ML20100D240

App B, Plant Technical Evaluation Rept on IPE Back-End Analysis

ML20100D240
Person / Time
Site:	Nine Mile Point
Issue date:	08/31/1995
From:	Amarasooriya W, Meyer J, Moieni P SCIENTECH, INC.
To:	NRC
Shared Package
ML17059B097	List: ML20100C909 ML20100D240 ML20100D247
References
CON-NRC-05-91-068-31, CON-NRC-5-91-68-31 SCIE-NRC-230-94, NUDOCS 9602050054
Download: ML20100D240 (42)

Text

_ . _ _ _ _ _ _ _ . - . . _ _ . . ._ _ . _

h f

NINE NILE POINT NUCLEAR STATION UNIT NO. 1 INDIVIDUAL PLANT EXAMINATION TECHNICAL EVALUATION REPORT (BACK-END) 1 I

i I

l i

a Enclosure 3 l (gop050:st/ XR 2nyp; Notoa

._ _ ____. _ _ ~ _ _ _

SCIE-NRC-230-94 l

NINE MILE POINT UNIT 1 ,

TECHNICAL EVALUATION REPORT ON THE l INDIVIDUAL PLANT EXAMINATION l BACK-END ANALYSIS l

P. Moieni W. H. Amarasooriya J. F. Meyer l

l l

Prepared for the U.S. Nuclear Regulatory Commission l Under Contract NRC-05-91-068-31 i August 1995 SCIENTECH, Inc.

11140 Rockville Pike, Suite 500 Rockville, Maryland 20852 l

l

TABLE OF CONTENTS ERER E. EXECUTIVE

SUMMARY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv E.1 Plant Characterization . . . . . . . . . . . . . . . . ...................iv E.2 Licensee IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv E. 3 Back-End Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' . . . . . v E.4 Containment Performance Improvements (CPI) . . . . . . . . . . . . . . . . . . . . . vi E.5 Vulnerabilities and Plant Improvements . . . . . . . . . . . . . . . . . . . . . . . . . vii E. 6 Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii  :

)

1. INTRODUCTION ........ ................................I 1.1 Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.2 Plant Characterization .................................... 1

2. TECHNICAL REVIEW . . . . . . . . . . . . . . . . . . . . . . '. . . . . . . . . . . . . .4 l

2.1 Licensee IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1.1 Completeness and Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . 4 i 2.1.2 Multi-unit Effects and As-Built, As-Operated Status . . . ..........5 1

1 2.1.3 Licensee Participation and Peer Review .....................5 1 2.2 Containment Analysis / Characterization . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.2.1 Front-end Back-end Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . 5 l

l 2.2.2 Sequences with Significant Probabilities .. ..................7 2.2.3 Failure Mode and Timing . . . . . . . . . . . . . . . . . . . . . . . ..... 10 Nine Mile IPE Back-End Review ii August 1995

\

l I

i

i l

2.2.4 Containment Isolation Failure ........................... 15 2.2.5 System / Human Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2.6 Radionuclide Release Characterization ...................... 16 2.3 Accident Progression and Containment Performance Analysis ........... 19 2.3.1 Severe Accident Progression . . . . . . . . . . . . . . . . . . . . . . . . ... 19 2.3.2 Dominant Contributors: Consistency with IPE Insights ............ 23 2.3.3 Characterization of Containment Performance . . . . . . . . . . . . . . . . . . 24 2.3.4 Impact on Equipment Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 l i

2.4 Reducing Probability of Core Damage or Fission Product Release . . . . . . . . . 25 1 1

2.4.1 Definition of Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1 2.4.2 Plant Improvements ................................. 25 ,

i 2.5 Responses to CPI Program Recommendations . . . . . . . . . . . . . . . . . . . . . 25 2.6 IPE Insights, Improvements and Commitments .................... 26

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS ............... 27

4. REFERENCES .......................................... 30 APPENDIX l

l l

Nine Mile IPE Back-End Review iii August 1995

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ . . -~. .__

i j

i' e i E. EXECUTIVE

SUMMARY

{ This repon presents the results of SCIENTECH's review of the back-end ponion of the

{ individual plant examination (IPE) of Nine Mile Point Nuclear Station-Unit 1 (NMP1). l l I

E.1 Plant Characterization l Niagra Mohawk Power Corporation (NMPC) operates the NMP1 plant, which is located on

! the southeast shore of I.ake Ontario, approximately 6 miles nonheast of the city of Oswego.

. - NMP1 is a General Electrie design, boiling water reactor (BWR) Type 1 BWR 2 NSSS, whose rated thermal power level is 1850 MWt with a net electric power output of 620 MWe.

l The containment is a Mark I Type with a torus suppression design and multiple downcomers l that connect the drywell to the torus (pressure suppression pool). The plant has a mean failure pressure of 80 psia, substantially lower than that of other BWRs with Mark I

! containmentscand has a free volume of 300,000 cubic feet. The NMP1 plant has an j emergency condenser system, which presents a potential for containment bypass and/or j containment isolation failure.

E.2 Licensee IPE Process i

j The NMPC IPE was the joint effon of utility staff and external consultants. Five

! probabilistic risk assessment (PRA) analysts, a support network of more than 20 members of

various plant organizations, an in-house review group, and a team of consultants carried out

! the IPE.

l The overall approach taken by the IPE team was to perform a I.evel II PRA by estimating ,

i the frequency of radionuclide releases for a spectrum of postulated severe accidents. The  !

l NMP1 IPE model consisted of a directly linked set of system event trees (front-line and

] support) and containment event trees (CETs) and each accident sequence was studied from j i

the initiating event to the release of radionuclides. This method was used to assess suppon l

systems and intersystem dependencies as well as to the achieve the proper interface between i

the front-end and back-end analyses. Using this approach appears to have ensured that the support state conditions were properly accounted for throughout the front-end and back-end j trees. However, it is not easy to trace and review the results obtained from a very large

integrated risk model involving a very large number of accident sequences. The computer code, RISKMAN, was used for accident sequence quantification in the NMP1 IPE. The MAAP code was used for thermal-hydraulic calculations associated with both the front-end '

(for success criteria) and back-end (for deterministic containment loading calculations) analyses.

The IPE team performed several plant walkdowns and conducted interviews with plant personnel to become familiar with the plant, to collect information, and to verify the "as-built" plant configuration.

Nine Mile IPE Back-End Review iv August 1995

E.3 Back-End Analysis Based on the front-end analysis, the total mean core damage frequency (CDF) was estimated to be 5.5E-6 per year, which is comparable to CDFs estimated for similar BWR plants. The dominant initiating event contributors were reported to be station blackout (63 percent),

medium LOCA (7 percent), loss of instrumt nt air (7 percent), ATWS (6 percent), and small LOCA (4 percent). Interfacing system LOCA sequences that bypass containment contributed less than 1 percent to the total CDF.

Based on the back-end analysis, a large majority of CDF sequences would lead to some form i of containment failure (87 percent of the CDF) with a total radionuclide release frequency of l 4.7E-6 per year. The frequency of little or no release occurring and the containment i remaining intact was reported to be 7.0E-7 per year (13 percent of the CDF). However, absent operator actions, core damage would result in containment failure. [2] That is, there j j would be almost c100-percent chance of containment failure, given that there was a core damage event and no operator recovery actions were taken.

l It appears that the principal mode of containment failure would be shell failure coupled with j subsequent drywell head failure (41 percent of the total release) followed by wetwell

! overpressure failure (22 percent). Energetic failure modes of containment due to rapid

! overpressurization at RPV failure, steam explosion, direct containment heating (DCH) and j hydrogen detonation contributed 15 percent to the total release. The probability of

containment isolation failure was shown to be negligible due to a highly reliable containment i isolation system and also a normally inerted containment. Controlled venting of the drywell accounted for 4 percent of the total release.

j i As an indicator of plant response to accident initiators, the frequency with which a "large" l j radionuclide release would occur was used as an indicator of containment performance and l

• risk to the public in the back-end analysis, just as it was used in the front-end analysis. The "large" release category was defined based on the magnitude and timing of the radionuclide j releases. The category includes those accident sequences that would result in "high" releases

(greater than 10-percent Csl fission products) and "early," i.e., in less than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> following j accident initiation. According to the IPE, this definition is consistent with the NRC staff

! definition of a "large" release in SECY-90-405, but is dissimilar to the NUREG-1150 i

definition. The frequency with which a large radionuclide release would occur was estimated

! to be 6.9E-7 per year. This represents only 13 percent of the total release frequency. The dominant initiating event contributors were ATWS (40 percent), station blackout (28

} percent), medium LOCA (16 percent), small LOCA (5 percent), large LOCA (4 percent) and j interfacing system LOCA (4 percent). It appears that the principal mode of containment j failure for a "large" release would be wetwell overpressure failure (38 percent of a large i

release), primarily found to occur in ATWS sequences. Energetic failures during j containment flooding (21 percent) and non-flooded containment energetic failures

! (18 percent) were the other dominant containment failure modes leading to a large release.

1 v August 1995 Nine Mile IPE Back-End Review f

Containment bypass failures contributed only 3 percent to the large release frequency. The source terms were calculated using MAAP code, evaluated up to 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after RPV breach.

