ML20101E149

TER on Individual Plant Exam Front End Analysis

ML20101E149
Person / Time
Site:	North Anna
Issue date:	08/31/1995
From:	Darby J, Sciacca F, Thomas W SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML20101E052	List: ML20101E149 ML20101E203 ML20101E556
References
CON-NRC-04-91-066, CON-NRC-4-91-66 SEA-92-553-029, SEA-92-553-029-A:3, SEA-92-553-29, SEA-92-553-29-A:3, NUDOCS 9603220159
Download: ML20101E149 (49)

Text

l I

SEA-92-553-029 A:3 August 31,1995 l l

North Anna 1 and 2 Technical Evaluation Report on the Individual Plant Examination Front End Analysis l

NRC-04 91-066, Task 29 John Darby, Technical Analyst Willard Thomas, Technical Editor Frank W. Sciacca, Technical Editor i

II l

Science and Engineering Associates, Inc. I l

l Prepared for the Nuclear Regulatory Commission i

i 9603220159 960305 )

PDR ADOCK 05000338 P PDR l )

TABLE OF CONTENTS 1

E. Executive S u mm ary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E.1 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 E.2 Licensee's lPE Process .................................

2 E.3 Front End Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 E.4 Generic lasues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 E.5 Vulnerabilities and Plant Improvements . . . . . . . . . . . . . . . . . . . . . . .

6 E.6 Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

1. l N TR O D U CTI O N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.1 Review P roce ss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.2 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

2. TECH NIC AL REV I EW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.1 Licensee's lPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.1.1 Comolateness and Methodoloov . . . . . . . . . . . . . . . . . . . . . . 9 2.1.2 Multi-Unit Effects and As-Built. As-Onarated Status . . . . . . . . 10 2.1.3 Licensaa Partleination and Paar Review . . . . . . . . . . . . . . . .

2.2 Accident Sequence Delineation and System Analysis . . . . . . . . . . . . . ' 10 10 2.2.1 Initiatino Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2.2 Event Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 2.2.3 Systems Analvals ................................

18-2.2.4 System Danandancias . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18 2.3 Quantitative Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 2.3.1 Onantifhtlon of Accident Seouance Freouancias . . . . . . . . . 19 2.3.2 Point Estlicates and Uncertaintv/Sannitivity Analvses . . . . . . .

2.3.3 Use of Plant-Soacific Data . . . . . . . . . . . . . . . . . . . . . 20 . . . . . 19 2.3.4 U se of Ganarie Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2.3.5 Common-Cause Quantification . . . . . . . . . . . . . . . . . . . . . . . 23 2.4 Interface issues . . . . . . . . . . . . . . . . . . . . ....................

. . . . . . . . . . . . . . . . . . . 23 2.4.1 Front-End and Back-End Interfaces 23 2.4.2 Human Factors interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . 24 2.5 Evaluation of Decay Heat Removal and Other Safety issues . . . . . . . .

.. 24 2.5.1 Evamination of DHR . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 2.5.2 Diverse IJImans of DHR . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 2.5.3 Unlous Features of DHR . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.5.4 Other GSI/USin Addressed in the Submittal . . . . . . . . . . . . . . 26 2.6 Intemal Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.6.1 Intamal Floodino Methodoloav . . . . . . . . . . . . . . . . . . . . . . . 27 2.6.2 Intamal Floodino Results . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.7 Core Damage Sequence Results . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.7.1 Dorr.ir. ant Core Damaos Seouances . . . . . . . . . . . . . . . . . . . 32 2.7.2 Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11

I , . j i

1 1

32  ;

l 2.7.3 Prooosed imorovements and Modifications . . . . . . . . . . . . . .

............... 35

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS 37

4. D ATA SU M M ARY S H E ETS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41 REFERENCES................................................  :

I 9

i i lii l

2.7.3 Procosed imorovements and Modifications . . . . . . . . . . . . . . 32

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS ............... 35 1

1' i 4. D ATA SU MM A RY S H E ETS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 I REFERENCES................................................ 42 l

A e

i i

t l

I a

k t .

i I

i  !

.\^

J 1

i e

lii

. o LIST OF FIGURES l

' Figure 2-1. Core Damage Frequency by internal Initiating Event . . . . . . . . . . . . 29 l Figure 2 2. Core Damage Frequency by Class of Initiating Event . . . . . . . . . . . . 30 e

l 6

iv

, I l

LIST OF TABLES ,

1 Table 2-1. Plant Specific Component Failure Data . . . . . . . . . . . . . . . . . . . . . . 20 Table 2-2. Generic Component Failure Data . . . . . . . . . . . . . . . . . . . . . . . . . . . 21- l Table 2-3. Comparison of Common Cause Failure Factors for 2 of 2 C o mpone nts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Table 2-4. Contribution to DHR Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1 l

Table 2-5. Top 6 Core Damage Sequences for Internal Events . . . . . . . . . . . . . 31 Table 2-6. Summary of Intemal Flooding Results . . . . . . . . . . . . . . . . . . . . . . . 34 i

i l

l l

l t

i i

1 4

4 i

4 d

l l

i I

I f

a h

5 V

4 1

4

+

i . .  !

l  :

i  !

i 1

E. Executive Summary i

This report summarizes the results of our review of the front end portion of the

[ Individual Plant Examination (IPE) for North Anna units 1 and 2. This review is based on information contained in the IPE submittal along with the licensee's responses to i

Requests for Additional Information (RAl).

i E.1 Plant Characterization i

The North Anna plant consists of two units, both a three loop Pressurized Water f Reactor (PWR), located near Richmond, Virginia. The power ratings for the units are i

2893 megawatt thermal (MWt), rated, and 915 megawatt electric (MWe), net. Stone .

j and Webster was the Architect Engineer (AE). The units achieved commercial operation in 1978 and 1980, respectively l

i i

Design features at North Anna that impact the core damage frequency (CDF) relative i

to other PWRs are as follows:

i b Ability to use comoonent coolina water (CCMA from the onoosite Unit for reactor ,

coolant numo (RCP) seal coolina. During' station blackout at one unit, CCW from the I f

opposite unit can be used for RCP seal cooling if the opposite unit has AC power.' ,

This feature tends to reduce the CDF during station blackout by reducing the likelihood j i

of core uncovery due to RCP seal failure. 4

{

Charaino numos cooled directiv with Service Water (SMA instead of CCW. Loss of

CCW does not lead to loss of seal cooling since the charging pumps are cooled with i SW and do not require CCW for cooling. The charging pumps can provide RCP seal .

j injection, and thus provide seal cooling. This feature tends to reduce the CDF since it i reduces the likelihood of a seal Loss of Coolant Accident (LOCA) due to loss of RCP j

. seal cooling systems.

Automatic switchover of emeroenev core coolina avstem (ECCS) from inlection to recirculation. This feature tends to reduce the CDF from a LOCA since operator j

action is not required to effect the switchover from injection to recirculation for either high or low head Emergency Core Cooling System (ECCS) pumps.

l 1

{

Heatina. ventilatina. and air conditionino (HVAC) la reautred for the electrical switchamar rooms (ESGRs). The mechanical refrigeration portion of the HVAC system l

is required to provide long-term cooling for the ESGRs. This requirement tends to i increase the CDF by increasing the likelihood of long term loss of AC power.

Raouirement to use the recirculation sorav system to cool containment. The ECCS i configuration is such that no heat exchangers are provided in the system lineups for j core cooling when in recirculation from the containment sump. Use of the recirculation

spray system is required to provide for heat removal from containment. This feature i

}

1

'4 4

1

would be expected to increase the CDF compared to plant designs which include heat )

exchangers in the ECCS recirculation lineups; however, as subsequently discussed, l the North Anna IPE assumes that loss of containment cooling has a minor impact on j the ability to provide core cooling. ]

E.2 Licensee's IPE Process  :

The IPE represents a level 2 Probabilistic Risk Assessment (PRA), that includes 1 intamal initiating events and intomal flooding. The IPE reflects the plant design as of j j the end of 1992.

1

! Utility personnel were involved in all aspects of the IPE. NUS Corp. (NUS) was the j major contractor used for the IPE effort. Plant walkdowns were used to support the j IPE analysis, along with numerous items of up-to-date plant documentation.

4 An independent review of the IPE was performed involving station personnel, f

corporate staff, and consultants.

j.

! The submittal states that the IPE will be maintained current to be used for future risk based studies. ,

i E.3 Front-End Analysis 4

The methodology chosen for the North Anna IPE front-end analysis is a Level 1 PRA.

[ The small event tree /large fault tree technique with fault tree linking was used. The j

.NUPRA computer code was used to quantify accident sequence frequencies.

The IPE quantified 17 classes of initiating events: 6 generic transients,5 LOCAs, and  ;

l l

6 plant specific initiating events. Loss of instrument air and loss of HVAC were not considered as special unique initiating events. l l l l '

Plant specific component failure data were used for selected components for both

hardware failures and unavailabilities due to test and maintenance. The method used i to quantify common cause failures was based on the guidelines of the procedure

! documented in NUREG/CR-4780.

Sensitivity and uncertainty analyses were performed. J The CDF for North Anna from intamal initiating events and intamal flooding is 7.1E-5/ year. The CDF from intomal initiating events, excluding intomal flooding, is 6.8E-5/ year. Section 4 of this report contains a comprehensive listing of CDF by initiating event; those events that contribute greater than 1% to the total CDF are as '

follows:

Loss of offsite power 17%

2

e O l

Small LOCA 14%

Station blackout 11 %

Steam Generator Tube Rupture (SGTR ) 10%

Medium LOCA 9%

Loss of ESGR cooling 9%

Other transients 8%

Large LOCA 6%

Loss of Bus 4160 V 1H 5%

intomal flooding 5%

interfacing systems LOCA 2%

Loss of feedwater 1%

Loss of 4160 V Bus 1J 1% i Core damage contributions by class of accident are as follows:

I LOCA 29%

i Loss of Offsite Power 28%

Transients 26 %

l SGTR 10%

l intemal Flooding 5%

interfacing System LOCAs 2%

Anticipated Transients without Scram (ATWS) 1%

i i Station blackout due to loss of offsite power contributes about 11% to the total CDF.

