Text

Technical Evaluation Rept on IPE Front End Analysis
	ML20097J762
Person / Time
Site:	Dresden, Quad Cities
Issue date:	07/05/1995
From:	Darby J; SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	; NRC
Shared Package
ML17180B458	List: ML17180B457; ML20097J762; ML20097J763; ML20097J766;
References
	SEA-92-553-019, SEA-92-553-019-A:4, SEA-92-553-19, SEA-92-553-19-A:4, NUDOCS 9509010243
	Download: ML20097J762 (46)
	v • d • e

- -.... _.. -.. - -... -....

SEA-92-553-019-A:4 July 5,1995 i

I

)

Dresden 2 and 3 Technical Evaluation Report on the individual Plant Examination Front End Analysis e

1 l

NRC-04-91-066, Task 19 i

John L. Darby, Analyst James R. Lynch, Editor Willard R. Thomas, Editor l

Science and Engineering Associates, Inc.

i l

Prepared for the Nuclear Regulatory Commission i

h h

TABLE OF CONTENTS E. Executive S umma ry..........................................

1 E.1 Plant Chara cte rization...................................

1 E.2 Licensee's lPE Process 2

E.3 Front-End Analysis.....................................

2 E.4 G e ne ric i ss ue s........................................

6 E.5 Vulnerabilities and Plant improvements.......................

6 E.6 Obse rvations..........................................

7

1. I N TR O D UCTI O N.............................................

9 1.1 Review Proce ss........................................

9 1.2 Plant Characterization...................................

9

2. TE C H N I C AL R EVI EW........................................ 11 2.1 Licensee's IPE Proce s s.................................. 11 2.1.1 Comoteteness and Methodoloav...................... 11 2.1.2 Multi-Unit Effects and As-Built. As-Operated Status........ 12 2.1.3 Licensee Particioation and Peer Review................ 12 2.2 Accident Sequence Delineation and System Analysis............. 13 2.2.1 Initiatina Event s.................................. 13 2.2.2 Fvent Trees 14 2.2.3 Systems Analvsis 18 2.2.4 System Deoendencies............................. 18 2.3 Quantitative Process.................................... 19 2.3.1 Quantification of Accident Secuence Freauencies......... 19 2.3.2 Point Estimates and Uncertaintv/Sensitivltv Analyses....... 19 2.3.3 Use of Plant-Soecific Data.......................... 19 2.3.4 U se of G e n e ric Data.............................. 21 2.3.5 Common-Cause Quantification....................... 21 2.4 Inte rface issue s........................................ 23 2.4.1 Eront.End and Back-End Interfaces 23 2.4.2 Human Factors interfaces 23 2.5 Evaluation of Decay Heat Removal and Other Safety issues........ 24 2.5.1 Exa mination of D H R.............................. 24 2.5.2 Diverse Means of DHR 24 2.5.3 Uniaue Features of DHR 24 2.5.4 Other GSI/USIs Addressed in the Submittal.............. 25 2.6 Inte mal Flooding....................................... 25 2.6.1 Internal Floodina Methodoloav....................... 25 2.6.2 Internal Floodina Results............................ 26

~

2.7 Core Damage Sequence Results........................... 26 2.7.1 Dominant Core Damaae Seouences................... 26 il

2.7.2 Vulnerabilities................................... 33 j

2.7.3 Prooosed imorovements and Modifications.............. 33

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS 35

{

4. DATA S U M M AR Y S H E ETS..................................... 37 REFERENCES................................................

40 l

1 l

I l

o l

l 1

1 l

l l

1 l

l I

1 1

1 iii

=. -.

d LIST OF TABLES Table 2-1.

Plant Specific Data 20 Table 2-2.

Common Cause Factors for 2-of 2 Components 22 Table 2-3.

CDF by initiating Event 27 Table 2-4.

Top 5 Systemic Core Damage Sequences 28 Table 2-5.

Offsite Power Recovery Data used in Quad Cities IPE 31 Compared to Data Used in Surry Shutdown PRA 4

6 l

l i

i iv

i 1

l i

i LIST OF FIGURES l

j Figure 2-1.

Comparison of Data for Recovery of Offsite Power 30 l

l I

I 1

1 i

I e

l l

I e

l l

i l

l l

I l

V 1

1 i

~* '

f 4

'i E. Executive Summary 1

L i

This report summarizes the results of our review of the front-end portion of the i

l Individual Plant Examination (IPE) for Dresden units 2 and 3. This review is based on t

_information contained in the IPE Submittal along with the licensee's responses to l

' Requests for Additional Information (RAI).

l-E.1 Plant Characterization

'l i

i The Dresden' site consists of two operating nuclear units,2 and 3, located near Morris, l

j Illinois. General Electric was the nuclear steam system supplier and the turbine I

i

' generator supplier, Sargent and Lundy (S&L) was the architect engineer, and United Engineers and Constructors was the constructor.

L l

Each unit is a boiling water reactor (BWR) 3 design with a Mark I containment. Both' l

units are currently operating. Each unit has a design power.of 2600 megawatts thermal (MWt), a rated power of 2527 MWt, and a not output of 809 megawatts -

)

electric (MWe). The two units began commercial operation in 1970 and 1971, respectively for units 2 and 3.

Design features at Dresden that impact the core damage frequency (CDF) are as follows:

lsolation condenser for shutdown coolino with seconc arv makeuo available from

=

diesel-driven numns. The isolation condenser has makeup water provided by diesel-driven pumps thereby not requiring DC power for pumping as does a typical Reactor Core isolation Cooling (RCIC) system; this tend to decrease the CDF from station blackout.

Automatic isolation of the isolation condenser after loss of 125 V DC oower at one unit. The isolation condenser at Dresden automatically isolates on loss of DC power; this tends to increase the CDF from loss of DC power. The licensee has instituted a procedural change to allow continued operation of the isolation condenser after station blackout; this tends to decrease the CDF from station blackout but has no impact on the CDF from loss of DC power.

Ability to crosstie AC nower between the two units. AC power can be crosstied between the two units thereby reducing the CDF from station blackout.

1 Shared DC cower between the two units. Loss of DC power at one unit results In automatic loss of the isolation condenser. This tends to increase the CDF; loss of DC power at one unit dominated the total CDF. (It is noted that each j

unit has one train of 125-V DC power that serves both units. ' Loss of 125-V DC power at one unit causes partial loss of DC power at both units.)

4 1

i

i Net oositive suction head (NPSH) maroin for low-oressure emergency core l

~

coolina system (ECCS) oumos usina the suooression nool. The low pressure ECCS pumps lose adequate NPSH from the suppression pool if containment cooling is lost even if containment venting is successful; this tends to increase the CDF.

E.2 Licensee's IPE Process The IPE is a level 2 probabilistic risk assessment (PRA). The PRA was initiated in response to Generic Letter 88-20. The freeze date for the IPE model was January, 1991.

Commonwealth Edison Company (CECO) established a management structure for all 6 IPE projects at its various plants. The Submittal indicates that personnel from the Individual Plant Evaluation Partenship (IPEP) performed the basic modeling and analysis while CECO personnel performed success criteria analysis using the Modular Accident Analysis Program (MAAP) and conducted reviews of the models, input assumptions, and results. The IPEP contractor team was comprised of Westinghouse, TENERA, and Fauske and Associates.

Plant walkdowns were performed to develop an appreciation for the potential i

environmental impact on equipment that is difficult to discern from drawings. During the walkdowns, the design descriptions and drawings were checked for accuracy and completeness.

Major documentation used in the IPE included: the Final Safety Analysis Report, Technical Specifications, system descriptions, plant drawings, simulator runs, procedures, and calculations.

The following PRA studies of other plants were reviewed: the Reactor Safety Study (NUREG-12j20), and the NUREG-1150 and NUREG/CR-4550 studies.

The following reviews of the level 1 PRA~were performed. The contractors performed intemal independent reviews of their work and CECO personnel reviewed information submitted by the contractors. Important results and products were reviewed by the senior management support team. A final review of the overall study was performed by CECO senior management.

The Submittal states that Dresden intends to maintain a "living" PRA.

E.3 Front-End Analysis The front-end portion of the IPE is a level 1 PRA; the specific technique used for the

~

level 1 PRA was the large event tree /small fault tree technique with support state-modeling. Quantification was performed with the GRAFTER code.

2 9

~

The IPE evaluated the following nine groups of initiating events:

Five loss of coolant accidents (LOCAs)

One anticipated transient Two loss of offsite power transients (single and dual unit)

Loss of 125-V DC power in one unit The IPE developed event trees to r iodel all of these initiating events.

The success criteria chosen for cora cooling was maintaining fuel temperature below 4040 degrees F.

System success criteria for accident seqtoncu were developed based on thermal hydraulic analyses performed with MAAP, the Updated Final Safety Analysis Report (UFSAR), and engineering Judgment. Overall, the success criteria used in the Dresden IPE are optimistic compared to the success criteria used in typical IPE/PRAs.

For example, the Dresden IPE assumed that depressurization can be successfully accomplished with only one Safety Relief Valve (SRV), while most IPE/PRAs for similar plants require 2 or 3 SRVs for successful depressurization.

Loss of instrument air was not considered as a special plant specific initiating event.

Loss of heating, ventilation, and air-conditioning (HVAC) was not considered to be an initiating event based on plant-specific analyses that were performed.

Major support systems were modeled in a support system event tree.

Plant-specific data were use,d based on the time period January 1,1984, through December 31,1990. Data from both units were combined into one database. Generic data were used when insufficient plant-specific data were available for quantification.