The IPE results show that station blackout (SBO) sequences contributed significantly to both the CDF and the frequency of large release. This is consistent with other IPE and PRA studies because in every plant most other support and front-line systems, including those for containment protection, depend on AC power to operate. ATWS sequences were shown not to be significant contributors to the CDF (mainly due to a highly reliable reactor protection system). However, ATWS sequences dominated the large release frequency (mainly because early containment failure would occur before or at the time of core damage due to rapid overpressurization and other energetic mechanisms).

According to NMPC, the NMP1 has re:iable safety systems. The overall CDF is 5.5E-6 per year, which is dominated by SBOs and LOCAs. No particular vulnerability to core damage was identified in the NMP1 IPE. Although the ATWS sequences were relatively small contributors to the CDF, they were the dominant contributors to the frequency of a "large" radionuclide release.

The containment analyses indicated an 87-percent conditional failure probability of the containment involving radionuclide release given core damage, and a 13 percent probability of an intact containment. The "large" release was shown to be dominated by wetwell overpressure failure mainly occurring in ATWS sequences. Containment isolation failures made a negligible contribution to large radionuclide releases and containment bypass failures contributed only 3 percent. The emergency condenser (EC) isolation failure was assessed, but only at high temperature because of the potential for creep rupture failure of the EC tubes. As is the case for other Mark I BWRs, hydrogen detonation was shown to make a negligible contribution to risk because the containment normally is inerted.

E.4 Containment Performance Improvements (CPI)

Discussion of the containment Performance Improvement (CPI) recommendations are scattered throughout the back-end IPE submittal. In performing the back-end analysis, the IPE team credited the following BWR CPI recommendations:

A hardened containment vent Implementation of Revision 4 of the BWR Owners Group EPGs Alternate water supply: Used the raw water cross-tie as an alternate injection source to RPV or as an alternate containment spray or flooding source.

Nine Mile IPE Back-End Review vi August 1995 l

1

The NMPC did not act on the CPI recommendation to enhance reactor pressure vessel depressurization system reliability, claiming that the reliability was sufficient and also citing some negative aspects of emergency depressurization.

The IPE submittal states that no evidence was found for unusually poor containment perfonnance, although the IPE team identified a number of accident management improvements, pnmarily mlating to emergency operating procedure (EOP) enhancement and operator training, which NMPC could implement to further reduce plant risk.

E.5 Vulnerabilities and Plant Improvements ,

l With regard to accident vulnerability, the IPE submittal states that the NMP1 plant'is considered to be free from vulnerabilities because the IPE results (both the CDF and frequency of large radionuclide release) were below the NRC proposed safety goals, which are 1.0E-4 for the CDF and 1.0E-6 for the frequency of a large release, per year.

Some unique NMP1 design features contribute to its low CDF and frequency of large releases. For example, NMP1 has four trains of containment spray, including heat i exchangers and raw water, which can spray the drywell and wetwell, or inject coolant into )

the suppression pool via torus cooling mode. In addition, NMP1 has a hardened containment vent and the capability of injecting fire water into the RPV through a feedwater injection path.

E.6 Observations The best-estimate containment ultimate pressure-temperature capability curve, as shown in Figure 4.4-8 of the IPE submittal, is substantially lower compared with those published for other Mark I BWRs. This is primarily due to two failure modes: 1) drywell-to-torus, single-ply, internal vent line bellows failure over a temperature range of 0* to 600* F, and '

2) drywell head silicone rubber gasket thermal degradation at extremely high temperature in conjunction with the drywell head low preload.

The submittal appears to be complete, comp',chensive, well documented, and in conformance with the GL 88-20 and NUREG-1335.

The conditional probability (conditional on there being core damage) for releases of Csl greater than 10 percent of the total Csl inventory is greater than 40 percent, a relatively large number. This included " intermediate" and " late" failures, as well as "early" failures. (If only "early" failures had been considered, the percentage for "high" Csl release (i.e., > 10%) would be much smaller, namely 13 percent or 6.93E-7/yr. However, because the IPE team defined these time increments ("early," " intermediate," and " late") differently than the way they are defined in NUREG-1150, caution must be used in comparing the "6.93E-7/yr" value with other IPE results or with the safety goal.) With a percentage Nine Mile IPE Back-End Review vii August 1995

greater than 40 percent for high releases, it is difficult to understand the IPE submittal position that the " containment has shown robustness in the face of a wide spectnim of severe accidents," and that there are no containment issues wonh considering further.

In the course of a complex back-end analysis, a number of assumptions had to be made. For 4 example, it was assumed that hydrogen deflagration would always result in containment '

failure, secondary containment failure, and a "large" release of radioactivity. It also was l assumed that the drywell shell melt-through would occur relatively quickly and with certainty j when its concrete floor came into contact with the core debris and water was not available to

quench the debris.

l The analysis employed was to directly link a set of system and containment event trees.

j Each sequence was treated from the initiating event to the back-end state, ensuring proper treatment of various dependencies. However, it is no easy task to trace and review the l

results from a very large integrated risk model involving a very large number of accident

sequences.

l As pan of the back-end analysis, three detailed CETs were developed that addressed passive and active plant and containment mitigating systems, operator recovery actions, and severe l; accident phenomenological issues such as shell melt-through, steam explosion, and DCH.

Plant-specific deterministic transient calculations using MAAP, probabilistic containment ,

ultimate capability analysis (containment fragility analysis), results from similar PRAs, and l

j engineering judgment were used to quantify CETs and subsequently assess the containment failure probabilities and the frequency of radionuclide releases. Phenomenological

uncertainties were addressed through sensitivity studies perfonned with MAAP as well as by j using insights gained from other studies.

5 One of the important groups of sequences that drives the final results of the NMP1 IPE is station blackout (63 percent, conditional on core damage). A station blackout resulted in J 74 percent of the "high" release, i.e., release greater than 10 percent of the Csl inventory.

Another contributor to the high release was the ATWS sequence group at 13 percent, although it was only a small percentage of the contribution to core damage at 6 percent. l J

i a

Nine Mile IPE Back-End Review viii August 1995

1. INTRODUCTION 1.1 Review Process This technical evaluation report (TER) documents the results of the SCIENTECH review of the back-end ponion of the Nine Mile Point 1 (NMP1) Individual Plant Examination (IPE) mbmittal. [1,2] This technical evaluation report complies with the requirements for reviews of the U.S. Nuclear Regulatory Comnussion (NRC) contractor task order, and adopts the NRC review objectives, which include the following:

• To determine if the IPE submittal provides the level of detail requested in the

" Submittal Guidance Document," NUREG-1335

• To assess the strengths and the weaknesses of the IPE submittal

• To complete the IPE Evaluation Data Summary Sheet

• To identify the need for additional information about the IPE submittal, based on this limited review On October 4,1994, SCIENTECH submitted to the NRC a draft TER for the back-end ponion of the Nine Mile-1 IPE submittal. Based in pan on this draft submittal, the NRC staff submitted a Request for Additional Information (RAI) to Niagara Mohawk on April 21, 1995. Niagara Mohawk responded to the RAI in a document dated June 26,1995. [2] This TER is based on the original submittal [1] and the response to the RAI.

Section 2 of the TER summarizes our review findings and briefly describes the NMP1 IPE submittal as it pertains to the work requirements outlined in the contractor task order. Each ponion of Section 2 corresponds to a specific work requirement. Section 2 also outlines the conclusions and insights gained, plant improvements identified, and utility commitments made as a result of the IPE. Section 3 presents SCIENTECH's overall observations and conclusions. References are given in Section 4. The appendix contains an IPE evaluation and data summary sheet.

1.2 Plant Characterization Designed by General Electric, the Nine Mile Point 1 plant is a Boiling Water Reactor Type 1 BWR 2 NSSS with a Mark I Type containment. The NMP1 containment data and design description are provided in detail in Section 4.1 of the IPE submittal. The NMP1 primary containment structure is a low-leakage, pressure-suppression system, which, in conjunction with the secondary containment, provides a fission product barrier. The general configurations of the primary and secondary containments are shown in Figures 4.1-1 and 4.1-2 of the submittal. The principal design parameters and characteristics of the NMP1 Nine Mile IPE Back-End Review 1 August 1995

primary containment are summarized in Table 4.1-1. The primary containment consists of two major structural components, namely, the drywell and the suppression chamber (The suppression chamber is also referred to as the torus or the wetwell.) The drywell is connected by 10 vent pipes to the suppression chamber.

The drywell is a steel pressure vessel, enclosed in a reinforced concrete structure and designed to withstand an internal pressure of 62 psig and a maximum temperature of 310" F.

The drywell can be accessed through the equipment hatch, the equipment / personnel air lock, the emergency escape lock, and the double O-ring, sealed drywell head. Figures 4.1-6 to 4.1-9 show the drywell floor configuration and the drywell pedestal region below the RPV.

According to the submittal, the NMP1 drywell pedestal design has some special features, including three drywell sumps: a pedestal sump and two sumps outside the pedestal. These sumps could contain up to 45 percent of the core volume durmg a core melt progression, which might result in the steel shell not even being reached by core debris. This positive design aspect poses a disadvantage, however. The depth of the pedestal rump (approximately 6 feet), could cause debris coolability to become a long-term issue. Other unique features of the NMP1 drywell pedestal are the five openings around the pedestal at the floor level, which allow communication between the pedestal and the rest of the drywell.

