ML20097F687
| ML20097F687 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 05/18/1995 |
| From: | Darby J, Jeffery Lynch, Thomas W SCIENCE & ENGINEERING ASSOCIATES, INC. |
| To: | NRC |
| Shared Package | |
| ML20097F332 | List: |
| References | |
| CON-NRC-04-91-066, CON-NRC-4-91-66 SEA-92-553-018, SEA-92-553-18, NUDOCS 9602200046 | |
| Download: ML20097F687 (34) | |
Text
. .. - . - . . . - . ..- .
SEA 92 553-018-A:3 May 18,1995 Cooper Technical Evaluation Report on the Individual Plant Examination Front End Analysis NRC-04-91-066, Task 18 l
1 John L. Darby James Lynch, Editor Willard Thomas, Editor Frank Sciacca, Editor l l
Science and Engineering Associatas, Inc.
l l
I Prepared for the Nuclear Regulatory Commission ENCLOSURE 2
~
9602200046 960214 PDR ADOCK 05000298 P PDR
1 .o . + .. ,
i
{ TABLE OF CONTEF A i
- E. E XE C UTIV E S U M M A RY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E.1 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E.2 Licensee's IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E.3 Front End Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 E.4 G e n e ric i s s ue s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 E.5 Vulnerabilities and Plant improvements . . . . . . . . . . . . . . . . . . . . . . 5 E.6 Ob se rvatio n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
- 1. I N TR O D U C TI O N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.1 ' Re view P rocess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.2 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
- 2. TEC H N IC AL R E VIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1 Lice n s e e's I P E P roce s s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1.1 Comoleteness and Methodoloov . . . . . . , . . . . . . . . . . . . . . 8 2.1.2 Multi-Unit Effects and As-Built As-Ocerated Status . . . . . . . . 8 2.1.3 Licensee Particioation and Peer Review . . . . . . . . . . . . . . . . 9 2.2 Accident Sequence Delineation and System Analysis . . . . . . . . . . . . 9 2.2.1 initiating Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
- 2. 2.2 E ve n t Tre e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.2.3 Syste ms An alvsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.2.4 System Deoendencies ............................ 15 1 2.3 Quantitative Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 2.3.1 Quantification of Accident Seouence Frecuencies . . . . . . . . . 16
'2.3.2 Point Estimates and Uncertaintv/ Sensitivity Analyses ...... 16 2.3.3 Use of Plsnt Soecific Data ......................... 16
- 2. 3.4 U s e of G e n e ric Da*= . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.3.5 Common Cause cuantification ...................... 17 2.4 I nte rface i s s ue s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 2.4.1 Front-End and Back-End interfaces . . . . . . . . . . . . . . . . . . . 18 J
2.4.2 H u man Factors Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . 19 ;
2.5 Evaluation of Decay Heat Removal and Other Safety issues . . . . . . . 19 2.5.1 Exa mination of DHR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.5.2 Diverse Means of DHR . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.5.3 Unioue Features of DHR . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.5.4 Other GSI/USI's Addressed in the Submittal . . . . . . . . . . . . . 20 2.6 Inte mal Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 I 2.6.1 Internal Flooding Methodoloov . . . . . . . . . . . . . . . . . . . . . . . 20 l 2.6.2 Internal Flooding Results .......................... 21 !
2.7. Core Damage Sequence Results . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2.7.1 Dominant Core Damage Seouences .................. 22 I
i
2.7.2 yuf ne rabilitie s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 i
2.7.3 Prooosed Imnrovements and Modifications . . . . . . . . . . . . . . 23 l
I 3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS ............... 26 I
- 4. DATA
SUMMARY
SHEETS ....................... ............ 27 l
REFERENCES................................................ 30 l
l l
l l
l i
I i
l i
l l
l l
l l
l l
l l
t 1
1 1
I l'
i 1
l' .
j li l
t I
~ .
LIST OF TABLES Table 2-1. Plant Specific Data 17 Table 2-2.' Top 5 Core Damage Sequences 24 i
l l
l l
I I
i l
l i
l
~
1 l
l ,
l i
I l
l .
j iil l
l j
l j-t _ _ -..- -.-..-._.- - --
E. EXECUTIVE
SUMMARY
This report summarizes the results of our review of the front-end portion of the individual Plant Examination (IPE) for Cooper. This review is based on information contained in the IPE submittal [lPE Submittal) along with the licensee's responses
[lPE, Responses] to a request for additional information (RAl).
E.1 Plant Characterization Cooper is a single unit site with one boiling water reactor (BWR) 4 reactor with a Mark I containment. Rated power is 2381 megawatt thermal (MWt) and 778 net megawatt electric (MWe). Burns and Roe was the architect engineer and constructor.
Design features at Cooper that impact the core damage frequency (CDF) relative to other BWR plants are as follows:
= No injection with diesel driven pumps - Some BWR plants can use diesel driven fire pumps to inject water for core cooling; the lack of such a capability at Cooper tends to increase the CDF.
- Four hour battery lifetime - The four-hour battery lifetime is less than that available at other plants and this tends to increase the CDF during station blackout, although the effect is limited due to failures of equipment from loss of containment cooling and suppression pool heatup.
- Two-inch diameter hardened containment vent - Installation of a hardened containment vent is planned but was not credited in the individual plant examination (IPE); the existing two-inch diameter vent is too small to prevent containment failure from overpressurization for accident sequences involving loss of containment heat removal. [lPE Submittal, Section 3.1.3.3.1.4) The lack of a containment vent tends to increase the CDF relative to plants which have credited continued use of the suppression pool for core cooling if containment cooling is lost but the containment is vented.
- Ability of two control rod drive (CRD) pumps to provide for core cooling - The two CRD pumps have sufficient injection capacity to provide for core cooling at shutdown if all other cooling systems are lost; failure of containment does not impact the ability to inject with CRD. This tends to decrease the CDF.
E.2 Licensee's IPE Process The IPE is a level 2 probabilistic risk assessment (PRA). The freeze date for the IPE model was December 31,1989. The IPE credited improved procedures for responding to loss of service water which were instituted after the freeze date.
1
f Nebraska Public Power District (NPPD) staff participated in all phases and tasks of the l' IPE. At least 50% of the fault trees were produced in-nouse by licensee staff.
Development of the success criteria was led by the licensee, with assistance from
, Science Applications International Corp. (SAIC). The identification of initiating events and recovery modeling was accomplished jointly among NPPD and SAIC staff. '
Three walkdowns were performed, involving utility and SAIC staff. The first walkdown documented plant specific features that could affect the progression of severe accidents. The second walkdown provided information for modeling of systems. The third walkdown was in support of the analysis of intemal flooding.
Major documentation used in the IPE included: the Updated Final Safety Analysis Report (UFSAR), station procedures, technical specifications, plant drawings, General Electric (GE) specifications, NUREG reports, Nuclear Engineering Design Organization (NEDO) reports, and calculations.
A three tier review process was used in the IPE. The three reviews were: intemal reviews by NPPD and SAIC staff; review by staff at the plant and at the utility general office; and third party review by ERIN Engineering and Research Inc. (ERIN).
The submittal states that the licensee intends to maintain a "living" PRA.
