ML20129A850

Plant TER on IPE Front End Analysis

ML20129A850
Person / Time
Site:	River Bend
Issue date:	04/09/1996
From:	Darby J, Sciacca F, Thomas W SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML20129A856	List: ML20129A850 ML20129A858 ML20129A864 ML20129B752
References
SEA-95-2338-10, SEA-95-2338-10-A:4, NUDOCS 9609190286
Download: ML20129A850 (41)

Text

._ _.

_. _ _ _. -..I, o

1

?

I 1

i l

L i

i s

i 1

APPENDIX A RIVER BEND STATION UNIT 1 INDIVIDUAL PLANT EXAMINATION I

TECHNICAL EVALUATION REPORT (FRONT-END)

I L

I I

1 i

l

)

1 1

f

o a

l SEA 95 2338-010 A:4 April 9,1996 o

i River Bend i

Technical Evaluation Report on the Individual Plant Examination Front End Analysis

{

NRC 04 91-066, Task 38 i

John L Darby, Analyst Frank W. Sciacca, Analyst Willard R. Thomas, Editor Science and Engineering Associates, Inc.

Prepared for the Nuclear Regulatory Commission

6 l

)

1 J

l 1

\\

TABLE OF CONTENTS t

i E. EX EC UTIVE SU M M ARY................................................

1 E.1 Plant Characterization 1

E.2 Licensee's IPE Process 2

E.3 Front End Analysis...............................................

2 E.4 G eneric issues.................................................

4 E.5 Vulnerabilities and Plant improvements..............

5 E.6 Observations..................................................

6 4

1

1. l N TR O D U C Tl 0 N...........................................

7 1.1 R eview Process................................................

7 1.2 Plant Characterization 7

I I

2. TECHNIC AL REVIEW.............................

9 i

2.1 Ucensee's IPE Process............................................

9 l

2.1.1 Comoleteness and Methodoloav...............................

9 2.1.2 Multi-Unit Effects and As-Built. As-Doorsted Status...................

9 2.1.3 Licenses Particioation and Peer Review..........................

10 2.2 Accident Sequence Delineation and System Analysis 10 2.2.1 initiatina Events 10 2.2.2 Event Trees...................................

13 i

2.2.3 Systems Analysis.......................................

17

)

2.2.4 System Donendencies.....................................

20 2.3 Quantitative Process............................................

20 2.3.1 Quantification of Accident Seauence Freauencies....................

20 2.3.2 Point Estimates and UncertaintvlSensitivity Analyses 21 2.3.3 Use of Plant Soecific Data..................................

21 2.3.4 Use of Generic Data.....................................

22

\\

2.3.5 Common-Cause Quantification 22 2.4 Interf ace issues...............................................

23 2.4.1 Front End and Back End Interfaces.............................

24 2.4.2 Human Factors Interfaces 24 2.5 Evaluation of Decay Heat Removal and Other Safety issues 25 2.5.1 Examination of DHR......................................

25 2.5.2 Diverse Means of DH'R....................................

26 2.5.3 Uniaue Features of DHR 26 2.5.4 Other GSilUSis Addressed in the Submittal 27 2.6 Internal Flooding.........................................

28 2.6.1 Internal Floodina Methodoloav................................

28 2.6.2 Internal Floodina Results...................................

29 2.7 Core Damage Sequenca Results..................

29 2.7.1 Dominant Core Damsae Seouences.......

29 2.7.2 Vulnerabilities......................

34 H

I l

2.7.3 Proposed Imorovements and Modifications........................

34 1

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS..............

36 l

4. DATA

SUMMARY

SHEETS 38 l

R EFER ENC ES...............................

42 j

\\

r i

l l

l 4

i I

i i

l I

i i

P 1

=.

O 6

\\

LIST OF TABLES l

Table 21. Plant Specific Data 22 Table 2 2. Common Cause Factors for 2 of 2 Components............................

23 Table 2 3. Functional Accident Sequences......

32 Table 2 4. Core Damage Frequency by Initiator...........

33 Tabis 2 5. Core Damage Frequency by Accident Type..............................

33 i

I i

l l

j l

IV

e o

o E. EXECUTIVE

SUMMARY

This report summarizes the results of our review of the front end portion of the Individual Plant Examination (IPE) for the River Bond. This review is based on information contained in the IPE submittal [lPE Submittal]

along with the licensee's responses [RAI Responses] to a request for additional information (RAI). The licenssa has indicated that a 'living PRA" will be maintained for the River Bond Station, and that the IPE has been updated to reflect physical modifications and procedural changes made to the plant since the completion of the original IPE.

E.1 Plant Characterization River Bend is a Boiling Water Reactor (BWR) 6 with a Mark 111 containment. Rated power for the unit is 2,887 megawatts thermal (MWt). Similar units in operation are: Grand Gulf, Perry, and Clinton.

Design features at River Bend that impact the Core Damage Frequency (CDF) relative to other BWR 6 plants are as follows:

Ability to crosstie standby service water and diesel driven firewster to low Pressure Coolant Iniection (LPCI) loon B for iniection to the vessel Crosstie of service water or firewater to LPCI provides alternate injection capability for core cooling, which tends to decrease the CDF.

Difficulty in usina firewater crosstie for iniection durina station blackout The firewater system has diesel driven pumps that can be used to inject water to the vessel during station blackout; however, procedures direct using a Motor Operated Valve (MOV) inside containment to effect the crosstie, and during station blackout this valve is likely to be inaccessible. The difficulty in using firewster for core cooling during station blackout tends to increase the CDF.

Containment fan coolers, no containment sorav system, and no sunoression pool makeuo system River Bend uses containment fan coolers instead of Residual Heat Removal (RHR) in a containment spray mode. The presence of a diverse containment cooling system tends to decrease the CDF, although both the suppression pool cooling system and fan coolers rely on standby service water (SSW) for a heat sink, thereby minimizing the impact of this feature on reducing CDF. The River Bend design does 'not require dump of upper pool water to the suppression pool to mitigate a loss of Coolant Accident (LOCA); other designs dump water from upper containment using the suppression pool makeup system to ensure adequate inventory in the suppression pool following a LOCA to compensate for water discharged into the drywell. The lack of a requirement for suppression pool makeup tends to decrease the CDF since it removes the makeup system as a requirement for successful mitigation.

Room coolina reouired for standby electrical switchaear Without either Heating Ventilation and Air Conditioning (HVAC) or compensatory action to open doors to the standby switchgear rooms, onsite electrical power is lost due to overheating of equipment. This dependency tends to increase the CDF.

1

i Four-hour battery lifetime The four hour lifetime, with credit for load shedding, is relatively short and this tends to increase the CDF from station blackout since it restricts the time available to recover offsite power and onsite AC power.

j E.2 Licensee's IPE Process 4

l The IPE is a level 2 probabilistic risk assessment (PRA). The freeze date for the IPE model was April 1991.

One change made to the plant after the freeze data was considered in the IPE model, that being the change l

l completed in the summer of 1992 establishing closed loop operation of the normal service water system.

The IPE was performed primarily by utility personnel. Utility personnel were involved in all facets of the analysis, and performed the majority of the work under the guidance and advice of contractor personnel.

j Consultants from Science Applications International Corp. (SAIC) and RAPA were used in the level 1 PRA.

i Both general and specific walkdowns were performed General walkdowns of major plant areas such as the auxiliary building and the reactor building were conducted. Specific walkdowns were performed for such j

focused tasks as internal flooding and assessment of natural circulation for room cooling.

}

Other IPElPRA studies and related information were reviewed, particularly, the NUREGICR-4550 PRA for Grand Gulf and the Kuosheng PRA.

An independent review of the level 1 PRA was performed by NUS Corp (NUS).

The submittal states that the licensee intends to maintain a "living" PRA.

E.3 Front End Analysis The methodology chosen for the River Bend IPE front end analysis was a level i PRA; the small event treellarge fault tree technique was used and quantification was performed with the Cut Set and Fault Tree Analysis (CAFTA) code.

The IPE quantified 17 groups of internal initiating events: 5 LOCAs,7 plant specific transients, and 5 generic transients. The IPE developed systemic event trees to model the plant response to initiating events.

initiating events were quantified using plant specific data and industry data for frequent events, data from previous PRA: for infrequent events, and system models with component failure data for plant specific initiating events.

Both loss of instrument air and loss of HVAC were modeled as plant-specific initiating events.

The criteria for core damage were: "..., severs core damage is generally defined to occur when the metallwater reaction of the fuel clad becomes exothermic and the hydrogen generation rate is drastically accelerated".

System level success criteria were based on: the updated final safety analysis report (UFSAR), consideration of non-safety systems, plant specific calculations, and past PRA studies.

2

i

\\

i i

l Support system dependencies were modeled in the fault trees. Figures of inter system dependencies were i

provided, and partial as well as complete dependencies were addressed.

1 The IPE used plant specific data to Bayesian update generic data for hardware failures for: Diesel Generators (DG), HVAC chillers, Reactor Core isolation Cooling (RCIC) pump, High Pressure Core Spray (HPCS) pump, and 2

RHR pumps. Testing / maintenance unavailabilities for these systems were quantified with plant specific data.

The plant specific data used in the IPE were comparable to data used in typical IPElPRAs.

The beta factor method was used to model common cause failures. Common cause failures were modeled within systems. Generic data from NUREGICR 4550 and from NUREGICR 4780 were used to quantify

]

common cause failures, and the data were consistent with generic data used in most IPElPRAs.

Internal flooding was quantified using transient event trees, modified to consider the failures resulting directly l

from the flooding events. Internal flooding was calculated to have a CDF of 1.75E 8/ year, thereby contributing only a small amount to the overall CDF.

i The total CDF from the baseline IPE analysis from internal initiating events was 1.55E-Slyear. The licensee reported core damage sequences consistent with the functional reporting criteria of NUREG 1335. Eight j

functional sequences were reported as meeting the screening criteria; these sequences comprised over 99%

of the overall CDF.

i Change:: made to the plant and to operating procedures as a result of the IPE have reduced the CDF to 2

l 3.55E 6/yr.

l Initiating events contributing the most to the overall CDF were as follows:

Loss of Offsite Power 90.3%

i Loss of Normal Service Water 4.8%

loss of Feedwater 2.4%

loss of reactor plant component cooling water (RPCCW) 1.8%.

)

A more complete listing of the CDF contributors by initiating events is provided in the main body of this i

report.

The submittal states that the dominant contributors to CDF by accident class were as follows:

Station Blackout (SBO) 86.0%

i Transient 8.4%

loss of Offsite Power 4.3%

Transient Induced LOCA 1.5%.

i Dominant hardware failures contributing to CDF included: loss of offsite power, failures of DGs, failures of RCIC, and failures of SSW.

3 l

_. _ ~ _

j 1

Dominant human errors and recovery failures contributing to CDF included: failure to recover offsite power, failure to restore SSW manual valve V134 after test or maintenance, failure to restore SSW manual valve V133 after test or maintenance, failure to establish compensatory cooling to switchgear rooms by opedng doors within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after loss of normal HVAC, operator failure to manually depressurize the reactor vessel, and failure to recover feedwater, firewster injection, or the power conversion system (PCS).