The suppression chamber is a steel pressure vessel in the shape of a torus, located below and encircling the drywell. Supported by a reinforced concrete foundation slab, tiv; suppression chamber contains the pressure suppression pool (PSP) and has a design pressure of 35 psig and a temperature of 205* F. A total of 10 vent pipes connect the drywell to the suppression chamber vent header and its 120 downcomer pipes, which discharge approximately 4 feet below the PSP level.

Redundant isolation valves in series are provided on lines penetrating the drywell and wetwell to ensure containment integrity when required. The isolation valves are automatically closed by the reactor protection system during an accident. The submittal states that manual backup power exists in the NMP1 main control room in case of automatic isolation failure.

Section 4.1.3.5 of the IPE submittal describes the various methods of removing containment heat; under severe accident conditions, the containment spray system would be the principal method to use. Among the other methods available is the main condenser system, which provides a viable EOP-based method of venting the RPV and thereby dropping energy outside the containment. The NMP1 EOPs also specify that, as a last resort, operators could vent the containment in the event of high and rising containment pressure. The NMP1 features four trains of containment sprays, including heat exchangers and raw water, which could be used to spray the drywell and wetwell, or to inject coolant into the suppression pool using the torus cooling mode. The containment is assumed to be intact if the leakage is analyzed to be less than 31 wt% per day.

Nine Mile IPE Back-End Review 2 August 1995

1 Table 1 compares some key attributes of the Nine Mile Unit 1 containment with those of l other Mark I BWRs. The mean failure pressure is significantly lower for the Nine Mile Unit 1 plant than it is for those plants with which it is compared. (The reasons for this are discussed in Section 2.2.3.) This shortcoming is somewhat ameliorated by the relatively lower thermal power and the relatively large free volume of the Nine Mile Unit 1 plant.

Nevertheless, the " Containment Capability Measure" (the larger the value, the better the l capability), which is a first-order indicator of containment capability, shows the potential for severe accident performance is better at the other containments than it is at NMP1.

Table 1: BWR Mark I Design Characteristics Characteristic Nine Mile Point Peach Bottom Fitzpatrick Browns Ferry (NUREG 1150)

Thermal power, 1.9 x 10' 3.3 x 10' 2.4 x 105 3.3 x 10$

MW(t)

Containment free 3.0 x 105 3.0 x 105 2.6 x 105 2.8 x 105 volume, ft3 Containment 1.2 1.5 1.7 1.3 capability measure Mean failure 0.80 x 102 1.63 x 102 1.58 x 102 1.55 x 102 pressure, psia Containment capability measure = [ Containment free volume] x [mean failure pressure]/(thermal power x E04) l I

l l

Nine Mile IPE Back-End Review 3 August 1995 l

l

4 i

i l-i 1 2. TECHNICAL REVIEW l In conducting the review, SCIENTECH compared the Nine Mile Point 1 plant IPE submittal

! with the guidance of Generic 12tter (GL) 88-20 and its Supplements, using guidance

provided in NUREG-1335.

2.1 Licen=* IPE Process j

j LL1 CamnlMe== and Methodology The NMP1 IPE submittal [1,2] contains a substantial amount of information in accprdance  !

with the recommendations of GL 88-20, its supplements, and NUREG-1335. The submittal ,

l appears to be complete and to provide the level of detail requested in NUREG-1335.

The Niagara Mohawk Power Corporation (NMPC) IPE was the joint effon of utility staff l and external consultants. Five probabilistic risk assessment (PRA) analysts, a suppon network of more than 20 members of various plant organizations, an in-house review group, ,

l and a team of consultants carried out the IPE.

I The overall approach taken by the IPE team was to perform a level II PRA by estimating the frequency of radionuclide releases for a spectrum of postulated severe accidents. The NMP1 IPE model consisted of a directly linked set of system event trees (front-line and support) and containment event trees (CETs) and each accident sequence was studied from the initiating event to the release of radionuclides. This method was used to assess suppon systems and intersystem dependencies as well as to the achieve the proper interface between the front-end and back-end analyses. Using this approach appears to have ensured that the suppon state conditions were properly accounted for throughout the front-end and back-end trees. However, it is not easy to trace and review the results obtained from a very large integrated risk model involving a very large number of accident sequences. The computer code, RISKMAN, was used for accident sequence quantification in the NMP1 IPE. The MAAP code was used for thermal-hydraulic calculations associated with both the front-end (for success criteria) and back-end (for deterministic containment loading calculations) analyses.

The IPE team performed several plant walkdowns and conducted interviews with plant personnel to become familiar with the plant, to collect information, and to verify the "as-built" plant configuration.  ;

i l

l j

Nine Mile IPE Back-End Review 4 August 1995 i

I l

l i

l ZM Multi-Unit Effects and As-Built As-Operated Status l NMP1 shares its site with Nine Mile Point-Unit 2. However, only a few systems are shared, none of which affected the back-end analysis. NMPC was assured that the IPE submittal represents the plant as-built and as-operated by performing walkdowns and reviewing plant i documentation. The IPE was conducted based on information current through January 1993.

2M I irancae Partici_ ationn and Peer Review i

To ensure the technical accuracy of the NMP1 IPE, an independent, in-house group was assembled to review the findings of the IPE team. The plant's Independent Safer /

Engineering Group (ISEG) and Quality Assurance (QA) groups coordinated assembly of the in-house review group whose panicipants included personnel from various plant organizations. A list of the 21 NMPC staff members who participated in the group is ,

presented in Table 5-5 of the submittal. According to the submittal, the in-house review of the NMP1 IPE review started early and continued until the IPE was completed. Reviewer j comments generally were acted on and incorporated into the study after discussion and it appears that the IPE received an adequate peer review. There was no external review of the  !

back-end portion of the IPE.

l 2.2 Containment Analysis /Characeization l 22 Front-end Back-end Denendencies l

In conducting its examination, the NMP1 IPE team explicitly linked the back-end containment event trees to the front-end front-line and support ever.1 trees. Every sequence l was treated-from the initiating event to the radionuclide release. In principle, this approach

! precluded the need to formally define functionally related plant damage states or bins. Yet l such bins are useful for summanzing the front-end results in terms of their similar challenges j to containment and operator response, and for ensuring that the back-end CETs are sufficient i to allow each front-end sequence to be properly addressed. The front-end back-end interface dependencies created in the process of defimng the PDS bins are described in Section 4.3 of

the submittal and are also outlined briefly below.

l l

The IPE team defined five accident sequence classes, or PDSs, mainly based on what the state of the RPV and containment conditions would be at the time of initial core damage.

l Class I and Class III accident sequences are those that would result in an initially intact containment, Class II and Class IV accidents would cause a failed or seriously challenged containment before core melt, and Class V accidents would lead to bypassed containment situations (i.e., interfacing system LOCAs and LOCAs outside containment with loss of RPV makeup). In assessing the ability of the containment and other plant systems to prevent or mitigate radionuclide releases, the IPE team subdivided the five functional classes into i 16 finer subclasses, so that the potential for system recovery could be modeled. These PDS Nine Mile IPE Back-End Review 5 August 1995 l

l l

subclasses were used to summarize the front-end results and are described in Table 4.3-1 of the submittal. Three CETs were developed in the NMP1 IPE to provide the link between the front-end and back-end analyses. Consistent with guidance given in NUREG-1335, the important aspects of the front-end back-end interface are summarized in Section 4.3.3 of the IPE submittal.

• Equipment failures in the front-end analysis. Equipment failures assessed in the front-end analysis were carried by the computer into the back-end analysis, ensurmg that failed equipment would not be credited, unless explicit repair or recovery was allowed.

• Human errors. Checks were performed to ensure that the plant staff could justify all of the recoveries that took place in the back-end analysis from front-end sequences caused by human error.

• RPV status. The RPV pressure condition was transferred from the front-end analysis l to the CETs.

• Containment status. The containment status was transferred explicitly from the front-I end analysis to the CETs.

• Containment isolation. The containment isolation evaluation was performed on a l sequence-by-sequence basis, taking into consideration all of the support system j dependencies.

• Dual usage. Because the front-end and back-end models were directly coupled on a sequence basis, the availability of common water or power sources was accounted for explicitly in the analysis.

• Mission times. The mission times for the entire sequence were considered, from the initiating eve.nt to the release point.

• Timing of recovery. Equipment or power recovery was accounted for at various phases in the front-end and back-end analyses.

• Deterministic thermal-hydraulic assessments. The NMP1 deterministic MAAP calculations were performed consistently with the PDSs to determine the containment response to various postulated scenarios through the CET. The submittal states that over 130 MAAP cases were performed to support the back-end analysis.

It appears that the IPE team's treatment of front-end back-end interface dependencies was complete and in accordance with the level of detail requested in NUREG-1335.