E.3 Front-End Analysis The methodology chosen for the Cooper IPE front-end analysis was a Level i PRA; the small event tree /large fault tree technique was used and quantification was <
performed with the Cut Set and Fault Tree Analysis (CAFTA) computer code. I Twenty internalinitiating events were evaluated. These initiating events can be categorized into the following groups: 6 loss of coolant accidents (LOCAs),5 generic transients, and 9 plant specific initiating events.
Loss of instrument air was considered as an initiating event. Loss of heating,,
ventilating, and air conditioning (HVAC) was not considered as an initiating event, based on an evaluation of the impact of loss of HVAC systems.
The criterion for core damage was fuel temperature in excess of i800 F when modular accident analysis program (MAAP) calculations were used.
System level success criteria were based on: the UFSAR, existing calculations, and MAAP analyses.
Support system dependencies were modeled in the fault trees. Tables of inter system dependencies were provided.
2 1
I
The IPE used plant specific data wherever possible for components judged to be most i important to preventing core damage. Plant specific data were used for test and maintenance unavailabilities. The data used in the IPE were consistent with data used in typical IPE/PRAs.
The beta factor method of NUREG/CR-4550 was used to model common cause failures. Common cause failures were modeled within systems. Generic data from EPRI NP-3967 and other standard sources were used to quantify common cause failures.
The IPE did not quantify the CDF from internal flooding; instead the IPE evaluated a l previous 1987 study of Cooper performed by Sandia National Laboratories i
[NUREG/CR 4767). The IPE concludes that the CDF from internal flooding is on the order of or less than 1E-6/yr.
i The total mean CDF from internal initiating events, excluding internal floooing, was calculated to be 7.97E-5/yr.'
Initiating events contributing the most to the overall CDF were:
I loss of offsite power turbine trip loss of all service water '
loss of instrument air.
Important hardware failures and operator errors contributing to the CDF were:
1 diesel generator hardware failures high pressure coolant injection (HPCI) hardware failures j reactor core isolation cooling (RCIC) hardware failures ;
common cause failures of 4 service water (SW) pumps ;
operator failure to use SRVs )
common cause failure of SRVs.
The dominant classes of accidents contributing to the total CDF are as follows: ,
l station blackout 34.8 % i transient induced LOCAs 30.3 %
l
' Upon further review of accident sequences in conjunction with the Level 2 portion of the analysis, the licensee determined that one of the dominant core damage scenarios initiated by total loss of service water in fact does not likely lead to core damage as originally predicted in the Levet 1 analysis.
A sensitivity study showed that elimination of the associated sequences reduces the CDF estinate to 7.10E-05/yr.
l
loss of coolant injection 18.1%
loss of containment heat removal 10.9%
Anticipated transient without scram (ATWS) . 4.9%
LOCAs 0.9%
8 fast containment failure 0.1 %
Level 1 core damage sequences were binned into Plant Damage States (PDS) for subsequent back end analysis. The binning criteria were consistent with typical PRA/IPE practice.
Based on our review, the following modeling aspects have an impact on the overall CDF:
=
the use of CRD to mitigate transient and ATWS events a
suppression pool lost at 200 deg F as source of water for core cooling The first modeling aspect decreases the CDF. The licensee states that without credit for CRD to provide core cooling, the CDF would increase by 9%. The second modeling aspect tends to increase the CDF since it leads to the inability to use the suppression pool for long term core cooling for any sequence involving loss of containment cooling.
E.4 Generic issues The IPE specifically addressed loss of decay heat removal (DHR), considering DHR as both core cooling and ultimate heat removal. Loss of containment heat removal sequences contributed 7.74E-6/yr to the CDF.
The Section on DHR in the submittal qualitatively addresses other aspects of DHR concluding that the major coritributors to loss of DHR are station blackout and !oss of injection accidents, important DHR system / action failures are: HPCI failures, RCIC failures, stuck open SRVs, failure to depressurize, diesel generator failures, loss of offsite power, turbine trip, and loss of service water. No vulnerabilities or cost-effective improvements were identified in conjunction with the DHR assessment.
The submittal states that the IPE does not resolve any other generic safety issues / unresolved safety issues (GSI/USIs).
i
- Fast containment failure results from a condition where an SRV tallpipe has broken off above the torus water line and the SRV has stuck open. As a result, steam is released directly to the torus air i
space instead of to the torus water. [lPE Submittal, Page 3-739).
t .
- 4 l i
E.5 Vulnerabilities and Plant improvements The process described in Nuclear Management and Resource Council (NUMARC) document 91-04 was used to identify potential plant-specific vulnerabilities. No vulnerabilities were identified in the IPE.
The submittal discusses key insights from the IPE. Three of these insights are expected reductions in CDF based on the following changes to the IPE model:
a consideration of upgraded emergency operating procedures a load study to relax the assumed four-hour battery lifetime
The remaining insights are as follows:
- Nitrogen supply to the SRVs depends on AC power, a procedure to bypass the AC solenoid valve would reduce risks by insuring a pneumatic supply to the SRVs.
- Significant reduction in risk could be realized by providing a backup for the service water pumps.
- A diesel driven fire water pump or other similar source of low pressure water independent of AC power would provide a significant reduction in risk for station blackout scenarios.
The submittal states: "no modifications are planned based on these insights". The l reason given is that the IPE reflected the plant configuration as of December 31,1989 :
and that modifications based on these insights will be considered after the IPE is j updated to reflect the current status of the plant.
E.6 Observations We believe that the licensee analyzed the plant design and operations of Cooper to discover instances of particular vulnerability to core damage. The licensee has j developed an overall appreciation of severe accident behavior, understands the most likely severe accidents at Cooper, has gained a quantitative understanding of the overall frequency of core damage, and has implemented changes to the plart to help prevent and mitigate severe accidents.
1 Strengths of the IPE are as follows. The consideration of plant-specific initiating events in the IPE was especially thorough in comparison to some other PRA/IPE studies. The core cooling / containment cooling interface is explicitly addressed. l l
No shortcomings of the IPE were identified. I i
5 'l l
_ .~. . . _ . _
Significant level-one IPE findings are as follows: ,
- Station blackout dominates the CDF; dominant contributors to station blackout include the loss of HPCI due to loss of room cooling, and loss of RCIC due to battery depletion at four hours.
Transient induced LOCAs resulting from open SRVs contribute significantly to the total CDF; dominant contributors include the failure of HPCI and failure to '
depressurize quickly enough to allow core cooling with low pressure emergency core cooling system (ECCS) pumps.
- All cooling using the suppression pool is lost after loss of containment neat removal when the suppression pool heats up to 200 deg F.
t t
6 l
l
.o -
o
- 1. INTRODUCTION 1.1 Review Process This report summarizes the results of our review of the front end portion of the IPE for Cooper. This review is based on information contained in the IPE submittal [lPE Submittal) along with the licensee's responses [lPE, Responses) to a request for additional information (RAI). J 1.2 Plant Characterization l
Cooper is a single unit site with one BWR 4 reactor with a Mark I containment. Rated ;
power is 2381 MWt and 778 MWe (net). Burns and Roe was the architect engineer l and constructor. The unit achieved commercial operation in 1974. Similar units in i operation are: Brunswick and Hatch. l Design features at Cooper that impact the CDF relative to other BWR plants are as follows:
- No injection with diesel driven pumps - Some BWR plants can use diesel driven fire pumps to inject water for core cooling; the lack of such a capability at Cooper tends to increase the CDF.