Loss of cooling for emergency electrical switchgear causing station blackout

! contributes about 6% of the total CDF.

Based on importance analyses that were performed, the IPE identified the.following

! component failures and operator errors as most important, listed in decreasing 4 importance, from the risk reduction calculation:

Failure of Diesel Generator (DG) 1H 4

Failure of Turbine Driven (TD) Auxiliary Feedwater (AFW) pump i

Failure of Operator Action to initiate High Head Safety injection (HHSI) for

}

either Feed and Bleed or following Power Restoration 4

- Failure to Recover ESGR Cooling

)

Failure of DG 1J.

DG 1J is less important than DG 1H because 1H serves 2 ESGR room coolers while 1J serves 1 ESGR room cooler.

4

' 3

?

I, . .

l 1

i

! Inclusion of recovery actions lowered the internal CDF by a factor of 3.2. Recovery a

actions as defined in the NAPS IPE are actions performed to recover a specific failure

. or fault such as recovery of offsite power or recovery o e y sys tem that f a front-line sa ft

is unavailable on demand earlier in the event. Such actions are not necessarily proceduralized in emergency operating procedures and instructions. In the NPAS IPE these recovery actions were not modeled in the event trees, but were included in the IPE model after initial quantification. [lPE Submittal, p. 3-129) The most important

. recovery actions were:

recovery of main feedwater

recovery of offsite power l recovery of Residual Heat Removal (RHR) following SGTR recovery of DG 1H from maintenance.

The IPE binned core damage sequences into Plant Damage States (PDS) to facilitate the back-end analysis. The PDSs bin core damage sequences based on common j characteristics, so that the back-end analysis can model a select set of core damage bins rather than model each core damage sequence individually. Nine criteria were used to bin the core damage sequences into PDSs.

Based on our review, the following aspects of the modeling process may have an "

! impact on the overall CDF:

! (1) For any size small LOCA with failure of high head safety injection,

depressurization can be accomplished sufficiently quickly so that core cooling 4

can be provided using low pressure safety injection pumps.

(2) If all seal cooling is lost, depressurization/cooldown can totally prevent a seal l

LOCA from occurring.

(3) If all containment cooling is lost and containment fails by overpressurization, core cooling systems survive 98% of the time.

l J (4) After loss of DC power, turbine driven AFW continues to operate although control of flow rate is lost. l (5) With the exception of cooling for the emergency switchgear rooms, HVAC was not explicitely modeled in the IPE.

3 All of these assumptions tend to lower the CDF. The first assumption lowers the CDF l 4

from a small LOCA by allowing for mitigation by depressurization and low head I injection. The second assumption lowers the CDF by decreasing the likelihood of a

seal LOCA following loss of all seal cooling. The third assumption lowers the CDF I associated with total loss of containment heat removal. The fourth assumption lowers the CDF for station blackout events by providing for longer term core cooling using turbine driven AFW. The final assumption lowers the CDF because of reduced l

i dependence of core cooling systems on HVAC.

i l

l 4 i I

3

E.4 Generic lasues  ;

. l 1

The submittal addresses Decay Heat Removal (DHR) and its contribution to CDF.

The IPE modeled DHR systems for both core cooling and containment heat removal, including: auxiliary feedwater, ECCS and feed and bleed. The IPE calculated the i relative contributions of the loss of the following DHR functions to the total CDF.

Based on the results of this analysis, the licensee concludes that there are no

]. vulnerabilities associated with loss of DHR.

! The licensee proposes that the IPE resolves two other Generic Safety issues / Unresolved Safety issues (GSI/USI's): the flooding portion of USl A 17, System

Interactions in Nuclear Power Piarets, and GI-23, Reacto.r Coolant Pump (RCP) Seal l LOCAs.'

! E.5 Vulrerabilities and Plant imprevements

! The licensee used the importance measutes of component contributions to determine j

l vulnerability. The submittal states that for a component failure or an operator error to 3

be a vulnerability, it must contribute more than 10% to the overall CDF or be a factor l l of 3 higher than the next highest similar event. Based on this definition of

! vulnerability, the submittal states that North Arena has no vulnerabilities. l l

The submittal discusses several minor improvements identified during performance of l l l j the IPE. These improvements were credited in the IPE. All of these procedural and i

hardware improvements were either completed or scheduled for near-term completion l

by the date of the submittal, December 1992. Recent information from the licensee '

states that all of these improvements have now been completed.

l The improvements are as follows:

1 Internal Events Procedure Enhancements-i l Revise periodic test procedures to verify that auxiliary feedwater full flow recirculation

!- valves are closed i Revise periodic test procedures to verify that quench spray piping and recirculation j

j spray piping is restored after testing Revise emergency operating procedures to add the altamate Safety injection (SI) header to the ' response not obtained' column if the normal Si header fails j

\

I 'The NRC has recently decided to drop any further rulemaking activities related to RCP i seal LOCAs [GI Memo). As a result, this item has been eliminated as a Generic issue.

5 4

4 4

.c

Stagger Low Head Safety injection (LHSI) pump tests to test one train every 45 days  !

and each pump every 90 days Administratively eliminate pre planned dual maintenance outages for chillers serving the main control room and the emergency switchgear rooms improve maintenance practices to minimize total time main control room and emergency switchgear room chillers are out of service Provide procedural guidance for trouble-shooting and repairing main control room /

7  :

! emergency switchgear room chiller protective circuitry Intemal Floodina Hardware Modifications:

Install backflow prevention devices in charging pump cubicle floor drains l

Improve piping penetration fire barrier between quench spray pump house and auxiliary building to limit flooding flow rate i

Add a dike to protect chiller room / fan roora doors and modify chiller room / turbine -

l building doors l

Intemal Floodina Proemdure Enhanr,ements:

l Periodic inspection / replacement r>f charging pump cubicle drain back flow prevention devices Periodic inspection of all flooct dikes and barriers l

Revision of periodic test procedures to test alarms and all automatic equipment

! actuations for floodirig level switches t

Revision of abnormal procedure for auxiliary building flooding to include steps which identify and isolate retrotely isolable floods and Refueling Water Storage Tanks (RWST) floods.

, E.6 Observations '

t l

The licensee appears to have analyzed the design .and operations of North Anna to l

discover instances of particular vulnerability to cora damage. It also appears that the licensee has: developed an overall appreciation cf severe accident behavior; gained an understanding of the most likely severe accidents at Nortn Anna; gained a ,

1 quantitative understanding of the overall frequency of core damage; and implemented changes to the plant to help prevent and mitigato severe accidents.

l L 6 I

l  !

l

j *

• i 2 No particular strengths or shortcomings of the IPE were identified.

4 i

Significant findings on the front-end portion of the IPE are as follows:

l I = LOCAs are important to the CDF

!' a- Station blackout contributes less to the CDF than is typical of many PWR IPEs/PRAs Seal LOCAs are not a major contributor to the CDF

) *

• Intemal flooding is not a major contributor to the CDF.

l i

l' LOCAs dominate the'CDF due to small LOCAs in which high pressure injection is lost i and depressurization/ low pressure injection fails. Station blackout is estimated to be less of a contributor to CDF than at many other PWRs due to the reliability of the i DGs, the IPE credit given for continued operation of turbine-driven auxiliary feedwater

' after DC power depletion, the high probability for recovery of offsite power, and the

! relatively low probability of a RCP seal LOCA at early times. RCP seal LOCAs are not a mejor contributor due to the ability to crosstle CCW for seal cooling between the l two units and due to the seal LOCA model used. Intemal flooding is not a major

! contributor due to the assumption that floods that cause loss of all containment cooling

! consequentially cause loss of core cooling only 2% of the time. ,

l 1

i i

I l

I 1

1-m i

I i

j 7

o- .

I i

1

1. INTRODUCTION j i

1.1 Review Process I l This report summarizes the results of our review of the front-end portion of the IPE for j North Anna units 1 and 2. This review is based on information contained in the IPE l . submittal [lPE] along with the licensee's responses [loE Responses) to RAI.

~

i 1.2 Plant Charactertration 1

- The North Anna plant consists of two units, both a three loop PWR, located near

Richmond, Virginia. The power ratings for the units are 2893 MWt, rated, and 915 MWe, net. Stone and Webster was the AE. The units achieved commercial operation '

3 in 1978 and 1980, respectively'

! Design features at North Anna that impact the CDF relative to other PWRs are as j

follows:

Ability to use CCW from the ocoosite Unit for RCP seal coolino. During station blackout at one unit, CCW from the opposite unit can be used for RCP seal cooling if I the opposite unit has AC power. This feature tends to reduce the CDF during station

blackout by reducing the likelihood of core uncovery due to RCP seal failure.

i I i

, Charoino numos cooled directiv with SW instead of CCW. Loss of CCW does not ,

lead to loss of RCP seal cooling since the charging pumps use SW for cooling and do i

not require CCW for cooling. The charging pumps can provide RDP seal injection, j and thus provide seal cooling. This feature tends to reduce the CDF since it reduces

the likelihood of a RCP seal LOCA due to loss of seal cooling systems.

Automatic switchover of ECCS from inleetion to recirentation. This feature tends to i reduce the CDF from a LOCA since operator action is not required to effect the

' switchover from injection to recirculation for either high or low head ECCS pumps, i

HVAC is reouired for the ESGRs. The mechanical refrigeration portion of HVAC i system is required to provide long-term cooling for the ESGRs. This requirement

tends to increase the CDF by increasing the likelihood of long term loss of AC power.