I Nine Mile IPE Back-End Review 6 August 1995

I i

a 2.J,2 Seauences with Sienificant Probabilities

] The NMP1 IPE model consisted of a directly linked set of system event trees (front-line and 4

support) and containment event trees: each accident sequence was treated from the initiating event to the release of radionuclides. Because each front-end sequence was transferred i explicitly into the back-end containment event tree and then was evaluated within the CET, there was no need for front-end binning, and, furthermore, it appears that, in principle, there 1 was no need for intermediate accident sequence selection criteria. However, for practical reasons, a cutoff frequency of 1.0E-11 per year was used in the quantification process. Thus each front-end core damage sequence above this cutoff frequency was transferred to the

back-end CET for evaluation. According to the IPE submittal, the NMP1 IPE approach of

. directly linking all of the front-end sequences to the back-end CET allowed the analysis to proceed on a sequence-by-sequence basis, with binning occurring only after completion of the

back-end analysis.

In reporting the dominant accident sequences, the IPE team selected the criteria given in

Appendix 2 of the GL 88-20 and NUREG-1335, and provided the top 100 back-end systemic sequences in Table 4.6-7 of the submittal. (The top 100 front-end systemic core damage sequences are summarized in Table 3.4.1-1.) The top 10 sequences for both the front-end j (core damage) and back-end (large radionuclide release) analyses are discussed in detali in

' Section 1.1 of the submittal. l i

j In the NMP1 IPE, the probabilistic quantification of severe accident progression was

performed using the containment event tree approach. The CET was used to map out the i possible containment conditions affecting the radionuclide releases associated with a given

core damage sequence (or class). The NMP1 IPE team used detailed CETs, which

. integrated system and human responses with phenomenological aspects of a severe accident.

! The potential for operator recovery actions in accordance with the plant EOPs was also j included. According to the submittal, the IPE team focused on the treatment of containment i faih;re mechanisms and their timing. Hence, based on the containment's initial condition at the core damage state, three CETs were developed to represent the five PDS bins.

• CET1 for PDSs, Class I and III, that would result in the containment remaining intact initially

$

• CET2 for PDSs, Class II and IV, which would cause the containment to initially fail or to be seriously challenged before core melt

• CET3 for PDS, Class V, for bypassed containment situations in which a direct release path was established from the RPV to the reactor building.

Nine Mile IPE Back-End Review 7 August 1995

]

j Figures 4.5-2 through 4.5-4 in the submittal show the three CETs developed during the

NMP1 IPE. The overall success criteria for the back-end analysis are mmmwized in i Table 4.5-1 of the submittal in terms of three critical safety functions, namely, RPV l integrity, containment integrity, and reactor building effectiveness. The specific functional l success criteria for each CET node are provided in detail in Table 4.5-3 of the submittal.

j Each CET entry point is the front-end core damage sequence with a frequency above 1.0E-11

per year and binned in one of the PDS classes. The end point of each CET is either a

! successful accident mitigation within the containment or a radionuclide release. The CET stnicture consists of event tree nodes that account for the following important aspects of severe accident progression and radionuclide release:

• Core damage accident class or PDS (entry to CE*)

• Mitigating system and operator response (post care melt)

• Containment response, including pressures, temperatures, dynamic loadings, and possibly failure location, size, and timing

• Reactor building response including failure location and size

• Phenomenological effects that can change any of the above characteristics.

A set of functional fault trees was developed to describe the various failure modes at each CET node. Figure 4.5-1 of the submittal shows a schematic of the CET model development .

process used in the NMP1 IPE. The following top events were considered for CET1 and l CET2 (see Section 4.5.3 for a detailed description of these top events): l

• Containment isolation (consistent with the NRC preference indicated in ,

NUREG-1335) i

• Emergency condenser tubes intact

• Reactor pressure status (recognizing the important condition of automatic closure by ADS or manual depressurization of the RPV)

• Coolability of core debris within the RPV

• Combustible gas venting

• Containment isolated and intact (addressing early containment failure)

• Drywell shell intact (addressing drywell shell liner melt-through, after core debris came into contact with the drywell concrete floor)

Nine Mile IPE Back-End Review 8 August 1995

1. -

I t

h

• Coolant injection for temperature control of molten debris (addressing drywell sprays and RPV water injection sources)

• Containment flooding (addressing the manual flooding by operators of the containment  ;

during core-melt progression)

• Containment heat removal (addressing containment spray system and venting)

• Suppression pool bypass l

• Containment response integrity (addressing the location and size of the containment l- failure)

!

• Continued RPV/ containment injection makeup (addressing the impact of a harsh  ;

environment on the survivability of injection systems after containment failure)

• Reactor building effectiveness (addressing the decontamination factor of the reactor l building in retaining a fraction of the radionuclide release). j The early containment failure top event included the following potential failure modes:

f

• Containment rapid overpressurization caused by an RPV blowdown i  !

l

• Steam explosion l 1

• Direct containment heating (DCH) l l

• Core-concrete interaction

• Hydrogen deflagration as a consequence of the containment being deinerted

• Recriticality

• Debris impingement.  !

The structure of the CET3 for the bypassed containment was simple, mainly reflecting the secondary containment building effects; the primary containment was bypassed already. The l four CET3 top-event headings addressed containment isolation, RPV depressurization,

contamment mtegrity during core-melt progression, and reactor building effectiveness.

1 i

i i

Nine Mile IPE Back-End Review 9 August 1995 f

l

Like the front-end event trees, the CET top event nodes were treated as split fractions in the NMP1 IPE. Split fractions mpresent the probability that, when called upon in an accident, a system will work or that an operator action will be successful under the given conditions.

Split fractions are defined and reduced according to the standard Boolean mies. Usually, an event tree or CET top event is subject to several split fraction logic mies and values, depending on the initiating event and the success or failure of the previous headings in the tree. According to the submittal, the code, RISKMAN, reduces the split fractions logic and stores the mean values in a master frequency file, which was used as input for the event tree quantification in the IPE front-end and back-end analyses. Table 3.3.5-1 summanzes the split fraction logic descriptions and their mean values for all top events modeled in the front-end event trees and the back-end CETs.

To quantify the NMP1 CET split fractions probabilistically for the containment system, the Niagara Mohawk contractor, EQE Engineering Consultants, used the standard stress-strength approach, firscdeveloping a comprehensive list of containment failure mechanisms (see Section 2.1.2.4 of this TER) and then performing a series of probabilistic, plant-specific, containment-ultimate-capability calculations for various accident temperatures, pressures, and dynamic loadings (i.e., the strength part of the analysis). EQE Engineermg performed these calculations to establish the NMP1 containment fragility curves (see Figums 4.4-5 through 4.4-8 in the submittal), and then the IPE team performed a series of plant-specific, thermal-hydraulic calculations using the MAAP code to assess various temperature and pressure challenges imposed on the containment under different severe accident conditions, or bins (i.e., the stress pan of the analysis). According to the submittal, more than 130 of such MAAP calculations were performed to support the CET quantification in the back-end analysis. The final step in the CET split fraction calculation process was to convolute the containment capability (or fragility) curves and the accident scenario profiles determined from MAAP runs. Tables 4.4-9 through 4.4-14 in the IPE submittal summarize the 2

conditional probabilities of containment failure for two sizes of " rupture" (2 ft ) and " leak" (27 in 2) under various postulated accident conditions. The results were also compared to those for Peach Bottom, as documented in NUREG-1150. [3]

The containment event tree development and quantification in the NMP1 IPE is very thorough, well presented, and in accordance with the level of detail requested in the GL 88-20 and NUREG-1335.

2.M Failure Modes and Timina As part of the NMP1 back-end analysis, the team evaluated the containment failure modes, timing, and capacity as described in Section 4.4 of the IPE submittal. A comprehensive list of containment failure modes was identified based on NMP1-specific design documents, NUREG-1150, NUREG-1335, the PRA Procedures Guide [4], and other studies for quantitative evaluation (see Tables 4.4-3 and 4.4-4 of the submittal). Examples of analyzed containment failure modes are containment structural failure and thermal degradation of Nine Mile IPE Back-End Review 10 August 1995

penetration seals. The following three important parameters were identified for all of the containment failure modes:

• Time of containment failure (e.g., early, late)

• Size of containment failure (e.g., small, large )

• Location of containment failure (e.g., drywell, wetwell)

Containment failure size was divided into two kinds:

• "Small (or leak)" with a 27 in breach t

area at which the prunary containment would not depressurize during most of the postulated severe accidents 2

• "Large (or rapture)" with a 2 ft breach area at which the primary comainment would depressurize within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> The late containment failures, which were characterized by extreme and slowly developing temperatures and pressures, were analyzed probabilistically in detail and documented in Section 4.4 of the submittal. Early containment failures, which were characterized primarily by phenomenological events such as steam explosions and direct conta'mment heating, did not undergo plant-specific engineering analyses. Rather, industry studies and staff positions on  !

phenomenological uncertainties were taken into account to assign failure probabilities, which represented a " generic" containment (see page 4.5-8 of the submittal).

i Figure 4.6-17 of the submittal shows that the principal mode of containment failure would be shell failure, coupled with a subsequent drywell head failure (41 percent of total release),

followed by wetwell overpressure failure (22 percent). Energetic failure modes due to rapid ,

overpressurization at RPV failure, steam explosion, direct containment heating (DCH), and hydrogen detonation would contribute 15 percent to the total release. Containment isolation failure probability would be negligible: the containment isolation system was shown to be highly reliable and containment normally inerted. Controlled venting of the drywell would account for 4 percent of the total release.