These results as presented in the IPE submittal indicated that SB0 dominates the CDF. The high contribution from station blackout was due to loss of offsite power with failure to recover offsite power in time to prevent core damage. Note that changes to the plant implemented as a result of the IPE have reduced the estimated CDF from 1.55E 5Iyear to 3.55E-6/ year, and have reduced the contribution of SB0 from 86% to only 4%. [RAI Responses, p.9)

Level I core damage sequences were binned into Plant Damage States (PDSs) at the cut set level for subsequent back end analysis. The binning criteria were consistent with typical PRAllPE practice.

E.4 Generic issues The IPE specifically addressed loss of Decay Heat Removal (DHR), considering DHR as both core cooling and ultimate heat removal. Loss of support systems resulting in loss of DHR were considered to be loss of DHR type accidents. Using this broad definition for DHR, loss of DHR contributed essentiaily 100% to the CDF since accidents such as ATWS were insignificant contributors to CDF.

No vulnerabilities associated with loss of DHR were identified.

The licensee proposes to resolve the following safety issues with the IPE: Gl 23 " Reactor Coolant Pump Seal Failures", GI 105 " Interfacing System LOCA at LWRs", and USl A 17 " Systems interactions in Nuclear Power Plants".

E.5 Vulnerabilities and Plant improvements A vulnerability was assumed to exist if the CDF from any functional sequence exceeded 1E 4/ year. No vulnerabilities were identified.

Four changes were made as a result of areas identified during the course of the level 1 PRA portion of the IPE. One hardware change was made, that being installation of a division 1 SSW return air operated valve (ISWP*A0V599) to address loss of SSW cooling water flow to the HPCS DG during station blackout. Three changes to procedures were implemented. (1) Enhanced guidance was developed for mitigating loss of i

control building ventilation. (2) Two checks per shift were instituted to check the fuel supply to running diesel-powered instrument air compressors. (3) SSW pump lock out during testing of normal service water (NSW) was eliminated based on the new closed loop configuration of the NSW system.

1 Other potential changes to the plant are discussed in the submittal. The ability to mitigate station blackout is limited by the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> battery lifetime and the condensate storage tank (CST) inventory. Also, low pressure diesel driven firewster cannot be used after DC power is lost since the safety relief valves (SRVs) close on loss of power resulting in repressurization of the vessel and the inability to use low pressure 4

e k

4 l

iajection. Implementation of a portable diesel generator for charging the batteries, in combination with j

simplifications to the firewater injection lineup, are predicted to lower the overaN CDF from 1.55E Slyear to i

3.55E 6/ year with the relative contribution of station blackout decressmg from 86% to 4%. The transmittal i

letter for the submittal identifies the foHowing changes: provide a 60 kW (minimum) DG onsite for charging 125 V batteries, remove internals in 3 check valves associated with crosstie of firewster for injection to the vessel to eliminate this tima consuming action for establishing the crosstie, and revise the station blackout procedure to provide for injection of firewster using a different flow path that does not require operation of valves inside containment. The changes described in this paragraph have now been completed.

1 I

The licenses evaluated the decrease in CDF if a large (10 inch diameter) hardened contamment vent were l

installed. The existing 3 inch vent is too smau to prevent containment failure by overpressurization if i

containment cooling is lost. The River Band IPE model assumes that containment failure by l

overpressurization results in the release of steam into the auxiliary building which renders certain core cooling i

equipment unavailable. With the addition of a larger vent, the licences estimates that the overaN CDF decreases by 2E 7/ year, a smaN amount. Therefore, 'mstallation of a larger hardened containment vent is not being considered further.

E.8 Observations The licenses appears to have analyzed the design and operations of River Bend to discover instances of particular vulnerability to core damage. It also appears that the licenses has: developed an overaN appreciation of severe accident behavior; gained an understanding of the most likely severs accidents at River Bend; gained a quantitative understanding of the overall frequency of core damage; and implemented changes to the plant to help prevent and mitigate severe accidents.

Strengths of the IPE are as follows. The identification and evaluation of plant specific initiating events is thorough compared to some other IPElPRA studies. The impact of seal failures in recirculation pumps during station blackout was explicitly addressed. The consideration (,f plant specific HVAC requirements is thorough compared to some other IPEIPRA studies.

No major weaknesses of the IPE were ida.tified.

Significant level-one IPE findings are as follows:

Transients involving station blackout doninate the overall CDF. The CDF from station blackout is dominated by immediate failure of high I.ressure coolant injection (HPCI) and RCIC.

ATWS is a negligible contributor to the overall CDF; the !PE model assumes that operators always successfully inhibit ADS and that HPCS can be used to mitigate ar. ATWS even without standby liquid control (St.C) operation.

Internal flooding is a small contributor to the CDF due to the layout of the plant.

5

,_7

?

i l

1 j

1. INTRODUCTION i

1.1 Review Process i

This report summarizes the results of our review of the front end portion of the Individual Plant Examination (IPE) for the River Bend. This review is based on information contained in the IPE submittal [lPE Submittal]

l along with the licensee's responses [RAI Responses] to a request for additional information (RAI).

1.2 Plant Characterization 1

River Bend is a single unit site located in Louisiana near Baton Rouge. The plant is a BWR 6 with a Mark lil contamment. General Electric was the nuclear steam system supplier (NSSS); Stone and Webster was the AE. The unit achieved commercial operation in 1986. Rated power for the unit is 2887 MWt and 936 MWe (not). Similar units in operation are: Grand Gulf, Perry, and Clinton.

River Bond has notable characteristics common to all BWR 6 demgns which differ from BWR 4 designs. The High Pressure Core Spray (HPCS) system uses a motor driven pump and injects over the core, not into the downcomer. LPCI injects into the core region and not into the downcomer. Three DGs are provided, one smaller one dedicated to HPCS; the DGs at River Band cannot be crosstied to power other division loads.

Crosby Safety Relief Valves (SRV) are used. The containment failure pressure is below the air supply pressure to the SRVs, thereby precluding closure of the SRVs due to high containment pressure. Constant speed recirculation pumps are used with recirculation flow varied by valve control.

Design features at River Band that impact the core damage frequency (CDF) relative to other BWR 6 plants are as follows:

Ability to crosstie standby service water and diesel driven firewster to Low Pressure Coolant Iniection (LPCI) loon B for iniection to the vessel Crosstie of service water or firewster to LPCI provides alternate injection capability for core cooling, which tends to decrease the CDF.

Difficulty in usina feedwater crosstie for iniection durina station bisckout The firewster system has diesel driven pumps that can be used ti inject water to the vessel during station blackout; however, procedures direct using a Motor Operated Valve (MOV)inside containment to effect the crossstie, and during station blackout this valve is likely to be inaccesable. The difficulty in using firewster for core cooling during station blackout tends to increase the CDF. (A modification made as a result of the IPE enhances the ability to use the firewster crosstie.)

Containment fan Ws. no containment scrav system. and no sunoression cool makeuo system River Bend uses containment fan coolers instead of RHR in a contamment spray mode. The presence of a diverse containment cooling system tends to decrease the CDF, although both the suppression pool cooling system and fan coolers rely on SSW for a heat sink, thereby minimizing the impact of this feature on reducing CDF. The River Bend design does not require dump of upper pool water to the suppression pool to mitigate a LOCA: other designs dump water from upper containment using the suppression pool makeup system to ensure adequate inventory in the 6

suppression pool following a LOCA to compensate for water discharged into the drywell. The lack of a requirement for suppression pool makeup tends to decrease the CDF since it removes the makeup system as a requirement for successful mitigation.

Room coolina reauired for standby electrical switchaear Without either HVAC or compensatory action to open doors to the standby switchgear rooms, onsite electrical power is lost due to overheating of equipment. This dependency tends to increase the CDF.

Four hour battery lifetime The four-hour lifetime, with credit for load shedding, is relatively short and this tends to increase the CDF from station blackout since it restricts the time available to recover offsite power and onsite AC power. A portable diesel generator has been made available onsite for charging 125 VDC batteries to improve capabilities for withstanding station blackout conditions. This capability, coupled with enhancements to facilitate the use of dieseldriven firewater injection during station blackout, tends to reduce the CDF.

7

Q 0

2. TECHNICAL REVIEW 2.1 Lisensee's IPE Process We reviewed the process used by the licenses with respect to: completeness and methodology; multi-unit effects and as built, as operated status; and licensee participation and peer review.

)

2.1.1 Comoleteness and Methodoloov.

The submittal contains the information requested by Generic Letter 88 20 and NUREG 1335. [NUREG-1335][GL 88 20] No obvious omissions were noted.

The front end portion of the IPE is a level l PRA. The specific technique used for the level i PRA was a small event treellarge fault tree techmque. The PRA upon which the IPE is based was initiated in response to Generic Letter 88 20. [ submittal Section 2.0)

The subnuttal described the details of the technique. Support systems were modeled in the fault trees and accident sequences were solved by fault tree linking. System descriptions were provided. Inter system dependencies were described in the system descriptions, and schematics of inter system dependencies were t

provided. Data for quantification of the models were provided, including common cause and recovery data.

The licenses quantified the uncertainty of dominant core damage sequences, and summarized sensitivity analyses that were performed for selected items.

2.1.2 Multi Unit Effects and As Built. As Ooorated Status.

River Bend is a single unit site, and therefore multi-unit considerations do not apply.

Both general and specific walkdowns were performed. General walkdowns of major plant areas such as the auxiliary building and the reactor building were conducted. Specific walkdowns were performed for such focused tasks as internal flooding and assessment of natural circulation for room cooling. [ submittal Section 2.4.4]

Major documentation used in the IPE included: the UFSAR, the Technical Specifications, P&lDs, wiring diagrams, layout drawings, procedures, records of equipment performance, and discussens with plant staff in engineering, operations and maintenance. Other IPEIPRA studies and related information were reviewed, particularly, the NUREGICR-4550 PRA for Grand Gulf and the Kuosheng PRA. [ submittal Sections 2.4.2, 1

l 2.4.3]

The freeze date for the IPE model was April 1,1991. One change made to the plant after the freeze data was considered in the IPE model, that being the change completed in the summer of 1992 establishing closed loop operation of the normal service water system. [ submittal Section 2.4.3]

2.1.3 Licensee Participation and Peer Review.

8

The IPE was performed primardy by utility personnel. Utility personnel were involved in all facets of the analysis, and performed the majority of the work under the guidance and advice of contractor personnel.

[ submittal Section 2.2]

Consultar,ts from SAIC and from RAPA were used in performing the level 1 PRA. [submittai Section 5.1.1]

The submittal states that the utility intends to maintain a "living" PRA. [ submittal page 63]

An indspendent review of the level 1 PRA was performed by NUS. The submittal contains the significant commints from the review and the disposition of these comments. [ submittal Sections 5.3.1 and 5.4.1]

2.2 Accident Sequence Delineation and System Analysis This section of the report documents our review of both the accident sequence delineation and the evaluation of system performance and system dependencies provided in the submittal.

1 2.2.1 Initiatina Events.