Plant-specific data were used to quantify test and maintenance unavailabilities. Bas 3d on a spot check of the plant-specific data, the values in the Dresden IPE for component failures are comparable to those values used in other PRAs.

The Multiple Greek Letter (MGL) method was used to model common cause failures.

The data for common cause failures were taken from EPRI NP-3967.

The Submittal implies that a Dresden-specilic evaluation of common cause failure events was performed for certain types of components, and generic common cause failure data was applied to other components. Based on the discussion of this evaluation provided in the Submittal, this evaluation involved screening generic data for applicability and reducing the failure values based on a qualitative assessment of Dresden-specific programs and practices. Based on the information from Table 2-2 of this report, the common cause failure factors used in the Dresden IPE are lower than the values typically used in other IPE/PRAs.

[

3

_.. _..... _ ~..

t i

I The total CDF in the IPE fiom internal initiating events was 1.85E 5/ year. Internal I

flooding was screened from consideration as an important contributor to CDF in the original IPE analysis. Additional information from the licensee stated that the j

estirnated CDF for Dresden has changed since the date of the Submittal. With the l

inclusion of failure of DC power due to water spray effects, the total CD.F for Unit 3 l '.

increased by 48% but the total CDF for Unit 2 did not change.

i l'

The Submittal reported core damage sequences consistent with the systemic reporting b

criteria of NUREG 1335. The top 100 core damage sequences were reported.

The dominant initiating events contributing to CDF were as follows:

i Initiating Event (IE)

IE Frequency CDF Percent of CDF j.

(1/ year)

Loss of 125-V DC 8.7E-4 1.1 E-5 60.2 i

Power at One Unit 7

I Loss of Offsite 9.6E-2 3.7E-6 19.9 I

Power to a Sing!e Unit I

Medium LOCA 8.0E-4 1.4E-6 7.5 l

Loss of Offsite 1.6E-2 1.2E-6 6.9 1

Power to a Both I

Units 1

i Anticipated 2.3E-4 5.3E-7 2.9 I

Transient without i

Scram (ATWS)

General Transient 7.4 2.7E-7 1.4 3

~

Inadvertent Open 7.1E-2 1.8E-7 1.0 Relief Valve Large LOCA 3.0E-4 3.7E-8 0.2 Small LOCA 3.0E-3 6.2E-9

<0.1 d

Interfacing 1.1 E-4 4.3E-4 a 0.1 Systems LOCA The CDF by accident class was as follows:

4

--. - - - -.. - - -... -. -. ~. - -. -..

- -.. _ _ - -.~. - - - - -..

l l

The plant-specific transient

loss of 125-V DC power" contributed about 60% to the total CDF Loss of offsite power (single or dual) without station blackout contributed about 20% to the total CDF LOCAs contributed about 7% to the CDF-Station blackout contributed about 5% to the CDF ATWS contributed about 2% to the CDF General transients contributed about 1% to the total CDF.

Based on the discussions of the dominant core damage sequences, important failures in mitigating systems were: failures of Motor Operated Valves (MOVs), operator failure to initiate suppression pool cooling, failure of Diesel Generator (DG) 2/3, operator failure to align to bus 24-1, operator failure to provide makeup to the isolation condenser, operator failure to depressurize, and failure of the High Pressure Coolant injection (HPCI) pump.

The IPE used Plant Response Trees (PRTs) that model both the front and back and portions of the accident sequences. Therefore, traditional plant damage states (PDSs) that bin front-end core damage sequences for subsequent back-end analyses were not used.

On the basis of our review, the following aspects of the modeling process have an impact on the overall CDF:

, uantification of only one olant-soecific initiatino event. If more plant-specific Q

initiating events had been quantified for core damage-as is typically the case in other IPE/PRAs-the CDF might have been increased.

NeaEaible leak =aa from recirculation oumo seals durino station blackout. The CDF from station blackout could be higher if the IPE had considered leakage -

from the recirculation pump seals; seal leakage cannot be isolated during station blackout and cooling with the isolation condenser does not provide makeup to the vessel.

Crd for maintainino adeauate NPSH from the suooression nool after loss of snaaression nool cardino by either inlectina water to the sunoression cool to annw continued use of low-oressure ECCS oumos or hv reationina low-1 pressur3 ECCS comes to inlect from the Condensate Stqtagg Rok (CST).

The CDF was significantly reduced by crediting these comperney actions to j

maintain the use of low pressure ECCS systems following less M wppression pool cooling.

The low common cause failure factors used. The use of common cause failure factors lower than typically assumed in other IPE/PRA studies lowered the CDF.

5

E.4 Generic issues The IPE specifically addressed loss of Decay Heat Removal (DHR), considering DHR as both core cooling and ultimate heat removal. The IPE evaluated the diverse means for DHR, including: use of the power conversion system, the isolation condenser, and ECCS.

r About 69% of the total CDF involved failure of suppression pool cooling: 55% due to hardware failure and 14% due to operator error. With the change to allow for long term alignment of Lov Pressure Coolant injection (LPCI) and core spray to the CST if -

suppression pool cooling is lost, the contribution of loss of suppression pool cooling to the overall CDF decreased to about 8%. No vulnerabilities associated with DHR were identified as a result of the IPE.

i The licensee does not propose to resolve any other generic issues other than DHR.

i E.5 VulnerabiWties and Plant improvements No definition of " vulnerability" was provided in the Submittal. The Submittal states that there are no vulnerabilities based on the low overall CDF.

4 j

Two modifications scheduled after the freeze date were credited in the IPE model, these being:

a torus /drywell hardened containment vent diesel-driven isolation condenser makeup pumps.

a As a result of the IPE,130 insights were developed and evaluated using the Nuclear Management and Resource Council (NUMARC) Severe Accident Closure Guidelines.

The evaluation indicated that the greatest reduction in plant risk could be achieved by implementin!g a procedural change for realignment of core spray or LPCI to the condensate storage tank, to prevent loss of adequate NPSH for the pumps when pulling from the suppression pool without suppression pool cooling. CECO has decided to implement this procedure at Dresden. This change was also implemented at Quad Cities. The CDF was recalculated with this change in procedure. This change lowered the CDF from 1.85E-5 to 3.75E-6 per reactor year [lPE submittal Table 6.2-1).

~

The CECO cover letter sttached to the Submittal indicates that CECO plans to implement a procedural change that is directed at ensuring operability of the isolation condenser during station blackout. The change is operator action to open circuit breakers for the 250 V DC operated valves in the isolation condenser piping prior to depletion of DC batteries under station blackout conditions.

6

-m n--

r

-<-n

Additional information from the licensee indicates that both of these procedural N

changes have now been implemented at Dresden, resulting in a decrease in the CDF for both units. With credit for these changes and considering the loss of DC power in Unit 3 due to water spray, the total CDF for Unit 2 is 3.76E-6/ reactor-year and the total CDF for Unit 3 is 4.36E-6/ reactor-year.

E.6 Observations We believe that the licensee analyzed the plant design and operations of Dresden to discover instances of particular vulnerability to core damage, with three exceptions as subsequently discussed. The licensee has developed an overall appreciation of severe accident behavior, understands the most likely severe accidents at Dresden-with the three exceptions as subsequently noted, has gained a quantitative understanding of the overall frequency of core damage, and has implemented changes to the plant to help prevent and mitigate severe accidents.

Strengths of the IPE are as follows. The model did recognize the design characteristic of the NPSH margin for the low pressure ECCS pumps such that adequate Net Positive Suction Head Available (NPSHA) is lost for these pumps pulling from the suppassion pool if suppression pool cooling is lost and no compensatory actions are taken.

Shortcomings of the IPE are as follows. (1) The common cause failure factors are much lower than those typically used in IPE/PRAs based on fl's plant specific screening evaluation employed. Common cause failures are subtle and it is possible that the licensee has underestimated the potential for common cause failures. (2) l Only one plant-specific initiating event was evaluated (loss of 125-V DC power at one unit) and that initiating event dominated the CDF. Other IPE/PRAs address plant-specific initiating events in more detail and retain more than one such event for -

quantification. The licensee has not demonstrated that all potentially important plant-specific initiating events were evaluated. (3) The Dresden IPE assumed that leakage from recirculation pump seals is a negligible affect during station blackout. A recent IPE for a similer plant addressed leakage from recirculation pump seats and it dominated the CDF for that plant. For BWRs witt, isolation condensers, shutdown cooling can be provided enthout injection to the vessel, but leakage from failed seals can negate the effectiveness of the isolation condenser.

Significant level-one IPE findings are as follows:

Loss of 125-V DC power at one unit dominates the CDF.

Station blackout is a low contributor to the CDF.

Realigning the low pressure ECCS pumps to the CST over the long term after loss of suppression pool cooling substantially decreases the total CDF.