According to Table 4.6-4, the frequency of "no radionuclide release with the containment remaining intact" was 7.0E-7 per year, which represented 13 percent of the NMP1 CDF. In other words, the conditional probability that the containment would r.: main intact in a severe accident, assuming core melt, was assessed to be 0.13. With regard to containment failure timing, Figure 4.6-15 of the submittal shows that approximately 26 percent of the core damage end states would lead to an "early" release (within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of the accident initiation),

48 percent would lead to an " intermediate" release (between 6 and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the accident initiation), and 14 percent would be " late" radionuclide releases (more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident initiation).

Nine Mile IPE Back-End Review 11 August 1995

_ _ _ _ - ~ _ _ , _ _ . _ _ . _ _ - . _ _ _____ ___ _ - _ - _

j 4

Before analyzing containment capability, the team classified into four regimes the challenges that would lead to containment failure:

1 j

• Pressure-induced containment challenges

• Temperature-induced challenges 1

j l

• Combined pressure and temperature-induced challenge.s

• Dynamic loading.

) EQE Engineering Consultants performed a probabilistic evaluation of the NMP1 containment  !

4 ultimate capability and the results are summarized in Section 4.4.4 of the submittal. EQE i i performed the containment capability calculations at different postulated containment temperatures (i.e., 200' F, 400* F, 600" F, above 800* F, and high PSP temperatures and

high RV discharge) and developed containment fragility curves for the three temperatures of 200 F (Figure 4.4-5),400 F (Figure 4.4-6) and 600" F (Figure 4.4-7), takmg into consideration the uncertainties represented by lognormal distributions. These fragility curves i

were then combined into a best-estimate composite containment ultimate pressure-temperature i capability curve, as shown in Figure 4.4-8 of the submittal. For containment temperatures i above 900" F, a conservative failure probability of unity associated with a large containment -

failure was assumed because of large property changes in steel and concrete and because of degradation of penetration seals at extremely high temperatures. The containment failure

. mode at high temperatures was assessed to be dominated by failure in the drywell head region.

! The following is a summary of the results of the probabilistic evaluation of NMP1 containment performance:

• At low temperature (approximately 200* F), the dominant failure mode would be a large failure in the wetwell airspace corresponding with the vent line bellows failure at a mean pressure of 65 psig. This is considerably lower than the failure pressure for other Mark I BWRs (e.g.,146 median psig for Brunswick and 105 mean psig for Quad Cities).

According to the submittal, this low failure pressure would be due to the fact that the single-ply vent line bellows at NMP1 is internal to the torus, which is subject to external pressure and temperature loading, in contrast to those for other BWRs, which are either subject to 4 internal pressure or are of a two-ply design. Figure 4.1-10 of the IPE submittal, reproduced here as Figure 1, shows the bellows arrangement. The next most significant failure mode was assessed to be the rupture of the suppression chamber shell at a median pressure of 119 psig.

i Nine Mile IPE .Back-End Review 12 August 1995

Mgure 1 ll

'?

.d 1;-

a Mi g 7

'o .

e  :  ; =cus: ; ._,

- r-ere e .

ar s:st;: n Iq- '

g

/

/ c .... .

S T

,\ - g-s

\ -r..

~~i

. .. g

&a

.:, u . u

' l e

.... : r- , e _ ,' p 1

-- t , .1:

.k ;8 l e, g - - .t .

.P g

s g

5 .7, -

l ti-

\# .  :  ! , T yu 3

.: A 4 8

tt ,s .. .

. . ' .f. . a 4

2- v o

'.. . 1. ...'

't-

.! t =.a. .

\

• .?

o ..

., r R n y 4 . t ~,

=

.A,  !. :. g..

~ a, 5 t

( *!v*, i.

\

Nine Mile IPE Back-End Review 13 August 1995 i

• At moderately low temperature (approximately 400 F), the dominant failure mode would still be the failure of the vent line bellows at a mean pressure of 60 psig. Seal thermal degradation would not be a significant failure mode at this temperature.

• At an intermediate temperature (approximately at 600* F), the dominant failure modes would be failure of the wetwell vent line bellows and drywell head flange seal failure at a mean pressure of 56 psig. According to the submittal, at temperatures greater than 400* F, seal leakage failure modes would contribute significantly to the containment failure. It was assumed that the elastomeric seal material for the drywell head flange and the equipment hatch would be severely degraded at temperatures above 400* F. .

• At a high temperature (approximately at 800* F), failures of the containment boundary at the drywell head flange, penetration and hatch seals, and the electrical penetration assemblies would become the dominant modes of containment failure. An overall mean failure pressure of 30 psig was reported for the containment at high temperature. The submittal also stated that, at high temperature, the drywell head silicone rubber gaskets would degrade severely and could not be ded on to hold a seal. Without gaskets, drywell leakage could be prevented by as; to-metal contact between the drywell closure head and the containment flange. Ihaver, it was predicted that the head flange separation would occur at a very kn ressure of approximately 4 psig.

This failure pressure value is low compared with the values cited in the submittal for other Mark I BWR plants (with failure pressures of 50 to 62 psig). The reason is that the NMP1 installation torque is specified at a relatively low 125 ft-lb (compared with 1,200 to 2,980 ft-lb for other BWRs) with a resulting bolt preload of only 35,000 pounds. (See Section 6.1 of the submittal). The IPE tem: recommended an increase in the drywell head bolt installation torque procedures during plant refueling.

• At an extremely high temperature (greater than 900* F), a conservative failure probability of unity associated with a large containment failure was assumed in the study, due to large steel and concrete property changes and penetration seal degradation. The containment failure mode at high temperatures was assessed to be dominated by failure in the drywell head region.

The NMP1 IPE included analyses of reactor building failure modes and of the integrity of the emergency condenser tubes. Various decoramination factor (DF) values were used in the CETs for assessment of the reactor building effectiveness. The capacity of the emergency condenser was found to be controlled by a 4-inch radius bend section of the tubes. A failure probability of 0.5 was reported in the submittal for the creep rupture of the bend sections.

Nine Mile IPE Back-End Review 14 August 1995

.- - - -.. _ - - - . . - - . . _ . . . . - - - - - -~ -

4 I

4 j According to the NMP1 IPE submittal, the best-estimate containment ultimate-pressure-temperature capability curve, as shown in Figure 4.4-8, is lower than those published for other Mark I BWRs. This lower curve appears to be the result of two failure modes:

j

• Drywell-to-torus, single-ply, internal vent line bellows failure over a temperature i range of 0* to 600* F

• Drywell head silicone rubber gasket thermal degradation at extremely high ,

temperature in conjunction with the drywell head low preload.

I It appears that the IPE team identified and analyzed all relevant potential containment failure modes. All applicable containment failure modes that appear in Table 2-2 of NUREG-1335

were considered.

} L2 4 Comminment Isolation Failure j In the NMP1 IPE, containment isolation was modeled and ruled out as a contributor to containment failure and large release. Two events were considered for the containment isolation function in the CETs. namely:

]

j

• Containment isolation (i.e., Top Event IS in CET1, CET2, and CET3) i

• Emergency condenser (EC) isolation in the event of a break outside the containment, i steam lines, or in the condensate return line of an EC (i.e., Top Event El in CET1 l and CET2).

j The IPE team examined in detail the pathways that could contribute to containment isolation i

failure, and the signals required to automatically isolate the containment penetrations. The i team also examined manual isolation, common cause failures, and test and maintenance j contributions to isolation failure. According to the submittal, the fault tree approach was j used in the NMP1 IPE to model containment isolation failure (see Section 4.6.2.4 of the i submittal). The EC isolation failure was considered only at high temperature because of the

potential for creep rupture failure of the EC tubes. The probability of containment isolation i failure was judged to be negligible because of the containment isolation system's high reliability (e.g., through its redundant valves and automatic isolation signals) and also j because the containment normally is inerted.

Containment bypass failure, which the IPE team also analyzed, was shown to contribute only l 3 percent to the frequency of a large radionuclide release. Containment bypass events, 4

caused by interfccing system LOCAs and LOCAs outside the containment with a loss of RPV makeup, were classified as Class V plant damage states and were analyzed using CET3 in the back-end analysis.

Nine Mile IPE Back-End Review 15 August 1995 i ,

i i

a

r i<

4 21_1 System / Human Resoonse r The NMP1 IPE back-end analysis included some important human interaction events that could affect the containment performance and subsequently the radionuclide release frequency, magnitude, or timing. According to the submittal, only operator actions directed by the current NMP1 emergency operating procedure.s were included in the IPE and quantified, taking into consideration the level of operator traming for each action.

i As in the front-end analysis, a combination of well-known human reliability analytical  ;

I methods was used to model and quantify the human error probabilities (HEPs) for which only point estimates (mean values) were assessed. Table 4.6-2 in the submittal provides a t

~

list of the operator actions with their mean HEPs that were included in the back-end analysis.

. Examples of key operator actions modeled in the NMP1 IPE follow:

• Emergency depressurization occurs during in-vessel core degradation.

