampelos and by William Bromley (PLG). The HRA work in the Shutdown Study (Reference 8) was performed by Thomas Casey (consultant to NHY) and Kenneth Kiper (NHY).

Page 38

4 References

1. New Hampshire Yankee Design Basis Document," Emergency Feedwater System," DBD-EFW-01, Rev. O, July 26,1989.

2. " Data Base for Probabilistic Risk Assessment of Light Water Nuclear Power Plants PWR Initiators," PLG-0500 - see IPE Report, Reference 26*.

3. Individual Plant Examination Report for Seabrook Station", New Hampshire Yankee Engineering Report No. 91-01, March 1991.

4. "Seabrook Station Probabilistic Safety Assessment," PLG-0300 - see IPE Report, Reference 3*.

5. New Hampshire Yankee Emergency Response Procedures (ERPs), ES-0.1," Reactor Trip Response," Rev. 9, Sept.14,1990.

6. "Seabrook Station Risk Management and Emergency Planning Study," PLG-0432

- see IPE Report, Reference 11*.

7. " Risk Management Actions to Assure Containment Effectiveness at Seabrook Station," PLG-0550 - see IPE Report, Reference 10*.

8. "Seabrook Station Probabilistic Safety Study - Shutdown Modes 4,5, and 6" - see IPE Report, Reference 28*.

9. " Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications," NUREG!CR 1278 - see IPE Report, Reference 27*

10." Risk-Based Evaluation of Technical Specifications for Seabrook Station,"

PLG-0451 - see IPE Report, Reference 55*

11, PSNH Letter (SBN 1225), dated October 31,1986, " Response to Request for Additional Information (RAls)", J. DeVincentis to S.M. Long.

12. PSNH Letter (SBN 1227), dated November 7,1986, " Response to Request for Additional Information (RAls)", J. DeVincentis to S.M. Long.

• These references are found in Section 8.0 Reference 1 of the "Seabrook Station IPE Report."

I Page 39 '

Enclosure 2 Frequency ofNonrecovery of Electric Power, PLG-0507, Rev. 2 (See Response to RAI-26) f

- - - _ _ _ _ _ - - - _ - _ _ _ _ _ _ - - - - _ _ _ - _ _ - _ _ _ - _ _ _ - - - _ _ _ -