7 l

l j

Y

^

Loss of 125 V DC at one unit results in loss of the ability to use the isolation l

condenser for core cooling. Station blackout is a low contributor to the total CDF due to the ability to cross tie power between the units, due to the high probability for recovery of offsite power, and due to the low common cause failure factors used for Diesel Generators (DGs). Credit for realigning the low pressure ECCS pumps to the CST over the long term after loss of suppression pool cooling decreases the total CDF 4

by a factor of 5.

i i

4 4

i l

8 j

i

1. INTRODUCTION T

4 I

1.1 Review Process f

This report summarizes the results of our review of the front-end portion of the IPE for j

Dresden units 2 and 3. This review is based on information contained in the IPE Submittal along with the licensee's responses to RAI. [lPE] [lPE Responses] [lPE Responses 2]

1.2 Plant Charactedzation 6

j The Dresden site consists of two operating nuclear units,2 and 3, located near Morris, j

lilinois. The water source is the Kanakee River, and a cooling lake provides the ultimate heat sink. (Unit 1, an earlier generation BWR, is defueled and permanently inoperable.) The systems at the two units are similar, with numerous shared systems and structures. The only differences between the two units are equipment locations

}

and sources of auxiliary power. General Electric was the Nuclear Steam System l

Supplier and the turbine generator supplier, Sargent and Lundy (S&L) was the architect engineer, and United Engineers and Constructors was the constructor.

i l

Each unit is a BWR 3 design with a Mark I containment. Both units are currently l

operating. Each unit has a design power of 2600 MWt, a rated power of 2527 MWt, and a net output of 809 MWe. The two units achieved commercial operation in 1970 j

l and 1971, respectively for units 2 and 3.

e.

l Design features at Dresden that impact the Core Damage Frequency (CDF) are as j

follows:

s Isolation condenser for shutdown coolina with secondarv makeuo available from l

diesel-driven oumos. The isolation condenser has makeup water provided by diese.l-driven pumps thereby not requiring DC power for pumping as does a typical Reactor Core Isolation Cooling (RCIC) system; this tend to decrease the i

CDF from station blackout.

f Automatic isolation of the isolation condenser after loss of 125 V DC oower at one unit. The isolation condenser at Dresden automatically isolates on loss of j

DC power, this tends to increase the CDF from loss of DC power. The licensee j

has instituted a procedural change to allow continued operation of the isolation condenser after station blackout; this tends to decrease the CDF from station blackout but has no impact on the CDF from loss of DC power.

Ability to crosstle AC oower between the two units. AC power can be crosstled between the two units thereby reducing the CDF from station blackout.

7 9

i' d

m.

Shared DC oower between the two units. Loss of DC power at one unit results in automatic loss of the isolation condenser. This tends to increase the CDF; loss of DC power at one unit dominated the total CDF. (It is noted that each unit has one train of 125-V DC power that serves both units. Loss of 125-V DC power at one unit causes partial loss of DC power at both units.)

Net oositive suction head (NPSH) margin for low-oressure emergency core cooling system (ECCS) oumos usino the sunoression cool. The low pressure ECCS pumps lose adequate NPSH from the suppression poolif containment cooling is lost even if containment venting is successful; this tends to increase the CDF.

e I

'l 3

I

/

10

s I

l

2. TECHNICAL REVIEW i

2.1 Licensee's IPE Process We reviewed the process used by the licensee with respect to: completeness and methodology; multi-unit effects and as-built, as-operated status; and licensee participation and peer review.

2.1.1 Comoleteness and Methodoloov The Dresden IPE is a level 2 PRA. The IPE is complete with respect to the type of information requested by Generic Letter 88-20 and NUREG 1335.

The front-end portion of the IPE is a level 1 PRA. The specific technique used for the level i PRA was the large event tree /small fault tree technique with support state modeling.

The Submittal described the details of the technique. Intemalinitiating events and intemal flooding were considered. Event trees were developed for all classes of indtiating events. Plant Response Trees (PRT) were developed for each class of initiating event. The PRTs model both the front-end and the back-end portions of the analysis, and they are larger in scope than the standard event trees that model the front-end portion of the accident sequences. The development of component level system fault trees was summarized, and system descriptions were provided.

The IPE did not include an uncertainty analysis. The Submittal did include a limited sensitivity anahsis.

The licensee provided a summary of how dependencies were accounted for in the lPE. The licensee discussed three types of dependencies: (1) intra-system j

dependencitps involving support systems, (2) intra-system dependencies between front line systems, and (3) inter-system dependencies. The first type of dependency is accounted for using support state modeling. The second type of dependency is accounted for in the structure of the event trees. The third type of dependency is modeled by using more than one fault tree to reflect success of an event in which the system is only partially successful; this allows the state of failed components to be retained for quantification of later events involving systems using the same compcaents.

The PRA upon which the IPE is based was initiated in response to Generic Letter 88-20.

11

=.

~

2.1.2 Multi-Unit Effects and As-Built. As-Ocerated Status

~-

i Dresden is a dual unit site and the two units share some systems, such as the swing i

DG and DC electrical power. The IPE modeled Unit 2 and concluded that the results of the analysis are applicable to Unit 3 as well. [lPE submittal, Sections 2.5 and 4.1.3.4]

The licensee provided additional information that estimates that the dual unit CDF from the initiating event dual unit loss of offsite power is 1.77E-7/ year.

Plant walkdowns were performed to develop an appreciation for the potential environmental impact on equipment that is difficult to discern from drawings. [lPE

' submittal, Section 2.4] During the walkdowns, the design descriptions and drawings were checked for accuracy and completeness.

Major documentation used in the IPE included: the UFSAR, technical specifications, system descriptions, plant drawings, simulator runs, procedures, and calculations.

[lPE submittal, Table 2-1]

PRA studies of other plants that were reviewed include: the Reactor Safety Study, and the NUREG 1150 and NUREG/CR 4550 studies. The freeze date for the IPE model was January 1991. Two modifications scheduled after the freeze date were credited in the IPE model, these being:

(1) a torus /drywell hardened containment vent (2) diesel-driven isolation condenser makeup pumps.

2.1.3 IIrmnsee Particioation and Peer Review CECO established a management structure for all 6 IPE projects at its various plants.

The Submittal indicates that IPEP (contractor) personnel performed the basic modeling and analysis while CECO personnel performed success criteria analysis using MAAP and conducted reviews of the models, input assumptions, and results. [lPE submittal, Section 3.1) The IPEP contractor team consisted of: Westinghouse, TENERA, and Fausle and Associates. The licensee provided additional information as to the invahoment of Dresden plant operations and maintenance personnelin the development and review of the PRTs, and fault trees.

The Submittal states that Dresden intends to maintain a "living" PRA.

The process used by the licensee to review the IPE was assessed. Several reviews of the level 1 PRA were performed. [lPE submittal, Section 3.2) CECO contractors performed internal independent reviews of their work, and CECO personnel reviewed information submitted by the contractors. Important results and products were i

12

i i

reviewed by the Senior Management Support Team. A final review of the overall study was performed by CECO senior management.

2.2 Accident Sequence; Delineation and System Analysis i

This section of the report documents our review of both the accident sequence l

delineation and the evatustion of system performance and system dependencies provided in the Submittal.

i 2.2.1 initiatino Events The IPE evaluated nine groups of initiating events. [lPE submittal, Table 4.1.1-1)

These events can be categorized as follows:

Five LOCAs i

One anticipated transient Two1oss of offsite power transients (single and dual unit)

Loss.of 125-V DC power in one unit.

The IPE developed PRTs to model all of these initiating events. [lPE submittal, Volume 2]

Plant-specific data were used to quantify high frequency transient initiating events.

2

[lPE submittal, Section 4.0) Generic data for transient initiating events were taken from NURE5G/CR-3862. LOCA initiating frequencies were taken from WASH-1400.

Interfacing system LOCA initiating events were quantified by a plant-specific calculatiort. Loss of 125 V DC power was quantified by fault tree analysis.

The IPE used one ' global' event tree to evaluate all transient initiating events except for the following events for which specific event trees were developed: A1WS, loss of offsite pourer, station blackout, and loss of DC power. The following four categories were included in the general (' global') transient category:

T1-General Transient with feedwater (FW) and main condenser (MC) Available T2-General Transient with FW Available and MC Unavailable TS-General Transient with FW Unavailable and MC Avallable l

T4-General Transient with FW and MC Unavailable.

Only one plant-specific initiating event was specifically evaluated, that being loss of DC power; typically, IPE/PRAs quantify the CDF from numerous plant-specific initiating events. The licensee does not address how plant-specific translent initiating events were cor sidered as initiating events. Most PRAs discuss how plant-specific failures were analyzed as potential initiating events, and most PRAs include a number of plant-specific failures as initiating events. The licensee only addressed ' generic' initiating events and initiating events based on the plant history.

13

\\

i For those initiating events considered, the frequencies assigned to the events are a

l.

comparable to values used in other IPE/PRAs, except for the frequency cssigned to a l

small LOCA initiating event. [lPE submittal, Table 4.1.1-1) The Submittal does not specify whether or not recirculation pump seal LOCAs were included in the small LOCA initiating event.

The licensee states that the leakage expected from a seal LOCA is sufficiently small so that the event can be classified as a transient rather than a small LOCA. This assumption is in contrast to the assumption made in most IPE/PRAs for BWRs and it results in a significantly smaller frequency for a small/small-small LOCA in the Dresden IPE than in other IPE/PRAs. The frequency of a small LOCA in the Dresden IPE is 3.0E-3/ year; NUREG/CR 4550 for Peach Bottom used a frequency of 3.0E-2/ year for a seal LOCA, designated as a small-small LOCA. [NUREG/CR 4550 Peach i

Bottom] The licensee pointed out that a seal LOCA can be isolated; this is true if AC power is available.

Because the IPE treated a seal LOCA initiating event as a transient, the model for mitigation of the seal LOCA in the IPE assumes that successful core cooling following a seal LOCA can be achieved using the isolation condenser without any makeup to the vessel.

The IPE does distinguish between single and dual unit loss of offsite power as initiating events. Single unit loss of offsite power does not automatically result in a requirement to use the DGs since offsite power can be crosstied between the two units.