- Four hour battery lifetime - The four hour battery lifetime is less than that available at other plants and this tends to increase the CDF during station -
blackout, although the effect is limited due to failures of equipment from loss of containment cooling and suppression pool heatup.
- Two-inch hardened containment vent - Installation of a hardened containment vent is planned but was not credited in the individual plant examination (IPE); '
the existing two inch vent is too small to prevent containment failure from overpressurization for accident sequences involving loss of containment heat removal. [lPE Submittal, Section 3.1.3.3.1.4) The lack of a containment vent tends to increase the CDF relative to plants which have credited continued use of the suppression pool for core cooling if containment cooling is lost but the containment is vented.
- Ability of 2 CRD pumps to provide for core cooling - The 2 CRD pumps have sufficient injection capacity to provide for core cooling at shutdown if all other cooling systems are lost; failure of containment does not impact the ability to inject with CRD. This tends to decrease the CDF.
7 l
l
- 2. TECHNICAL REVIEW )
2.1 LJcensee's IPE Process We reviewed the process used by the licensee in the IPE with respect to:
compkteness and methodology; multi-unit effects and as built, as-operated status; and licensee participation and peer review.
2.1.1 Comoleteness and Methodoloov.
The Cooper IPE is a level 2 PRA. The submittal is complete in terms of the overall requests of NUREG 1335.
We assessed the methodology employed in the front-end portion of the IPE. The a
front-end portion of the IPE is a level i PRA. The specific technique used for the level 1 PRA was a small event tree /large fault tree technique and it was clearly described in the submittal. Support systems were modeled in fault trees and accident sequences were solved by fault tree linking. System descriptions were provided. Tables of inter-systeen dependencies were provided. Data for quantification of the models were provided, including common cause data. Uncertainty and sensitivity analyses were perfamned.
The PRA upon which the IPE is based was initiated in response to Generic Letter 88-
- 20. [lPE Submittal, Section 1.3.1]
2.1.2 Mutti-Unit Effects and As-Built As-Ocerated Status.
Cooper is a single unit site.
The iPE is a level 2 PRA. The freeze date for the IPE model was December 31,1989.
The IPE credited improved procedures for responding to loss of service water, which were instituted after the freeze date.
Three walkdowns were performed, involving utility and SAIC staff. [lPE Submittal, Sectican 2.4.3) The first walkdown documented plant specific features that could affect the progression of severe accidents. The second walkdown provided information for modeling of systems. The third walkdown was in support of the analysis of internal flooding.
Major documentation used in the IPE included: the UFSAR, station procedures, technical specifications, plant drawings, GE specifications, NUREG reports, NEDO reports, and calculations.
8 1
I
The submittal states' that the licensee intends to maintain a 'living" PRA. [lPE Submittal, Section 5.3) 2.1.3 Licensee Particioation and Peer Review.
The IPE was performed by NPPD with support from SAIC. [lPE Submittal, Section 1.3.1) The submittal states that NPPD staff participated in all phases and tasks of the IPE.
At least 50% of the fault trees were produced in-house by licensee staff. Development of the success criteria was led by the licensee, with assistance from SAIC. .The
, identification of initiating events and recovery modeling was accomplished jointly among NPPD and SAIC staff.
J A three tier review process was used in the IPE. [lPE Submittal, Section 1.3.1) The three reviews were: internal reviews by NPPD and SAIC staff; review by staff at the plant and at the utility general office; and third party review by ERIN.
2.2 Accident Sequence Delineation and System Analysis This section of the report documents our review of both the accident sequence delineation and the evaluation of system performance and system dependencies provided in the submittal.
2.2.1 - Initiatina Events.
9 We reviewed the initiating events, both internal and intamal flooding, considered in the IPE. Dependencies among initiating events and mitigative functions were reviewed.
The completeness of the set of initiating events was reviewed. The consideration of plant specific initiating events was reviewed, including the use of plant historical operating experience. The point estimate frequencies assigned to the initiating events were reviewed.
The identification of initiating events considered both generic and plant specific events.
[lPE Submittal, Section 3.1.1) Initiating events were identified using: EPRI NP-2230,
~
plant operating history, and analyses of plant specific support systems. j l
Twenty internal initiating events were analyzed in the IPE model to quantify core i damage. [lPE Submittal, Table 3.1.1-14) These initiating events can be categorized into the following groups: 6 LOCAs,5 generic transients, and 9 plant-specific initiating events.
The following plant-specific initiating events were quantified for core damage: loss of service water; loss of reactor building closed cooling water (RBCCW); loss of turbine o
9 G
t building closed cooling water (TBCCW); loss of instrument air; loss of 4160 V AC bus 1F; loss of 4160 V AC bus 1G; loss of no break power (NBP) panel; loss of 125 V DC Bus 1 A; and loss of 125 V DC Bus 18. [lPE Submittal, Section 3.1.1.2)
The IPE considered loss of HVAC systems as initiating events. [lPE Submittal, Section 3.1.1.2.2] Loss of HVAC in the following areas was considered: intake structure, ECCS pump rooms, diesel generator rooms, and control building. Loss of HVAC is not a potentialinitiating event in the ECCS pump rooms or in the diesel generator rooms, since the systems in these rooms are in standby during operation at power and the heat loads are negligible. Past history and analyses have shown that HVAC in the intake structure can be lost without affecting immediate plant operation, allowing time for compensatory actions for room cooling or controlled shutdown of the unit. Loss of HVAC in the control building can be compensated for with a portable ventilation system. Loss of HVAC in the steam tunnel and loss of HVAC in the turbine building ware retained as valid initiating events; they were lumped into the T, transient initiating event category, which is a transient with associated loss of the power conversion system. [lPE Submittal, Section 3.1.1.2.1]
Less of 250 V DC does not lead to reactor trip so this event was not retained as a special initiating event. [lPE Submittal, Section 3.1.1.2.2]
Two types of typical transient initiating events were stated to not be applicable for Cooper, these being: Decrease in Recirculation Flow, and Trip of One Recirculation Pump. [lPE Submittal, Table 3.1.1-2]
Table 3.1.1-14 of the submittal summarizes the point estimate frequencies assigned to the initiating events. Section 3.3.2.3 of the submittal documents the assignment of values to the initiating events. These values are consistent with other BWR lPE/PRA studies; also, the incorporation of plant specific data appears appropriate. It is interesting to note that the small-small LOCA was quantified with plant specific data.
The frequency of an interfacing system LOCA (ISLOCA) including component overpressure failure ranges from 10"/yr to 10'*/yr.
Table 3.1.1-14 has the same frequency,0.0943/yr, for all of the following initiating events: Loss of Feedwater, inadvertent Open Relief Valve, Loss of instrument Air, and Smal!-Small LOCA; the error factor for each event is 9.6. Each of these events has occurred one time at the plant and use of this plant specific failure history provides the same frequency for each of these events. [lPE, Responses) 2.2.2 Event Trees.
Each accident initiating event was included in an appropriate class of initiating events, and each class of initiating events had a corresponding event tree logic model. All 10
1 '
o .
1 l l functions or systems important to the accident sequences were considered. The-
{
interfaces among the events in the event tree logic models and the corresponding mitigating systems were clearly indicated. The event tree logic models accounted for:
time ordered response, system level dependencies, sequence specific effects on system operaoility-such as environmental conditions, and high level operator actions as appropriate.