The idatification of initiating events considered both generic and plant specific events Sources for generic initiating events included: EPRI NP 2230 and past PRAs. [ submittal Section 3.1.1]

Actual plant trip data were reviewed and were used to Bayesian update generic data.

A plant specific internal flooding study was performed to identify internal flood initiating events.

Seventeen groups of internal initiating events were retained for analysis: 5 generic transients, 5 LOCAs, and 7 plant spedfic events. The plant specific initiating events were as follows: loss of division 1 DC power, loss of division 2 DC power, loss of normal service water, loss of turbine plant component cooling water (TPCCW), loss of reactor plant component cooling water, loss of instrument air, and loss of main steam tunnel cooling. [ submittal Table 3.110]

The submittal summarizes the evaluation of plant systems that was performed to identify plant specific I

initiating events and the submittal provides the basis for not considering failures in some of these systems as unique initiating events. The identification and screening of plant specific initiating events is consistent with standard PRA practics. The frequencies of plant specific initiating events retained for analysis were i

quantified with simplified system models except for the loss of DC power, which was quantified with j

NUREGICR 4550 data.

A recirculation pump seal LOCA was considered as an initiating event and was modeled as a smallsmall LOCA.

LOCAs outside of containment were screened from analysis except for Environmentnl Qualification (EQ) related considerations from flooding and steaming. The submittal implies that isolation of LOCAs outside containment is sufficiently reliable so that core damage due to failure to isolate containment leading to ultimate loss of suppression pool inventory is not a major contributor to the CDF from LOCAs. Many BWR 9

I

a i

1 i

i j

IPEs have analyzed LOCAs in steam, feedwater, and HPCllRCIC lines outside containment and found them to not be significant contributors to overall CDF. Such LOCAs are design basis accidents; however, consideration of LOCAs outside containment should not greatly impact the overall CDF. [ submittal page l

3.1.1.6]

loss of an emergency 4.16 kV AC power bus was screened from consideration as a plant specific initiating event. A review of the non 1E loads powered off the 1E buses was performed, and it was concluded that loss of any of these loads would not result in an immediate reactor scram, thereby allowing time for controlled shutdown.

Loss of a 120 V AC emergency bus was screened from consideration as a plant specific initiating event, since the impact of this event is considered in the general transient, " Transient with PCS Available".

Containment isolation was not considered as a plant specific initiating event, and the hcensee does not address this system in the discussion of systems evaluated for plant specific initiating events. However, containment isolation should not contribute significantly to overall CDF; even if containment isolation results in a seal LOCA due to loss of cooling to the recirculation pump seals, this is not of significance for a non-isolation condenser BWR such as River Bend for which all core cooling systems involve injection directly to the vessel.

HVAC systems for the following plant areas are important support systems in the mitigative portion of the IPE model: standby switchgear and battery rooms, DG rooms, ECCS pump rooms, standby service water l

pump rooms, and the main steam tunnel. The licensee evaluated loss of these HVAC systems as potential initiating events. Loss of HVAC in the main steam tunnel was modeled as a plant specific initiating event, since within 5 minutes loss of this system results in actuation of the MSIV steam line break detection system, leading to closure of the MSIVs and isolation of steam supply to the RCIC turbine. Failures of the other HVAC systems were determined to not be special initiating events due to the standby status of the systems or due to the ability to detect loss of the systems and take compensatory actions to prevent plant i

trip.

)

The point estimate frequencies assigned to most of the initiating events are comparable to typical values used in PRAllPEs. For example, the frequency of loss of offsite power is 0.035/ year and the frequency for spurious opening of an SRV is 0.14Iyear. These frequencies are similar to values used in other IPEIPRAs.

The frequency for a recirculation pump seal LOCA is 0.02/ year, which is comparable with other IPElPRAs.

The frequency assigned to loss of instrument air,1.2E 4/ year, is rather low; however, as discussed in Section 2.2.3 of this report, River Bond has three motor driven air compressors and two diesel driven air compressors, which provide for significant redundancy in the supply of air.

1 The frequency of an interfacing systems LOCA,4.0E 3/ year, seems high; however, as discussed in Section 2.2.2 of this report, this event only refers to exposure of low pressure piping to greater than design basis pressure and does not include failure of the piping.

NUREGICR-4550 data were used to quantify the frequencies for LOCAs inside containment.

10

l Loss of offsite power was quantified using generic data from NSAC 166; of the 10 scrams that occurred at River Bend up to the freeze date of the model, none were loss of offsite power. [RAI Responses, p.11] All other generic transients were first quantified using generic data from NUREGICR 3862, and were then

)

Bayesian updated based on the 10 plant specific scrams that had occurred (nine were transients with PCS l

available and one was loss of the turbine plant cooling water system).

The frequency assigned to loss of the turbine plant component cooling water system is 2.0E.3/ year; however, the submittal indicates that over the Le year tirt.a period used for evaluation of plant specific scram data, loss of this system occurred once. The submittal states that this plant specific failure w:s not considered as it could " unduly affect the estimate of frequency"; instead, the frequency was quantified with a simplified system model using generic data. The licenses stated that the specific failure that occurred would not now result in plant trip due to a change in operation that has NNS-SWG1B now aligned to offsite power.

[ submittal pages 88,92] [RAI Responses)

A listing of the initiating event frequencies used in the River Bend IPE is presented in Section 4 of this report.

2.2.2 Event Trees.

Each accident initiating event was included in an appropriate class of initiating events, and each class of initiating events had a corresponding event tree. The following 9 event trees were developed:

Large LOCA Intermediate LOCA Small LOCA Small Small LOCA Transient loss of Offsite Power Station Blackout ATWS Interfacing Systems LOCA.

The IPE defined core damage as follows: "..., severe core damage is generally defined to occur when the metallwater reaction of the fuel clad becomes exothermic and the hydrogen generation rate is drastically accelerated". This definition does not indicate the long term collapsed core water level that is acceptable,

)

nor does it address the duration of significant core uncovery allowed during a large LOCA or during operator-initiated depressurization. However, the lack of a more precise definition of core damage does not have a significant impact on the system level success criteria used in the iPE. [ submittal Section 3.4, p. 408]

The IPE modeled four sizes of LOCAs inside containment: large, medium, small, and small small (recirculation pump seal LOCA).

The HPCS system can be used to mitigate a large LOCA at River Bend; in the BWR 6 design HPCS is motor driven and injects over the core region instead of into the downcomer.

11

The large LOCA event tres credits the use of service water injection to LPCI loop B to cool the core if all l

ECCS pumps fail. This capability was also credited in the NUREGICR 4550 PRA for Grand Galf. [NUREGICR-4550, Grand Gulf] (subnuttal Table 3.114 and Figure 3.11]

The large LOCA event tres models the interdependence between core ccoling and containment cooling.

Successful containment cooling requires either 1 of 2 loops of suppression pool cooling with the RHR system, or operation of 1 of 3 containment fan coolers. The submittal states that HPCS, low Pressure Core Spray (LPCS), and RHR pumps can operate with a saturated suppression po'ol, and that the critical temperature limut.ons rf the pumps are above the temperature corresponding to containment failure (70 psia, which has i

a satuistion temperature of about 300 F). Therefore, HPCS, LPCS, and LPCI can operate without contamment cooling until the contamment fails by overpressurization. The not positive suction head (NPSH) margin for these pumps is about 4 feet at conditions of 0 psig and about 210 F. This implies that the pumps can operate with a saturated suppression pool, since the decrease in margin from 210 F to 212 F is about 2 feet; thus, we agree with the assumption in the IPE that these pumps can operate with a saturated suppresson pool Containment failure due to overpressurization is assumed to release steam into the 141 foot level of the auxiliary buildmg, resulting in loss of electrical switchgear necessary for operation of: LPCS, RHR A, and RCIC pumps, and loss of power to the MOVs in one of two flow paths for service water.

crosstie to LPCI loop B. Therefore, after containment failure due to loss of containment cooling, the following core cooling systems remain available to mitigate a large LOCA: HPCS, LPCI B and C, and service water crosstie (through both flow paths if aligned prior to containment failure or through the one remainmg flow path if aligned after containment failure). [ submittal page 104 and Figure 3.11 and Table 3.114] (UFSAR, i

Section 6.3.2.2]

The River Bend IPE front and model assumes that containment failure by overpressurization leads to steam release into the auxiliary building resulting in EQ induced failures of certain core cooling systems. The submittal states that the 3 inch containment vent is too small to prevent containment failure by overpressurization following loss of containment cooling. The PUREGlCR 4550 PRA level 1 model for Grand Gulf assumed that containment failure resulted in release to the atmosphere with no steam-induced failures of core cooling equipirant; thesies, the IPE model for River Band differs from the NUREGICR 4550 PRA

]

model for Grand Gulf 'n the impact of containment failure on the ability to provide for core cooling.

J (submittal page 105]

The medium LOCA event tres requires either HPCS or manual depressurization to use low pressure ECCS systems. RCIC is not credited due to the relatively low capacity of RCIC for the larger of the medium break LOCAs.

The small LOCA event tres credits RCIC as sufficient for makeup. A stuck open SRV is modeled as a small LOCA. No credit for control rod drive (CRO) makeup is taken as the injection capacity is too low for the larger of the small LOCAs. The PCS is not credited for a small LOCA but the condensate system is credited for injection. With failure of HPCS and RCIC, manuel operator act:on is required to span 3 SRVs for depressurization to allow core cooling with low pressure systems. To prevent rentainment failure by overpressurization, either 1 of 2 loops of suppression pool cooling with th0 RHR :ristem, or operation of 1 of 3 contamment fan coolers is required. The model credits long term operation of RCiC if one train of the suppression pool cooling system is successful, but does not credit RCIC over the long term if only fan coolers 12

.. - ~ _ - - - --

i l

are avadable or if no containment cooling is available. The submittal states that RCIC will be lost due to j

inadequate NPSHA if the suppression pool heats up to 173 F. [ submittal page 111, Table 3.116]

i The IPE does not credit realignment of RCIC to the CST over the long term; the licenses stated that the CST has insufficient inventory over the long term and that makeup to the CST is uncertain. The effect of no contamment cooling on HPCS, LPCS, LPCI, and the service water crosstie for injection to the vessel 4

fobowing a smaN LOCA is modeled as in the large LOCA case. [RAI Responses]

Steam released into the auxiliary building fo8owing containment failure by overpressurization also causes I

degradation in other systems important for mitigating a small LOCA or a transient. Unless RHR is aligned for i

shutdown cooling (SDC) prior to containment failure, SDC cannot be used due to loss of power to SDC l

suction isolation valves. Unless firewster injection to the vessel is aligned prior to containment failure, one of the flow paths is lost due to loss of power to MOVs. Operation of the SRVs in the relief mode is lost after contamment failwe due to loss of power. Containment failwa is assumed to subject SRV electrical control equipment located in the auxiliary building to damaging steamlmoistwo, and thus control power to the SRVs is assumed to be lost under these conditions. [ submittal, p.133] The SRVs still function in the safety mode but with loss of relief capability it is not possible to prevent represswization of the vessel thereby rendering ineffective the following low pressure core cooling systems that require the SRVs to mitigate a smsH LOCA or a transient: LPCI, LPCS, sonnce water crosstie, firewster crosstie, and the condensate system.

