ML20083B767

Comments on NUREG CR-5604 Re Isloca.Concludes That in Order to Multiply Probabilities Given in Branches of Event Tree All Values Used Need to Be Mean Values

ML20083B767
Person / Time
Site:	Davis Besse
Issue date:	11/07/1990
From:	Hanan N AFFILIATION NOT ASSIGNED
To:	Diab S Office of Nuclear Reactor Regulation
Shared Package
ML20081D760	List: ML20083B473 ML20083B549 ML20083B658 ML20083B696 ML20083B767
References
FOIA-90-512, RTR-NUREG-CR-5604 NUDOCS 9109250194
Download: ML20083B767 (5)

Text

_ _ _ _. __ _ _ _ _ _ _ . ~ _ . - _ . _ _ ._ _ _ _ _ _ _ _ ___

y November 07, 1990 Mr. sammy s. Diab r.lsk Assessment Branch '

Division of Radiation Protection and smorgency Preparedness Office of Nuclear Reactor Regulation U.8. Nuclear Regulatory Commission Washington, D.C. 20555

Subject:

Comments on Report NVREG/CR-5604 (Draft) - Oct/01/90

Dear 8ammy,

Based on a preliminary review of the above subject, the following are my comments:

I

1. Make-up (MUAP) ISLOCA )

l 1.a Based on the f ault tree (yT) presented in page I-27, the '

evaluation of the event tree (ET) top event HD2 is not correct.

Instead of the 2.65-03, th3 probability for " failure to detect i l IsLOCA" should be equal to 6.1E-02. Note that this modification will make the MUAP ISL % the dominant contributor to ISLOCA core damage frequency, a;suming everything else remains the same.

I do not have-any way to check if the indications included in the  !

L FT in page E-27 are the only ones the control room crew will have. I I think that it should also be checked if there are any flood or radiation alarms in the area where the most probable breaks can '

occur.

1.b It is stated in page 24 -that "a bounding calculation was  !

performed to estimate tne time to core uncovery for a DHR/LPI and  !

a.) HPI sequence. The HPI calculation produced a minimum time to l uncovery, given a rupture in the HPI system, of about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. .

This time is utilized in the HKA analysis for post-ruptur1 recovery i events." In the Attachment 1 it is explicitly stated that it is  :

assumed that 2 LPI trains are used (together with 1 HPI and 2 l charging pamps) to refill the primary system and that the steam <

generators were depressurized to enhance primary to secondary heat l transfer. It is also stated in Attachment 1 that the assumptions were made to minimize the time to empty the RWST.

It is my opinion that those assumptions are very conservative (as a matter of fact the use of two LPI pumps is not correct because I

the initiatom also disables one of the two LPI trains) and do not reflect the real progression of the accident. c I do think that, as also stated in Attachment 1, a simulation of more realistic l accident progression will substantially increase the time available  !

for detection, diagnose and isolation of the modeled ISLOCA.  !

1 1.c It was not possible to review the evaluation of the  !

, probabilities of failure to diagnose and to isolate the ISLOCA i 1

o109250194 910419 7

PDR FOIA '

+i WILLIAM 90-512 PDR < L <

j

- - . _ . _ . . _ . , _ _-.-.______.___.____,_.._,_._.,__,._____,i__ _ . , , _

i

. 1

. 1 i

since the value used is taken directly from a table in a NGG  !

report which I do not have at this moment. However, even without '

having the report I will give a qualitative comment. Given the fact that the operators have detected and correctiv diaan_esed the ISLOCA, and in order to do that the used the indicatione from the "high Temp. alarm in the HP pump 1-2" and the opening of the relief valve 1511, i.e. the operators know that the break is in the MU&P system, and given the long time available for break isolation, I do think that the probability of failure used for the failure to isolate the I5LOCA seems to be high.

2. EPI 15LOCA The comment 1.c given above is also valid for the HPI ISLOCA.

3. DNR Letdown ISLOCA - Shutdown 3.a I do not understand why the treatment of operator actions to " jumper DM-11 s n 1 DH-12" are treated exactly the same way in the event tree in pageJ E-52 and E-53. It seems to me that the action to " jumper DH-12" is correctly treated because it is a step in the shutdown procedure. However, since to jumper DH-11 the operators would have to make an " error" (because it is not a step in the procedures) the treatment of this action (represented as event L in that ET) does not seem to be correct. In other words, I do not understand why the action "Ro fails to instruct I&C to jumper DH-11" can be an error of omission as shown in page E-23. I do think that unless there is something missing in the writeup or in my understanding of the ET, the correct treatment of that action can make a large impact in the quantification of the event represented by that event tree.