J The IPE used systemic event trees to quantify accident sequences. The event tree . l models are consistent with models used in typical IPE/PRAs. The following discussion addresses specific aspects of the event tree models noted as important during our review.
An 1800 F fuel temperature was used as the definition of core damage when MAAP calculations were performed.
The IPE assumed that 3 SRVs are required for depressurization to allow use of low '
pressure core cooling systems for transients in which all high pressure core cooling is lost. If only 2 SRVs are available, the slower rate of vessel depressurization does not a!!ow pressure to drop below the shutoff head of the low pressure pumps prior to core damage. [lPE, Responses]
The success criteria for a large LOCA states that one LPCI pump can provide sufficient core cooling. Long term cooling of the uncovered portion of the fuel without core spray is questionable since the steaming rate decreases leading to less steam cooling of the uncovered fuel. An IPE submittal for another BWR identified this as an item of potential significance. This particular item was not specifically addressed in the Cooper IPE. ;
The small LOCA event tree success criteria state that RCIC is sufficient for injection for the largest small break LOCAs: 0.005 sq ft water break and 0.1 sq ft steam break.
[lPE Submittal, Table 3.1.2-5) The success criteria in the IPE for either a small LOCA or for a transient do not model the requirement to close main steam isolation valves
-(MSIVs) if cooling is provided using the suppression pool with low pressure coolant injection (LPCI)'or core spray (CS). [lPE Submittal, Tables 3.1.2-5 and 3.1.1-16]
Without closing of the MSIVs, recirculation from the suppression pool is lost due to flow out the open steam lines. However, failure to isolate is a very low probability event due to the presence of two MSIVs in each steam line and the presence of other downstream isolation valves. [lPE, Responses) l The success criteria for a transient indicate that injection with 2 CRD pumps can '!
provide core cooling. [lPE Submittal, Table 3.1.1-16) Without credit for CRD for core '
cooling the total CDF would increase by about 9%. [lPE, Responses) Long term room i cooling for the CRD pumps was not required in the IPE based on engineering judgment by the licensee. The CRD pumps provide recirculation pump seal cooling i 0
11
i 0 .
l and for scenarios in which makeup to the vessel with CRD is credited, cooling to the recirculation pump seals would also occur. The CRD has no automatic containment isolation valves; this supports the assumption that CRD can be used for long term !
core cooling without any containment cooling.
For transient sequences with loss of containment cooling, the model assumes that RCIC and HPCI could be available until about four hours, when the suppression pool I temperature reaches 200 deg F. The submittal states that RCIC trips at a high l backpressure of only 20 psig. A MAAP calculation for station blackout indicated that '
the 200 deg F temperature condition was reached prior to the 20 psig condition. ,
The event trees used in the IPE contain numerous " core vulnerable" end states.
These are' outcomes for which the system modeling was extended beyond the initial l success criteria to determine whether or not core damage occurred. l The IPE assumes that CS, LPCI, HPCI, and RCIC pumps fail if the suppression pool l temperature reaches 200 deg F due to (a) lack of adequate NPSHA for pumps, and/or (b) excessive temperature of fluid for self cooling of seals and bearings. HPCI and RCIC will auto-isolate on high turbine exhaust pressure, determined by the torus ;
airspace pressure. HPCI isolates at 135 psig [lPESubmittal, Section 3.2.1.4.6] RCIC l isolates at 20 psig. [lPE Submittal, Section 3.2.1.8.6] HPCI is lost if steam pressure j for driving the turbine drops below 115 psig. [lPE Submittal, Section 3.1.2.2.2.1] RCIC i is lost if steam pressure for driving the turbine drops below 65 psig. [lPE Submittal, Section 3.1.2.2.2.1]
The submittal states: "The study assumes that all injection to the RPV is lost when I suppression pool temperature exceeds 200 deg F". [lPE Submittal, Section 1.4.1] This statement is slightly misleading. For example, for transient and LOCA sequences in which the suppression pool reaches 200 deg F, the event trees denotes the outcome as " core vulnerable" not " core damage". The actual assumption used is that at 200 deg F all systems usina the suooression cool as a source of water are unavailable for injection. For such " core vulnerable" sequences, the IPE evaluates other long term cooling options as discussed in Section 3.1.3.3 of the submittal. For large and intermediate LOCAs, " core vulnerable" sequences involving loss of containment cooling (suppression pool heatup) are further evaluated as " group 13" sequences. [lPE Submittal, Section 3.1.3.3] For transient " core vulnerable" sequences involving loss of containment cooling, the sequences are further evaluated as " group 4" sequences. 1
[lPE Submittal, Section 3.1.3.3] In evaluating both of these groups, the IPE assumes i that core injection systems pulling from the suppression pool fail at about four hours due to loss of net positive suction head (NPSH).
For transient sequences in which the suppression pool heats up to 200 deg F, the IPE j takes credit for cooling with 1 CRD pump, starting at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. We evaluated the ability of 1 CRD pump to cool the core starting at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; our scoping calculations indicate ll 12
that the core can be maintained covered. With injection from CRD but with no containment cooling, the containment will fail by overpressurization; the two inch vent is too small to prevent overpressurization. The IPE states that containment failure does not result in loss of CRD injection. [lPE Submittal, Section 3.1.3.3.1.4)
For sequences involving loss of containment cooling, external injection with low pressure systems, such as service water crosstie or condensate, cannot be used indefinitely. Without a hardened containment vent, containment will fall by overpressure, but prior to failure the SRVs will close due to high pressure resulting in re-pressurization of the RCS. Without the SRVs maintained open, low pressure injection systems cannot be used. [lPE Submittal, Section 3.1.3.3]
In the system description for CRD, the submittal states that 1 CRD pump can provide core cooling after 1.5 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. [lPE Submittal, Section 3.2.1.2.1]
In the event tree model for ATWS, two " core vulnerable" sequences were analyzed further. [lPE Submittal, Sections 3.1.3.3.1.15 and 3.1.3.3.1.16] One sequence involved mechanical failure of the RPS (apparently excluding mechanical binding of rods) to trip followed by failure to inject with the standby liquid control (SLC) system but with successful level control and use of the power conversion system. For this sequence, the additional analysis credited operator initiated insertion of control rods,~ assigning a probability for failure of this action of 8E-4. The submittal states that failures causing
- both failure to scram and failure to allow manual insertion of rods is highly unlikely.
' The second " core vulnerable" sequence for ATWS involved successful injection with SLC, but loss of suppression pool due to high temperature. The follow on analysis credits the use of CRD pumps. In effect, this is a sequence similar to a transient with reactor trip in which CRD injection is used, since success of SLC terminates power production except for decay heat generation.
The A1WS event tree models the use of SLC to terminate power production. [lPE Submittal, Figure 3.1.3-2] The description of this event does not indicate whether one or two SLC pumps are required, however the system description in Section 3.2.1.11.2 i of the submittal states that both SLC pumps must be started within 22 minutes. PRA studies of some other similar BWRs have assumed that SLC injection must be started within significantly shorter time periods (order of several minutes) to ensure success.
Finally, it is noted that a number of event tree sequences were screened out due to recovery actions. The top sequences screened by this process are listed in Table 3.4.1-5 of the submittal. The screened sequences are associated with various special initiating events, for example loss of 125 VDC and loss of 4,160 VAC.