The model indicates that following a small LOCA with success of one train of suppresson pool cooling, RCIC can be used over the long term to mitigate a small LOCA. The hconses stated that by definition a smali LOCA is not large enough to depressurize the vessel by itself. [subndttal Figure 3.13 Sequence #7] [RAI Responses]

The model for a small-small LOCA due to failure of a recirculation pump seal is the same as that for a small LOCA, except that the model credits operator action to close recirculation line valves to isolate the seal LOCA. [ submittal Figure 3.14]

The transient event tree credits core cooling with both CRD pumps if the vessel is not depressurized. CR0 has insufficient makeup capacity after depressurization to restore level as quickly as is needed to prevent 1

core damage. The model also credits use of one CR0 pump for core cooling over the long term (several hours after reactor trip). The transient tres does not credit the Automatic Depressurization System (ADS), since procedures call for operator action to inhibit automatic depressurization due to ATWS considerations; manual action is required to depressurize to allow the use of low pressure core cooling systems. The need for containment cooling to support core cooling and the effect of containment failure on core cooling is the same as modeled in the small LOCA event tree. [ submittal page 115]

Station blackout is loss of offsite power and loss of both division 1 and 2 of the 1E power system; division 3 of IE power (dedicated to HPCS) may or may not be available following station blackout. CRD cannot be used during station blackout since the CRD pumps require non-1E power. The model upon which the submittal was based did not credit injection with firewster crosstie during station blackout since this capability is lost after depletion of the batteries due to closure of SRVs and repressurization of the vessel, and due to the conglexity of establishing the cros tie especiaHy during station blackout. Procedures instruct 13

s

)

i operators to establish the firewater crosstie with valve MOV'42 B which is located inside containment; during station blackout the lack of AC power requires entry into containment to open the valve, and it likely that containment will not be readily accessible during station blackout. Based on the IPE evaluations of I

station blackout, several modifications have been made to the plant and operating procedures to reduce the i

likelihood of core damage due to blackout events. These changes include providing a 60 kW (minimum) DG l

onsite for charging 125 V batteries, removing internals in 3 check valves associated with crosstie of l

firewster for injection to the vessel to eliminate this time consuming action for establishing the crosstie, and l

revising the station blackout procedure to provide for injection of firewster using a different flow path that

)

does not require operation of valves inside containment. These changes have now been implemented. [RAI responses, p. 9]

l j

If HPCS is lost during station blackout, the turbine driven RCit, system can provide core cooling provided that l

DC control power is available, containment heatup effects do not render RCIC unavailable, RCIC HVAC j

remams available, and the supply of water for injection with RCIC is not depleted. The River Band IPE used

]

a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> depletion time for Division 1 and 2 batteries, and a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> depletion time for division 3 batteries.

I i

During station blackout, AC power to effect transfer of RCIC from the CST to the suppression pool is not available, and the model assumes that RCIC remains aligned to the CST. The IPE credits operator action to

{

bypass RCIC isolation on high main steam tunnel temperature (indicative of a steam line break); this isolation 7

4 action is proceduralized but must be accomplished within about 5 minutes after loss of HVAC. The IPE considered seal LOCAs due to loss of seal cooling to recirculation pump seals during statioa blackout. The i

effect of a seal LOCA durmg station blackout is to decrease the time that CST inventory remams available to i

supply RCIC. The sulmuttal concludes that during station blackout with successful operation of RCIC, the j

limiting factor for how long RCIC can operate is the DC battery lifetime which is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, even considering j

seal leakage. The addition of the portable diesel generator on site for recharging of batteries during SB0 I

conditions reduces the likelihood of battery depletion and the related effects on RCIC operability.

j Containment pressure and CST inventory remain as limitations on how long RCIC can be used for providing coolant injection to the core under blackout conditions. Consideration of seal LOCAs during station blackout is discussed further in Section 2.5.4 of this report. [ submittal pages 34, 35, 125, 126, 730, Figure 3.2-41]

j 1

}

I The ATWS model assumes that manually 4nitiated injection with one of two standby liquid control (SLC) pumps is sufficient to provide timely shut 6own of the reactor. The ATWS model does not credit use of PCS, L

since following an ATWS prior to iiwien wSh SLC, power equilibrates at about 40% of full power and at l

18% of full power with ro6ction in water level, which is in excess of the 10% turbine bypass capability.

The ATWS model assumes that operators will always be able to inhibit ADS following an ATWS, i.e., that l

failure to inhibit has a probability of 0.0. Also, even if SLC injection fails, the IPE credits HPCS alone with successful mitigation of an ATWS if HPCS suction is successfully switched from the suppression pool to the CST for long term core cooling. With success of SLC, the IPE credits several other means of providing core i

cooling, including HPCS, LPCS, LPCI, and SSW cross tie, each in combination with RHR in either the l

suppression pool cooling mode or shutdown cooling mode, as being able to mitigate an ATWS. With these multiple possibilities' for ATWS mitigation, the licenses concludes that ATWS is a negligible contributor at j

River Band. [ submittal pages 82, 127, 129, 358, 395, 428, Figure 3.18. Sequence f7]

i j

The model for an interfacing systems LOCA (ISLOCA) assumed a frequency of 4E 3/ year that a low pressure system is exposed to higher than design pressure due to failure of isolation valves. The model assumed that, l

14

)

1 given exposure to greatw than design pressure, the piping fails with a probability of 0.01 based on NUREGICR 5124. This is a value comparable to that used in other PRAllPEs that have evaluated ultimate i

failure of components exposed to greater than design pressure. Given a rupture, the IPE assumes that 90%

of the ruptures are small. For large rupteres, the accident can be mitigated by isolation of the break by operator action; the model accounts for revwse pressure differential reducing the probability that isolation can be successfully accomplished. Without isolation, the large breaks can be mitigated by HPCS and low pressure injection systems. Some ECCS equipment would be expected to fail due to EQ effects, but sufficient redundancy existe that the contribution to core damage from large ISLOCA: is very low. For a small break, isolation is credited and, if isolation fails, depressurization to prevent EQ related failure of core cooling systems is considwed. With failure to depressurize, injection with RCIC and HPCS are consulered.

With successful depressurization following a small LOCA outside containment, the IPE credits continued use of injection for core cooling from systems such as: HPCS, LPCS, LPCI, and service water crosstie.

[ submittal Section 3.3.7 and Figure 3.31]

The failure to isolate a large LOCA is quantified with a value of 0.1, while the same action for small LOCAs was quantified with a value of 0.01. [ submittal Figure 3.31 and page 372] [RAI Responses]

2.2.3 Systems Analysis.

i System descriptions are included in Section 3.2 of the submittal. The system descriptions contain simplified schematics that display important items of equipment. Our comments on the system descriptions are as follows.

River Band has some unique design characteristics in comparison with othw BWR 6 Mark lil plants. Rivw Bond does not have a suppression pool makeup system (SPMU). Other plants have this system which dumps watw from an upper pool down into the suppression pool post LOCA to prevent loss of adequate water inventory in the suppression pool for the operation of ECCS pumps given that inventory during recirculation is diverted out the break from the suppression pool to the drywell. River Band has a typical suppression pool cooling system using RHR and SOC heat exchangers, but it does not have a contamment spray system; instead, fan coolers are provided. [submittel Section 2.4.1]

River Bend has typical RCIC and HPCS systems. HPCS is motor driven and injects over the core and not i

into the downcomer.

l River Bend has typical RHR and LPCS systems, except that no containment spray mode for RHR is provided.

RHR provides LPCI and suppression pool cooling as in other BWR 6 plant designs. Two loops of LPCI are provided by RHR and each of these loops contains two shutdown cooling heat exchangers in series cooled by either normal or standby service water; the third LPCI loop is dedicated to LPCI and does not contain a heat exchanger. LPCI injects into the core region and not into the downcomer. One loop of LPCS is provided that sprays over the top of the core.

Three fan coolers are provided, normally cooled by the HVAC chilled water system. However, fan coolers A i

and B are cooled by service water under accident conditions. Operator action is not required for system initiation or realignment to safety operating rtatus. [ submittal page 288]

i 1,

l 15

l t

The plant is equipped with 16 Crosby SRVs,7 of which are actuated automaticaly by ADS. [UFSAR, Figure 5.29]

Two DGs are provided, one each for IE aivium 1 and 2. These DGs are cooled by service water and require once through ventilation for room cooling. A third smaller DG provides ;~"::a for NFCS ami &

i service water pump 20. The River Bond IPE does not credit crosstie of power among divisions; the NUREGICR 4550 PRA for Grand Gulf credited use of division 3 power (HPCS DG) crosstied to electrical loads in divisions 1 or 2. [ submittal page 33]

The standby service water system (SSW) provides safety grade cooling for plant equipment; SSW uses a mechanical draft cooling tower for the ultimate heat sink. SSW interfaces with the normal service water system (NSW). NSW provides normal non safety related cooling; NSW is a closed loop sptem, which is cooled by the service water system, a system distinct from the SSW. NSW is normally operating and SSW is normally in standby. When SSW is initiated NSW is isolated. The RPCCW system is normally cooled by NSW, but the following loads normally serviced by RPCCW can be cooled with SSW: CRD pumps and RHR pumps. [ submittal pages 263,266]

The plant air system has three motor driven air compressors powered by non 1E power that require TPCCW for cooling. Two diesel driven backup air compressors are also provided which do not require TPCCW cooling. The licensee stated that as of the latest revision of the PRA (September 1994), two dieseldriven air compressors are in service. A modification is in process to remove one of these compressors; once the l

compressor is removed the CDF is estimated to increase by less than 2%. [ submittal page 267, Figure 3.2-37, Section 9.3.1.3] [UFSAR, Section 9.3.1.3] [RAI Responses).

The feedwater pumps are motor driven and require TPCCW for cooling.

l The CRD pumps cannot be powered by non 1E power. The pumps require cooling either by RPCCW or by SSW as a backup.

The firewster system hac diesel driven pumps but AC power is required for remote manual opening of MOVs to crosstie firewster to LPCI loop B for injection to the core. The crosstie valves can be manually opened, but procedures call for opacing a MOV inside containment which is not readily accessible.

l The submittal contains a description of the requirements for HVAC systems to support operation of frontline systems. HVAC systems for the following areas were modeled as required: standby switchgear and battery rooms, DG rooms, ECCS pump rooms (RHR, RCIC, and LPCS), SSW pump rooms, and the motor control center (MCC) area and main steam tunnel; for rooms containing pumps, HVAC was required only over the long term as indicated in the system dependency diagrams. Room cooling for HPCS was also required over the long term. HVAC for CRD pump rooms and for SLC pumps was not required. The model credits operator actions to open doors to the standby switchgear rooms to provide for room cooling by natural circulation if the normal HVAC systems fail. Based on plant specific calculations, one hour is available to open the doors to the switchgear rooms during a non station blackout sequence and 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> are available during station blackout. Chilled water provided by mechanical refrigeration units is used as the heat sink for air handling units that provide cooling for the control room and for air handling units that provide cooling for the standby switchgear rooms. The IPE modeled control room air conditioning as part of the control building 16

cooling system. [ submittal Sections 3.2.1.18, 3.3.5.2.1, Figures 3.2 23,3.2 31 and 3.2 41) [UFSAR, Section 9.4] [RAI Responses]

External cooling for the following pumps was modeled as required: CRD (with RPCCW or SSW backup) and feedwater and condensate (with TPCCW). The.following pumps are self cooled: RCIC, HPCS, and LPCS.