2.2.2 Event Trees The success criteria chosen for core cooling was maintaining fuel temperature below 4,040 F. [lPE submittal, Section 4.1.4.1) This definition of success criteria for core cooling doe.s not contain any consideration the Peak Cladding Temperature (PCT) which is the limiting parameter following a large LOCA. The licensee states that PCT was considered in development of the success criteria but was not explicitly quantified i

since MAAP was used to evaluate success criteria, and MAAP does not calculate PCT.

The system success criteria in the IPE differ from the system / function success criteria in the UFSAR for mitigation of a large LOCA; for example, the IPE credits one LPCI pump alone as adequate for core cooling. The licensee states that the large LOCA success criteria were based on MAAP calculations. The calculation did not consider leakage out the jet pump joints. The licensee stated that the UFSAR (for Quad Cities) indicates that one LPCI pump is adequate to provide core cooling during a large LOCA; the UFSAR information referred to is Table 6.3-11 of the UFSAR. It is not.

clear how the information in this table supports the assumption that one LPCI pump can provide core cooling since this table is based on the ECCS failures indicated in 14

Tables 6.3-7 and 6.3-9 of the UFSAR, in which at least one train of core spray and at least 2 LPCI pumps are available, or both core spray trains are available, in our opinion, MAAP should not be used to support significant deviations from the licensing success criteria for large break LOCAs. On the other hand, the success criteria used l

in the Dresden IPE for a large LOCA are similar to those used for other BWR IPE/PRAs. During our review of an IPE for a similar plant, the licensee provided additionalinformation stating that GE's SAFER /GESTR methodology was used to establish the large LOCA success criteria and that this methodology did include delayed neutron fission energy and implicitly accounted for jet pump leakage by using conservative ECCS injection rates. [TER, Hatch) Therefore, the success criteria for a large LOCA used in the Dresden IPE in terms of the number and types of ECCS pumps required, may be valid, based on the more comprehensive analyses performed for similar plants.

The systems / sequences success criteria in the IPE for preventing core damage have numerous differences from the success criteria used in other PRA/IPE studies of BWRs as discussed in the following topics:

The iPE assumes that only one relief valve is required to depressurize so that LPCI or CS can be used. Typically, PRAs assume more than one valve is required; for example, the NUREG/CR 4550 study for Peach Bottom assumed that 3 are required. The licensee states that MAAP calculations were used to demonstrate that core damage will not occur. The model assumed that an electromagnetic relief valve would relieve 625,000 lbm/hr at 1117 psig. Based on information available to us (timing of critical events and the maximum core temperature reached), the size of the relief valve used in the Dresden analysis may be too large. Since IPE/PRAs typically require more than one relief valve to depressurize, and the ability to depressurize is a key aspect of the mitigation strategy for transients in a BWR upon loss of high pressure makeup / injection systems, we believe that additional information is needed to support the IPE assumption that only one valve is needed to successfully depressurize.

I The IPE models containment venting for the back-end analysis, but the front-

=

end success criteria do not address containment venting. If the containment is vented with a hot suppression pool, adequate NPSHA can be lost for ECCS pumps pulling from the suppression pool; this was the assumption in the NUREG/CR 4550 analysis of Peach Bottom. The licensee states that venting is initiated at about 60 psig, and that the low pressure ECCS pumps would have lost adequate NPSHA from the suppression pool prlor to the conditions for venting.

Credit is taken for supplying containment with water from the Standby Coolant System (SBCS) following a large LOCA if suppression pool cooling is lost. This system involves using feedwater to supply water to the containment from the condenser hotwell with the hotwell makeup supplied from service water. This 15 j

l

,-=

l i

presewes adequate NPSHA for the LPCI and Core Spray (CS) pumps. The

~

licensee states that the following support systems are needed to effect use of i

Standby Coolant System (SBCS): Turbine Building Component Cooling Water (TBCCW), instrument air, and various 4160 V AC,480 V AC, and 125 V DC buses. Operator actions required to implement the option are discussed in the licensee response. Control of containment overfill was not specifically modeled due to the relatively little amount of injection required to provide for long term adequate NPSHA; the model implicitly assumed that operator action to control l'

overfill would be taken.

The IPE success criteria for a large LOCA do not address the need to close the i

recirculation discharge isolation valve in the intact recirculation loop to prevent loss of LPCI injected water out the break. However, the licensee states that I

closure of the discharge valve in the intact recirculation loop should have been required in the IPE model to successfully mitigate a large LOCA. This change is expected to increase the CDF by about only 0.2%.

LOCAs outside containment were screened from consideration. Therefore, the success criteria for LOCAs do not address LOCAs outside containment in steam and feedwater lines, and the need to isolate such breaks to prevent loss of suppression pool inventory from ECCS recirculation out the break.

The success criteria for ATWS do not discuss operator action to inhibit depressurization to prevent reactivity increase due to the injection of large quantities of cold water. The licensee states that the model assumed the operators would inhibit ADS. The IPE model would be more complete if the modeling explicitly included failure of the operator to inhibit ADS in response to an ATWS.

The IPE success criteria indicate that if the core is cooled using feedwater, containment failure has no impact on the ability to maintain core cooling. It was assumed that containment failure has no impact on the ability to use the feedwater system to cool the core due to the location of components in the feedwater system.

HVAC was modeled as required for the containment cooling service water (CCSW) pumps B and C. HVAC was assumed to not be required for other areas, specifically the electrical switchgear rooms, battery rooms, CCSW rooms, and the control room. The basis for not requiring HVAC for the other areas was not further clarified.

The IPE success criteria do not require containment cooling to support operation of HPCI. MAAP calculations indicate that cyclical operation of HPCI without containment cooling would not result in loss of HPCI during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time. Specifically, the calculation indicated that: the turbine 16

i backpressure would not exceed 100 psig, the area temperature would not exceed 200 F, and sufficient NPSH would be maintained for the HPCI booster j

Pump.

The IPE assumed that no safety or relief valves open during a station blackout before operator action can successfully establish cooling with the isolation condenser. At least 10 minutes are available for operator action to initiate cooling with the isolation condenser following loss of offsite power, before l

valves are challenged to open. We believe that his operator action should be evaluated by the human factors review of the IPE, as discussed in Section 2.4.2 of this report.

l The event trees do not require cooling for the recirculation pump seals during a transient to prevent the accident from evolving to a small LOCA. This is an important point forthe Dresden design as isolation condensers are used to provide shutdown cooling during station blackout and the use of the isolation condensers does not involve makeup to the vessel. The IPE assumes that even though seal cooling is lost during station blackout, cooling with the isolation condensers is sufficient to prevent core damage and no long term makeup to the vessel is required. The licensee expects that the impact of seal leakage on use of the isolation condenser should be minimal due to the low seal leakage flow rates expected. However, in our assessment, seal leakage, especially during station blackout, should be considered; leakage from the vessel dominated the CDF in the IPE for a similar plant The IPE uses the following modeling for an ATWS: OSL1 is operator action to use 1 of 2 Standby Liquid Control (SLC) pumps to borate, and the PRT indicates that if OSL1 is not successful, OSL2 can successfully provide boration, and OSL2 is operator action to use 2 of 2 SLC pumps. OSL1 is earfy operator action and requires 1 of 2 SLC pumps for success. OSL2 is late operator action and requires 2 of 2 SLC pumps for success. No hardware failures are included in OSL1 and OSL2; these are purely i

operator action events.

The IPE success criteria do not address containment venting. [IPE submittal, Table 4.1.4-1] For many BWR IPEs, if suppression pool cooling is lost containment venting is assumed to not to cause loss of core cooling by using low pressure ECCS pumps

- pulling from the suppression pool, and containment venting has an important impact on reducing the CDF. As previously discussed in this report, for Dresden, without suppression pool cooling, adequate NPSHA for the LPCI and core spray pumps is lost prior to reaching the pressure for venting (60 psig). Therefore, containment venting has little impact on reducing the CDF for Dresden. This is a reflection of the NPSH margin for these pumps inherent in the plant design; Quad Cities has the same design feature.

4 4

17

L s

2.2.3 Systems Analysis i

System descriptions are included in Section 4.2 of the Submittal; system schematics l

are included in Volume 2 of the Submittal.

The system description for the Isolation Condenser does not discuss a major design feature of the system that impacts the CDF. The loss of 125 V DC power at a unit causes automatic closure of 250 V DC valves in the system piping resulting in loss of the isolation condenser. [lPE submittal, Sections 1.6.3 and 7.2) Therefore, the isolation condenser is lost following the initiating event ' Loss of 125-V DC Power at One Unit". Also, during station blackout long term core cooling via the isolation condenser is lost after the 125 V DC batteries deplete even though diesel-driven pumps are available to provide makeup to the secondary of the isolation condenser.

As discussed in Section 2.7 of this report, the licensee has instituted a cb uge in procedures to prevent loss of the isolation condenser due to long term loss of DC power during station blackout.

No discussion of cooling for the recirculation pump seals is provided in the Submittal.

Details are not provided that address cooling for these seals to prevent a transient from evolving into a small LOCA.

For loss of all AC power at one unit, credit is taken for supply of power by crosstie from the other unit via the 24-1 and 34-1 buses. The IPE model required either suppression pool cooling or injection of external water to the suppression pool to maintain adequate NPSH for the low pressure ECCS pumps, and failure to isolate containmert would not alter the model. The licensee also states that containment isolation does not isolate Reactor Building Component Cooling Water (RBCCW) cooling to the recirculation pump seals.