I Raouireirent to use the recirnulation morav system to cool containment. The ECCS configuration is such that no heat exchangers are provided in the system lineups for j

core cooling when in recirculation from the containment sump. Use of the recirculation j spray system is required to provide for heat removal from containment. This feature j would be expected to increase the CDF compared to plant designs which include heat j exchangers in the ECCS recirculation lineups; however, as subsequently discussed, J

the North Anna IPE assumes that loss of containment cooling has a minor impact on 5 the ability to provide core cooling.

i

! 8 4

4

O e t

4 j 2. TECHNICAL REVIEW i

j 2.1 Licensee's IPE Process 4 We reviewed the process used by the licensee with respect to: completeness and methodology; multi-unit effects and as-built, as-operated status; and licensee j participation and peer review.

i 1

2.1.1 Comoleteness and Methodoloav.

1 A modified level 2 PRA was performed to satisfy generic letter 88-20; the IPE makes i l

i extensive use of the NUREG/CR 4550 PRA for Surry and of the IPE for Surry, l l particularly for the back-end analysis. [NUREG/CR-4550, Surry) The PRA was )

performed in response to the generic letter. [GL 88-20)[lPE submittal, Section 1.1)

The submittal is complete in terms of the requests of generic letter 88-20.

l The front-end portion of the IPE is a level 1 PRA. The small event tree, large fault l tree technique with fault tree linking was used. Dependencies were included in the i fault trees. The NUPRA computer code was used for quantification of accident -

4

! sequences.

1 Intersystem dependencies are discussed and tables of system dependencies are l

l provided. Data for quantification of the models are provided, including common cause events and human recovery actions. Sensitivity and uncertainty analyses were ,

l performed and results of these analyses are described in the IPE.

4 I- 2.1.2 Multi-Unit Effects and As-Built. As-Onarated Status.

North Anna is a dual unit site. The two units share the following systems: service

water, component cooling water, and instrument air. The IPE model considers the sharing of systems as appropriate to maintain one unit in hot standby while mitigating an accident at the other unit. [lPE submittal, Section 2.3.10] The IPE considers dual-i l

unit core damage from a common initiating event to be highly unlikely. [lPE

Responses)

The IPE model considered CCW as not being cross-connected between the two units during normal operation. [lPE Responses) The IPE did consider use of CCW from the l

j opposite unit as a recovery action. Subsequent to the IPE submittal, the plant j configuration has changed so that CCW is normally cic ,s connected between the two j units in normal operation; therefore, the model used in the IPE is conservative. (IPE Responses) 4 9

i .

1 I

i The freeze date for the IPE model was December,1992. [lPE submittal, Section 1.3]

The IPE model credited numerous minor hardware and procedural changes past the l freeze date; these changes are discussed in Section 2.7.3 of this report.

h l

Plant walkdowns were performed for the internal flooding analysis. Also, the IPE j analysts interfaced with system engineers who had recently performed system i walkdowns. [lPE submittal, Sections 2.4 and 2.5.3)

The submittal states that the IPE will be maintained current to be used for future risk j based studies. [lPE submittal, Preface]

! 2.1.3 Licensee Particloation and Peer Review.

i Three utility staff members were assigned full time to the IPE effort. [lPE submittal, j Section 5.1) At least one utility person participated in each major IPE task. The major contractor for the IPE was Halliburton NUS; staff from NUS supported the IPE on an j as needed basis.

! An independent review of the IPE was performed. [lPE submittal, Section 5.2] The

independent review team consisted of members from

station personnel, corporate, staff, and consultants. Two senior staff members from SAIC served as chairpersons l

l of the independent review committee. The review team was provided with the project

! analysis files. The overall review was documented in a report. Comments from the

[ review were responded to and resolved by the PRA team. Section 5.3 of the submittal l summarizes significant review comments.

l 2.2 Accident Sequence DeBnestion and System Analysis This section of the report documents our review of both the accident sequence j delineation and the evaluation of system performance and system dependencies provided in the submittal.

I 4

2.2.1 initiatina Events, l

! The licensee used the following process to identify initiating events: [lPE submittal, l' Section 3.1.1.1)

(1) review of the Surry IPE (2) ' review of plant operating history (3) failure modes and effects analysis of plant specific support systems.

The initiating events were quantified as follows. [lPE submittal, Sections 3.3.1 and 3.3.2.2) Generic data were used for rare, generic initiating events, such as a large LOCA. Plant historical data were used for events that had occurred, such as turbine trip. Fault tree analysis was used for plant specific support systems.

l 10 l

i Plant specific initiating events were systematically identified by a Failure Modes and j Effects Analysis (FMEA) applied to systems. [lPE submittal, Section 3.1.1 and

Appendix C) Seventeen groups of initiating events were identified and analyzed. [lPE l submittal, Table 3.1.12] These groups of initiating events are as follows

)

! LOCAs:

i Vessel Rupture Large LOCA (greater than 6 inches) i Medium LOCA (2 to 6 inches)

' Small LOCA (less than 2 inches but greater than 3/8 inch) interfacing Systems LOCA Loss of Offsite Power ,

i Transients with Loss of Main Feedwater

Transients with Main Feedwater Available

! Transients with Main Feedwater Recoverable

Loss of Cooling to Reactor Coolant Pump (RCP) Seals

! SGTR Plant Specific Events:

f Loss of DC Bus 1-1 1-- Loss of DC Bus 1-ill

j. Loss of 4160 V Bus 1H i Loss of 4160 V Bus 1J i Loss of Service Water

! Loss of Emergency Switchgear Room Cooling.  ;

1

)

l Breaks less than 3/8 inch equivalent diameter are within the capability of normal i j charging makeup, and are therefore not considered to be LOCAs.

Loss of instrument air was considered as contributing to loss of main feedwater (the MSIVs close) and as a factor in loss of seal cooling (CCW to RCPs is lost). [lPE submittal, Section 3.1.1.1.3] .l The submittal states that main steam line breaks were screened out. [lPE submittal, Section 3.1.1.1.4) These events did not contribute significantly to core damage in the Surry IPE, so they were screened from the North Anna IPE.

Loss of CCW by itself was not considered as an initiating event. The charging pumps are cooled by SW and since seal cooling can be provided by seal injection with the charging pumps or CCW cooling to the pump thermal barrier coolers, loss of CCW alone does not cause loss of seal cooling. Loss of CCW together with loss of charging was considered as the initiating event ' loss of RCP seal cooling'. [lPE submittal, Page 3-17] The IPE assumed that a vibration-induced seal LOCA, due to failure of CCW and failure of operator action to trip the RCPs, is an insignificant {

contributor to the total CDF. [iPE Responses] The operator is alerted to loss of CCW 11

, -... -.-- - - - . - - - . - . - = - - -

i. .

I

cooling to the RCPs and is trained to trip the RCPs; therefore, the likelihood of a )

l: vibration induced seal LOCA prior to operator action to trip the RCPs is very small.

[lPE Responses) l The submittal discusses the systems analyzed for an interfacing systems LOCA. It is l pointed out that RHR at North Anna is separate from LHSI and RHR is located

! completely inside containment. The only systems that can suffer an interfacing systems LOCA at North Anna are: LHSI, HHSI, and Chemical Volume and Control

! System (CVCS). Interfacing system LOCAs from breaks in RCP thermal barrier coolers were screened due to the small size of the equivalent break. The NUREG/CR

! 4550 Surry PRA frequency for an interfacing systems LOCA,1.6E-6/ year, was used j

for North Anna based on the similarities between the plants. [lPE submittal, Page 3- )

j 65) The IPE assumed that an interfacing systems LOC.A cannot be mitigated and l leads directly to core damage. [lPE submittal, Page 3-65) 4 i The IPE modeled loss of offsite power as loss of power to both units. [lPE submittal,

! Page 3-11] Following loss of offsite power to unit 1, power from unit 2 for common l support systems between the two units was considered; this required operation of a I

DG at unit 2. [lPE, Responses)

! Tables 3.3.1-3 and 3.3.2-4 of the submittal provide the point estimate initiating eve'nt

! frequencies. These frequencies are comparable to corresponding data used in other l PRA/IPEs. Loss of SW is relatively low,6.3E-6/ year, but not unreasonable for a j system with normally operating components.

! The frequency of a small LOCA is 2.1E 2/ year. [lPE submittal, Table' 3.3.1-3) The . I event tree for a small LOCA differentiates between a small LOCA and a very small l

j LOCA, the difference being that a very small LOCA does not cause Containment l Depressurization Actuation (CDA). [lPE submittal, Page 3-46) Without CDA, operator j action to depressurize can avoid the need for recirculation from the containment sump.

! 2.2.2 Event Trees.

i l' Eighteen primary event trees were constructed and analyzed, these being: [lPE submittal, Section 3 Event Tree Figures]

j Large LOCA (A) l_ Medium LOCA (S1)

Small LOCA (S2)

Loss of Offsite Power (T1) and Station Blackout (T1 A)

Loss of Main Feedwater (T2)

Recoverable Loss of Main Feedwater (T2A)

!l Transient with Main Feedwater Available (T3)

Loss of RCP Pump Seal Cooling (T4) l Loss of DC Bus 1-1 (TSA) 2 12 I

L_

I l 1

4

$ Loss of DC Bus 1-111 (T58) j Loss of Service Water (T6) j ' SGTR (17)

Loss of Emergency Switchgear Room Cooling (T8) l Loss of 4160 V Bus 1H i Loss 4160 V Bus 1J

ATWS with Power 2 40*/.

i ATWS with Power < 40%.

2 l

Event trees were also developed for an interfacing systems LOCA and for reactor vessel rupture, but were not used to model prevention of core damage, as the IPE l

i assumed that these events lead directly to core damage. The event trees are j systemic rather than functional.

The submittal states that the criteria used for core damage are the ECCS licensing l criteria of 10 CFR 50.46 as discussed in the UFSAR. [lPE submittal, Section 3.1.1.2.1]

j I 2200 F peak clad temperature is the acceptable limit for no core damage.

i'

- The mission time used was 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. [lPE submittal, Section 3.1.1.2]

i The station blackout event tree credits use of turbine driven auxiliary feedwater. [lPE submittal, Section 3.1.3.1.1) The battery lifetime is 2 houre. [lPE, Responses] After loss of DC power, turbine driven AFW continues to operate although control over flow rate is lost. The IPE assumed that with continued operation of turbine driven AFW at I a fixed flow rate, core damage will not occur for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, based on MAAP 4 j I calculations which considered: depletion of Condensate Storage Tank (CST) inventory, l-and overfill with subsequent rupture of the main steam lines. [lPE Responses) j i

The cuccess criteria for a large LOCA require long term switchover of ECCS injection l

l from cold leg to hot leg recirculation. [lPE submittal, Table 3.1.1.-16] This is to prevent blockage of core cooling flow from boron precipitation. If cold leg injection is used, all l

the injected water is lost out the break except for that necessary to makeup for'bolloff from the core region; with hot leg injection, all the injected water is forced through the l l

core prior to exiting the break. Many IPEs have assumed that this switchover is not required or that the time available for switchover 16 sufficiently long so that failure to

switchover is negligible.

l The success criteria for a large LOCA require containment cooling with one l

rec'rculation spray pump and its associated heat exchanger. [lPE submittal, Table l.