13
i* .
1 i 2.2.3 Svstems Analvsis.
i^
' . System descriptions are included in Section 3.2 of the submittal. The system--
descriptions include simplified schematics. Our comments on the system descriptions are as follows.
The IPE credits one RHR heat exchanger as sufficient for containment heat removal to
- support core cooling. The results of testing heat exchanger thermal efficiency for j response to Generic Letter 89-13 indicate that the actual fouling is less than the i design fouling factor.
l i : The submittal provides a description of the 1E electrical power system. [lPE Submittal, i
Section 3.2.1.12] Table 3.2.1.12-1 of the submittal summarizes the design basis accident loads on a diesel generator, both automatically loaded and after manual
- action at 10 minutes. This table indicates that 2 RHR pumps are automatically loaded, f but that only 1 RHR pump is stillloaded at 10 minutes. At 10 minutes, the UFSAR
! safety analysis assumes that containment cooling is manually initiated. This is
- reflected in Table 3.2.1.12-1 of the submittal in that at 10 minutes the loads include ,
l 1 one service water booster pump. The total dieselload at 10 minutes as specified in
- the table is 4038 kW. If the second RHR pump remained powered by the diesel the additional load would be 858 kW, using 1150 HP for an RHR motor as specified on
, page Vill-5-5 of the UFSAR. Th!s would bring tM totalloading on the diesel generator i i to 4896 kW, which is in excess of the 4000 kW continuous rating and is in excess of ,
j the 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> per year overload capacity of 4700 kW as specified in Table Vill-5-3 of l j the UFSAR. This steady state discussion does not consider transient effects on the l
- diesel generator as it is loaded. The information in the submittal and in the UFSAR i imply that at 10 minutes after a design basis accident, if both RHR pumps are running i
one is to be turned off to allow containment cooling to be initiated without overloading the diesel generator. (Note: Some other BWRs of similar vintage have restrictions on diesel generator loading that require such actions.)
{ Based on the system description for electrical power, the IPE did not credit crosstie of a diesel generator to drive loads in the opposite division.
The submittal states that CRD requires non-essential RBCCW for pump oil and bearing cooling. [lPE, Submittal Table 3.1.1-4 and Section 3.2.1.2.5) i
~
The submittal contains a discussion of HVAC systems and the impact of loss of these systems on the ability to mitigate accidents. [lPE Submittal, Section 3.2.1.13] The
{ submittal states that control room HVAC is not required based on the UFSAR.
The IPE assumes that room cooling for the CRD pumps is not required. [lPE j Submittal, Section 3.2.1.2.5) As previously discussed in Section 2.2.2 of this report,
- room cooling for the CRO pumps is not required over the long term.
. i 14 a a i
i
~ - ,. - . . . - . - , . . - --- -
Section 3.2.1.13.1 of the submittal states that HVAC for the turbine building is included in the model for power conversion system components.
The submittal states that the trip setpoint for high turbine exhaust pressure on the RCIC turbine is 20 psig. [lPE Submittal, Section 3.2.1.8.6) This indicates that the plant has not implemented the 1982 SIL from General Electric that recommended -
raising this trip setpoint to 50 psig to enhance RCIC availability during small break LOCAs. [GE SIL # 371)-
The IPE assumed that the MSIVs drift closed on loss of air, due to leakage in the accumulators. [lPE Submittal, Section 3.2.1.6.5) The UFSAR states that following a LOCA, the inboard MSIVs require air to remain closed. [UFSAR, Section IV-6) r To maintain the SRVs open in the relief mode nitrogen or air is required; accumulators are provided. [lPE Section 3.2.1.5.5) The nitrogen supply system requires non safety related 480 V AC power for vaporizer tank heaters. [lPE Submittal, Section 3.2.1.15.5)
The model for DC power in the IPE uses a four-hour battery lifetime during sequences in which AC recharge capability is lost. [lPE Submittal, Section 3.1.2.2.2.1)
The IPE credits use of CRD for core cooling. The normal supply of water for CRD is from the condensate storage tank (CST) with backup suction from the demineralized water storage tank which requires manual alignment to supply CRD. (IPE Submittal, Section 3.2.1.2.3) If CRD is used to supply 160 gpm for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time, the total amount of water required is 230,000 gal. Section XI-9.3 of the UFSAR states that two CSTs are available with capacities of 450,000 and 700,000 gal respectively.
This information indicates that to use CRD over the long term, makeup from the demineralized water tank is not required.
2.2.4 System Deoendencies. ,
The submittal provides a discussion of system interdependencies in Section 3.2.3.1.
Tables are provided indicating the dependence of front line systems on support systems, and the dependence of support systems among one another. [lPE Submittal, Tables 3.2.3-1 and 3.2.3-2) The system descriptions provided in Section 3.2 of the submittal discuss the system dependencies and indicate where various dependencies were assumed to not be important.
1 All the expected dependencies are identified in the IPE, such as: DC power for AC power electrical switchgear, cooling for pumps / motors seals and oil, room coolers for equipment such as LPCI, CS, and HPCI, and air / nitrogen for air operated valves. The IPE did model a number of subtle dependencies such as non-safety grade power for the vaporizer heaters in the nitrogen system.
15 ,
i l
l l
l
.- . . - - . . - - . _ . - -- . - . . . - . - - . - - . - - - = - -- -
2.3 ' Quantitative Process This section of the report summarizes our review of the process by which the IPE quantified core damage accident sequences. It also summarizes our review of the data base, including consideration given to plant specific data, in the IPE. The uncertainty and/or sensitivity analyses that were performed, if any, were also reviewed.
2.3.1 Quantification of Accident Secuence Frecuencies.
The Cooper IPE used the small event tree /large fault tree model with fault tree linking for quantifying core damage. [lPE Submittal, Section 3.3.7) Support systems were modeled in fault trees. The CAFTA code was used to quantify accident sequences. A mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was used. The truncation value for the final quantification of sequences was 1E-8/yr. [lPE Submittal, Page 3-718] The truncation value used for accident sequence cut sets was not stated. Common cause failures were modeled directly in the fault trees.
2.3.2 ~ Point Estimates and Uncertaintv/ Sensitivity Analvses.
Mean values were used for point estimate failure frequencies and probabilities.
An uncertainty analysis was performed on the top 108 core damage sequences by ,;
combining distributions applied to failure probabilities. [lPE Submittal, Section 3.3.7.4]
A sensitivity analysis was performed on 15 topics by varying the point estimate failure probabilities in the previously calculated cut sets. [lPE Submittal, Section 3.3.7.3.5]
2.3.3 Use of Plant Soecific Data.
The IPE used plant specific data to quantify component failures whenever possible, as dictated by the availability of information. [lPE Submittal, Section 3.3.2.2) The data base used was from 1985 to 1989.
Table 3.3.2-1 of the submittal summarizes the plant specific data used for hardware failures and test / maintenance faliures.