• Operator fails to recover in,iection before RPV melt-through.

• Operator fails to initiate containment venting per procedures.

!

• Operator fails to initiate drywell sprays. -

• Operator fails to initiate containment flooding per procedures. b

• Operator fails to initiate suppression pool cooling.

In response to the NRC staff's RAI, the NMPC noted that, if no credit were given for operator actions, nearly all postulated core damage events from level 1 would result in .

. containment failure. [2]

Among the NMP1 IPE team's accident management insights, Section 4.8 of the submittal notes a number of areas where emergency operating procedures could be improved. Such  !

improvements could increase the reliability of operator actions in preventing and mitigating i severe accidents. These recommendations will undergo further analysis and investigation  ;

before a decision is made on whether or not to implement them.

2.2 6 Radionuclide Release Characterization The NMP1 IPE team selected the top 100 front-end systemic sequences as dominant contributors to core damage for the back-end analysis. These sequences were binned into five accident classes (Classes I through V) consisting of 16 subclasses. Table 4.3-1, page 4-3-7 of the submittal, defines these subclasses along with corresponding WASH-1400 designators. As described in Section 2.1.2.2 of this report, the NMP1 IPE team developed Nine Mile IPE Back-End Review 16 August 1995 l

l

three CETs, each specific to one or two of the accident classes. The propagation of an accident sequence through the accident-class-specific CET resulted in several end states, which dermed radionuclide releases.

NUREG-1335, page 2-6, outlines guidance for reporting systemic sequences as follows:

The total number of unique sequences to be reported should be determmed by the criteria listed below, or by the criteria in Appendix 2 to the Generic J2tter, but in any case should not exceed the 100 most significant sequences.

Using the above guidance, the IPE team reported the top 100 sequences derived from the level 2 end states (Table 4.6-7). The team grouped the releases into 12 release categories, based on release severity and timing. Cesium iodide was used as a surrogate for the other fission products, and the percentage of cesium iodide was used to derme release severity as follows:

• High (H) - greater than 10

• Medium or moderate (M) - 1 to 10

• Iew (L) - 0.1 to 1

• Low-low (LL) - less than 0.1

• No iodine (OK) - 0 Release timing was defined relative to accident initiation time:

• Early (E) - less than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />

• Intermediate (I) - 6 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

• Late - greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Usually, the release time is defined based on the occurrence of vessel breach. For example, NUREG-1150 defined early containment failures for BWRs as those occurring before or within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of vessel breach. Figure 2, reproduced from the submittal, compares the definition of "early" radionuclide release used in the IPE with its defmition in the NUREG-1150 study. Any comparisons of NMP1 results with those of other IPEs and NUREG-1150 have to be made accordingly.

Nine Mile IPE Back-End Review 17 August 1995

Mgure 2 i N i

l N .

a os m  :

o z

• 4 W. a a ~

• I.) -

e = g~

~

.'o u .....

3 x C s 9 Zu:

m o

• A a I t

b l

u . _-

To sP 3

- 1

'u  ;

l eO -

h t

3 C d Ob g j i C #' s

• s  :

s t. y. i u .6 . l e A.J e A.

a >u s >.

e k -, k r NN -

- N .

- s e u r \ \\ >:

0 5 h\ > $.

' "I.*4 8 *A - *: i m . . .: ~ '

l t  :  :  :

C a, a i a -

C  : n y y y

0 - -

u 8 - = E

= a

• e 0, c c x k u v =

s E

I I

18 August 1995 b Nine Mile IPE Back-End Review i

I

Tables 4-7-2a, b, and c of the submittal give MAAP summary results for 138 runs, including data on sequence timing, containment peak conditions, containment conditions at containment failure, and cesium iodide release fractions.

Figures 3 and 4, both reproduced from the submittal, show containment failure modes as contributors to total release and to "large" (early/high) release, respectively.

2.3 Accident Progression and Containnwat Performance Analysis Lil Severe Accident Proeression The NMP1 IPE team used MAAP computer code (BWR Mark I, Version 3.0B, Rev. 8.01) to calculate severe accident progression and performed 138 MAAP runs for representative accident sequences. Severe accidents are described in detail (pages 4.6-3 through 4.6-7 of the submittal) for the following classes:

• Class IA: less of adequate makeup at high RPV pressure with containment initially intact

• Class ID: less of adequate makeup at low RPV pressure with containment initially intact

• Class II: Loss of adequate containment heat removal

• Class III: large LOCA with inadequate coolant makeup

• Class IV: ATWS event with containment failure preceding the occurrence of core damage.

The CET node "Early Containment Failure - CZ/CE" addressed early containment failure phenomena including the following:

• Containment pressurization caused by an RPV blowdown results in a rapid rise in containment pressure that exceeds capacity

• Steam explosion

• Direct containment heating

• Recriticality

• Core / concrete interactions

• Hydrogen deflagration in a deinerted containment

• Debris impingement.

19 August 1995 Nine Mile IPE Back-End Review ,

z if Figure 4.6-17

{

a 5 Summary of Initial Containment Failure Modes:

5 Contributors to Total Release

(

\

Isolation Fallure - 0% Drywell Overpressure - 2%

o- Isolation Condonsor Dypass Fallure - 1%

f, .

Overpressure Wetwell - 22%

S .

l DW Vent - 4%

! w ,

' Combustible Gas Vent - 0%

Shell & DW liond - 41% Energetic Fallure During Flood - 5%

Energetic Fallure - 15%

Shell Failure - 9% ,

I Total Release (4.7E-6/yr)

> s

\

n W

p Figure 4.6-18 {

1.

i Summary of Initial Containment Failure Modes:

!c Contributors to "Large" (Early/High) Release

• \

to n

5 .. .

m  :

Overpressure Wetwell - 38%

R ,

E' DW Overpressure - 6%

e isolation Failure - 0%

Isolation Condenser j -

p Vented - 0%

Oypass Failure - 3% .,

Combustible Gas Vent - 0%

DW tiend & Shell- 5% DW Vent - 0%

M Shell Falture - 7%

4 Energetic Fallure During Flood - 21%

Energetic Failure (CZ, CE) - 18%

E/H Release (6.9E-7/yr)

N

> \

c -

E e

1 i- )

i 1

Although no engineering r.nalyses of the capability of the NMP1 containment to withstand various energetic phenomena were performed, industry studies and NRC staff positions on l j

phenomenological uncertainties were taken into account (page 4.5-8 of the submittal). The above-cited severe accident phenomena were described in the NMPC response to the staff's request for Additional Information. [2] Two sensitivity cases were run by assuming an optimistic value of "e" (negligible) and a pessimistic value of 1.0 for the node CZ/CE (page 4.9-32 of the submittal). The description of these two cases was also provided in the NMPC response. [2]

Based on the findings of a study by Theofanous, et al., [4] the IPE team assumed that, without water available to cool the debris, the steel shell would most assuredly melt shortly after coming into contact with substantial molten debris. It was assumed that the availability of water (greater than 1000 gpm) to the core debris at the time of vessel failure would prevent liner melt-through. Outstanding issues of liner melt-through were addressed using sensitivity analysis: time delay for shell failure, shell failure area, multiple containment

- failure location, effect of water availability, and location of discharge in the reactor building.

For base case calculations, shell failure area was assumed to be 2 ftz. Increasing this area to 2

10 ft: or decreasing it to 1 ft did not cause any appreciable change in Csl release, the lack '

of change due prunarily to the long path length and confm' ed area downstream from the failure location. Decreasing the failure area to 0.18 ft 2caused the Csl release to drop by about a factor of 3. As shown in Figure 4.6-17 of the submittal, shell failure (by itself and coupled with subsequent drywell head failure) contributed to 50 percent of the total releases (2.3E-6 per year, which was 44 percent of total CDF). The total early containment failures of NMP1 amounted to 25 percent of the total CDP. Table 4.7-3 of the submittal notes that, if it occurred, shell failure would take place during either the early or the intermediate time frame in Accident Class I and during the late time frame in Accident Class II. A high probability of shell melt-through was postulated despite the fact that the NMPI drywell consists of sumps that could contain about 45 percent of the total corium inventory and therefore there would be less corium to spread on concrete and attack the shell (page 8-10 of the submittal).

Fractions estimated for the core remaining in vessel over the long term ranged from 0 to 46 percent in the MAAP runs, as listed in Table 4.7-2b of the submittal. For the most part, "only cases with large LOCAs (Class IIIC) or depressurization without injection (Class ID) led to 100 percent discharge of the core material following vessel failure" (page 4.9-5 of the submittal). An assumption made in all of the NMP1 base case analyses was that, when 90 percent of the core was melted, the remaining 10 percent would be forced out of the vessel to the pedestal region. Four sensitivity cases were run in which the 90 percent value was changed to 50 percent, i.e., only 50 percent of the core material needed to melt before the remainder was allowed to leave the vessel). Results of these cases showed about an order of magnitude less fraction of Csl would be released to the environment than in the base case.