3.1.1-16). The LHSI system at North Anna does not have heat exchangers in '

j recirculation from the containment sump; thus, containment cooling long term with the

recirculation spray system is needed. The IPE considered fouling of the recirculation

spray heat exchangers in evaluating the ability of one heat exchanger to provide

adequate containment cooling. [lPE, Responses) i 13 l

i i

I 4

> ,-we ,- -- --w-- ,

The success criteria for a large LOCA require quench spray to provide adequate Net Positive Suction Head Available (NPSHA) for the inside recirculation spray pumps.

[lPE submittal, Table 3.1.1-16)

The success criteria for a medium LOCA credit depressurizati.on with the secondary of the steam generators to allow use of LHSI to mitigate the LOCA if HHSI with the charging pumps is not available. [IPE submittal, Table 3.1.1-17] However, the submittal states that no credit was given to this option due to the short time available for operator action to depressurize. [lPE submittal, Page 3-267]

The small LOCA success criteria credit feed and bleed with one Power Oportted Relief Valve (PORV) and one charging pump in the HHSI mode, if cooling to the steam generators is not available. [lPE, submittal, Table 3.1.1-18]

The small LOCA success criteria credit depressurization with the secondary of the steam generators to allow use of LHSI to mitigate the LOCA if HHSI with the charging pumps is not available. [lPE submittal, Table 3.1.1-18) This capability is not always credited in PRAs for PWRs due to the complexity of achieving depressurization in time to prevent core damage. The NUREG/CR 4550 PRA for Surry did not credit this method for mitigating a small LOCA; for example the S,D, core damage sequence for ,

Surry is a small LOCA with failure of HHSI. [NUREG/CR- 4550, Surry, Table 4.4-11 and Page 5 27]

The event trees segregate recirculation spray from the containmer.t sump (event Rs) from heat removal from containment by cooling of the recirculation spray heat l exchangers with service water (event Ch). The success criteria for large, medium, and small LOCAs require containment heat removal, that is, success of events Rs and Ch. [lPE submittal, Tables 3.1.1-16,3.1.1-17,3.1.1-18) However, later in the submittal in the discussion of event REC-CONTAINMENT, it is stated that sequences were considered for which containment cooling was lost, ECCS was successful , and containment fails; a probability of ECCS failure from Environmental Qualification (EO) effects associated with containment failure was assigned a value of 0.02. [lPE submittal, Page B-11) Therefore, the IPE model assumed that with loss of all containment cooling and containment failure by overpressurization, core conling systems survive 98% of the time. This treatment of the ability to provide cure cooling without containment cooling is consistent with that in the NUREG/CR 4550 model for Surry. [NUREG/CR-4550, Surry)

The SGTR success criteria require depressurization, and use of RHR shutdown cooling to atmospheric pressure to stop the leak if the faulted steam generator cannot be isolated. [lPE submittal, Table 3.1.1-20] The IPE did not consider hot shutdown with an unisolated faulted SG with HHSI and refill of the RWST as a successful endstate, in contrast to the NUREG/CR 4550 PRA for Surry which did consider such a state as acceptable. [lPE submittal, Page 7-5) Other PRAs have assumed that 14

a ,

f success following a SGTR is hot standby with HHSI and refill of RWST for continued HHSl supply.

The ATWS model for initial reactor power greater than 40% accounts for the early in l life conditions when the moderator temperature coefficient is insufficiently negative to prevent excessive pressure. [lPE submittal, Page 3-32] Also, the model for mitigation of an ATWS with initial power greater than 40% requires turbine trip to prevent loss of SG inventory too early before power runback to an acceptable level has been achieved from the negative temperature coefficient of the moderator. [lPE submittal, Page 3-32]

The IPE contains an event tree for loss of cooling to the emergency switchgear room.

The equipment in this room is only qualified to 120 F, so loss of room cooling leads to

! failure of the equipment in the room. [lPE submittal, Section 3.1.3.5] This is a plant specific characteristic; other IPE submittals have stated that cooling to electrical switchgear is not required, while some IPEs have required cooling to switchgear rooms.

i i The RCP seal LOCA event tree requires failure of both CCW and charging injection to cause loss of seal cooling. [lPE submittal, Section 3.1.3.2] This event tree credits operator action to depressurize and cooldown to lower primary temperature. The ~

model assumes that successful depressurization and cooldown totally prevents a seal LOCA to tripped RCPs without seal cooling; other IPE/PRAs, such an as the NUREGICR 4550 PRA for Surry, assumed that depressurization affects the timing and the magnitude of the seal LOCA but does not totally prevent it. [NUREG/CR-4550, Surry Table D.5 3] With failure to. depressurize, the Westinghouse model for a seal LOCA (likelihood and size) is used in the North Anna lPE.

2.2.3 Svntems Analvsis.

Systems descriptions are included in Section 3.2 of the submittal. There are 21 l system descriptions in total, each consisting of a brief description of the system and a l

summary of the modeling of the system in the IPE. Simplified schematics of the systems are provided in Appendix A of the submittal.

The system description for containment isolation states that containment isolation does not isolate seal injection. [lPE submittal, Page A-34]

The IPE credited crosstle of AC power between units for selected initiating events.

[lPE Responses] If the initiating event results in the possible trip of the opposite unit, then crosstle was not credited. The 1H to 2J 4160 V emergency bus crosstle over i

transfer bus F was credited in the models for mitigation of all initiating events except the following: loss of offsite power (T1, T1 A, SBO), partial loss of power (T9A, T9B),

and loss of service water (T6). The submittal states that the impact of the l

consideration of the crosstle on the total CDF is negligible.

l l

15

s . .

I J

The IPE used a battery lifetime of two hours. [lPE Responses) j North Anna has loop isolation valves in each of the three primary loops. However, the 4

submittal did not indicate that these valves were included in the IPE model, i

The IPE assumed that the accumulators provided for the pressurizer PORVs could j

maintain the PORVs open as required during the mission time. [lPE Responses] The

! IPE did not credit any backup air suppiy for maintaining the steam generator Atmospheric Dump Valves (ADV) open with loss of instrument air. [lPE Responses) l d

North Anna has a decay heat removal valve common to all three SGs. [lPE submittal,

' Page A 31] This valve is sized for decay heat at 30 minutes, but it was not considered in the IPE models as a backup to the SG ADVs. Only 2 of the 8 turbine I bypass steam dump valves to the condenser can be manually controlled to dump l

steam. [lPE submittal, Page A-31]

The system description for the safety injection actuation system states that ECCS switchover from injection to recirculation is automatic. [lPE submittal, Section 3.2.20]

Automatic switchover for both LHSI and for HHSI piggyback on LHSI is provided. The automatic switchover is a backup to operator action to manually initiate ECCS ,

switchover. [lPE submittal, Section 3.1.2.2.1]

- The AFW system is suppIled with 110,000 gal from the emergency condensate storage tank (ECST). Backup supply from the 300,000 Condensate Storage Tank (CST) is available, as well as backup from service water or firewater. [lPE submittal, Section 3.2.2.1] ,

The charging system consists of three pumps, one normally operating. The charging i

pumps serve as the HHSI pumps at North Anna. [lPE submittal, Sections 3.2.3 and l

3.2.10 ) Two of the pumps are required operable by the technical specifications. Only i

two pumps can be running simultaneously for HHSI, the third pump is in an ' auto after l

.stop' mode. [lPE submittal, Section 3.2.10] The charging pumps require SW cooling; '

they are not cooled by CCW. [lPE submittal, Page A-19]

The LHSI system at North Anna is distinct from the RHR system. [lPE submittal, Sections 3.2.12 and 3.2.19] The LHSI pumps are self-cooled and the LHSI system employs no heat exchangers, even in the recirculation mode of operation; heat removalis accomplished with the heat exchangers in the recirculation spray system.

The RHR pumps and RHR heat exchangers are cooled with CCW. The IPE only modeled RHR in the SGTR accident, where it was necessary for successful mitigation of the accident.

North Anna uses a subatmospheric containment. Negative pressure is maintained by exhaust fans during normal operation. Following a LOCA, the quench and spray systems retum containment pressure to subatmospheric by injecting cold water (the 16

o .

RWST and casing water is chilled); as temperature in containment is lowered, the pressure drops negative due to the initial inventory of air being low from the initial condition being negative pressure (in-leakage is a small effect).

Both the CCW and SW systems are shared at North Anna. (IPE submittal, Sections 3.2.4 and 3.2.21) The SW system can operate in a lake-to-lake mode or in a reservoir to-reservoir mode. The reservoir is sufficient to provide the ultimate heat sink.

The IPE considered the need for HVAC to support operation of frontline systems. [lPE

~

Responses) Cooling requirements were determined from: calculations, system documentation, the UFSAR, the technical specifications, system walkdowns, and interviews with system engineers. HVAC was modeled in the IPE as follows.

The submittal contains a system description for the emergency switchgear room cooling system. [lPE submittal,3.2.9) The low temperature qualification of the equipment in the room is of note: 120 F. The cooling system uses air handling units supplied with chilled water from mechanical refrigeration units cooled by service water.