2.2.4 Systern Deoendencies The Submittal provides tables that delineate system dependencies, and each figure has an accompanying table of notes. [lPE submittal, Tables 4.2.2-1 through 4.2.2-9)

Important asymmetries in train-level system dependencies are indicated. The following types of dependencies were considered: shared component, instrumentation and control, isolation, motive power, direct equipment cooling, area HVAC, operator actions, and environmental and phenomenological effects.

We found the dependency tables and accompanying notes to be useful in our review of the IPE.

18

j i

a 2.3 Quantitative Process 2

2 i

4, l

This section of the report summarizes our review of the process by which the IPE quantified core damage accident sequences, it also summarizes our review of the l

data base, including consideration given to plant-specific data, in the IPE. The l

uncertainty and/or sensitivity analyses that were performed, if any, were reviewed.

2.3.1 Quantification of Accident Seouence Frecuencies i

i The Dresden IPE used the large event tree /small fault tree technique with support -

state event trees. A mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months was used. Support states were quantified prior to quantificatim of the PRTs..The PRTs are event trees that model both the front-end and bac,,.)d response to a class of accident initiating events. The i

PRTs are systemic. The fault trees were developed and quantified with the Westinghouse GRAFTER computer code system. [lPE subiaittal, Section 3.3.5) The truncation limit for sequence quantification was 1E-15.

2.3.2 Point Estimates and Uncertaintv/ Sensitivity Analyses Mean values were used for point estimate failure frequencies and probabilities. No uncertainty analyses were performed, but sensitivity analyses were performed for the following three operator actions: [lPE submittal, Section 4.5.4]

Operator action to supply makeup to the secondary of the isolation condenser, Operator action to establish suppression pool cooling, and Operator action to depressurize the reactor vessel.

Based on the sensitivity analyses, CDF was shown to be sensitive to increases in failure probabilities for any of these three operator actions.

2.3.3 Use of Plant-Soecific Data The Submittal states that plant-specific data were used based on the time period January 1,1984 through December 31,1990. [lPE submittal, Section 4.4.1] Data from both units were combined into one databesa. Generic data were used when insufficient plant-specific data were avaEmble for quantification. Plant-specific data were used to quantify test and maintenance unavailabilities.

A spot check of the plant-specific data from Table 4.4.1-3 of the Submittal was conducted. These data were compared to data used in NUREG/CR 4550 for Peach Bottom. Table 2-1 summarizes the comparison. (Since Quad Cities and Dresden are similar plants operated by the same utility, data from the Quad Cities IPE Submittal are also included in this table.)

19

---w----

Table 2-1. Plant-Specific Data Component and Dresden Value "

Quad Cities NUREG/CR 4550 Failure Mode IPE Submittal Table Value UM)

Value 03- (2) 4.4.1-3 IPE Submittal Table Peach Bottom 4.4.1 -3 Table 4.9-1 Diesel Generator 1.6E-2/D DG2 1.6E-2/D DG1 3.0E-3/D Fall to Start 5.1E-2/D DG3 1.4E-2/D DG2 3.4E-2/D DG2/3 9.9E-3/D DG %

Diesel Generator 1.3E-2/H DG2 4.3E-3/H DG1 2.0E-3/H Fall to Run 1.1E-2/H DG3 1.8E-3/H DG2 3.1E-3/H DG2/3 3.2E-3/H DG1/2 HPCI Turbine 6.9E-3/D 1.4E-2/D 3E-2/D Fall to Start HPCI Turbine 2.2E-4/H W 2.2E-4/HW SE-3/H Fail to Run LPCIPump 2.4E-3/D 4.0E-4/D 3E-3/D Fall to Start LPCIPump 2.4E-4/H 7.2E-4/H 3E-5/H Fall to Run Core Spray Pump 3.1 E-3/D 3.4E-3/D 3E-3/D i

Fall to Start Core Spray Pump 2.4E-4/H 1.8E-3/H 3E-5/H Fail to Run i

MOV 1.9E-3/D 1.4E-3/D 3E-3/D Fall to Change State (Open/Close)

Air Operated Valve 9.4E-4/D 2.0E-3/D 1 E-3/D (AOV)

Fail to Change State (Open/Close)

RCIC Pump No RCIC System 1.7E 2/D 3E-2/D Fail to Start at Dresden RCIC Pump No RCIC System at 2.2E-4/H W SE-3/H Fall to Run Dresden (1)

D is per demand; these values are probabilities.

(2)

H is per hour; these values are frequencies.

(3)

Generic Data from IEEE-Std. 500.

20

Based on this spot check of the plant-specific data, the values in the Dresden IPE for component failures are comparable to those values used in other PRAs.

2.3.4 Use of Generic Data The primary sources used for generic data were: NUREG/CR-2815, NUREG/CR-4550, IEEE Std. 500-1984, and NUREG/CR-2728.

l The generic data used in the Dresden IPE are comparable to the data used in other IPE/PRAs.

2.3.5 Common-Cause Quantification The MGL method was used to model common cause failures. [IPE submittal, Section 3.3.4] The data for common cause failures were taken from EPRI NP-3967.

The Submittalimplies that a Dresden-specific evaluation of common cause failure

.g events was performed for certain types of components, and generic common cause failure data were applied to other components. Based on the discussion of this evaluation provided in the Submittal, this evaluation involved screening generic data for applicability and reducing the failure values based on a qualitative assessment of Dresden-specific programs and practices.

The values assigned to common cause failures were reviewed. Table 4.4.3-1 of the Submittal lists the common cause failure data MGL factors. We compared selected i

beta factors from this table in the Submittal to those used in other IPE/PRAs;.

Table 2-2 of this report summarizes the comparison. (Quad Cities common cause factors are also included in the table.)

Based on the information from Table 2-2 of this report, the common cause failure factors used in the Dresden IPE are significantly lower than the values used in typical IPE/PRAs. -

The licensee stated that the common cause database was screened to make it plant specific, using expert opinion. In our opinion, the licensee has not provided a complete basis for using significantly lower common cause failure values for many important components in the plant, than the values used in almost every other IPE and PRA.-

21

=r

,r-

~

-w

t e

Table 2-2 Common Cause $ Factors for 2-of-2 Components

.l Component Dresden Value IPE Quad Cities Value Value form Source Submittal Table IPE Submittal Table as Indicated in 4.4.3-1 4.4.3-1 Footnote l

Diesel Generator 0.004 0.002 0.04 W

0.03 "I fail to run (0.006 for fail to start}

(

MOV 0.01 0.01 0.05 U) 0.09 ")* ")

i 0.05 ")

Residual Heat Not Provided 0.009 0.1 U)*

Removal (RHR) 0.2 ")

0.1 "I fail to start Pump

{0.02 for fail to run}

Electromagnetic 0.2 Relief Valve Safety Relief Valve 0.06 0) 0.2 0.1 Safety / Relief Valve 0.2 "3 0.3 ") fail to open on pressure (0.1 fail to open on signal}

High Head Pump 0.032 0.009 0.2 03 W Core Spray Pump 0.072 0.009 0.2

0.2 fail to start (0.02 for fail to run}

Service Water 0.0011 0.009 0.03

)*

0 Pump Circuit Breaker 0.054 0.04 0.2 ) for 480 V and i

higher 0.07 ") for less than 480 V HPCl/RCIC Turbine Not Applicable Not Provided 0.02 fall to start )

Pump (0.009 for fall to run}

(1)

NUREG/CR 4550 Peach Bottom, Table 4.9-1.

(2)

NUREG/CR 4550 Grand Gulf, Table 4.9-29 (3)

NRC IPE Review Guidance, Rev 1, November 1993 (4)

PLG Generic Data in Brown Ferry IPE submittal Table 3.3.4-10.

22

,,e.

yr-

2.4 Interface issues 1

This section of the report summarizes our review of the interfaces between the front-end and back-end analyses, and the interfaces between the front-end and human factors analyses. The focus of the review was on significant interfaces that affect the ability to prevent core damage.

2.4.1 Front-End and Back-End Interfaces if main feedwater is being used to cool the core, then the IPE assumed that loss of containment cooling, failure of containment venting, and containment failure by overpressurization does not impact core cooling with main feedwater.

Without suppression pool cooling and without injection with the SBCS, low pressure ECCS pumps pulling from the suppression pool willlose adequate NPSH before venting pressure is reached. The Submittal states that a procedural change is being implemented to allow long term transfer of LPCI or core spray from the suppression pool to the CST to allow for continued operation of these systems for core cooling with loss of containment cooling. [lPE submittal, Section 4.6.4] The Submittal states that this change will lower the overall CDF by a factor of 5. Additional information provided by the licensee indicates that this change has been implemented at Dresden.

As previously discussed, containment isolation does not result in loss of cooling to the recirculation pump seals.

The PRTs modeled both the front and back end aspects of accident sequences thereby negating the need for binning of core damage sequences into Plant Damage States (PDS) for back end quantification.

2.4.2 Human Factors Interfaces

~

Based on the front-end review, the following operator actions were noted for possible consideration in the review of the human factors aspects of the IPE:

1 l

Initiation of Suppression Pool Cooling Use of SBCS to preserve NPSH from Suppression pool Crosstie of AC Power between the two Units initiation of iso (ation Condenser mode of cooling

=

Manual Depressurization of the Vessel inhibition of ADS and initiation of Standby Liquid Control during an A1WS.

e i

23 i

i 2.5 Evaluation of Decay Heat Removal and Other Safety lasues This section of the report summarizes our review of the evaluation of Decay Heat Removal (DHR) provided in the Submittal. Other generic safety issues / unresolved safety issues (GSl/USIs), if they were addressed in the Submittal, were also reviewed.

i 2.5.1 Examination of DHR 1

About 69% of the total CDF involved failure of suppression pool cooling: 55% due to hardware failure and 14% due to operator error. With the change to allow for long term alignment of LPCI and core spray to the CST if suppression pool cooling is lost, the contribution of loss of suppression pool cooling to the overall CDF decreases to about 8%.