We performed a spot check of the plant specific data as compared to NUREG 1150 data used for Peach Bottom; the results are given in Table 2-1. ,
16 s
Table 2-1. Plant Specific Data Component IPE Submittal Point Point Estimate for Peach Estimate Bottom from NUREG 1150 Diesel Generator 6E-3 fail to start' 3E-3 fall to start' 7E-3 fail to run* 2E-3 fail to run" P
Motor Operated Valve 1E-3 fall to open' (typical 3E-3 fail to open' value)
Motor Driven Pump 5E-3 fall to start' (RHR) 3E-3' (RHR)
Turbine Driven Pump 4E-2 fall to start' (HPCI) 3E-2 fall to start'(HPCl) 9E-2 fail to run' (RCIC) SE-3 fall to run' (RCIC)
' probability of failure on demand 8
frequency of failure per hour Based on this spot check, the plant specific data appear to be comparable with the data used in other IPE/PRAs.
2.3.4 Use of Generic Data.
The IPE used generic data for component failures wherever plant specific data were not available. The submittal provides the generic data base. [lPE Submittal, Table >--
3.3.1-3] We reviewed the generic data base and found it consistent with generic data used in other studies.
The major source for generic data was NUREG/CR-4550, but other sources such as IEEE Std 500 and NUREG/CR-2728 were also used.
2.3.5 Common Cause Quantification.
The basic approach for common cause modeling was that o' REG /CR-4550. [lPE Submittal, Section 3.3.4] Common cause failures were explicitly included in the system fault trees. Systems were reviewed for 'like' components and common cause failures for these components within a system were modeled.
The submittal states that the following list of components were candidates for common cause modeling:
reactor trip breakers diesel generators motor operated valves (MOVs) air operated valves (AOVs)
SRVs l
17 1
l l
I
l l pumps chillers fans batteries. I i
1 Common cause events were quantified with the beta factor method o? NUREG/CR- l 4550 using generic data. The main sources for the common cause data were EPRI-NP-3967, NUREG/CR-4780, NUREG 0666, and NUREG/CR-4550. Table 3.3.4-1 of
) the submittal provides beta factors used in the quantification. We reviewed these beta factors and found them to be consistent with values typically used in IPE/PRAs. l Selected components not in the generic data base, such as accumulators for ADS actuated SRVs, were assigned a beta factor of 0.1. This is a typical beta factor that is suitable to account for common cause failures, l i
- Common cause failures of circuit breakers and buses were not specifically modeled in !
the IPE. [lPE, Responses] '
9 2.4 Interface issues This section of the report summarizes our review of the interfaces between the front-
. end and back-end analyses, and the interfaces between the front-end and human
, factors analyses. The focus of the review was on significant interfaces that affect the ability to prevent core damage.
. 2.4.1 Front-End and Back-End Interfaces.
The IPE addressed the most important interface between the front-end and the back-and, that being the dependence of core cooling on containment cooling. The IPE assumed that allinjection from the suppression pool is lost if the suppression pool
, temperature reaches 200 deg F, due to loss of adequate NPSHA and/or loss of self cooling for seals and bearing oil. The submittal also notes that the steam supply to l RCIC is auto-isolated on a high turbine backpressure of 20 psig.
For those accident sequences involving loss of suppression pool pumping sources due to loss of containment heat removal, the IPE considers the end state to be " core vulnerable" and further analyses are performed. The additional modeling considers the use of water sources that do not require use of the suppression pool, such as CRD, service water crosstle for injection, and condensate supply.
CRD can cool the recirculation pump seals and CRD is not isolated by the containment isolation system.
4 2
18 N
, - ~ - ,,
Plant damage States (PDSs) were used to bin together similar core damage accident sequences for subsequent analysis by the containment event tree for the level 2 portion of the PRA. [iPE Submittal, Sections 3.1.5 and 4.3) Table 3.1.51 of the.
submittal discusses the criteria used for the binning. These criteria for binning of the core damage sequences into PDSs are consistent with the factors typically used in other IPE/PRAs for binning of core damage sequences. Seven final PDSs were analyzed in the level 2 part of the PRA. [lPE Submittal, Table 4.3-1]
2.4.2 Human Factors Interfaces.
Based on our front-end review, we noted the following operator actions for possible consideration in the review of the human factors aspects of the IPE:
manualinitiation of containment cooling shedding an RHR pump off a DG when containment cooling is initiated
. manual depressurization with the SRVs e
level control with HPCI or RCIC -
block MSIV closure for small break LOCAs
. implement core cooling with CRD.
. Initiation of SLC injection following ATWS a implement core cooling with service water cross tie a manual insertion of control rods during ATWS.
2.5 Evaluation of Decay Heat Removal and Other Safety lasues This section of the report summarizes our review of the evaluation of Decay Heat Removal (DHR) provided in the submittal.
2.5.1 Examination of DHR.
The submittal discusses decay heat removal (DHR) in a broad sense in Section 3.4.2 of the submittal. This section points out that the entire IPE focused on DHR and hence automatically addresses DHR issues.
The submittal quantitatively discusses only loss of containment heat removal DHR failures in the DHR section of the submittal. [lPE Submittal, Section 3.4.2.7] For loss of containment heat removal following transient initiated events, denoted as TW sequences, the submittal states that the CDF is 7.74E-6/yr.
The Section on DHR in the submittal qualitatively addresses other aspects of DHR concluding that the major contributors to loss of DHR are station blackout and loss of injection accidents. Important DHR system / action failures are: HPCI failures, RCIC failures, stuck open SRVs, failure to depressurize, diesel generator failures, loss of offsite power, turbine trip, and loss of service water.
19
5 No vulnerabilities or cost-effective improvements were identified in conjunction with the DHR assessment.
2.5.2 Diverse Means of DHR.
The submittal discusses the various options for providing DHR. The standard techniques for core cooling were evaluated, such as: use of the PCS, RCIC, use of ECCS, and depressurization with SRVs. Also, unusual methods of core cooling were evaluated, such as: cooling the core with the CRD system alone, and using service water crosstie to LPClior providing core cooling.
2.5.3 Uniaue Features of DHR.
The unique features at Cooper that directly impact the availability to provide DHR are as follows:
a no injection with diesel driven pumps e four-hour battery lifetime a no hardened containment vent ability of 2 CRD pumps to provide for core cooling.
The impact of these design features on CDF is discussed in Section 1.2 of this report.
2.5.4 Other GSI/USI's Addressed in the Submittal.
No other GSI/USI's were stated to be resolved by the IPE. [lPE Submittal, Section 3.4.3]
2.6 Intemal Flooding We reviewed the process by which the IPE modeled core damage from internal flooding, and we reviewed the results of the internal flooding analysis.
2.6.1 Internal Flooding Methodologv.
No special model for intamal flooding was developed for the Cooper IPE. The IPE evaluated a previous 1987 study of Cooper performed by Sandia National Laboratories. (NUREG/CR 4767] Based on the evaluation of this study, the IPE concluded that there are no core damage accidents greater than 1E-6/yr due to internal flooding events. The study addressed both submergence and spray effects.
The IPE evaluated the assumptions in the 1987 study and concluded that the study
, was acceptable for the flooding portion of the IPE. As discussed in Section 3.3.8.2 of ;
l the submittal, the 1987 study did not address flooding via drains backing up.