The submittal contains a schematic of this system, indicating that the mechanical refrigeration units also supply chilled water to the control room air handling units. [lPE

~

submittal, Figure A.15-1]

Ventilation for the DGs was considered in the overall plant-specific data used to quantify failure of the DGs. DG ventilation was not considered spearately from the DG

' super-component" model. [IPE Responses)

The IPE did not require room cooling for: AFW, charging /HHSI, LHSI, RHR, service  ;

water, or the control room. The licensee states that the cooling systems are reliable and that compensatory actions can be taken to provide room cooling if the normal room cooling systems are lost. Therefore, separate models for room cooling for these areas / components were not included in the NAPS IPE. [lPE Responses]

The IPE used the Westinghouse seal LOCA model for RCPs with unqualified elastomers. [lPE Responses)

The submittal states that the design temperature of the LHS1 pumps is 250 F; however in response to RAI the licensee states that the actual design temperature for the pumps at North Anna is 300 F, and that the pumps at Surry have the 250 F design temperature for the graphite bearing assembly. [lPE submittal, Page A-62] [lPE Responses) j .

)

17 l~

2.2.4 Svstem Denendencies The submittal contains tables of inter-system dependencies. [lPE submittal, Tables 3.1-13 and 3.1-14) These tables indicate the dependencies of frontline systems on support systems, and the dependencies among support systems.

The following dependencies are not addressed in the system dependency tables:

AC power requires DC power for switchgear control, HVAC dependencies are not explicitly indicated, dependence of main feedwater on bearing cooling is not indicated, dependence of inside recirculation on quench spray is not indicated, dependence of outside recirculation on casing cooling is not indicated, dependence of component cooling water on service water is not indicated, dependence of instrument air on co'.'ing water for compressors and aftercoolers is not indicated.

Tables of component dependencies in Appendix A of the submittal do indicate the dependence of pumps on component cooling and on room cooling, but these extra tables do not provided all the inter-system dependencies needed to understand the dependencies as modeled in the IPE. (Tables A.S.1 through A.5-17] It appears that these dpendencies were considered in the detailed IPE model.

2.3 Quantitative Process This section of the report summarizes our review of the process by which the IPE quantified core damage accident sequences. It also summarizes our review of the data base, including consideration given to plant-specific data, in the IPE. The unceitainty and/or sensitivity analyses that were performed were reviewed.

2.3.1 Quantification of Accident Saouance Fraouancias.

f The North Anna IPE used the small event tree /large fault tree technique with fault tree linking. The NUPRA computer code was used to quantify accident sequence -

frequencies. [lPE submittal, Page 3-233] Support systems were modeled in the fault ,

trees. Common cause failures and human errors were considered in the model. A 24 l hour mission time was used for the front-end model. The IPE used a truncation value of 1E-9/yr for intermediate steps in the analysis and 1E-11/yr for final sequence quantification. [lPE submittal, Page 3-105) Recovery actions were applied to the dominant sequence cut sets.

i 18

4 4 2.3.2 Point Estimates and Uncertaintv/ Sensitivity Analvses.

The accident sequence quantification process utilized mean values for initiating event frequencies and fault tree event probabilities. Mean values are reported for the sequence frequencies and the total CDF.

The licensee performed an uncertainty analysis and generated a probability distribution for the CDF. The licensee performed sensitivity analyses. [lPE submittal, Section 3.4.2] The sensitivity analysis for an RCP seal LOCA indicates that if a seal LOCA occurs at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> then the total CDF increases by 91%.

2.3.3 Use of Plant-Soacific Data.

Five years of operating data were used for the plant specific data base, covering the time period from 1986 through 1990. [lPE submittal, Section 3.3.2.1] Data from both units were used. The plant specific data were used to Bayesian update generic data, l

except plant specific data were exclusively used for unavailabilities 'due to maintenance. [lPE submittal, Section 3.3.2.3] Appendix C of the submittal contains more details on the plant specific data base. The components for which plant specific l

data were developed for demand faults are as follows: [lPE submittal, Section C.5.3]

charging /HHSI pumps AFW pumps recirculation spray pumps LHSI pumps SW pumps DGs ESGR room cooling components. (air handling units and chillers)

These components were selected based on the experience of other PRAs, the Surry NUREG/CR 4550 PRA, and the Surry IPE.

The IPE used generic data for Motor Operated Valves (MOVs). There were not sufficient plant-specific data available for MOVs during the five years used for data gathering to warrant the use of plant-specific data. [lPE Responses]

l Table 2-1 of this report compares the plant specific data for selected components from Table 3.3.2-4 of the submittal to values typically used in IPE/PRA studies, using the NUREG/CR 4550 data for comparison. [NUREG/CR- 4550, Methodology) l Based on the comparison in Table 21, the plant specific failure data are consistent l with NUREG/CR-4550.

l I I I f 19 l  !

o .

I Table 2-1. Plant Specific Component Failure Data ' l Component IPE Point Estimate NUREGICR 4550 (Table 3.3.2-4 of Submittal) Point Estimate Turbine driven AFW pump 2E-2 Fall to Start 3E-2 Fall to Start SE-3 Fall to Run HHSI pump 5E-3 Fall to Start 3E-3 Fall to Start 3E-5 Fall to Run hlHR pump 4E-3 Fall to Start (LHSl) 3E-3 Fall to Start 3E-5 Fail to Run l l

ESW pump 3E-3 Fall to Start 3E-3 Fall to Start l 3E-5 Fall to Run Diesel Generator 1E-2 Fall to Start 3E-2 Fall to Start 2E-3 Fall to Run

' Failures to start or open are probabilities of failure on dernand. Failures to run are frequencies in 1/hr. l

\

\

l 2.3.4 Use of Generic Data.

Numerous sources of generic data were used, specifically: NRC documents, EPRI reports, and industry group reports. [lPE submittal, Section 3.3.1.2) These sources are listed in Table 3.3.1-2 of the submittal.

4 l

.We performed a comparison of the data for selected components from Table 3.3.1-of the submittal, to generic values use in the NUREG/CR-4550 studies; [NUREG/CR-4550, Methodology) The comparison is summarized in Table 2-2. j Based on the data in Table 2-2, the generic data used in the IPE are consistent with generic data used in typical PRA studies.

The IPE applied recovery actions to cut sets of dominant core damage sequences.

The data used for non-recovery of offsite power for times up to 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> is plotted in Figure B.1-3 of the submittal. Data used for times out to 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> are provided in Table C.7-1 of the submittal. The submittalindicates that these data are from i NUREG/CR 4550 for Surry. [lPE submittal, Table C.7-1) l 20

Table 2-2. Generic Component Failure Data '

Component IPE Point Estimate NUREG/CR-4550, Vol.1, (Table 3.3.1-4 of Submittal) Rev.1, Point Estimate MOV 1E-2 Fall to Open 2E-3 Fail to Operate EH Valve - 2E-3 Fail to Operate AC Bus 5E-7 1 E-7 Circuit Breaker 2E-3 Falls to Open 3E-3 Fall to Operate DG 2E-3 Fails to Run 2E-3 Fall to Run Motor Driven Pump 3E-5 Fall to Run 3E-5 Fail to Run Pressurizer PORV 1E 2 Fall to Open 2E-3 Fall to Open .

2E-2 Fail to Close' 2E-3 Fall to Close

' Failures to start, open, or operate are probabilities of failure on demand. Failure of the AC Bus and failures to run are frequencies in 1/hr.

I

• Data taken from NUREG/OR-4550, Vol. 3. Rev.1 (Surry) 2.3.5 Common-Cause Quantification. ,

The submittal states that the method used to model and quantify common cause failure was based on the guidelines of the procedure documented in NUREG/CR-l l 4780. [lPE submittal, Section 3.3.4) The submittal summarizes components selected for common cause failure consideration, these being: [lPE submittal, Section 3.4.4]

standby pumps valves with operators check valves DGs l banedes l chillers l l&C channels SW reservoir screenwells.

The rationale for selecting these components is provided in Appendix C of the submittal. [lPE submittal, Section C.6.1] This selection process is consistent with that

" sed in other IPE/PRA analyses.

Jommon cause failures across systems were screened from consideration; this is the typical practice used in PRA.

Detailed quantification of common cause failures was performed for the following components: [lPE submittal, Section C.6.2]

21

O e DGs MOVs LHSI Pumps MD AFW Pumps.

The remaining common cause failures were quantified using the basic parameter model with a beta factor of 0.1.

Tables 3.3.4-1 and C.6-8 of the submittallists the common cause failure probabilities used. These tables in the submittal tabulate probabilities, not common cause factors.

To compare the common cause factors with those typically used, we used the data from the submittal that was used to develop Tables 2-1 and 2-2 of this report to estimate equivalent beta factors for common cause failure of 2-of-2 components. The results of this comparison are given in Table 2-3 of this report.

Table 2-3. Comparison of Common Cause Failure Factors for 2 of 2 Components Component Estimated Beta Factor from Factor from Submittal NUREG/CR 4550 for 2/2 FaRures' AFW Pump (Motor Driven) 0.09 0.056 Fall to Start ESW Pump 0.10 0.026 Fall to Start CCW Pump Not Provided 0.026 Fall to Start RHR Pump 0.1 (LHSI) 0.15 Fall to Start HHSIPump Not Provided 0.21 Fall to Start Containment Spray Pump 0.10 0.11 Fall t:) Start 0.04 0.088 Fall to Open MOV Diesel Generator 0.02 0.038 Fall to Start 0.10 0.07 Fall to Open (2 of 2)

Pressurizer PORVs

' Calculated based on failure to start data k1 the submittal i'

The common cause failure data in the submittal does not include values specifically for the HHSI and CCW pumps; common cause failure were not considered for normally l- ,

i running components. [lPE submittal, Page C-23]

. The data in Table 2-3 of this report indicates that the beta factors used in the IPE are It should be noted that the probability for

! comparable to those used in typical PRAs.

j 2 DGs to fait due to common cause failure at North Anna (the product of the beta .

factor and the single DG fall to start value) is relatively low (about a factor of 6 lower f

i than the failure probability used in NUREG/CR-4550), since the failure to start

probability for a DG is relatively low as noted in Table 21 of this report, and the i equivalent beta factor is relatively low as indicated in Table 2-3 of this report.

i I 22

}

i i . .

2.4 Interface lasues This section of the report summarizes our review of the interfaces between the front-end and back-end analyses, and the interfaces between the front-end and human factors analyses. The focus of the review was on significant interfaces that affect the ability to prevent core damage.

2.4.1 Front-End and Back-End Interfaces.

The IPE model assumes that with loss of all containment cooling and containment failure by overpressurization, core cooling is not lost 98% of the time.