No vulnerabilities associated with DHR were identified as a result of the IPE.

2.5.2 Diverse Means of DHR The IPE evaluated the diverse means for DHR, including: use of the power conversion system, the isolation condenser, and ECCS.

Section 4.6.4 of the Submittal provides a description of the ways for providing DHR at the Dresden plant. The Submittal points out that long term use of the isolation condenser requires 125 V DC power. As discussed in Section 2.7 of this report, the licensee has implemented a procedural change which removes the long term dependence of use of the isolation condenser on 125 V DC power. The SBCS system can be used to inject water to maintain adequate NPSHA forlow pressure ECCS pumps pulling from the suppression pool if suppression pool cooling is lost. As discussed in Section 2.7 of this report, the licensee has implemented a procedural change to allow long term switchover of LPCI and core spray pumps from the suppression,poolto the CST to preserve use of these core cooling systems with loss of adequate NPSHA from the suppression pool.

2.5.3 Uniaue Features of DHR Design features at Dresden that impact the Core Damage Frequency (CDF) from loss of DHR are as follows:

Isolation condenser for shutdown cooling with secondary makeuo available from diesel-driven oumos. The isolation condenser has makeup water provided by diesel-driven pumps thereby not requiring DC power for pumping as does a typical Reactor Core isolation Cooling (RCIC) system; this tends to decrease the CDF from station blackout.

24 1

Automatic isolation of the isolation condenser after loss of 125 V DC oower at one unit. The isolation condenser at Dresden automatically isolates on loss of DC power; this tends to increase the CDF from loss of DC power. The licensee has instituted a procedural change to allow continued operation of the isolation condenser after station blackout; this tends to decrease the CDF from station blackout but has no impact on the CDF from loss of DC power.

Ability to crosstie AC nower between the two units. AC power can be crosstied i

between the two units thereby reducing the CDF from station blackout.

Shared DC nower between the two unks. Loss of DC power at one unit results in automatic loss of the isolation condenser. This tends to increase the CDF; i

loss of DC power at one unit dominated the total CDF. (It is noted that each l

unit has one train of 125-V DC power that serves both units. Loss of 125 V DC power at one unit causes partialloss of DC power at both units.)

Net oositive suction head (NPSH) maroin for low-oressure emergency core coolina system (ECCS) oumos using the suooression oool. The low pressure ECCS pumps lose adequate NPSH from the suppression pool if containment cooling is lost even if containment venting is successful; this tends to increase the CDF.

2.5.4 Other GSI/USls Addressed in the Submittal No other GSI/USis are addressed by the IPE Submittal for Dresden. (IPE submittal, Section 2.6]

2.6 Intemal Floodng This section of the report summarizes our reviews of the process used to model internal floogling and of the results of the analysis of internal flooding.

2.6.1 Internal Floodina Methodoloav J

Much of the analysis for internal flooding was based on the Appendix R Safe Shutdown Report.

The Submittal states that the only flood source which curvived qualitative screening is in the units 2 and 3 condensate pump rooms, and that the frequency of this flood is 1.2 x 10~8 per reactor year. This flood was screened from analysis since the Submittal contends that it has the same effect on mitigating systems as does the much more likely initiating event, loss of feedwater. Therefore, no further analysis of flood mitigation was performed.

25 e,,

w r-

1 l

The methodology for intemal flooding evaluated detrimental effects other than submergence; that is, it considered spray induced failures.

2.6.2 Intemal Floodino Results j

The IPE screened intemal flooding from further consideration and did not quantify the CDF from internal flooding.

j The licensee states that because of failures due to water spray identified in the Quad Cities IPE, further consideration was given to the effects of water spray in the Dresden i

IPE. [TER Quad Cities) The additional information states that the re-evaluation indicates that water spray can increase the frequency of the loss of DC power initiating

- event for Unit 3 but not for Unit 2, thereby increasing the CDF due to loss of DC power for Unit 3 but not for Unit 2. The response states that consideration of loss of.

DC power at Unit 3 from water spray increases the overall CDF by 48% for Unit 3.

The licensee also discusses the improvements implemented since the date of the

- Submittal as discussed in Section 2.7 of this report, namely: (1) a procedure to transfer LPCI or core spray from the suppression pool to the CST over the long term if containment cooling is lost, and (2) operator action to prevent automatic isolation of the isolation condenser during station blackout. With these changes, the CDF for Unit 2 is estimated as 3.67E-6/ year and the CDF for Unit 3 is estimated as 4.36E-6/ year, the difference being the susceptibility of Unit 3 to loss of DC power from water spray.

2.7 Core Damage Sequence Results This section of the report reviews the dominant core damage sequences reported in the Submittal. The reporting of core damage sequences-whether systemic or functional-is reviewed for consistency with the screening criteria of NUREG-1335.

The definition of vulnerability provided in the Submittalis reviewed. Vulnerabilities, enhancements, and plant hardware and procedural modifications, as reported in the Submittal, are reviewed.

2.7.1 Dominant Core Damage Seauences The IPE utilized systemic event trees, and reported results using the screening criteria from NUREG 1335 for systemic sequences. [lPE submittal, Section 4.6]

l Table 4.5.3-1 of the Submittal lists the top 100 core damage sequences.

The total CDF from internal initiating events was 1.85E-5/ year. Internal flooding was screened from quantification in the original IPE; section 2-7 of this report summarizes j

the updates to the IPE.

Table 2-3 of this report summarizes the CDF by initiating event.

26

$7 7

p -

1 T

EN' r-+T-W r'

r-

u-ei

-pw

-rr~-

8

t

.~

Table 2-3. CDF By initiating Event Initiating Event (IE)

IE Frequency CDF Percent of CDF (1/ year)

(1/ year)

Loss of 125-V DC 8.7E-4 1.1 E-5 60.2 Power at One Unit '

l Loss of Offsite 9.6E-2 3.7E-6 19.9 Power to a Single Unit Medium LOCA 8.0E-4 1.4E-6 7.5 Loss of Offsite 1.6E-2 1.2E-6 6.9 power to Both Units o

ATWS 2.3E-4 5.3E-7 2.9 General Transient 7.4 2.7E-7 1.4 Inadvertent Open 7.1 E-2 1.8E-7 1.0 Relief Valve Large LOCA 3.0E-4 3.7E-8 0.2 Small LOCA 3.0E-3 6.2E-9

<0.1 Interfacing 1.1 E-4 4.3E-4 0.1 Systems LOCA Loss of 125 V DC power at one unit causes partial loss of DC power at both units, but does not cause total loss of DC power to either unit since each unit has one train of 125 V DC power that serves both units. However, loss of DC power at one unit results in automatic loss of the isolation condenser. [lPE submittal, Figure 4.2.1.7-6]

The Submittal does not specifically provide the CDF by accident class, but information in Table 1.5.1-2 of the Submittalindicates:

The plant-specific transient loss of 125-V DC power contributes about 60% to the total CDF Loss of offsite power (single or dual) without station blackout contributes about 20% to the total CDF LOCAs contribute about 7% to the CDF

=

Station blackout contributes about 5% to the CDF 27

AN/S contributes about 2% to the CDF General transients contribute about 1% to the total CDF.

The top five sequences are summarized in Table 2-4 of this report.

Table 2-4. Top 5 Systemic Core Damage Sequences initiating Event and Subsequent Failures Sequence Frequency Failures Due to initiating 1/ year and CDF Percent Event l

Loss of 125-V DC Power Suppression Pool Cooling 8.2E-6 i

at One Unit Hardwarc Falls 44 %

[ Automatic isolation of isolation Condenser)

Loss of 125-V DC Power Operator falls to initiate 1.7E-6 at One Unit Suppression Pool Cooling 9.0%

[ Automatic isolation of Isolation Condenser]

Medium LOCA Operator fails to initiate 5.0E-7 Suppression Pool Cooling 2.7 %

Loss of Offsite Power to a Loss of Swing DG and 4.3 E-7 Single Unit Loss of Bus 24-1 (Station 2.3%

Blackout), Operator falls to provide Makeup to isolation Condenser Medium LUCA HPCI Fails, Operator Fails 3.9 E-7 to Depressurize 2.1%

Based on the discussions of the dominant core damage sequences, important failures in mitigating systems were: failures of MOVs, operator failure to initiate suppression pool cooling, failure of DG 2/3, operator failure to align to bus 24-1, operator failure to provide makeup to the isolation condenser, operator failure to depressurize, and failure of the HPCI pump.

The IPE calculated that station blackout contributes 5% to the overall CDF of 1.85E-5/ year. [lPE submittal, Table 1.5.1-2 and Table 1.6.2-1) This is a low contribution from station blackout compared to that calculated in most BWR IPE/PRAs.