The HPCS and LPCS pumps were credited for long term operation at elevated temperatures; the IPE assumes that seal failures will occur at about 250 F but that seal failure is assumed to not fail these pumps, and that the bearings will not fail until temperature exceeds 360 F which is above the temperature carresponding to containment failure (about 300 F). The RHR pumps have seal coolers serv!ced by RPCCW with bac!so cooling available from SSW; in the IPE model, seal cooling is not required during injection with LPCI, but is required over the long term for suppression pool cooling. (submittal pages 120,121, 235, 237, 239, and 266, Figure 3.2 28] [RAI Responses]

The submittal contains a discusson of subtle interactions and how they were considered in the IPE model.

This discussion indicates that subtle interactions were considered in the model. We note the discussion of voltage drop in Section 3.2.3.2.5. The submittal states that a voltage drop on the grid does not affect loads at River Band since they are normally powered off the station generator. This does not address an important point. Voltage drop is of significance if it is small enough to not result in plant trip and actuation of DGs, yet twge enough to render voltage levels on IE buses insufficient for starting motors to power emergency equipment should an accident initiating event occur. Many plants have installed second level circuit breaker trip protection for sustained low magnitude voltage drop to address this potential situation.

[ submittal page 343, Section 3.2.32]

2.2.4 System Dependencies.

The submittal contains schemati::s indicating system dependencies in Figures 3.2 23 through 3.2 44. These schematics contain footnotes that indicate partial dependencies or time related dependencies. TF schematics for system dependencies appear to be complete and accurate. We did note that t% system dependency schematic for CRD does not clearly indicate that RPCCW is the normal source for pump cooling backed up by SSW. Figure 3.2 25 of the submittal indicates that supply of air is not required to operate the SRVs in a relief mode; the valves do require air to open, but accumulators are provided. [ submittal Figure 3.2 41]

It appears that all dependencies have been accounted for in the IPE.

2.3 Quantitative Process This section of the report summarizes our review of the process by which the IPE quantified core damage accident sequences. It also summarizes our review of the data base, including consideration given to plant-specific data, in the IPE. The uncertainty and/or sensitivity analyses that were performed, if any, were reviewed.

2.3.1 Quantification of Accident Seouence Freauencies.

17

A l

4 i

The River Bend IPE used the small event treellarge fault tree model for quantifying core damage. Support

]

systems were included in fault trees, and fault tree linking was used to quantify accident sequences. The CAFTA code was used to quantify accident sequences. Truncation limits were IE 9 for cut sets. Common l

cause failures were modeled directly in the fault trees. [ submittal pages 2 22, 69, 360]

2.3.2 Point Estimates and UncertaintvlSensitivity Analyses.

Mean values were used for point estimate failure frequencies and probabilities. A mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> j

was used. [ submittal Section 2.3.7)

I The IPE considered two types cf uncertainty; parameter uncertainty and model uncertainty. Parameter uncertainty was quantified using legnormal probability distributions for failure data. Model uncertainty was l

addressed by sensitivity analyses. [ submittal Section 2.3.8]

1 Considering parameter uncertainty, the mean CDF was 1.87E Slyear with 5% and 95% confidence limits of 1.51E 6/ year and 7.26E 5/ year, respectively. The mean of the distribution for CDF differs from the mean j

calculated using point estimates (1.55E-Slyear) since the uncertainty analysis considered correlation of failures j

for similar components. [ submittal Table 3.4-36]

l Eleven sensitivity cases were analyzed and discussed in the submittal. Of the eleven cases, two have a j

significant impact on overall CDF, those being: installing locked closed manual valves to decrease the time necessary to implement injection to the vessel with firewster crosstie, and assuming that RCIC fails due to harsh environment from steam after gland steam condensing fails during station blackout. The first case lowers the point estimate CDF by 83%, and the second case increases the overall CDF by 100%. The 3

l submittal states that both these cases have a significant impact on the CDF from station blackout. As

]

discussed in Section 2.7.3 of this report, changes have been made to the plant to more effectively allow for the use of the firewater crosstie providing injection to the vessel. [ submittal pp. 427 429, Table 3.4 35, i

Section 3.4.1.10.1, RAI Responses p. 9]

2.3.3 Use of Plant Specific Data.

j River Bend does not have a long history of operation, therefore plant specific data were available for only a i

few systems modeled in the PRA. The plant specific data were used to update generic data to produce values used in the actual quantification. Data were collected from 1988 through 1992, but data collection

)

for particular systems and components typically did not occur over the entire period from 1988 to 1992.

j

[ submittal Section 3.3.2] [RAI Responses]

Plant specific data were used to bayesian update generic data for components in the following systems: DGs, HVAC, RCIC, HPCS, and RHR. The following types of failures were addressed in the plant specific data for these components: failure to start, failure to run, and unavailability due to test and maintenance. For the following failures the plant specific data were either not available or inconclusive: HPCS failure to start, l

HPCS failure to run, RHR failure to run, and RCIC failure to run. Testing and maintenance unavailabilities for j

these systems were quantified with plant specific data. [ submittal page 350, Table 3.3 2]

j 4

)

18

We performed a spot check of the plar.t specific data for component failures. The results of this check are summarized in Table 21 of this report.

Table 21. Plant Specific Data Ceanpeneet and River Bend NUREGICR 4550 Failere Illieds Updated Valse"""

Valesnum g,,,g g,gg Diesel Generator Fail to Start 2.9E 3/D 3.0E 2/D Diesel Generater Fail to Run 4.0E 3/H 2.0E 31H RHR Pump Fail to Start 5.7E 410 3.0E-3l0

]

RCIC Pump Fail to Start 7.4E 2/D 3.0E 2/D

{1)

D is per demsM: these values are probabilities.

(2)

H is per hour; these values are frequencies.

The DG fail to start probability is less than that used for the Grand Gulf PRA by a factor of 10, but it is not diffwent from values used in other IPElPRAs; for example, the NUREGICR 4550 PRA for Peach Bottom used 3.0E 3 for this probability. Based on the data in Table 2-1 of this report, the plant specific component failure data are comparable with typical plant specific data used in ' ilPRAs. [NUREGICR4550, Peach Bottom Table 4.9-1]

The recovery of offsite poww model was based on NUREG 1032 and NUREGICR 5032. [RA' lesponses]

2.3.4 Use of Generic Datt.

The primary sources of genanc data were: NUREGICR 4550, WASH 1400, and IEEE 500. These are standard data bases used in numerous PRAllPEs. The generic data base is provided in Table 3.31 of the submittal.

The generic data used in the River Band IPE are comparable with generic data used in typical IPEIPRAs.

2.3.5.G9mmoi.qause Quantification.

The beta factor method was used to model common cause failures. Common cauce failures among similar components within the same system wwe modeled. Those components modeled arm listed in Table 3.310 of the submittal. The extent of the common cause modeling in terms of components coreidsred for failure is comparable with typical IPElPRAs. The model does consider common cause failure of all three DGs, including the smaller HPCS DG. [ submittal Section 3.3.4, Table 3.310]

Common cause failures were quantified mainly using generic data from NUREGICR 4550. Beta factors for fans, chillers, and check valves were taken from NUREGICR-4780. The beta factor for the batteries was based on a plant specific analysis of the system design; the worst case factor of 0.4 from NUREG 0666 was adjusted to 8E 3 using the guidelines of NUREG-0666. [ submittal page 359]

We reviewed the values assigned to common cause failures by performing a spot check of the data used in the IPE, as sununarized in Table 2 2 of this report. [ submittal Table 3.3-10]

l 19 l

l i

Table 2 2. Common cause Factors for 2-of 2 Component l

4 Component River Bond IPE Beta Facter Vales from Searce Indicated in Feetnote Diesel Generator 0.04 0.04 "' S i

(mode not specified) 0.03 "' f ail to run I

{0.006 for fail to start}

j MOV 0.09 0.05 "'

O.09 *

• 0.05 "'

1 RHR Pump 0.2 0.1 "' *

(mode not specified) 0.2

• O.1 "' f ail to start i

{0.02 for fail to run}

SafstylRelief Valve 0.2 0.1 "'

O.2

• 0.3 "' fail to open on pressure

{0.1 fail to open on signal}

Service Water Pump 0.03 (motor driven pump, mode not 0.03 "'

• s specified) i (1)

NUREGICR4550 Peach Bottom. Table 4.91.

i (2)

NUREGICR4550 Grand Gulf, Table 4.9 29 (3)

NRC IPE Review Guidance, Rev 1 November 1993 j

14i PLG Generic Data Based on the data in Table 2 2 of this report, the common cause factors appear comparable to values used in typical IPElPRAs.

2.4 Interface issues This section of the report summarizes our review of the interfaces between the front end and back end analyses, and the interfaces between the front end and human factors analyses. The focus of the review was on significant interfaces that affect the ability to prevent core damage.

20

2.4.1 Front End and Back End Interfaces As dia-d previously in Section 2.2.2 of this report, the IPE assumes that without suppression pool cooling RCIC is lost due to high suppression pool temperature. With no containment cooling (either from the suppression pool cooling system or from the fan coolers), the IPE assumes that HPCS, LPCS, and RHR pumps remain available until containment failure by overpressurization. After containment failure, the model assumes that steam released into the 141 foot level of the auxiliary building renders the following equipment unavailable: RHR train A, LPCS, the MOVs for crosstie of service water or firewster for injection to the vessel, tha shutdown cooling isolation MOVs, and the SRVs in the relief mode. Therefore, loss of containment cooling and subsequent containment failure by overpressurization degrades core cooling systems but does not result in total loss of core cooling.

The three inch vent is too small to prevent containment failure by overpressurization if containment cooling from both the suppression pool cooling system and the fan coolers is lost.

The IPE does not model containment isolation and the potential for a seal LOCA due to isolation of cooling water to the recirculation pump seals. However, at River Bend all core cooling systems involve injection directly to the vessel, therefore this event should have little impact on the overall CDF.

The core damage sequences were binned into plant damage states (PDS) for the back end analysis. The binning into the PDSs was done at the cut set level. Eight parameters were used to bin the functional core damage sequences into 49 groups: type of initiating event, availability of electrical power at the time of core damage, status of HPCS, status of LPCS and (PCI, status of suppression pool cooling, status of fan coolers, vessel pressure at time of core damage, and the tine of failure of injection to the versel relative to the occurrence of the initiating event. Then, six questions were asked of each of the 49 cut set groupings to unequivocally specify the state of containment cooling and containment isolation. This resulted in 236 new groups of cut sets. The 236 groups were then binned into PDSs based on similar characteristics affecting the source term. This process resulted in binning of core damage cut sets into 43 actual PDSs. [ submittal i

page 140, Section 3.4.1]

The binning process used to coalesce core damage cut sets into PDSs in the River Band IPE was comparable to the process used in typical IPEIPRAs.