The IPE binned core damage sequences into Plant Damage States (PDS) to facilitate the back-end analysis. [lPE submittal, Section 2.3.8] The PDSs bin core damage sequences based on common characteristics, so that the back-end analysis can model a select set of core damage bins rather than model each core damage sequence individually. Nine criteria were used to bin the core damage sequences into PDSs:

[lPE Section 4.3.2):

Containment bypass ,

Containment status before core melt Transient or LOCA -

l Station blackout Power recovery Recirculation sprays Containment heat removal RCS pressure at core damage Status of in-vessel injection.

Based on the characteristics of the front-end core damage sequences, the PDS binning process used in the North Anna IPE is consistent with that used in other 4 IPE/PRAs. l 2.4.2 Human Factors interfaces i I

During our review, we noted the following human actions that should possibly be '

considered in the human factors review of the IPE:

• operator actions to recover main feedwater a operator actions to recover ESGR cooling including using the opposite units room coolers a operator actions to feed and bleed

• operator actions to depressurize to prevent a seal LOCA if all seal cooling is

- lost c

23

• operator actions to depressurize and use LHSI to mitigate a small LOCA if HHSI s lost

• operator actions to isolate the bad SG and depressurize following a SGTR

• operator actions to use the opposite unit's charging pumps

• operator actions to cross tie 4160 and 480 V AC both within a unit and between units

= operator action to use backup air bottles on loss of instrument air

• - operator action to terminate HHSI following a spurious ECCS actuation to prevent opening a PORV

• operator action.to restore injection following recovery of AC power

• operator action to trip RCPs following loss of CCW to prevent a vibration-induced seal LOCA.

2.5 Evaluation of Decay Heat Removal and Other Safety issues This section of the report summarizes our review of the evaluation of Decay Heat Removal (DHR) provided in the submittal. Other GSI/USIs were also reviewed.

2.5.1 Examination of DHR.

Section 3.4.3 of the submittal discusses DHR. The IPE calculated the relative contributions of the loss of the following DHR functions to the total CDF. [lPE Responses) These contributions are summarized in Table 2-4 of this report. Note that the percentages are not additive since some sequences involve failure of more than one function.

Table 2-4. Contribution to DHR Failure Function Failed (Event Tree Headings) Contribution to CDF Failure to Cooldown (0+Y) 29%

Failure of Secondary Heat Removal 16%

(L+M)

Failure of injection (D1+D3) 62 %

Failure of Recirculation (H1+H2) 15%

Failure of Feed and Bleed (P) 2%

The importance analyses p.orformed for the IPE indicate that the dominant component contributing to loss of DHR is the turbine driven auxiliary feedwater pump. The licensee concludes that there are no vulnerabilities associated with loss of DHR, since l

the contribution of any individual component failure to overall CDF is small. The

following features reduce the likelihood of loss of DHR at North Anna

3 motor driven j main feedwater pumps that can be used if the MSIVs are closed, ability to feed and 24

- . - - - . - . - - - - - - - ~ . - - _ . . . - - - - - - - - - . .

o ,

I bleed, ability to cross connect charging flow between units, and ability to depressurize and use LHSl pumps to mitigate a small LOCA with loss of HHSI.

2.5.2 Diverse Means of DHR.

The IPE evaluated the diverse means for DHR, including: use of the power conversion system, feed and bleed, auxiliary feedwater, and ECCS. Depressurization using the secondary was considered for small LOCA accidents when HHSI was unavailable.

Cooling for RCP seals was considered. Containment cooling was addressed.

l 2.5.3 Unlaue Features of DHR l

l The unique features at North Anna that directly impact the ability to provide DHR are an as follows:

Ability to use CCW from the Oooosite Unit for RCP Seal Coolino. During station blackout at one unit, CCW from the opposite unit can be used for RCP seal cooling if .

the opposite unit has AC power. This feature tends to reduce the CDF during station l blackout by reducing the likelihood of core uncovery due to RCP seal failure.

Charoina oumos cooled directiv with SW instead of CCW. Loss of CCW does not '

lead to loss of seal cooling since the charging pumps do not require CCW for cooling.

This feature tends to reduce the CDF since it reduces the likelihood of a RCP seal LOCA due to loss of seal cooling systems.

Automatic switchover of ECCS from inlection to racirculation. This feature tends to reduce the CDF from a LOCA since operator action is' not required to effect the switchover of ECCS from injection to recirculation for either high or low head ECCS pumps.

HVAC is raauired for the ESGRs. The mechanical refrigeration portion of the HVAC system is required to provide long-term cooling for the ESGRs. This requirement tends to increase the CDF by increasing the likelihood of long term loss of AC power.

Raouirement to use the racirendation morav svatem to cool containment. The ECCS configuration is such that no heat exchangers are provided in the system lineups for core cooling when in recirculation from the containment sump. Use of the recirculation spray system is required to provide for heat removal from containment. This feature would be expected to increase the CDF compared to plant designs which include heat exchangers in the ECCS recirculation lineups; however, an as subsequently discussed, the North Anna lPE assumes that loss of containment cooling has a minor impact on the ability to provide core cooling.

1 25

S 8 2.5.4 Other GSI/USts Addressed in the Submittal.

The licensee proposes to resolve USI A-17 with respect to internal plant flooding. [IPE submittal, Section 3.4.4) The submittal states that the contribution to the total CDF from intemal flooding is low (about 5%) and that there are no vulnerabilities associate with intomal flooding.

The licensee proposes to resolve GI-23, RCP seal LOCAs.' (IPE submittal, Section 3.4.4) The IPE considered RCP seal LOCAs from: random initiating events, loss of seal cooling not associated with station blackout, and station blackout. The plant design allows cross connection between the two units of both seal injection and thermal barrier cooling. The licensee concludes that the contribution of seal LOCAs to the total CDF is small, about 10% of the total CDF.

2.6 Intemal Flooding This section of the report summarizes our reviews of the process used to model intamal flooding and of the results of the analysis of intamal flooding.

2.6.1 Internal Floodina Methodoloav. .

The following process was used to address intemal flooding. (IPE submittal, Section 3.3.7) Information from the Appendix R Safe Shutdown Submittal, from prior evaluations of flooding in the turbine and auxiliary buildings, and from plant walkdowns were used to evaluate flooding in the IPE. After as initial screening, the follcwing areas were retained for detailed consideration for flooding analysis:

turbine building auxiliary building unit 1 quench spray pump house

! unit 2 quench spray pump house unit 1 air condition!ng chiller room unit 2 air conditioning chiller room.

Flood-induced failures due to spray and dripping as well as submergence were considered.

The event trees developed for intomal initiating events were modified to account for flood induced failures and used to quantify core damage from intomal flooding. (IPE submittal, Appendix E) Using worst-case assumptions for the effects of a flood, flood scenarios with a CDF of less than 1E-6/ year were screened from further consideration.

Those flood scenarios surviving this screening were analyzed in detail.

I 8 The NRC has recently decided to drop any further rulemaking activities related to RCP 4

! seal LOCAs (Gl Memo). As a result, this item has been eliminated as a Generic issue.

26

... . - -=- _ .

! c .

The IPE credited changes to plant hardware and procedures in the flooding analysis.

[lPE submittal, Section 1.4.2] These changes are as follows:

)

Installation of backflow prevention devices in charging pump cubicle floor drains l l

l to prevent floods in the auxiliary building and in the quench spray pump house

! from propagating to the charging pump cubicles 4 Erection of a flood barrier in the pipe tunnel between the quench spray pump house and the auxiliary building to prevent propagation of floods between these

{

two areas Modification of the chiller room doors to prevent flooding of the instrument rack l

j room and the emergency switchgear room following a flood in the chiller room.

These three modifications were completed prior to transmittal of the IPE submittal to

! the NRC.

1 i

2.6.2 Internal Floodina Results. I l

The dominant flood scenario results from a service water flood in the auxiliary building.

Such a flood causes cause a loss of RCP seal cooling due to flood-induced loss of ,

i SW, CCW, and charging pumps. [lPE submittal, Section 3.3.7.2] Containment cooling is lost since SW is lost. The event tree for this flooding event is included in

~

the submittal. [lPE submittal, Figure E FAB 2] This event has a frequency of 1.0E-4/ year and results in a CDF of 2.6E-6/ year.

Although the initiating event results in loss of seal cooling and HHSI, it does not

directly lead to RCP seal damage since the IPE credited depressurization an as a

- method to totally prevent a RCP seal LOCA (event O). If event 0 is successful there is no core damage.

If event O falls, an RCP seal LOCA results. High pressure injection was lost as a i

result of the flood initiating event. The model credits depressurization and use of low pressure core injection for core cooling. Containment cooling was failed as a result of the initiating event, but the model assumes that without containment cooling core cooling falls only 2% of the time. The CDF for this sequence is 7.61E-7/ year; if loss of containment cooling did result in loss of core cooling the CDF would increase to 3.8E-5/ year. [lPE Responses]

The other flooding event of significance is a service water flood in the chiller room

] which disables room cooling to the ESGR. [lPE submittal, Section 3.3.7.4] Without i recovery of ESGR room cooling, this flood results in core damage due to station i

blackout. [lPE submittal. Figure E FAC1] The frequency of the initiating event is 5.6E-1 4 / year and the CDF from this flood is 9.7E 7/ year.

27 i

4

i i

The submittal notes that the CDF from internal flooding at North Anna is substantially less than the CDF from intamal flooding at Surry: 3.6E 6/ year compared to 5.1E-5/ year. [lPE submittal, Section 7.1.2] At Surry, gravity supply of water from a canal is used to supply circulating water and service water, resulting in flood scenarios of

! potential significance in the turbine building and in a mechanical equipment room.

! This gravity supply arrangement is not used at North Anna.

2.7 Com Damage Sequence Results This section of the report reviews the dominant core damage sequences reported in the submittal. The reporting of core damage sequences- whether systemic or functional- is reviewed for consistency with the screening criteria of NUREG-1335.