The submittal explains that the displaced core debris caused less radiative heat transfer from the RPV to the drywell, resulting in a suppressed or delayed revaporization of fission products. This behavior is referred to as an analysis anomaly (Section 4.2.3.3, page 4.2-8L Nine Mile IPE Back-End Review 22 August 1995

l 2.3.2 Dominant Contributors: Consistency with IPE Insiehts j Table 2 of this report shows the results of SCIENTECH's comparison of the dominant contributors to the NMP1 conditional failure probability with the results of the NUREG-1150 study of Peach Bottom and of other BWR Mark I IPEs. The CDF postulated for NMP1 approximates that estimated at Peach Bottom, is about an order of magnitude lower than Browns Ferry, and is about three times that of Fitzpatrick. Thus the NMP1 CDF is consistent with those estimated in the NUREG-1150 study and other IPEs.

A major difficulty exists, however, in directly comparing the results of the NMP1 IPE with i the results of other plant examinations. In the NMP1 submittal, containment failure tunmg is defined relative to accident initiation. Usually, it is defined relative to vessel breach.

Because of this definition, NMP1 is shown to have a lower early containment failure probability despite its having a weaker containment than other plants. This is because early containment failures are binned as " late," e.g., as a part of liner melt-through failures. (The mean containment failure pressure of NMP1 is 80 psia, which is about half of that of the other three plants shown in Table 2.)

Table 2. Containment Failure as a Percentage of Total CDF: NMP1 IPE Results Compared with the Peach Bottom NUREG-1150 PRA Results and with Other BWR Mark I IPE Results Study CDF (per Early Late Bypass Intact w/o Intact w/

rx yr) Failure Failure Vessel Vessel Breach Breached Peach 4.5E-6 56 16 na 10 18 Bottom /NUR EG-1150 Fitzpatrick 1.9E-6 60 26 na 11 3 IPE Browns 4.8E-5 46 26 na 25 3 Ferry IPE Nine Mile 5.4E-6 25 62 0.5 na 13 Point ' IP1 ___

' Containment failure time is defined relative to accident initiation. na= Not available Even with a weaker containment, the NMP1 IPE team postulated the conditional probability of the containment remaining intact to be close to that of the Fitzpatrick plant. For NMP1, containment cooling was achieved by torus cooling for the sequences where in-vessel or l ex-vessel debris cooling was available. l l

l Nine Mile IPE Back-End Review 23 August 1995

2JJ, Characterization of Containment Performance i

The IPE team used the MAAP computer code with several plant-specific features, including  ;

i the following, to calculate accident progression parameters (Section 4.2.1.4, pages 4.2-3 and I

4.24)- ,

• Specified a containment failure curve as a function of drywell pressure and temperature

• Used raw ' water cross-tie (containment-spray raw water to core spray) as the alternate injection source to the reactor vessel  ;

i

• Aligned containment-spray raw water to the toms to flood the containment.-

Phenomena not addressed in MAAP were treated with separate effect analysis and/or probabilistically (page 4.2-5 of the submittal): Mark I liner failure was treated ,

probabilistically using work by Theofanous, et al. [5]; the ex-vessel steam explosion was i treated probabilistically; direct containment heating and reactivity insenion during core melt progression were treated with separate effect analysis and probabilistically. The NMP1 IPE team treatment of the Mark I liner failure phenomenon appears to have been complete. ,

However, the analyses of ex-vessel steam explosions, DCH, and reactivity insertion phenomena were less complete.

l

)

2J 4 Imnact on Eauioment Behavior Section 4.6.2.3 of the submittal dezribes the IPE team's assessnient of equipment survivability in harsh environments, such as ones of extreme temperature, pressure, radiation, aerosol loading, and moisture during severe accidents. Using engineering  ;

judgment coupled with available data, the IPE team considered the survivability / operability l of equipment (e.g., cables, electrical penetration assemblies, solenoid valves, MOVs, motor-driven pumps, MCCs) which would be relied on in a severe accident. At the system level, the IPE team analyzed injection, depressurization, and the containment vent valves for survivability.

According to the submittal, equipment located in the reactor building is fairly reliable in general, and could survive the 100* to 200 F worst-case temperatures for tens of hours. It appears that the cable connections (specifically, the terminal blocks) are the weakest links, having high failure rates under temperatures of about 200* F. However, in response to Information Notice 84-47, NMP1 has removed the terminal blocks from the safety systems as well as other selected systems that may be exposed to a harsh environment. Of remaining concern is individual component susceptibility which was not modeled, for example, the susceptibility of the CRD pumps to fail from exposure to high temperatures and steam.

However, it appears that the issue of equipment survivability received adequate attention during the NMP1 IPE in accordance with the level of detail requested in NUREG-1335.

24 August 1995 Nine Mile IPE Back-End Review i

- - - - - * ^ - - - - - _ _ _ _ _ _ _ _ _ . _ _ , , _ _ _ _ _ _ _ _ __ _

2.4 Reducing Probability of Core Damage or Fission Product Release l 1

2A1 Definition of Vulnerability i According to the IPE submittal, the NMP1 plant is considered free from vulnerabilities to accidents. The IPE results (calculated for the CDF and for the frequency of a large radionuclide release at NMP1) were below the NRC proposed safety goals, which are 1.0E-4 for the CDF and 1.0E-6 for the frequency of a large release, per year.

2A2 Plant Imnrovements  ;

i Two IPE team insights from the NMP1 back-end analysis, currently under study by NMPC, could lead to plant improvements:

• Drywell head preload. Increasing the drywell head bolt installation torque would result in a higher head flange separation pressure and consequently increase the l containment integrity at high temperatures (see Section 2.1.2.3 in this report). This l could be done by changing the refueling maintenance procedure.

i l

• Containment venting pressure. The NMP1 containment structural analysis results  !

i suggest that the EOP-specified venting pressure (43.4 psig) may need to be modified.

( Specifically, in order to have high confidence that no large containment structural failure (e.g., bellow buckling failure) will occur, the containment pressure should not exceed 40 psig (which is below the EOP-specified venting pressure).

2.5 Responses to CPI Program Recommendations l Containment Performance Improvement recommendations are scattered throughout the back-end IPE submittal. Below is a summary of what CPI actions have been implemented and which ones were credited in the IPE submittal.

• Hardened containment vent: Implemented and credited

• Revision 4 of the BWR Owners Group EPGs: Implemented and credited

• Alternate water supply: Implemented and credited. Used the raw water cross-tie as an alternate injection source to RPV or an alternate containment spray or flooding ,

source. )

i l

• The CPI recommendation for enhanced reactor pressure vessel depressurization system reliability was not acted on. The NMPC claimed that the reliability was sufficient and also discussed negative aspects of emergency depressurization.

I i j i t

i Nine Mile IPE Back-End Review 25 August 1995 l

c .

2.6 IPE Insights, Improvements and Commitments The insights, improvements, and commitments provided by NMPC in the IPE submittal were, for the most part, directed to front-end issues [Section 6]. However, several were directed to the back-end.

Insights included:

• Hardened vents and containment flooding capability allowed for an additional set of mitigation actions ,

l

• The containment failure pressure for NMP1 is considerably lower than it is for other Mark I containments  !

l

• The drywell sumps can accommodate large amounts of core debris, an advantage in reducing the likelihood of liner melt-through but a disadvantage in increasing the likelihood of having noncoolable debris.

• Containment flooding has adverse effects (page 6-13)

• Accident Management: A comprehensive and informative discussion of accident management insights is provided in Section 4.8 of the submittal and includes a summary table (Table 4.8-6).

Recommended back-end improvements included:

• Increasing drywell head preload would increase containment failure pressure at elevated temperature

• Lowering the containment venting pressure from 43.4 psig could prevent ccntainment failure (There is also a 10-percent probability that the containment will fail at 40 psig.)

NMPC made no commitments to act on the insights described in Section 6.2 of the submittal, [2] but will study them further as part of their accident management program.

Nine Mile IPE Back-End Review 26 August 1995

3. CONTRACTOR OSSERVATIONS AND CONCLUSIONS t

The NMP1 IPE submittal contains a substantial amount of information consistent with the i recommendations of Generic Letter 88-20, its supplements, and NUREG-1335, and appears j to be complete in accordance with the level of detail requested in NUREG-1335. The IPE

methodology used is described clearly in the submittal. The approach followed is consistent with the basic tenets of GL 88-20, Appendix 1, and the assumptions underlying the approach are clearly described. The important plant information and data are well documented and the key IPE results and findings are well presented. The submittal relies heavily on NMP1- specific data and analyses as well as on the results of similar BWR PRAs (e.g., NUREG-1150) and other studies. ,

One of the important containment characteristics that drove the final results of the NMP1 IPE was the relative lowness of the failure pressures (failures as a function of drywell temperature) that the team observed. Determined as part of each IPE assessment, the values of the failure pre.ssures at NMP1 were considerably lower than those at other Mark I containments. The points of vulnerability were (1) at the (single-ply) bellows, which is part of each vent to the wetwell and (2) the drywell head seals and hold-down bolts.

One of the important groups of sequences that drove the final results of the NMP1 IPE was station blackout (63 percent, conditional on core damage). Station blackout resulted in 74 percent of the "high" release, i.e., release greater than 10 percent of the Csl inventory.

Another contributor to the high release was the ATWS sequence group at 13 percent, although it was only a small percentage of the contribution to core damage at 6 percent.