2.4.2 Human Factors interfaces Based on the front-end review, the following operator actions were noted for possible consideration in the review of the human factors aspects of the IPE:

manual initiation of depressurization opening doors to provide natural circulation cooling for standby switchgear rooms bypass of RCIC steam supply isolation following loss of steam tunnel HVAC during station blackout j

e inhibition of ADS during ATWS sequences initiation of suppression pool cooling isolation of interfacing systems LOCAs outside containment

+

initiation of SLC to mitigate an ATWS 4

21

I s

implementation of service water or firewater crosstie for core cooling

+

isolation of a seal LOCA

+

recovery actions following internal flooding.

l As noted in Section 2.2.2 of this report, the IPE assumes that operator failure to inhibit ADS following an ATWS has a probability of 0.0.

4 j

As discussed in Section 2.2.2 of this report, RCIC steam line isolation must be bypassed in 5 minutes after station blackout since HVAC in the steam tunnel is lost which leads to isolation on high temperature indicative of a steam line break.

l As noted in Section 2.6.2 of this report, the key ' recovery' actions considered for internal flooding events are actually a subset of the post accident human actions considered for internal initiating events, and are not unique recovery actions specific to internal flooding.

As noted in Section 2.2.2 of this report, the IPE credits injection with service water crosstie to mitigate a large LOCA, and prompt operator action is needed to establish this mode of cooling to prevent core damage after the core is uncovered due to blowdown following a large LOCA.

2.5 Evaluation of Decay Heat Removal and Other Safety 1: sues This section of the report summarizes our review of the evaluation of Decay Heat Removal (DHR) provided in the submittal. Other GSIlUSIs, if they were addressed in the submittal, were also reviewed.

2.5.1 Examination of DHR I

The licensee evaluated DHR. This evaluation addresses all accidents except: ATWS, interfacing systems LOCAs, vessel rupture, and large and medium break LOCAs. Two functional requirements are addressed: core cooling and ultimate heat removal. [ submittal Section 3.4.3]

Fourteen functional sequences in the IPE survived truncation, including a small contribution from internal flooding. All of these sequences involve loss of DHR. Therefore, the entire CDF reported for River Bend, 1.55E 5Iyear, involved loss of DHR.

The sequences can be categorized by three types of failures: (1) failure of high pressure injection and failure to depressurize, (2) failure of all high pressure injection, successful depressurization, and failure of low pressure injection, and (3) failure of containment heat removal when required (suppression pool cooling and containment fan coolers).

The licensee uses information from NUREG-1289 to address potential vulnerabilities in DHR for River Band.

The submittal states that the frequency for loss of DHR at River Bend is in category 1 as defined by NUREG 1289,in that the CDF is less than 3E 5Iyear. The submittal states that the low value of CDF from loss of DHR indicates that no vulnerabilities exist related to loss of DHR at River Band.

22

3 The evaluation of DHR does not discuss the major contributors to has of DHR; however, since all of the CDF sequences that survived truncation involve loss of DHR, the discussion in the submittal of the overall results j

are applicable to loss of DHR. The overall results of the iPE are discussed in Section 2.7 of this report.

2.5.2 Diverse Means of DHR Section 3.4.3 of nie submittal provids.s a summary of the options for providing DHR. With the vessel at high pressure, the preferred means of heat removal is main feedwater and the condenser. Backup cooling options

]

at high pressure are: RCIC, HPCS, and CRD (both pumps required in the short term). The SRVs can be used to depressurize the vessel so that low pressure core cooling systems can be used. Low pressure core l

cooling systems are: LPCS, LPCI, SDC, SSW or firewster crosstie, and condensate; HPCS can also be used at low pressure in the BWR 6 design. Core cooling is supported by containment cooling with the suppression pool cooling system and the containment fan coolers; the impact of loss of containment cooling on the ability to cool the core was considered in the model and is discussed in Sections 2.4.1 and 2.2.2 of this report.

The model required operation of numerous HVAC systems to support long term operation of core cooling systems and standby electrical power as discussed in Section 2.2.3 of this report.

The submittal states that the 3 inch contamment vent is too small to prevent containment failure by overpressurization for sequences involving release of energy into contamment in which containment cooling is lost.

]

2.5.3 Unious Features of DHR a

Design features at River Band that impact the Core Damage Frequency (CDF) from loss of DHR are as follows:

l Ability to crosstie standby service water and diesel driven firewster to low Pressure Coolant Iniection (LPCI) loon B for iniection to the vessel Crosstie of service water or firewster to LPCI provides alternate injection capability for core cooling, which tends to decrease the CDF.

Difficulty in usina feedwater crosstie for iniection durina station blackggi The firewater system has diesel driven pumps that can be used to inject water to the vessel during station blackout; however, procedures direct using a Motor Operated Valve (MOV) inside containment to effect the crossstie, and duiing station blackout this valve is likely to be inaccessible. The difficulty in using firewster for core cooling during station blackout tends to increase the CDF.

Containment fan coolers. no containment sorav system, and no suporession pool makeuo system 1

River Bend uses containment fan coolers instead of Residual Heat Removal (RHR) in a containment spray mode. The presence of a diverse containment cooling system tends to decrease the CDF, although both the suppression pool cooling system and fan coolers rely on SSW for a heat sink, thereby minimizing the impact of this feature on reducing CDF. The River Bond design does not require dump of upper pool water to the suppression pool to mitigate a loss of Coolant Accident J

(LDCA); other designs dump water from upper containment using the suppression pool makeup system to ensure adequate inventory in the suppression pool following a LOCA to compensate for 23

o watw discharged into the drywell. The lack of a requirement for suppression pool makeup tends to decrease the CDF since it removes the makeup system as a requirement for successful mitigation.

Four hour batterv lifetime The four hour lifetime, with credit for load shedding, is relatively short and this tends to increase the CDF from station blackout since it restricts the time available to recover offsite power and onsite AC power. A portable diesel generator has been made available onsite for charging 125 VDC batteries to improve capabilities for withstanding station blackout conditior.4. This capability, coupled with enhancements to facilitate the use of diesel-driven firewster injection during station blackout, tends to reduce the CDF.

2.5.4 Other GSIlUSIs Addressed in the Submittal.

The licenses proposes to resolve thres other safety issues with the IPE, these being: GI 23 " Reactor Coolant Pump Seal Failures", GI 105 " interfacing System LOCA at LWRs", and USI A 17 " Systems Interactions in Nuclear Poww Plants". [ submittal Section 3.4.4)

The IPE evaluated the impact of failures of recirculation pump seals during station blackout when cooling to the seals is lost. During station blackout with failure of HPCS, RCIC is the only means of providing injection to the vessel until other methods of core cooling are recovered. RCIC requires DC power from batteries that deplete after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> during station blackout. During station blackout, RCIC is aligned to the CST and a seal LOCA decreases the time during which the CST inventory can last for core cooling. The licenses concluded that seal LOCA: have a minor effect on the station blackout sequence. If the seals leak at 18 gpm per pump (36 pm total from two pumps) the CST inventory lasts longer than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. If the seals leak at 100 gpm per pump (200 gpm total) the CST inventory lasts for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />; however, considering the additional i

time to core damage, four hours total are available and the model assumed that recovery must be accomphshed within four hours. Therefore, the IPE model took the four hour battery lifetime as the limiting factor for the long term availability of RCIC during station blackout, and assumed that recovery must be successful within this four hour time frame, possimistically neglecting the additional hour required for core j

uncovery after loss of R010 at four hours. Based on this evaluation, the licenses concludes that the impact of seal failures during station blackout on overall CDF is negligible. The explicit consideration of the impact of loss of seal cooling is a strength of the IPE. [ submittal pages 435 and 436]

The IPE explicitly modeled interfacing system LOCAs. Due to the completeness of the model and the small contribution of interfacing system LOCAs to the overall CDF, the licensee proposes that the IPE resolve GI-105. [ submittal Section 3.4.4.3]

The licensee proposes that the IPE resolve two issues for USI A 17, these being: consider insights listed in the appendix of NUREG 1174 in performance of the internal flooding analysis, and consider insights from USl A 17 regarding adverse system interactions in the IPE. The submittal states that the IPE for River Bend did incorporate all these insights and considerations. Our review of the internal flooding analysis is contained in Section 2.6.2 of this report; previous sections of this report commented on the consideration of system interactions in the IPE.

2.6 laternal Fleeding 24

6 This section of the report summarizes our reviews of the process used to model internal flooding and of the results of the analysis of internal flooding.

2.6.1 Internal Floodina Methodoloov.

Over ISO flood zones were evaluated. Failures due to submergence, steam, and spray were evaluated and flood water propagation was considered. The transient event tree model was used to quantify the core damage frequency from internal flooding considering failures as a direct result of the floods as pre existing unavailabilities in the event trees. Based on a screening study, five specific internal flooding scenarios were quantified. [ submittal page 369, Section 3.3.6]

The analysis of internal flooding did not consider the plant modification completed in the summer M 1992 that changed to closed loop operation of the nuclear service water system; this change reduced the total volume of service water in the auxiliary building, thereby reducing the damaga from service water floods in j

the auxiliary building.

i The submittal states that internal flooding alone, without additional random failures, would i.ot result in core damage if operator recovery actions are taken. The submittal diseases the recovery actions credited in the analysis of internal flooding, and discusses the impact of these actions on the CDF from internal flooding.

[ submittal page 366, Sections 3.3.6.2 and 3.3.6.3]

i 2.6.2 Internal Floodina Results.

The IPE quantified five flooding scenarios. All of these scenarios involved floods in the auxiliary building.

Three of the scenarios involved breaks in service water piping, one scenario involved a break in a main steam line, and one scenario involved a break in the RCIC steam supply line. [ submittal Section 3.3.61]

The CDFs from three of these scenarios were quantified, specifically those involving breaks in the service water system piping in the auxiliary building. The other two scenarios, breaks in a main steam line and in a RCIC steam supply line, were eliminated based on the low frequency of the break considering subsequent failure to isolate the break. The submittal tabulates those components failed as a direct rcA ti inocomg for these three flooding initiating events. [ submittal Tables 3.312 and 3.313]

The following recovery actions were important in the quantification of internal flooding: recovery of main feedwater, failure to manually depressurize the vessel with the SRVs, and failure to start the standby cooling tower fans. These are a subset of the operator post accident actions considered in the quantification of internal events, and are not true ' recovery' actions such as the recovery actions for internal event cut sets that are addressed in Section 3.3.5.2.1 of the submittal. Therefore, none of the key recovery actions for internal flooding are unique actions in response to the flood event itself. [ submittal page 369 and Table 3.3-3]

25

l l

2.7 Core Damage Sequence Results This section of the report reviews the dominant core damage sequences reported in the submittal. The reporting of core damage sequences whether systemic or functional is reviewed for consistency with the screening criteria of NUREG 1335. The definition of vulnerability provided in the submittal is reviewed.

q Vulnerabilities, enhancements, and plant hardware and procedural modifications, as reported in the submittal, are reviewed.