The definition of vulnerability provided in the submittalis reviewed. Vulnerabilities, enhancements, and plant hardware and procedural modifications, as reported in the submittal, are reviewed.

l 2.7.1 Dominant Core Damana Seouances, i

i The IPE utilized systemic event trees. The reporting of results in the submittal is j consistent with the Generic Letter 88-20 screening criteria for systemic sequences.'

j [lPE submittal, Section 3.4.1)

The CDF from intamal initiating events and intomal flooding is 7.1E-5/ year. The CDF l

from intamal initiating events alone, excluding intamal flooding, is 6.8E-5/ year. The l CDF from intomal flooding is 3.6E-6/ year.

l Figure 2-1 of this report summarizes the contribution to core damage by intamal d initiating event based on Figure 1-1 of the submittal. Figure 2-2 of this report

summarizes the contribution by class of initiating event to total CDF, including flooding, based on Table 1-1 of the submittal.

SGTR is a relatively high contributor to CDF,10% in this IPE compared to 4% in the 4 Surry NUREG/CR 4550 PRA. This is due to the North Anna IPE assumptions for success criteria for SGTR that require cooldown and use of RHR shutdown cooling if i

the bad SG cannot be isolated, while the NUREG/CR-4550 study for Surry credited

! long term hot standby with refill of the RWST if the SG was not isolated.

4 i

Station blackout for North Anna is less of a contributor than for Surry per the NUREG/CR-4550 study, for three reasons:

l '

the North Anna IPE credited operation of turbine driven feedwater after DC

(1) i power depletion i

)

l 28 i

i

-i Contribution of Internal Initiating Events to CDF for North Anna

-s l

Loss Offelte Power l

Small LOCA

. Station Blackout -

I 1 I SGTR 5 -

l l l W Medium LOCA -

1 I i

@ Loss ESGR Cooling s ' Toi:al CDF from 5

E Trans.w Main Feed - i Internal Events Large LOCA - 6.8E-5/yr

- A Loss Bus 1H

- h ummuuumammi Other , , ,

i

, , s s

' i a i

• a 10 12 14 16 18 t 4 6 8 Per Cent Contribution to CDF Figure 2-1. Core Damage Frequency by internalInitiating Event 29

1 l -

Contribution of Class of Accident to Total CDF for North Anna

-s LOCA nummmmuneunummunum -

w-mumumimmuu -

Loss Offsite Power

- - - - t

- -summmmmmm-s lii j Transients o -

U 4 SGTR o _

m  :

• V LOCA -- Total CDF 9 ,

o _

'" 7.1 E-5/yr ,

ATWS _ -

der J Flood ,

s s x e e e i i i ,

i i l 15 20 25 30 0 5 10 Per Cent Contribution to CDF Figure 2-2. Core Damage Frequency by Class of initiating Event i

30 l

O s

(2) the North Anna IPE used a seal LOCA model which predicts as average time for core uncovery of 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> an as oppoM to 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> per the NUREG/CR l

l study

, (3) the North Anna IPE used a smaller probability for common cause failure of DGs j' than the value used in the NUREG/CR.

d ATWS is less of a contributor in the North Anna IPE than in the NUREG/CR-4550 study of Surry for two reasons:

i j (1) A1WS Mitigating Systems Actuation Circuitry (AMSAC) was modeled for North Anna; it was not installed in Surry at the time of NUREG/CR-4550 (2) the North Anna IPE used a more detailed analysis of the pressure relief l

- requirement an as a function of core lifetime than.did the NUREG/CR- 4550

study for Surry.

The sutimittal discusses the highest frequency systemic core damage sequences, per the screening criteria of NUREG 1335, in Section 3.4.1.3.

All sequences with a CDF greater than 1E-7/ year are given in Appendix B of the l

. submittal. The top six internal event sequences are summarized in Table 2-5 of th,is l

report.

l

! Table 2-5. Top 6 Core Damage Sequences for Intemal Events j

i intiating Dominant Subsequers Fetures Per Cent CDF forinasmal

{

in Sequence CDF For Total Sequence l Event HMSI Falls, Operator Attempts Depressurizanon to 8%

Small LOCA Use LH8I, l.HSl Fans -

Failure of HHSI (Depressurization and use of t.HSl 6%

4 Medium LOCA

! not Credited for Medium LOCA)

6%

} Loss of Offsite ESGR Cooling Falls leading to Station Blackout,

! Power Depressurization not Possible due toff losed PORV Block Valves ESGR Cooling and Power l Restored, Safety injection Falls due to Operator

] Error Staton Blackout,TD AFW Pump Falls Operators 5%

Loss of ESGR Room CMbg fan to Recover ESGR Cooling to Restore Power Failure of DGs leading to Station Blackout, Failure 4%

Loss of Offsite Power. of TD AFW, Failure to Recover Offsite Power before Core Uncovery Operator Failure to Depressurize before Bad SG 4%

SGTR goes Solid, Bad SG ADV Falls Open due to Discharge of Water, Failure to Depressurize to RHR before RWST depleted 31 l

l l

i

)

i 4

i l Based on importance analyses that were performed, the licensee identified the

following component failures and operator errors as most important, listed in

! decreasing importance, from the risk reduction calculation: [lPE submittal, Section

{ 3.4.1.1)

! Failure of DG 1H, '

Failure of TD AFW pump,

{

[ Failure of Operator Action to initiate HHSI for either Feed and Bleed or following Power Restoration, Failure to Recover ESGR Cooling, Failure of DG 1J.

! DG 1J is less important than DG 1H because 1H serves 2 ESGR room coolers while y 1J serves 1 ESGR room cooler.

b j inclusion of recovery actions lowered the intamal CDF by a factor of 3.2. [lPE submittal, Section 3.4.1.5) The most important recovery actions were:

i recovery of main feedwater l recovery of offsite power ~

1 l

i recovery of RHR following SGTR l recover of DG 1H from maintenance. l l

2.7.2 Vulnerabilities.

l Section 3.4.2 of the submittal addresses vulnerabilities. The licensee used the

! importance measures of component contributions to determine vulnerability. The submittal states that for a component failure or an operator error to be a vulnerability,

{

it must contribute more than 10% to overall CDF or be a factor of 3 higher then the

! next highest similar event. [lPE submittal, Page 3-133] Based on this definition of i vulnerability, the submittal states that North Anna has no vulnerabilities.

j 2.7.3 Pronosed imorovements and Modifications.

1 j Section 6.2 of the submittal discusses several minor improvements identified during i

performance of the IPE. These improvements were credited in the IPE. All of these i procedural and hardware improvements were ehher completed or scheduled for near-term completion by the date of the submittal, December,1992. Recent information from the licenses states that all of these improvements have now been completed.

], [lPE Responses]

1 The improvements are as follows:

l 4

k 32 i

l

_ C

l J

I 4

l Internal Events Procedure Enhancements:

Revise periodic test procedures to verify that auxiliary feedwater full flow recirculation valves are closed i

Revise periodic test procedures to verify that quench spray piping and recirculation spray piping is restored after testing 4

l

Revise emergency operating procedures to add the altamate Sl header to the

- ' response not obtained' column if the normal Si header falls Stagger LHS1 pump tests to test one train every 45 days and each pump every 90

! days i

Administratively eliminate pre-planned dual maintenance outages for chillers serving ,

l

! the main control room and the emergency switchgear rooms Improve maintenance practices to minimize total time main control room and i'

emergency switchgear room chillers are out of service t

Provide procedural guidance for trouble shooting and repairing main control room / '

emergency switchgear room chiller protective circuitry i

Intemal Floodina Hardware Modifications:

i install backflow prevention devices in charging pump cubicle floor drains i improve piping penetration fire barrier between quench spray pump house and auxiliary building to limit flooding flow rate j

Add a dike to protect chiller room / fan room doors and modify chiller room / turbine i building doors i ^

i

,' intamal Floodina Procedure Enhancements:

L i

Penodic inspection / replacement of charging pump cubicle drain back flow preventi I devices Periodic inspection of all flood dikes and barriers

! Revision of periodic test procedures to test alarms and all automatic equipment

' actuations for flooding level switches i

l Revision of abnormal procedure for auxiliary building flooding to include steps w l identify and isolate remotely isolable floods and RWST floods.

i l

33 i

I

Table 2-6. Summary of Internal Flooding Results

l Modification CDF before CDF after Decrease in CDF Modifications Modifications Charging Pump 9.0E-5/ year 3.6E-6/ year 8.6E-5/ year Cubicles Flowpath from QSPH 7.0E-5/ year negligible 7.0E-5/ year to AB Basement Chiller Room Door 6.4E-6/ year 3.6E-6/ year 6.0E-5/ year The information in Table 2-6 may be based on interim results for the North Anna IPE

' since the final estimated CDF is 7.1E-5/yr and the overall contribution from intamal flooding is stated to be 3.6E-6/yr. Table 2-6 does indicate that the intomal flood related modifications significantly reduced the CDF due to this event.

The submittal does not identify any additional recommendations that are under evaluation. However, in discussions related to GI 23, RCP seal LOCA, the submittal indicates that modifications to improve the availability of seal injection will be installed.8

[lPE submittal, Page 3-140) Recent information from the licensee states that a fifth AC generator has been installed onsite, and this is the modification that improves the availability of seal injection by providing another source of onsite AC power. [IPE Responses)

• The NRC has recently decided to drop any further rulemaking activities related to RCP seal LOCAs [GI Memo). As a result, this item has been eliminated as a Gencric issue.

34

a i

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS 1

This section of the report provides as overall evaluation of the quality of the IPE based j_ on this review. Strengths and shortcomings of the IPE are summarized important assumptions of the model are summarized. Major insights from the IPE are presented.

j All of the major aspects that affect the CDF were addressed in the IPE. The analysis 4 addresses the plant-specific characteristics of the North Anna plant, those that impact the CDF both positively and negatively.

No particular strengths or shortcomings of the IPE were identified, f

Based on our review, the following aspects of the modeling process have an impact

- on the overall CDF:

(1) For any size small LOCA with failure of high head safety injection, depressurization can be accomplished sufficiently quickly so that core cooling

can be provided using low pressure injection pumps.

(2) If all seal cooling is lost, depressurization / cooldown can totally prevent a seal LOCA.