1 28

c

\\

l

~

Since the IPE modeled the isolation condenser as being lost during station blackout i

after the 125-V DC batteries deplete, which was after 4 to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , the obvious j

question is "Why is the CDF from station blackout so low in the IPE?". The answer can be deduced by evaluating the major sequences contributing to core damage from i

station blackout where core damage was due to loss of DC power prior to recovery of -

offsite power resulting in loss of the isolation condenser. Table 1.6.2-1 of the Submittal Ests the dominant station blackout sequences, which in total contribute 5% to the total CDF. Table 4.5.3-1 tabulates the events for these sequences. These dominant sequences can be divided into two classes based on the initiating event: (1) those initiated by dual unit loss of offsite power (LOSP), and (2) those initiated by.

single unit LOSP. The top three station blackout sequences-7,14, and 15-contribute about 4% to the total CDF. Sequences 7 and 14 are both initiated by dual unit LOSP y

and sequence 15 is initiated by single unit LOSP. (Note that all these sequences include a probability of 1.0 for operators falling to open circuit breakers to prevent loss of the isolation condenser after the batteries deplete; this is event OIC2 in the sequence event listings.) The frequency for dual unit LOSP is lower than that for single unit LOSP (1.6E-2/ year compared to 9.6E-2/ year), but with single unit LOSP the unit with the loss of power can be powered by crosstie of offsite power from the other unit. As indicated in sequence 15, for single unit LOSP the probability for failure to crosstle offsite power from the other unit is 8.78E-3. Therefore, the frequency of total LOSP to a unit for the two cases is: (1) 1.6E-2/ year for dual unit LOSP, and (2) about 8.4E-4/ year for single unit LOSP considering crosstie from the other unit. The frequency for LOSP used in other IPEs is higher, typically about 0.05/ year, due to either: a 1 unit site, inability to crosstle power among units at a multi-unit site, or conservatively modeling LOSP at a multi-unit site as LOSP to all units. The distinction between single and dual unit LOSP and credit for crosstle of power between units for single unit LOSP reduced the contribution of station blackout to overall CDF by about a factor of 3 (0.05/0.016). This distinction reflects the plant design.

Another factor that reduces the contribution of station blackout to overall CDF is the relatively low probability used for non-recovery of offsite power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . As indicated in the listing of sequences in Table 4.5.3-1 and in the data of Table 4.5.2-1, the probability of non-recovery of offsite power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months was taken as 0.0205; this is about a factor of 6 lower than the probability used in many PRA/IPEs.

[NUREG/CR 6144][NSAC-147) Figure 2-1 of this report compares the data used for non-recovery of offsite power in the Dresden IPE to typical data. For comparison purposes, the Nine Mile Point 1 IPE used a probability for non-recovery of offsite power of 0.07 at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . [TER Nine Mile Point 1) The licensee provided the values j

given in Table 2-5 of this report: [TER, Quad Cities) j Note that the probability of non-recovery by 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months used in the Quad Cities IPE is 0.067, a factor of 3.3 higher than that used in the Dresden IPE. Compared to typical data used, the data used in the Dresden IPE for recovery of offsite power results,in a lower CDF from station blackout by about a factor of 3 to 6.

29 i

.L ii,,'

i,i:l 00 1

1 1

y is

,i n

r

,i r

w e

e

,i w

o v

d E o

t P P

o

.i uI 7 e

hn4 t

c Se1 s

i e

ydC

\\

ff 0

O sA r

R is I

ii r e 1

f

\\

urS

.h o

.t y

r o

SDN b

i r

l i

,9 e

m o

._i g

o v

ii f

r c

p' 1

e a

ii

,h s R

\\

r r

t s

s u

o a

.'(-

of a Dr b

h t

1 a

f e

N D

,e f

0 ow s[

mo s

3 n

iT o

n o s

oP irap s e m

i o

rt C

i a s iJ 0

1 pf 4

1-2 mO iL f

a e

ru of g

i Co F

1 0

i 1

10 0

0 0

wegg,ygO pG:oGg!$ yED,D2n-s

Table 2-5. Offsite Power Recovery Data used in Quad Cities IPE Compared to Data in Surry Shutdown PRA Duration (hrs)

Probability of Not Probability of Not Recovering Offsite Power Recovering Offsite Power IPE Value

[NUREG/CR 6144]

O 1.0 1.0 l

0.5 0.61 0.61

)

1 0.37 0.45 2

0.14 0.28 3

0.096 0.18 4

0.067 0.13 5

0.058 0.10 6

0.051 0.08 7

0.044 0.06 8

0.038 0.05 9

0.036 0.04 10 0.033 0.03 11 0.031 12 0.028 13 0.026 14 0.024 15 0.023 0.02 16 0.021 0.02 The licensee provided information with regard to the basis for the relatively low values used for failure to recover offsite power during station blackout. This information included the calculation used to calculate the probabilities for recovery of offsite power in the Dresden IPE. [lPE Responses 2] The calculation used the selection criteria of NUREG-1032 to quantify recovery. The calculation concluded that Dresden is in switchyard configuration group 12, a grid group G1 and a grid reliability / recovery group GRS, a severe weather / recovery group SR7, and an extremely severe weather loss of offsite power frequency group SS1. Consideration of these subgroups places Dresden 31

4 in the Offsite Power Cluster Group 1. Data from NUREG-1032 for this cluster group were used with exponential interpolation used to calculate values for times between the data points in the NUREG, and the results were used for the probabilities of not recovering offsite power as a function of time.

We conclude that the CDF from station blackout in the IPE is relatively low for three reasons:

(1) distinguishing between single and dual unit LOSP (2) data used for non-recovery of offsite power by 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (3) use of common cause factors for failures of the DGs lower than typically assumed in other IPE/PRA studies (as discussed in section 2.3.5 of this report)

The assumption that seal leakage is negligible during station blackout is a notable assumption used in the IPE. The licensee states that this leakage was conside ed negligible. [lPE Responses, Question #5) The fact that the IPE did not address vessel leakage during cooling with the isolation condenser during station blackout has little impact on the CDF as calculated in the IPE since the IPE assumed that the isolation condenser is lost due to battery depletion anyway.

The licensee provided information verifies that two changes have been implemented as a result of the IPE: (a) a procedural change to align LPCI and core spray to the CST prior to loss of adequate NPSH, and (b) a procedural change to direct operators to open isolation condenser valve circuit breakers. These changes lower the overall CDF by about 76%, from 1.85E-5/ year to 4.36E-6/ year, for Unit 3, and they lower the overall CDF by about 80%, from 1.85E-5/ year to 3.67E-6/ year, for Unit 2. [lPE Responses, Pages 13-6 and 13-7 for Question 13) With operator action to open isolation valve circuit breakers, the IPE model assumes that the isolation condensers can indefinitely cool the core during station blackout with no AC or DC power and with no makeup to the vessel, since makeup to the secondary of the isolation condensers can be provided with diesel-driven pumps.

An IPE for another BWR plant with isolation condensers calculated that 63% of the total CDF was due to station blackout. In this IPE, the top two specific accident sequences both lead to core damage due to station blackout with successful operation of the isolation condensers but loss of vessel inventory by leakage; these two sequences alone contributed 28% to the total CDF. [Nine Mile Point 1 IPE] [TER, Nine Mile Point 1]

The IPE distinguished between core damage sequences and sequences denoted as

)

success with accident management (SAM). A SAM sequence is one for which core damage does not occur within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time, but for which core damage will eventually occur unless accident management actions are taken. The licensee 4

provided information as to the magnitude of the SAM sequences, and the major actions required to prevent core damage for these sequences. The licensee states 32

l k

that the sum frequency of the SAM sequences is 7.3E-7/ year. Major actions for recovery include: recovery of the isolation condenser and recovery of standby liquid l

control.

The licensee states that the estimated CDF for Dresden has changed since the date of the original IPE. With he inclusion of failure of DC power due to water spray effects, the total CDF for Unit 3 increased by 48% but the total CDF for Unit 2 did not change. With implementation of the two procedural actions to: (1) realign LPCI or core spray to the CST if suppression pool cooling is lost and (2) rack out circuit breakers to l

prevent automatic isolatica of the isolation coridenser during station blackout, the CDF for both units decreased. With credit for these changes and considering the loss of DC power in Unit 3 due to water spray, the total CDF for Unit 2 is 3.76E-6/ year and 7

the total CDF for Unit 3 is 4.36E-6/ year, the difference being due to the CDF from water spray causing loss of DC power in Unit 3.

Loss of DC power at a unkis an important initiating event in terms of overall CDF.

The licensee indbcated that15 insights were identified that would either eliminate or ameliorate the effects of loss of 125 V DC; some of these insights will require major modifications and others ut only require changes to procedures. One procedural change has been implemented, specifically that dealing with prevention of automatic isolation of the isolation condenser during station blackout. There is a minor modification under active consideration that will eliminate the 125 V DC as an initiating event.

2.7.2 Vulnerabilities No definition of 'Vulnerabuty" was provided in the Submittal.

Section 7.2 of the Submbial states that there are no vulnerabilities, based on the low overall core damage frequency. (IPE submittal page 7-7]

2.7.3 Procosed imorovements and Modifications As a result of the IPE,130 insights were developed and evaluated. (IPE submittal Section 4.7] The evaluations were performed using the NUMARC Severe Accident Closure Guidelines.

The evaluation indicated Amt the greatest reduction in plant risk could be achieved by implementing a procedure change for realignment of core spray or LPCI to the condensate storage tank,to prevent loss of adequate NPSH for the pumps when pulling from the suppression pool without suppression pool cooling. CECO has decided to implement this procedure at Dresd6n. This change was credited in the IPE for Quad Cities. The CDF was recalculated with this change in procedure. (IPE submittal Section 6.0] This change lowered the CDF from 1.85E-5 to 3.75E-6 per-reactor year. [lPE submmal Table 6.2-1]

33

,,n.,

+w+

l l

l One other procedural change was planned as a result of the IPE. This procedural change is directed at ensuring operability of the isolation condenser during station blackout. [lPE submittal Section 1.6.3) The change being considered is operator action to open circuit breakers for the 250 V DC operated valves in the isolation condenser piping prior to depletion of DC batteries under station blackout conditions.