2.7.1 Dominant Core Damsos Seouences.

The total CDF from internal initiating events given in the submittal was calculated to be 1.55E 5Iyear, and the total CDF from internal flooding was calculated to be 1.75E 8/ year. [ submittal Section 3.41 l

i d

The IPE used systemic event trees to quantify core damage. The cut sets were binned into functional groups, and the results of the IPE were reported on a functional basis. Of the total 33 functional groups, j

5 cut sets in 14 groups survived truncation and were actually quantified. Of these 14 functional groups,8 i

met the screening criteria of the generic letter for reporting, these being: [ submittal Sections 3.1.4.1 and i

3.4.1]

1 TBU: station blackout with immediate failure of HPCS and RCIC l

l TBUX: station blackout with immediate failure of HPCS and long term failure of RCIC due to battery depletion l

4 TQUX: transient with loss of PCS, failure of all high pressure injection systems, and failure to depressurize T1UX: sequences involving loss of offsite power, failure of all high pressure injection systems, and failure to depressurize TQUV: transient with loss of PCS, failure of all high pressure injection systems, wecessful depressurization, and failure of all low pressure injection systems S2UX: small 1.0CA, failure of high pressure makeup, and failure to depressurize TW: transient, failure of all high pressure injection systems, successful depressurization, loss of all containment heat removal (suppression pool cooling and fan coolers), loss of SRVs due to EQ after containment failure by overpressurization resulting in repressurization of the vessel and inability to

)

use low pressure injection systems TIUV: sequences involving loss of offsite power, failure of all high pressure injection systems, i

successful depressurization, and failure of all low pressure injection systems The CDF from these eight functional sequences comprised 99.7% of the total CDF calculated. [ submittal page 411]

26

(

(

The submittal provides details of these eight functional sequences. Dominant cut sets are given and Fussell-Vesely importance measures are provided. (submittal Tables 3.4 2 through 3.4 32]

Overall results are provided in Section 1.4.1 of the submittal. The contribution to the overall CDF from internal initiating events categorized by the eight functional sequences is summarized in Table 2 3 of this report based on Table 1.4 2 of the submittal. The contribution to the overall CDF from internal initiating events categorized by initiating event is summarized in Table 2 4 of this report based on Table 1.41 of the submittal. The contribution to the overall CDF from internal initiating events categorized by type of accident is summarized in Table 2 5 of this report based on Table 1.41 of the submittal.

The most important events as ranked by Fussell Vessly importance are provided in Table 1.4 3 of the submittal. Ranked by decreas:ng importance these events are: loss of offsite power as an initiating event, failure to recover offsite power within I hour, DG failures, failure to recover offsite power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and failures in the RCIC and SSW systems.

These results indicate that SB0 dominates the CDF, contributing 86% to the total CDF. Station blackout also dominated the CDF in the NUREPlCR 4550 PRA for Grand Gulf, contributing 97% to the overall CDF.

Based on the listings of dominant cut sets, important failures contributing to the CDF from station blackout are: failure of SSW, failure of the DGs including the HPCS DG, and failure to recover offsite power.

The CDF for River Bond was estimated as 1.55E 5Iyear; the CDF for Grand Gulf in the NUREGICR-4550 PRA was estimated u 4.0E 6/ year.

Note that the results presented in Tables 2 3,2 4, and 2 5 of this report are based on the information developed in the base IPE and described in the submittal. Updates to the IPE which take credit for recent physical and procedural modifications indicate that the CDF for River Band has been reduced to 3.55E-6/ year, and that the SBD contribution has been reduced to 1.4E 7/ year (4% of revised CDF). Additional information indicating the revised dominant sequences, major contributors by initiator, or major contributors by accident type has not been provided. [RAI Responses, pp. 9,50]

The licensee concludes that ATWS is a negligible contributor to the overall CDF. As discussed in Section 2.2.2 of this report, the model for ATWS assumes that operators inhibit ADS with a probability of 1.0 and that HPCS can be used to mitigate the ATWS. The NUREGICR 4550 PRA for Grand Gulf estimated that ATWS contributed about 3% to the overall CDF from internal initiating events.

The River Bend IPE determined that certain core cooling systems that survive loss of containment cooling are lost due to steam damage after containment failure by overpressurization. This overpressurization failure is assumed to result in release of steam into the auxiliary building. The NUREGICR-4550 PRA for Gesnd Gulf determined that containment failure would result in steam release directly to the atmosphere and not into other buildings, and therefore would not result in EQ induced failures of core cooling equipment.

27

l l

Table 2 3. Functional Accident Sequences i

Functionel Accident Description l Frequency Segmence TBU Loss of offsite power or transient with subsequent loss of offsite power initiated 8.94 x 10 8i event with failure of both Division I and 11 emergency AC power supplies resulting in j

station blackout. Both HPCS and RCIC fail immediately, so there is no means to provide coolant makeup and core damage results. The reactor vessel is depressurized so the core damage results with the reactor vessel at low pressure.

TBUX Loss of offsite power or transient with subsequent loss of offsite power initiated 4.59 x 10-6 event with failure of both Division I and 11 emergency AC power supplies resulting in station blackout. HPCS fails immediately but RCIC may succeed until the batteries deplete when it also fails,so there is no means to provide coolant makeup and core damage results. The reactor vessel is not depressurized so the core damage results with the reactor vessel at high pressure.

TQUX Transient initiator followed by failure of the power conversion system to remain 7.98 x 10-7 available. All high pressure coolant makeup fails immediately. Reactor vessel depressurization fails, preventing the use of low pressure coolant makeup systems.

Core damage results.

TIUX Loss of offsite power or transient with subsequent loss of offsite power initiated 5.40 x 10-7 j

event followed by irnmediate failure of all high pressure coolant makeup.

Depressurization of the vessel fails so low pressure makeup is unavailable. Core damage results.

TQUV Transient initiator followed by failure of the power conversion system to remain 2.09 x 10-7

)

available. Both high pressure and low pressure coolant makeup fails immediately although depressurization is successful. With no coolant makeup, early core damage occurs.

S2VX Pipe break or transient with one stuck open relief valve initiated small LOCA followed 2.09 x 10 7 by irnmediate failure of all high pressure coolant makeup. Depressurization of the vessel fails so low pressure makeup is unavailable. Core damage results.

TW Transient initiator followed by failure of all decay heat removal. High pressure coolant 1.53 x 10 7 makeup either fails immediately or,in the case of RCIC, at about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> due to inadequate NPSH, but the vessel is successfully depressurized and low pressure makeup is initially successful. However, without decay heat removal, containment failure due to overpressurization eventually occurs. Containment failure results in a harsh environment in the auxiliary building which causes failure of the SRVs which repressurizes the vesa! and fails the operating low pressure systems. Core damage occurs.

TIUV Loss of offsite power or transient with subsequent loss of offsite power initiated 1.08 x 10 7 event followed by immediate failure of all high pressure and low pressure coolant makeup. Early core damage results.

28

a i

k Table 2 4. Core Damage Frequency by initiator i

leitieter Fregesesy per Year i

I a

Lou of Offsite Power (TI) 1.4 x 10 5 Loss of Normal Service Water (TNSW) 7.5 x 10 7 Lou of Feedwater (T3BI 3.7 x 10 7 j

Loss of Reactor Plant Component Cooling (TCCP) 2.9 x 10 7

)

Transient with PCS Available (T3A) 5.6 x 10-8 1

Transient with Loss of PCS (T2) 4.6 x 10 8 Table 2 5. Core Damage Frequency by Aceident Type 1

Aseident Type Fregesasy per Year Station Blackout 1.3 x 10-5 Transient 1.3 x 10 6 Loss of Offsite Power 6.7 x 10 7

)

Transient induced LOCA 2.4 x 10 7 i

i

}

The submittal discussed other important differences between the IPE model for Rivw Band and the l

NUREGICR 4550 model for Grand Gulf that account for the hqi er CDF for Rivw Bond. The River Bend h

]

model required HVAC for the standby switchgear rooms, whwess the Grand Gulf PRA did not. The River Band model did not credit crosstis of the HPCS DG to divisior 1 and 21E loads; the Grand Gulf PRA did.

The River Band IPE modeled common cause failure among all three DGs, including the HPCS DG; the Gr. l Gulf PRA did not model the HPCS DG common cause failure. The River Bend demgn incorporates a service j

water system consisting of shared NSW and SSW; the Grand Gulf design incorporates a separate SSW j-system. [ submittal Section 7.1]

l We noted an additional important difference between the River Bend IPE and the Grand Gulf PRA in NLiREGICR 4550 associated with station blackout. River Band used a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> battery lifetime, while Grand i

Gulf used a time of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Also, the River Band IPE used lower probabilities for failure to recover offsite power than are used in many IPEIPRAs; for sxample, the probability of nonrecovery within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> was about 0.01 in the River Bond IPE model, while the probability of nonrecovery within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> was about 0.07

)

i in the Grand Gulf PRA. [NUREGICR-4550, Grand Gulf, page 4.6 75, Figure 4.9 2]

i Based on the FussellVessly importance measures and the discussions of the dominant cut sets in the i

submittal, the following human errors contribute to most to the CDF:

i i

failure to restore SSW manual valve V134 after test or maintenance, e

failure to restore SSW manual valve V133 after test or maintenance,

}

failure to establish compensatory cooling to switchgear rooms by opening doors within I hour after

]

loss of normal HVAC, operator failure to manually depressurize the reactor vessel, ano 2

i 29

t failure to recover feedwater, firewater injection, or the PCS.

The submittal states that one event of significance, lock out of SSW pumps for NSW system testing (event SWP MDLMNTLOCK), does not exist hr the new closed loop operation of the NSW system. This event renders cooling water to the DGs unavailable. The IPE model assumed that the operators did lock out the SSW pumps. Recently, the PRA ivas updated to reflect the change to the plant in which the pumps are not locked out; with this change, the CDF decreases by 17%. [ submittal pages 366,412] [RAI Responses]

2.7.2 Vulnerabilities.

Section 3.4.2 of the submittal discussed front end vulnerabilities. The licensee used the NRC's Safety Goal Policy Statement to develop the following vulnerability screening criteria. If the CDF for any functional accident sequence exceeded 1E-4Iyear, a vulnerability was assumed to exist. Since no functional accident sequences had a frequency greater than IE 4/ year, the licenses concludes that River Band has no vulnerabilities.