I 20 l
l l
i
I i
However, a separate calculation performed by the licensee concluded that backflow would not result in water level exceeding the minimum safe operating levelfor equipment, particularly for the four comer pump rooms in the basement of the Reactor Building where the front line emergency systems are located. (IPE, Responses]
The IPE evaluated the potential flow of water into the ECCS corner rooms down stairwelis or unsleeved piping penetrations. Based on a calculation, it was concluded that flow through such openings would not result in water level exceeding the minimum safe operating level for the equipment in these rooms. (IPE, Responses]
Some other BWRs of the same vintage as Cooper have non-seismic water bearing lines routed over safety related electrical switchgear. At Cooper, no water pipes are located in the switchgear rooms, and that calculations indicate that inflow of water into the rooms from flooding events outside the rooms would not result in damage of equipment. [iPE, Responses]
In older BWRs of the vintage of Cooper, circuit breaker coordination was identified as having the potential for affecting safety, for example from inadequate bracing of switchgear to handle forces during momentary overload, to improper coordination of breakers, to designs where molded case circuit breakers (MCCB) feed MCCBs making coordination diifftcult. If protective devices are not coordinated, then a fault downstrearn can render the entire electrical supply unavailable due to trip of main feeder breakers. The Cooper flooding analysis did not specifically address lack of circuit breaker coordination. However, circuit breaker and fuse coordination is used at the plant so it is not likely that entire train (s) of electrical power would be lost due to localized flooding. [lPE, Responses]
2.6.2 Internal Floodino Resuits.
As previously discussed, the IPE did not quantify the core damage from intemal flooding. The NUREG/CR-4767 study was used as the internal flooding analysis for the IPE, The IPE evaluated this study and concluded that the CDF from internal flooding is on the order of or less than 1E-6/yr. (IPE Submittal, Section 3.3.8.51 2.7 Case Damage Sequence Results This section of the report summarizes our review of the dominant core damage sequences reported in the submittal. The reporting of core damage sequences-whether systemic or functional- was reviewed for consistency with the screening criteria of NUREG-1335. The definition of vulnerability provided in the submittal was reviewed. Vulnerabilities and enhancements to plant hardware and procedural modifications, as reported in the submittal, were reviewed.
21
. . , 1
.i e
2.7.1 Dominant Core Damaae Seouences.
The mean CDF was calculated to be 7.97E-5/yr.' The CDF to 5% confidence is 2.2E-5/yr and the CDF to 95% confidence is 2.01E-4/yr. [lPE Submittal, Section 1.4} The CDF from internal flooding was not quantified, but based on an evaluation of a previous study the IPE states that the CDF from internal flooding is expected to be on the order of or less than 1E-6/yr.
The dominant classes of accidents contributing to the total CDF are as follows, if the !
I service water scenarios noted in footnote (3) below are included: l station blackout 34.8 %
I i
transient induced LOCAs 30.3 % .
I loss of coolant injection 18.1 % l loss of containment heat removal 10.9%
anticipated transient without scram l 4.9% !
LOCAs 0.9% !
fast containment failure 0.1 %'
If the service water scenarios noted in footnote (3) are not included, the accident classes contributing to the CDF are as follows:
station blackout 39.0 %
transient induced LOCAs 34.0 %
loss of coolant injection 20.3 %
loss of containment heat removal 0.0%
anticipated transient without scram 5.5%
LOCAs 1.0%
fast containment failure 0.1 %
Dominant component failures and operator errors are listed in Section 1.4.3 of the i submittal as follows:
a diesel generator hardware failures 3
Upon further review of accident sequences in conjunction with the Level 2 portion of the analysis, the licensee determined that one of the dorninant core damage scenarios initiated by total loss of service water in fact does not likely lead to core damage as originally predicted in the Level 1 analysis.
A sensitivity study showed that elirnination of the associated sequences reduces the CDF estimate to ,
7.10E-05/yr. [p. 3 782 of submittal] ;
- Fast containment failure results from a condition where an SRV tailpipe has broken off above the torus water line and the SRV has stuck open. As a result, steam is released directly to the torus air .
l spam instead of to the torus water. [lPE Submittal, Page 3-739).
22 o
l
- HPCI hardware failures
- RCIC hardware failures
= common cause failure of 4 SW pumps
- common cause failure of diesel generators e operator failure to use SRVs a common cause failure of SRVs.
p The initiating events contributing most to core damage are given in Section 3.4.1.1.2.2 as:
- loss _ of offsite power '
- loss of all service water
- loss of instrument air.
The submittal does not provide the CDF by initiating event.
Section 3.4.1.1.3.2 of the submittal summarize the top 25 CDF sequences which comprise about 88% of the total CDF. The top five dominant core damage sequences are summarized in Table 2-2 of this report.
The IPE submittal reported results using the systemic screening criteria of NUREG-1335. Table 3.4.1-3 of the submittal provides all the accident sequences above the ,
NUREG 1335 screening criteria for systemic sequences. .
2.7.2 Vulnerabilities.
NUMARC 91-04 was used to search for vulnerabilities. [lPE, Responses) Section 1.4.4.5 of the submittal states that there are no vulnerabilities.
2.7.3 Pronosed imorovements and Modifications.
The IPE identified dominant contributors to CDF as summarized in Section 2.7.1 of this report. Key insights are provided in Section 1.4.4 of the submittal; three of these insights are expected reductions in CDF based on the following changes to the IPE model:
a consideration of upgraded emergency operating procedures a load study to relax the assumed four-hour battery lifetime
The remaining insights are as follows:
23 c____. _. - . - - . .. - . - - - - . ,
4 ~pa e a.-un s.A 4.-.a..+.-2 4 4 *
- AE 4_. - .a _~ a-+s+4 - J A_d Table 2-2. Top 5 Core Damage Sequences initiating Event (Failures independent CDF in 1/yr and in due to initiating Event) Failures % of Total Loss of Offsite Power Loss of Onsite AC Power resulting in 1.45E-5/yr 18.2%
Station Blackout; Loss of HPCI due to loss of Room Cooling; Loss of RCIC due to Battery Depletion at Four Hours; Failure to Recover AC Power prior to Core Damage Loss of Offsite Power Loss of Onsite AC Power resulting in 1.06E-5/yr 13.3%
Station Blackout; Loss of HPCI due to loss of Room Cooling; Loss of RCIC; Failure to Recover AC Power prior to Core Damage Turbine Trip SRVs fall to Reclose; HPCI Fails; 8.22E-6/yr 10.3%
Failure to Depressurize sufficiently quickly to allow Core Cooling with Low Pressure ECCS Pumps Loss of all Service Water Core Cooling provided from CST; 7.82E-6/yr 9.8%
(loss of CRD; loss of Coolant injection eventually stopped containment cooling; to prevent Containment Overfill which eventual loss of results in Loss of Core Cooling suppression pool as source of cooling)
Inadvertent Open Relief Another SRV Fails Open; all High 6.57E-6/yr 8.2%
valve Pressure injection fails; Failure to Depressurize sufficiently quickly to allow Core Cooling with Low Pressure ECCS Pumps Nitrogen supply to the SRVs depends on AC power, a procedure to bypass the AC solenoid valve would reduce risks by insuring a pneumatic supply to the SRVs.
- Significant reduction in risk could be realized by providing a backup for the service water pumps.5 l
s As noted earlier, the licensee deterrnined that one of the dominant core darnage scenarios l initiated by total loss of service water in fact does not likely lead to core damage as originally predicted in the Level 1 analysis. Therefore, it appears that this insight no longer applies.-
24 1
l
a ,
i A diesel driven fire water pump or other similar source of low pressure water l
independent of AC power would provide a significant reduction in risk for station blackout scenarios.