The licensee indicates that both of these procedural changes have been implemented at Dresden.

f I

e i

b e

l l

34 I

~.

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS 4

This section of the report provides our overall evaluation of the quality of the front-end portion of the IPE based on this review. Strengths and shortcomings of the IPE are summarized. Important assumptions of the model are summarized. Major insights from the IPE are presented.

Strengths of the IPE are as follows. The model did recognize the design characteristic of the NPSH margin for the low pressure ECCS pumps such that adequate NPSHA is lost for these pumps pulling from the suppression pool if suppression pool cooling ic lost and no compensatory actions are taken.

Shortcomings of the IPE are as follows. (1) The common cause failum factors are j

much lower than those typically used in IPE/PRAs based on the plant specific screening evaluation employed. Common cause failures are subtle and it is possible that the licensee has underestimated the potential for common cause failures. (2)

Only one plant-specific initiating event was evaluated (loss of 125 V DC power at one unit) and that initiating event dominated the CDF. Other IPE/PRAs address plant-specific initiating events in more detail and retain more than one such event for quantification. The IPE for Dresden has not demonstrated that all potentially important plant-specific initiating events were evaluated. (3) The Dresden IPE assumed that leakage from recirculation pump seals is a negligible effect during station blackout. A recent IPE for a similar plant addressed leakage from recirculation pump seals and it dominated the CDF for that plant. For BWRs with isolation condensers, shutdown cooling can be provided without injection to the vessel, but leakage from failed seals can negate the effectiveness of the isolation condenser.

On the basis of our review, the following aspects of the modeling process have an impact on the overall CDF:

Quantification of only one olant-soecific initiatina event. If more plant-specific f

initiating events had been quantified for core damage-as is typically the case in other IPE/PRAs-the CDF might have been increased.

i Neatioible leakaae from recirculation oumo seals durina station blackout. The CDF from station blackout could be higher if the IPE had considered leakage from the recirculation pump seals; seal leakage cannot be isolated during station blackout and cooling with the isolation condenser does not provide makeup to the vessel.

Credit for maintainino adeaunte NPSH from the suooression cool after loss of suooression oool coolina bv either inlectina water to the suooression oool to allow continued use of low-oressure ECCS oumos or by realianina low-oressure ECCS oumos to in_ lect from the Condensate Storage Tank (CST).

The CDF was significantly reduced by crediting these compensatory actions to 35

~

. ~., -.

_. ~..

maintain the use of low pressure ECCS systems following loss of suppression l

pool cooling.

The low common cause failure factors used. The use of common cause failure factors lower than typically assumed in other IPE/PRA studies lowered the CDF.

Significant level-one IPE findings are as follows:

Loss of 125 V DC power at one unit dominates the CDF.

Station blackout is a low contributor to the CDF.

Realigning the low pressure ECCS pumps to the CST over the long term after loss of suppression pool cooling substantially decreases the total CDF.-

Loss of 125 V DC at one unit results in loss of the ability to use the isolation condenser for core cooling. Station blackout is a low contributor to the total CDF due to the ability to cross tie power between the units, due to the high probability for.

recovery of offsite power, and due to the low common cause failure factors used for Diesel Generators (DGs). Credit for realigning the low pressure ECCS pumps to the CST over the long term after loss of suppression pool cooling decreases the total CDF by a factor of 5.

l 9

36

4. DATA

SUMMARY

SHEETS This section of the report provides a summary of information from our review.

Overall CDF The total CDF from intemal initiating events was 1.85E-5/ year. Internal flooding was screened from quantification in the original IPE. (in responses to RAI, the licensee provided summary information of an updated analysis; this update is discussed in previous sections of this report.)

Dominant Initiatina Events Contributina to CDF Initiating Event (IE)

IE Frequency CDF Percent of CDF (1/ year)

(1/ year)

Loss of 125 V DC 8.7E-4 1.1 E-5 60.2 Power at One Unit '

Loss of Offsite 9.6E-2 3.7E-6 19.9 Power to a Single Unit Medium LOCA 8.0E-4 1.4 E-6 7.5 Loss of Offsite 1.6E-2 1.2E-6 6.9 power to Both Units ATWS 2.3E-4 5.3E-7 2.9 General Transient 7.4 2.7E-7 1.4 inadvertent Open 7.1 E-2 1.8E-7 1.0 Relief Valve Large LOCA 3.0E-4 3.7E-8 0.2 Small LOCA 3.0E-3 6.2E-9

<0.1 Interfacing 1.1 E-4 4.3E-4 0.1 Systems LOCA 37

Dominant Hardware Failures and Ooerator Errors Contributina to CDF Based on the discussions of the dominant core damage sequences, important failures in mitigating systems were: failures of Motor Operated Valves (MOVs), operator failure to initiate suppression pot' cooling, failure of Diesel Generator (DG) 2/3, operator fa'm to align to bus 24-1, operator failure to provide makeup to the isolation cor,.

or, operator failure to depressurize, and failure of High Pressure Core injection (HPCI) pump.

Dominant Accident Classes Contributing to CDF The plant specific transient loss of 125 V DC power contributes about 60% to the total CDF Loss of offsite power (single or dual) without station blackout contributes about 20% to the total CDF LOCAs contribute about 7% to the CDF station blackout contributes about 5% to the CDF ATWS contributes about 2% to the CDF General transients contribute about 1% to the total CDF.

Desian Characteristics Imoortant for GDE The following design features impact the CDF:

I Isolation condenser for shutdown cooling with secondary makeup available from diesel-driven pumps.

Automatic isolktion of the isolation condenser after loss of 125 V DC power at one unit.

Ability to crosstie AC power between the two units.

j Shared DC power between the two units.

1 Net positive suction head (NPSH) margin for low-pressure emergency core cooling system (ECCS) pumps using the suppression pool.

The impact of these design features on the overall CDF is discussed in Section 1.2 of this report.

~

Modifications The evaluation indicated that the greatest reduction in plant risk could be achieve'd by implementing a procedure change for realignment of core spray or LPCI to the 38 I

4

~.

condensate storage tank, to prevent loss of adequate NPSHA for the pumps when pulling from the suppression pool without suppression pool cooling. CECO has -

j decided to implement this procedure at Dresden. This change was credited in the IPE for Quad Cities. The CDF was recalculated with this change in procedure. [lPE submittal Section 6.0) This change lowered the CDF from 1.85E-5 to 3.75E-6 per i

reactor year. [lPE submittal Table 6.2-1]

One other procedural change is being considered as a result of the IPE. This procedural change is directed at ensuring operability of the isolation condenser during station blackout. [lPE submittal Section 1.6.3) The change being considered is operator action to open the 250 V DC operated valves in the isolation condenser j

piping piior to dep!stion of DC batteries under station blackout conditions.

The licensee responses to our questions indicates that both of these procedural changes have been implemented at Dresden. [lPE Responses)

Other USI/GSis Addressed No other GSI/USis are addressed by the IPE Submittal for Dresden.

Sionificant PRA Findinas Significant findings on the front-end portion of the IPE are as follows:

Significant level-one IPE findings are as follows:

Loss of 125-V DC power at one unit dominates the CDF.

Station blackout is a low contributor to the CDF.

Realigning the low pressure ECCS pumps to the CST over the long term after loss of suppression pool cooling substantially decreases the total CDF.

~

Loss of 125 V DC at one unit results in loss of the ability to use the isolation condenser for core cooling. Station blackout is a low contributor to the total CDF due to the ability to cross tie power between the units, due to the high probability for recovery of offsite power, and due to the low common cause failure factors used for Diesel Generators (DGs). Credit for realigning the low pressure ECCS pumps to the CST over the long term after loss of suppression pool cooling decreases the total CDF by a factor of 5.

i 39

REFERENCES

. [CL 88-20]

' Individual Plant Examination For Severe Accident Vulnerabilities - 10 CFR 50.54 (f)', Generic Letter 88.20, U.S. Nuclear Regulatory Commission, November 23,1988

[NUREG-1335]

' Individual Plant Examination Submittal Guidance",

NUREG-1335, U. S. Nuclear Regulatory Commission, August,1989

[lPE]

Dresden IPE Submittal January 28,1993

[lPE Responses]

Letter from J.D. Peter Piet CECO to NRC, October 28,1994

[lPE Responses 2]

Letter from John Schrage CECO to NRC, December 23,1994

[UFSAR]

Updated Final Safety Analysis Report for Dresden

[NUREG/CR

" Analysis of Core Damage Frequency: Peach 4550 Peach Bottom]

Bottom, Unit 2 Intemal Events", NUREG/CR-4550, Vol. 4. Rev.1, Part 1, August 1989.

[lPE Quad Cities]

IPE Submittal for Quad Cities

[Nine Mile Point 1 IPE]

IPE Submittal for Nine Mile Point 1

[TER, Quad, Cities]

SEA TER for Quad Cities IPE Submittal ITER, Hatch]

SEA TER for Hatch IPE Submittal i

ITER, Nine Mile Point 1]

SEA TER for Nine Mile Point 1

[NUREG/CR 6144]

Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations at Surry, Unit 1,"

NUREG/CR-6144, Vol. 2, Pa.11 A, June 1994.

i 40 i

1

)

ENCLOSURE 3 DRESDEN UNITS 2 & 3 INDIVIDUAL PLANT EXAMINATION TECHNICAL EVALUATION REPORT I

i 1

i (BACK-END) l I

l l

I t

1 l

i i

I

,

ML20097J762

Text

SUMMARY

Navigation menu

Search