2.7.3 Proposed improvements and Modifications.

The submittal states that 4 changes were made as a result of areas identified dunng the course of the level 1 PRA portion of the IPE. One hardware change was made, that being installation of a division 1 SSW return air operated valve (ISWP*A0V599) to address loss of SSW cooling water flow to the HPCS DG during station blackout. Three changes te procedures were implemented. (1) Enhanced guidance was developed for mitigating loss of control building ventilation. (2) Two checks per shift were instituted to check the fuel supply to running diesel powered instrument air compressors. (3) SSW pump lock out during testing of NSW was eliminated based on the new closed loop configuration of the NSW system. [ submittal Section 6.2.11 Other potential changes to the plant are discussed in the subnuttal. The ability to mitigste station blackout is limited by the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> battery lifetime and tha CST inventory. Also, low pressure diesel driven firewster cannot be used after DC power is lost since the SRVs close on loss of power resulting in repressurization of the vessel and the inability to use low pressure injection. Implementation of a portable diesel generator for charging the batteries, in combination with simplifications to the firewater injection lineup, are predicted to lower the overall CDF from 1.55E Slyear to 3.55E 6Iyear with the relative contribution of statiw Sackout decreasing from 86% to 4%. The transmittal letter to the submittal identifies the following changes. provide a 60 kW (minimum) DG onsite for charging 125 V batteries, remove internals in 3 check valves associa.ted with crosstie of firewster for injection to the vessel to eliminate this time consunk;; action for est.M;shing the crosstie (currently /mstalled manual block valves would be locked closed to perform the function of the check valves), and revise the station blackout procedure to provide for injection of firewster using a different flow path that does not require operation of valves inside containment. The changes described in this paragraph have now been completed. [ submittal Section 6.2.2] [RAI Responses]

The licensee evaluated the decrease in CDF if a large (10 inch diameter) hardened containment vent were installed. The existing 3 inch vent is too small to prevent containment failure by overpressurization if containment cooling is lost. As discussed previously in this report, the model assumes that containment failure by overpressurization results in the release of steam into the auxiliary building which renders certain i

core cooling equipment unavailable. With the addition of a larger vent, the licenses estimates that the overall i

l 30 l

4 CCG decreases from 1.55E 5/ year to 1.53E Slyear, a small amount. Therefore, installation of a larger hardened contamment vent is not being considered further. [ submittal Section 6.2.31

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS This section of the report provides our overall evaluation of the quality of the front end portion of the IPE based on this review. Strengths and shortcomings of the IPE are summarized. Important assumptions of the

]

model are summarized. Major insights from the IPE are presented.

Strengths of the IPE are as follows. The identification and evaluation of plant specific initiating events is I

thorough compared to some other IPEIPRA studies. The impact of seal failures in recirculation pumps during station blackout was explicitly addressed. The consideration of plant specific HVAC requirements is thorough compared to some other IPElPRA studies.

No major weaknesses of the IPE were identified.

Based on our review, the following modeling assumptions have an impact on the overall CDF:

For ATWS events operators block ADS with probability of 1.0 HPCS can mitigate an Anticipated Transient without Scram (ATWS)

Emergency Core Cooling System (ECCS) pumps can operate above design temperatures Containment failure by overpressurization leads to loss of core cooling equipment due to steam damage to components in the auxiliary building The first two assumptions lower the CDF calculated for ATWS. Since the model assumes that operators always block ADS, the model for ATWS does not address depressurization and the potential difficulty associated with controlling power if low pressure injection systems operate. HPCS injects over the core and can increase reactivity leading to difficulty in controlling power level. The third assumption lowers the CDF by crediting ECCS for continued core cooling with water from the suppression pool even if all containment cooling systems are lost. The fourth assumption increases the CDF by assuming loss of selected core i

cooling systems after caitamment feile a by overpressurization for sequences involving loss of containment cooling.

Significant levelone IPE findings are as follows:

Transients involving station blackout dominate the overall CDF. The CDF from station blackout is dominated by immediate failure of high pressure coolant injection (HPCI) and RCIC.

ATWS is a negligible contributor to the overall CDF; the IPE model assumes that operators always successfully inhibit ADS and that HPCS can be used to mitigate an ATWS even without standby liquid control (St.C) operation.

Internal flooding is a small contributor to the CDF due to the layout of the plant.

31

4

)

i

\\

4. DATA

SUMMARY

SHEETS l

This section of the report provides a summary of information from our review.

)

OveraN CDF The total CDF from internal initiating events was calculated to be 1.55E 5/ year, and the total CDF from internal floodmg was calculated to be 1.75E-8/ year. An update to the IPE crediting physical and procedural changes at River Bend indicates that the revised CDF is 3.55E 6/ year.

Initiatina Event Freauencies

[

i The initiating event frequencies used in the River Band IPE are as foHows:

leitiating Event Fregeeney per Year Large LOCA 1.00E44 intwmediate LOCA 3.00E 04 Smell LOCA 1.00E 03 SmeN-Small LOCA (Recire. pump seal LOCA) 2.0E42 Loss of Offsite Poww Transient 3.50E 02 Tranment with Loss of PCS 1.66 Tranment with PCS Available 2.0 Loss of Feedwatn Transient 0.76 Inadvertent SRV Opening Transient 0.14 Station Blackout Not a separate initiator but a sequence of concern that could result from other f

initiators Lou of DC Division i Transient 6.0E 03 j

Loss of DC Division il Transient 6.0E 03 j

Loss of Normal Service Water Transient 7.6E 03 Loss of Turbine Plant Component Coolms Wata Transient 2.0E 03 Loss of Reactor Plant Component Cooling Watw Transient 2.0E 03 Loss of instrument Air Transient 1.2E 04 Loss of Main Steam Tunnel Cool Transient 0 05 Interfacing Systems LOCA 4.0E43 l

Anticipated Transient Without Scram. Not a separate initiator but a sequence of concern that j

could result from other initiators Dominant initiatina Events Contributina to CDF The CDF by initiating event, as presented in the subnuttal, is as follows:

i r

32 t

1 i

e i

Loss of Offsite Power 90,3%

Loss of Normal Service Water 4.8%

Lou of Feedwater 2.4%

Loss of RPCCW 1.8%

Transient with PCS Available 0.4%

Transient with loss of PCS 0.3%

i Dominant Hardware Failures and Ooerator Errors Contributina to CDF Dominant hardware failures contributing to CDF include: loss of offsite power, failwes of DGs, failures of RCIC, failures of SSW.

Dominant human errors and recovery failures contributing to CDF include: failure to recovw offsite power, failure to restore SSW manual valve V134 aftw test or maintenance, failws to restore SSW manual valve V133 after test or maintenance, failure to establish compensatory cooling to switchgear rooms by opamng I

doors within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after loss of normal HVAC, operator failure to manually depressurize the reactor vessel, and failure to recover feedwater, firewster injection, or the PCS.

j Dominant Accident Classes Contributina to CDF i

The dominant contributors to CDF by accident class are as follows:

Station Blackout 86.0%

Transient 8.4%

' Loss of Offsite Power 4.3%

Transientinduced LOCA 1.5%

The updated IPE results indicate that the contribution of SB0 has been reduced to 4%. Further delineation of the revised contribution to CDF of the various accident classes has not been provided.

'n f: 1 Desia~n Charaderistics important for C0F l

Ability to crosstie standby service water and diesel driven firewster to low Pressure Coolant injection (LPCI) loop B for injection to the vessel Difficulty in using feedwater cros tie for injection during station blackout Containment fan coolers, no containment spray system, and no suppression pool makeup system

)

I Room cooling required for standby electrical switchgear

}

Four hour battery lifetime l

I The impact of these design features on the overall CDF is discussed in Section 1.2 of this report.

i 33

a P

Modifications Four changes were made as a result of areas identified during the course of the level 1 PRA portion of the IPE. One hardware change was made, that being installation of a division 1 SSW return air c,perated valve (ISWP*A0V599) to address loss of SSW cooling water flow to the HPCS DG during station blackout. Three changes to procedures were implemented. (1) Enhanced guidance was developed for mitigating loss of control building ventilation. (2) Two checks per shift were instituted to check the fuel supply to running diesel-powered instrument air compressors. (3) SSW pump lock out during testiny of normd service water (NSW) was eliminated based on the new closed loop configwation of the NSW system.

Other potential changes to the plant are discussed in the submittal. The ability to mitigate station blackout is limited by the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> battery lifetime and the CST inventory. Also, low presswa diesel driven firewster cannot be used after DC power is lost since the SRVs close on loss of power resulting in repressurization of the vessel and the inability to use low pressure injection. Implementation of a portable diesel generator for charging the batteries, in combination with simplifications to the firewster injection lineup, are predicted to lower the overall CDF from 1.55E-5/ year to 3.55E 6/ year with the relative contribution of station blackout decressmg from 86% to 4%. The transnuttal letter to the subnuttal identifies the following changes: provide a 60 kW (minimum) DG onsite for charging 125 V batteries, remove internals in 3 check valves associated with crositie of firewater for injection to the vessel to eliminate this time consummg action for estabhshmg the crosstie (currently-installed manual block valves would be locked closed to perform the function of the check valves), and revise the station blackout procedure to provide for injection of firewster using a different flow path that does not require operation of valves inside containment. The changes described in this paragraph have now been completed. [ submittal Section 6.2.2] [RAI Responses]

The licensee evaluated the decrease in CDF if a large (10 inch diameter) hardened containteent vent were installed. The existing 3 inch vent is too small to prevent containment failure by overpressurization if containment cooling is lost. As discussed previously, the model assumes tint containmsK failure by overpressurization results in the release of steam into the auxiliary building which rendus certain core cooling equipment unavailable. With the addition of a larger vent, the licensee estimates that the overall CDF decreases from 1.55E Slyear to 1.53E Slyear, a small amount. Therefore, installation of a larger hardened containment vent is not being considered further.

Other USilGSis Addressed The licensee proposes to resolve three other safety issues with the IPE, these being: Gl 23 " Reactor Coolant Pump Senl Failures", GI105 " Interfacing System LOCA at LWRs", and USl A 17 " Systems Interactions in Nuclear Power Plants".

Sianificant PRA Findinos Significant level-one IPE findings are as follows:

Transients involving station blackout dominate the overall CDF. The CDF from station blackout is dominated by immediate failure of HPCI and RCIC.

34

. = _.

a i

ATWS is a negligible contributor to the overall CDF; the IPE model assumes a that operators successfully inhibit ADS and that HPCS can be used to mitigate an A1WS.

Internal flooding is a small contributor to the CDF due to the layout of the plant.

I l

l 35

a 1

REFERENCES 4

i l

[GL 88 20]

" Individual Plant Examination For Severe Accident Vulnerabilities 10 CFR 50.54 (f)", Generic letter 88.20, U.S. Nuclear Regulatory Commission, November 23,1988

[lPE Submittal]

River Bond IPE Submittal February 1,1993

[NUREG 1335)

" Individual Plant Examination Submittal Guidance", NUREG 1335, U.

S. Nuclear Regulatory Commission, August,1989 (NUREGICR 4550, Grand Gulf)

NUREGICR 4550, Vol 6, Rev 1, Part 1, Analysis of Core Damage Frequency: Grand Gulf, Unit 1 internal Events

[NUREGICR 4550, Peach Bottom]

NUREGICR 4550, Vol 4, Rev 1, Part 1, Analysis of Core Damage Frequen cy:

Peach

Bottom, Unit 2 Internal Events

[RAI Responses)

Letter from James J, Fisicaro, Entergy Operations Inc., to U.S.

NRC, September 22,1995.

[ Tech Specs)

Technical Specifications for River Bend

[UFSAR)

Updated Final Safety Analysis Report for River Bend 36