Section 1.4.4 of the submittal states: "no modifications are planned based on these ;
insights". The reason given is that the IPE reflected the plant configuration as of '
December 31,1989 and that modifications will be considered after the IPE is updated to reflect the current status of the plant.
25 l
1
l
- 3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS This section of the report provides our overall evaluation of the quality of the front-end portion of the IPE based on this review. Strengths and shortcomings of the IPE are summarized, important assumptions of the model are summarized. Major insights l from the IPE are presented. i Strengths of the IPE are as follows. The consideration of plant specific initiating l events in the IPE was especially thorough in comparison to some other PRA/IPE l studies. The core cooling / containment cooling interface is explicitly addressed. l 1
No shortcomings of the IPE were identified.
Based on our review, the following modeling aspects have an impact on the overall ,
CDF: !
the use of CRD to mitigate transient and ATWS events suppression pool lost at 200 deg F as source of water for core cooling The first modeling aspect decreases the CDF. The licensee states that without credit for CRD to provide core cooling, the CDF would increase by 9% The second modeling aspect tends to increase the CDF since it leads to the inability to use the suppression pool for long term core cooling for any sequence involving loss of containment cooling.
Significant findings on the front-end portion of the IPE are as follows: ;
- Station blackout dominates the CDF; dominant contributors to station blackout ;
include the loss of HPCI due to loss of room cooling, and loss of RCIC due to battery depletion at four hours. !
Transient induced LOCAs resulting from open SRVs contribute significantly to j the total CDF; dominant contributors include the failure of HPCI and failure to depressurize quickly enough to allow coro cooling with low pressure emergency core cooling system (ECCS) pumps.
- All cooling using the suppression pool is lost after loss of containment heat removal when the suppression pool heats up to 200 deg F.
26
1
- 4. DATA
SUMMARY
SHEETS This section of the report provides a summary of information from our review.
Overall CDE The mean core t.t,49 frequency (CDF) from internal initiating events, excluding internal flooding, v.n ralculated to be 7.97E-5/yr.' The CDF from internal flooding
, was not specifically calculated but was estimated to be no greater than 1E-6/yr.
4
- Dominant initiatino Events Contributino to CDF The submittal does not provide the CDF by each specific initiating event. The initiating events contributing most to core damage are:
loss of offsite power turbine trip loss of all service water loss of instrument air.
Dominant Hardware Fa!!ures and Ooerator Errors Contributino to CDF Dominant component failures and operator errors are:
diesel generator hardware failures HPCI hardware failures RCIC hardware failures common cause failure of 4 SW pumps common cause failure of diesel generators operator failure to use SRVs common cause failure of SRVs.
Dominant Accident Classes Contributino to CDF The dominant classes of accidents contributing to the total CDF are as follows, if the service water scenarios noted in footnote (5) are included:
' Upon further review of accident sequences in conjunction with the Level 2 portion of the analysis, the licensee determ'ned that one of the dominant core damage secnariosinitiated by total loss of service water in fact does not likely lead to core damage as originally predicted in the Level 1 analysis.
A sensitivity study showed that elimination of the associated sequences reduces the CDF estimate to 7.10E 05/yr. [p. 3-782 of submittal) 27 i
i
o ,_
{
station blackout 34.8 % i transient induced LOCAs . 30.3 % :
loss of coolant injection 18.1 % ;
loss of containment heat removal 10.9% i anticipated transient without scram 4.9% l LOCAs 0.9%
7 fast containment failure 0.1 % I If the' service water scenarios noted in footnoto (5) are not included, the accident l' classes contributing to the CDF are as follows-c station blackout 39.0 % l transient induced LOCAs 34.0 % :
loss of coolant injection 20.3%
- loss of containment heat removal 0.0%
anticipated transient without scram 5.5% ;
LOCAs 1.0% i fast containment failure 0.1 % j Desion Characteristics Imoortant for CDF j The following design features impact the CDF:
= no injection with diesel driven pumps a four-hour battery lifetime
= AC control power required for long-term supply of nitrogen to SRVs
=' no hardened containment vent
=
< ability of 2 CRD pumps to provide for core cooling.
l The impact of these design features on the overall CDF is discussed in Section 1.2 of l
this report. l Modifications The IPE identified dominant contributors to CDF as summarized in Section 2.7.1 of this report. Three insights are expected reductions in CDF based on the following changes to the IPE model: l
= consideration of upgraded emergency operating procedures
= load study to relax the assumed four-hour battery lifetime
- Fast containment failure results from a condition where an SRV tailpipe has broken off above the torus water line and the SRV has stuck open. As a result, steam is released directly to the torus air space instead of to the torus water. [lPE Submittal, Page 3-739).
28
. o e
improved reliability data (obtained after the freeze date) for HPCI and RCIC.
The remaining insights are as follows:
3
. Nitrogen supply to the SRVs depends on AC power; a procedure to bypass the AC solenoid valve would reduce risks by insuring a pneumatic supply -
to the SRVs. '
Significant reduction in risk could be realized by provid:ng a backup for the service water pumps'.
. A diesel driven fire water pump or other similar source of low pressure water ;
independent of AC power would provide a significant reduction in risk- ,
for station blackout scenarios. ;
The submittal states: "no modifications are planned based on these insights'. The i reason given is that the IPE reflected the plant configuration as of December 31,1989, !
and that modifications will be considered after the IPE is updated to reflect the current .
status of the plant.
l Other USI/GSis Addressed l None.
Sionificant PRA Findinas 1 Significant findings on the front-end po.11on of the IPE are as follows:
. Station blackout dominatas the CDF; dominant contributors to station blackout include the loss of HPCI due to loss of room cooling, and loss of RCIC due to battery depletion at four hours.
. Transient induced LOCAs resulting from open SRVs contribute significently to the total CDF; dominant contributors include the failure of HPCI and failure to depressurize quickly enough to allow core cooling with low pressure emergency core cooling system (ECCS) pumps, .
. All cooling using the suppression pool is lost after loss of containment heat I removal when the suppression pool heats up to 200 deg F.
4
- As noted earlier, the licensee determined that one of the dominant core dernage scenarios initiated by total loss of service water in fact does not likely lead to core damage as originally predicted in the Level 1 analysis. Therefore, it appears that this insight no longer appfles. .
29
REFERENCES l
IIPE Submittal] Cooper IPE Submittal, March 31,1993
[UFSAR) Updated Final Safety Analysis Report for Cooper, Revised through 7-22-91 l
IIPE, Responses) NLS950060, Letter from John Mueller, NPPD, to NRC, February 25,1995 l
! ITech Specs] Technical Specifications for Cooper INUREG/CR 4767] Shutdown Decay Heat Removal Analysis of a General Electric BWR4/ Mark I," Sandia National Laboratories, July 1987.
[GE NEDO-24708A] ' Additional info ~ation Required for NRC Staff - Generic Report on Boiling water Reactors, Rev.1 - 1980'
[GE NEDC-30936P-A] "BWR Owner's Group Technloal Specification improvement Methodology," December,1988
[Obert]' Obert and Young, Essentials of Thermodynamics and Heat Transfer. Krieger,1980.
[GE Sll # 371] General Electric Nuclear Services Information Letter, "RCIC Turbine Exhaust Pressure Trip Setpoint,"
February,1982 t
30 I
l l