The conditional probability (conditional on core damage) that there would be releases of Csl greater than 10 percent of the total Csl inventory was more than 40 percent, a relatively large number. This included " intermediate" and " late" failures, as well as "early" failures.

(If only "early" failures had been considered, then the percentage for "high" CsI-release (i.e. > 10%) would have been much smaller, namely 13 percent or 6.93E-7/yr. However, because the IPE team defined these time increments ("carly," " intermediate," and " late")

differently than the way they are defined in NUREG-1150, caution must be used in comparing the "6.93E-7/yr" value to other IPE results or the safety goal.) With a greater than 40-percent probability of a high release, it is difficult to understand the IPE submittal position that the " . . . containment has shown robustness in the face of a wide spectrum of severe accidents," and that there are no containment issues worth considering further.

The following are the major findings of the NMP1 IPE presented in the submittal:

• The NMP1 has reliable safety systems. The overall CDF is 5.5E-6 per year, to which the dominant contributors are SBOs and LOCAs. No particular vulnerability to core damage was identified. Although ATWS sequences are relatively small contributors to the CDF, they are the dominant contributors to the frequency of "large" radionuclide releases.

l Nine Mile IPE Back-End Review 27 August 1995 l

9

• The containment analyses indicated that the conditional probability of the containment failing as the result of a radionuclide release, given core damage, is 87 percent and the probability of the containment remaining intact is 13 percent. The "large" release was shown to be dominated by wetwell overpressure failure mainly occurring in

~ ATWS sequences. Containment isolation failures make negligible contributions to i large radionuclide releases and containment bypass failures contribute only 3 percent.

As is the case with other Mark I BWRs, hydrogen detonation was shown to make a i negligible contribution to risk because the NMP1 containment normally is inerted. No  !

particular vulnerability to containment failure was identified.

• Some unique NMP1 design features contribute to its low CDF and frequency of large  :

releases. For example, NMP1 has four trains of contdnment spray, including heat j exchangers and raw water, which can spray the drywell and wetwell, or inject coolant  !

into the suppression pool via the torus cooling mode. In addition, NMP1 features a )

hardened containment vent and the capability of injecting fire water into the RPV through the feedwater injection path.

• The best-estimate containment ultimate-pressure-temperature capability curve, as shown in Figure 4.4-8 of the IPE submittal, is lower compared with those published for other Mark I BWRs. This appears to be due primarily to two failure modes:

Drywell-to-torus, single-ply, internal vent line bellows failure over a temperature '

range of 0* to 600* F l

- Drywell head silicone rubber gaskets thermal degradation at extremely high temperature in conjunction with the drywell head low preload.

• Although the submittal states that the IPE uncovered no evidence of unusually poor containment performance, the IPE team did offer a number of accident management insights, pnmarily relating to emergency operating procedure enhancement and operator training that could be implemented by NMPC to further reduce plant risk in the future.

't

• With regard to accident vulnerability, the submittal states that the NMP1 plant is considered free from vulnerabilities because the IPE results (both the CDF and frequency of large radionuclide release) were below the NRC proposed safety goals, which are 1.0E-4 for the CDF and 1.0E-6 for the frequency of large release, per year.

The results of the SCIENTECH technical evaluation of the NMP1 IPE back-end analysis are summarized below:

• The submittal appears to be complete, comprehensive, well documented, and in  ;

conformance with the GL 88-20 and NUREG-1335. l Nine Mile IPE Back-End Review 28 August 1995

• The IPE team employed an analytical method of directly linking a set of system event trees with a set of containment event trees. Each sequence was treated from the initiating event to the back-end state, thereby ensuring proper treatment of various dependencies. This method presents a disadvantage, however. It is not easy to trace and review the results produced by a very large integrated risk model involving a very large number of accident sequences. For example, the relationships are not transparent that exist between the various split fractions for a top event and the accident and containment conditions. Neither are the bases for their values.

• As part of the back-end analysis, three detailed CETs were developed that addressed

. passive and active plant and containment mitigating systems, operator recovery actions, and severe accident phenomenological issues such as shell melt-through, steam explosion, and DCH. Plant-specific deterministic transient calculations using MAAP, probabilistic containment ultimate capability analysis (containment fragility analysis), results from similar PRAs, and engineering judgment were used to quantify

' CETs and subsequently assess the containment failure probabilities and the frequency of radionuclide releases. Phenomenological uncertainties were addressed through

^

sensitivity studies performed with MAAP and through insights obtained from other studies.

• In the course of a complex back-end analysis, a number of assumptions had to be made. For example, it was assumed that hydrogen deflagration always resulted in a

containment and secondary containment failure and a "large" release of radioactivity. '

Also, it was assumed that the drywell shell melt-through would occur relatively quickly and with certainty when the molten core came into contact with the liner and water was not available to quench the debris.

Nine Mile IPE Back-End Review 29 August 1995

4. REFERENCES

1. "Nine Mile Point Nuclear Station - Unit 1 Individual plant Examination (IPE) for Internal Events," Niagara Mohawk Power Corporation, July 1993.

2. " Request for Additional Information Regarding Individual Plant Examination (IPE) for Nine Mile Point Nuclear Station Unit No.1," Letter from C. D. Terry, Niagara Mohawk, dated June 26,1995.

3. USNRC, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants,"

NUREG-1150, Vols. I and 2, December 1990.

4. USNRC, "PRA Procedures Guide," NUREG/CR-2300, Vols.1 and 2, January 1983.

l

5. "The Probability of Liner Failure in a Mark-I Containment," T. G. Theofanuos, et al., 3 NUREG/CR-5423, August 1991. i l

f i

i 4

Nine Mile IPE Back-End Review 30 August 1995

l Appendix A IPE Evaluation and data Summary Sheet BWR Back-End Facts l Plant Name Nine Mile Point 1 i

Containment Type

! Mark-I Unique Containment Features The NMP1 drywell has three drywell sumps: a pedestal sump and two sumps outside the pedestal. These sumps can contain up to 45 percent of the core volume during core melt progression, which may preclude core debris from reaching the steel shell. Another unique feature of the drywell pedestal is the existence of five openings around the pedestal at the floor level, which allows for communication between the drywell and the pedestal. NMP1 has four trains of containment spray, including heat exchangers and raw water, which can be used to spray the drywell and wetwell, or to inject coolant into the suppression pool via the torus cooling mode. In addition, NMP1 has a hardened containment vent.

NMP1 has drywell-to-torus, single-ply, internal vent line bellows, which are subjected to external pressure and temperature loading, in contrast to those for some other Mark I BWRs, which are either subjected to internal pressure or are of two-},1y design.

Unique Vessel Features None found Number of Key Plant Damage States 16 Ultimate Containment Failure Pressure 65 psig (mean value) at approximately 200* F temperature 60 psig (mean value) at approximately 400" F temperature 56 psig (mean value) at approximately 600* F temperature 30 psig (mean value) at temperatures above 800* F 04 psig (mean value) at temperatures above 900 F over 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> Nine Mile IPE Back-End Review A-1 January 1996

Appendix A (continued)

IPE Evaluation and data Summary Sheet Additional Radionuclide Transport and Retention Structures Reactor building retention is credited Conditional Probability That The Containment Is Not Isolated Very small relative to the other conditional probabilities .

Important Insights, Including Unique Safety Features l Drywell head preload. Increasing the drywell head bolt installation torque would result in a higher head flange separation pressure and consequently increase the containment integrity at h:gh temperatures (see Section 2.1.2.3 in this report). This could be done by making a l redseling maintenance procedure change.

1 l

Ccintainment venting pressure. The results of the NMP1 containment structural analysis

]

suggest that the EOP-specified venting pressure (43.4 psig) may need to be modified. ,

Specifically, in order to have high confidence that no large containment structural failure i (e.g., bellow buckling failure) will occur, the containment pressure should not exceed 40 psig.

Implemented Plant Improvements

- Hardened the containment vent

- Implemented Revision 4 of the BWR Owners Group EPGs

- Initiated use of the raw water cross-tie (containment-spray raw water to core spray) as an alternate injection source to the RPV. Initiated exercise of the option to align containment-spray raw water directly to the torus to flood the containment.

l Nine Mile IPE Back-End Review A-2 January 1996

C-Matrix Accident Frequency Early Intermediate Late Intact Class (per yr)

IA 5.76E-07 0.06 0.02 0.58 0.35 IB 3.45E-06 0.13 0.76 0.10 IC 2.88E-08 0.06 0.03 0.91 ID 6.49E-08 0.04 0.03 0.12 0.81 IIA 1.04E-07 1 Ill 1.06E-08 1 l

IIT 1.11E-07 0.91 0.09 IIV 1.07E-07 1 IIIB 9.23E-09 0.01 0.03 0.01 0.95 IIIC 3.47E-07 0.86 ~0.03 0.11 IIID 4.41E-08 1 IV 4.96E-07 1 V 2.60E-08 1 1

A-3 January 1996 Nine Mile IPE Back-End Review

~ 2 NINE NILE POINT NUCLEAR STATION UNIT NO. 1 ,

INDIVIDUAL PLANT EXANINATION TECHNICAL EVALUATION REPORT (HUMAN RELIABILITY ANALYSIS) l l

l t

Enclosure 4 l