(3)

If all containment cooling is lost and containment falls by overpressurization, 3

core cooling systems survive 98% of the time.

(4) After loss of DC power, turbine driven AFW continues to operate although

control of flow rate is lost.

(5) With the e:teeption of cooling for the emergency switchgear rooms, HVAC was not explicitely modeled in the IPE.

A!! of these assumptions tend to lower the CDF. The first assumption lowers the CDF from a small LOCA by allowing for mitigation by depressurization and low head )

l injection. The second assumption lowers the CDF from a seal LOCA. The third assumption lowers the CDF associated with total loss of containment heat removal.

Significant findings on the front-end portion of the IPE are as follows:

. LOCAs are important to the CDF

. Station blackout contributes less to the CDF than is typical of many PWR IPEs/PRAs

. Seal LOCAs are not a major contributor to the CDF l

. Intemal flooding is not a major contributor to the CDF.

LOCAs dom'aste the CDF 'due to small LOCAs in which high pressure injection is lost _

and depressurization / low prorsure injection fails. Station blackout is estimated to be

" 'less of a contributor to CDF than at many other PWRs due to the reliability of the i DGs, the iPE credit given for continued operation of turbine-driven auxiliary feedwater after DC power depletion, the high probability for recovery of offsite power, and the 35 J

relatively low probability of a RCP se'ai LOCA at early times. RCP seal LOCAs are not a major contributor due to the ability to crosstie CCW for seal cooling between the l two units and due to the seal LOCA model used. Internal flooding is not a major contributor due to the assumption that floods that cause loss of all containment cooling j consequentially cause loss of core cooling only 2% of the time.

i s

4 36 j

A

4. DATA

SUMMARY

SHEETS This section of the report provides a summary of information from our review.

i Overall CDF i

The total CDF from intemal initiating events and intemal flooding is 7.1E 5/ year. The CDF from intomal flooding is 3.6E-6/ year.

I i

Initiatina Events Contributina to CDF Initiating events that contribute the most to CDF, and their percent contribution, are an as follows: ,

Loss of offsite power 17%

f 14%

4

Small LOCA Station blackout 11 %

l j SGTR 10%

Medium LOCA 9%

l

! Loss of ESGR cooling 9% '

! Other transients 8%

Large LOCA 6%

Loss of Bus 4160 V 1H 5%

Intemal flooding 5%

Interfacing systems LOCA 2%

Loss of feedwater 1%

Loss of 4160 V Bus 1J 1%

ATWS 0.6%

Loss of DC Bus 1-1 0.2% l Loss of DC Bus 1-111 0.2%

Dominant Hardware Failures and Ocarator Errors Contributina to CDF Based on importance analyses that were performed, the licensee identified the following component failures and operator errors as most important, listed in decreasing importance, from the risk reduction calculation:

Failure of DG 1H Failure of TD AFW pump Failure of Operator Action to initiate HHSI for either Feed and Bleed or following Power Restoration Failure to Recover ESGR Cooling Failure of DG 1J.

37

i o ,

i i

l DG 1J is less important than DG 1H because 1H serves 2 ESGR room coolers while i

1J serves 1 ESGR room cooler.

Inclusion of recovery actions lowered the internal CDF by a factor of 3.2. The most

Important recovery actions were:

[ recovery of main feedwater

{ recovery of offsite power l recovery of RHR following SGTR l recover of DG _1H from maintenance.

1 1 Dominant Accident Classes Contributino to CDF i

1 J LOCA 29%

l Loss of Offsite Power 28%

l

Transients 26%

Steam Generator Tube Rupture 10% ,

l- I i Intemal Flooding 5'.

! Interfacing System LOCAs 7%

! ATWS 1% ~

i i Station blackout contributes about 11% to the total CDF.

1 Desion Characteristics imoortant for CDE Ability to use CCW from the onnosite Unit for RCP seal coolino. During station

}

j blackout at one unit, CCW from the opposite unit can be used for RCP seal cooling if the opposite unit has AC power. This feature tends to reduce the CDF during station blackout by reducing the likelihood of core uncovery due to RCP seal failure.

l f Charoino numos cooled directiv with SW Instead of CCW. Loss of CCW does not j

lead to loss of RCP seal cooling since the charging pumps use SW for cooling and do not require CCW for cooling. The chargingin pumps can provide RDP sealinjection, i

and thus provide seal cooling. This feature tends to reduce the CDF since it reduces i the likelihood of a RCP seal LOCA due to loss of seal cooling systems. ,

i i

! Automatic switchover of ECCS from intaction to recirculation. This feature tends to reduce the CDF from a LOCA since operator action is not required to effect the switchover of ECCS from injection to recirculation for either high or low head ECCS l

! . pumps.

I-HVAC is reouired for the ESGRs. The mechanical refrigeration portion of the HVAC l

system is required to provide long-term cooling for the Electrical Switchgear Rooms l

j (ESGRs). This requirement tends to increase the CDF by increasing the likelihood of j long term loss of AC power.

i 38 i

1 Raouirement to use the recirculation sorav system to cool containment. The ECCS 1 configuration is such that no heat exchangers are provided in the system lineups for core cooling when in recirculation from the containment sump. Use of the recirculation l spray system is required to provide for heat removal from containment. This feature would be expected to increase the CDF compared to plant designs which include heat exchangers in the ECCS recirculation lineups; however, an as rubsequently discussed, the North Anna IPE assumes that loss of containment cooling has a minor  ;

l impact on the ability to provide core cooling.

Modifications The submittal discusses several minor improvements identified during performance of l I

the IPE. These improvements were credited in the IPE. All of these procedural and hardware improvements were either completed or scheduled for near-term completion by the date of the submittal, December,1992. Recent information from the licensee states that all of these improvements have now been completed.

The improvements are as follows:

Internal Events Procedure Enhancements ,

Revise periodic test procedures to verify that auxilir.ry feedwater full flow recirculation valves are closed l Revise periodic test procedures to verify that quench spray piping and recirculation spray piping is restored after testing 4

Revise emergency operating procedures to add the altamate Si header to the l ' response not obtained' column if the normal Si header falls h

j Stagger LHSI pump tests to test one train every 45 days and each pump every 90 i days Administratively eliminate pre-planned dual maintenance outages for chillers serving the main control room and the emergency switchgear rooms

improve maintenance practices to minimize total time main control room and

emergency switchgear room chillers are out of service t

Provide procedural guidance for trouble-shooting and repairing main control room /

emergency switchgear room chiller protective circuitry

! , Intemal Floodina Hardware Modifications:

Install backflow prevention devices in charging pump cubicle floor drains J 39

Improve piping penetration fire barrier between quench spray pump house and auxillary building to limit flooding flow rate Add a dike to protect chiller room / fan room doors and modify chiller room / turbine l

building doors s

Internal Floodina Procedure Enhancements:

i ,

j Periodic inspection / replacement of charging pump cubicle drain back flow prevention

! devices Periodic inspection of all flood dikes and barriers l

i Revision of periodic test procedures to test alarms and all automatic equipment j' actuations for flooding level switches i

l Rev!sion of abnormal procedure for auxiliary building flooding to include steps which  !

! identify and isolate remotely isolable floods and RWST floods. j q

L i Other USI/GSis Addressed , l 4 l The licensee proposes that the IPE resolves two other Generic Safety l

j lasues/ Unresolved Safety lasues (GSI/USl's): the flooding portion of USI A-17, System Interactions in Nuclear Power Plants, and GI-23, RCP Seal LOCAs.'

SignificantERA Findinas ,

i j Significant findings on the front-end portion of the IPE are as follows:

i

• LOCAs dominate the CDF

! + Station blackout contributes less to the CDF than is typical of many PWR

! IPEs/PRAs

• Seal LOCAs are not a major contributor to the CDF

• intomal flooding is not a major contributor to the CDF. l LOCAs dominate the CDF due to small LOCAs in which high pressure injection is lost and depressurization/ low pressure injection fails. Station blackout is not a major j contributor due to the reliability of the DGs, the high probability for recovery of offsite

! power, and the relatively low probability of a RCP seal LOCA at early times. RCP seal LOCAs are not a major contributor due to the ability to crosstle CCW for seat l

' cooling between the two units and due to the seal LOCA model used. Intemal i

I

• The NRC has recently decided to drop any further rulemaking activities related to i- RCP seal LOCAs (Gl Memo). As a result, this item has been eliminated as a Generic i Issue.

40 1-

l *

• 1 1 flooding is not a major contributor due to the assumption that floods that cause loss of all containment cooling consequentially cause loss of core cooling only 2% of the time.

I P

1 4

l I

I I

l l

41

REFERENCES

~

[GL 88 20) ' Individual Plant Examination Fo'r Severe Accident Vulnerabilities - 10 CFR 50.54 (f)", Generic Letter 88.20, U.S. Nuclear Regulatory Commission, I

November 23,1988.

' Individual Plant Examination Submittal Guidance",

[NUREG 1335)

NUREG 1335, U. S. Nuclear Regulatory Commission, August,1989.

North Anna IPE Submittal, December 14,1993

[lPE)

[lPE Responses) Letter from M.t Bowling, Virginia Electric and Power

(

Co., to NRC, "lirginia Electric and Power Co. North j

Anna Power Station Units 1 and 2 individual Plant Examination Request for Additional Information",

Serial-740A, April 27,1995.

Updated Final Safety Analysis Report for North Anna

[UFSAR) l

[ Tech Specs) Technical Specifications for North Anna l

[NUREG/CR-4550, Surry] NUREG/CR-4550, Vol 3, Rev 1, Part 1 Analysis of Core Damage: Surry, Unit 1 Intemal Events, April 1990.

i lasuance of Proposed Rulemaking Package on GI-23

[Gi-23 Memo) Reactor Coolant Pump Seal Failure, Intemal Memo from John C. Hoyle (Secretary) to James M. Taylor (Executive Director for Operations), SECY-94-225, March 31,1995.

NUREG/CR-4550, Vol 1 Rev 1, Analysis of

[NUREG/CR 4550, Methodology)

Core Damage Frequency: Intemal Events Methodology l

t I

i 42