3.b Given that the break in the DMR would disable one of the LPI trains for the injection mode (even without any rupture if the operators are following procedures they would have to close DH-2734 and open its breaker), I think that the inclusion of the failure of the other train of DHR/LPI in the injection modo needs to be included in the ET of Sage D-6. My suggestion is that the new ET should be similar to the one in figure 1. I think that, as can be seen in figure 1, based in the large LOCA success criteria use'd in all PWR PRAs I have seen, a core damage would occur given the failure of the LPI. This does not necessarily means that the break core darage to avoid an outside can not be isolated after containment release. It is also important to note that given the initiator frequency,b the core damage frequency from the postulated sequence is going to Dery high when compared with core damage f rom large-LOCAs ha other PWR PRAs. 7 3.c The evaluation of the probability for the top event

" operators f mil to isolate ISLOCA" does not include the f silure of the valves themselves. If one uses the same data used in NUREG-1150 the CCF of two MOVs to close is equal to 3.0E-03

• 4.9E-02, i.e. 1.53-04.

d' e

3.d I do not understand why the analysis presented in Appendix H of NUREG/CR-5604 was used for the DHR shutdown ISLOCA.

Based on the Davis Besse procedure DB-OP-06903 (Plant Shutdown and Cooldown). Given that the crew decided to go to shutdown prematurely and given that it opens the valves DH-11 and DH-12, following procedures the valves DH-10 and DH-26 will be closed as will also valves DM-1517 and DH-1518. At this point there would be an overpressurization of line 12"-0CB-7 and its possible ruptural at the same time there would be release through the relief valve DH-4849. If the line does not rupture and the operators do not detect the release through valve DH-4849, they may continue in the process of shutdown. Given that, they would have to open valve DH-1518 (procedural step) and there is a need to verify if this valve is designed to open against the existing differential pressure.

Only if the valve DH-1517 can be opened (after the operators fail to detect release through valve DH-4849) the calculations presented in appendix H oan be used for the rupture analysis.

4. DKR Letdown I5LOCA - startup 4.a I do not understand why the "f a11ure to read Note B.4.48*

in the startup procedures would lead to leaving the valvos DM-11 and DH-12 open, given that the next steps in the procedures (before raising the reactor pressure), require the operators to close thoso l valves and also to complete Attachment 12 of the startup procedure; that attachment refers to two independent verifications to check that those valves aro closed. It seems to me that thift was not considered in the NRA ET presented in pages E-65 and E-66.

Note that the same is true f or the case (in the HRA ET) in which the operators do not read the note 5.4.48 correctly.

4.b I do not understand why, given that the "RO correctly performs DHR valve lineup" (event t in HKA ET of page E-66), the valves are lef t in the open position if the Ro and the sRo "f ail to -

verify bi-stable light goes out." Given that the valves are correctly line-up they will not change position if the Ro and 3Ro fail to verify the light. Also, here, the next stop in the procedures is to perform Attachment 12 of that procedure (same as described above) . I do think that this event tree needs to be completely modified.

4.c In all ISLOCA event trees presented in Appendix D, the

" operators failure to detect an ISLOCA, correctly, leads directly to the question of mitigation of release. However, for the DHR Letdown (startup) ISLocA event tree, even if the operators f ail to detect the IS&oCA they can still correctly diagnose the event. I ~

do think that this is not correct. -

5. General comment I think that in order to be able to multiply the probabilities given in the branches of the event trees all values used need to be mean values.

I

l 4

Please note that all the above comments with exception to coraent 3.d were discussed in our yesterday meeting with 0. Burdick (NRC/RES) and the INEL representatives.

Saray, if you have any questions or need more information, please let ne know.

Since oly, ,

my _ -+

Na . A. Hanan M ,

.m a w;_ __.m. g_a -4 w-,s a _._ua.a.--a__-..L.u.s.#x._ w-_ m . . _ - - . _ ---_so...u- Ar

.- m..a._-A_ .a.%.-_.As .u, 4

e e r ,

. J

< d N

Iw k

i u

l l [

111 I

y E

N = < m. ion < =W <== = = ...

Glgs ml e <

T 4

• b

_., a  ; _.

Y

, $. T. .T T, C manas . _

N Y

E  ? "

I a 3 4

.** . 3

.s

=

u m.,,,

., .s. o

.4 i ( 3

• g . +s 9 Ol N e

b8 4 *o Ml

?~d i

A P

T[5

&hf w -

i4 l e .t 4 3 Sp a C s ,

8 4 2 b a .

f '

w d "

E .

5 3 C b '=

r

, - n C =

i

,. - . - . _ _ - - - - - _ _