ML20134C735
| ML20134C735 | |
| Person / Time | |
|---|---|
| Site: | Wolf Creek  |
| Issue date: | 11/28/1995 |
| From: | Thomas W SCIENCE & ENGINEERING ASSOCIATES, INC. |
| To: | NRC |
| Shared Package | |
| ML20134C737 | List: |
| References | |
| CON-NRC-04-91-066, CON-NRC-4-91-66 SEA-94-2344-010, SEA-94-2344-010-A:3, SEA-94-2344-10, SEA-94-2344-10-A:3, NUDOCS 9609300301 | |
| Download: ML20134C735 (51) | |
Text
-
0 W
l SEA-94 2344-010-A:3 l
November 28,1995 l
Wolf Creek Generating Station Technical Evaluation Report 3
on the Individual Plant Examination Front End Analysis NRC-04-91-066, Task 44 j
Willard Thomas 1
i 4
Science and Engineering Associates, Inc.
Prepared for the Nuclear Regulatory Commission I
.\\
1 \\ d\\J 3
w w
o to o i B o o % D q p.
1
?
s TABLE OF CONTENTS E. EXEC UTIVE S U M M ARY.......................................
1 i
E.1 Plant Characterization...................................
1
{
E.2 Licensee's IPE Process 2
i E.3 Front-End Analysis.....................................
3 4
E.4 G e ne ric iss u e s........................................
5 j
E.5 Vulnerabilities and Plant improvements......................
5 l
E.6 Obse rvations.........................................
7 i
4 4
- 1. I NTR O D U CTI O N............................................
9 l
1.1 Review Proce ss.......................................
9 j
1.2 Plant Characterization...................................
9 l
2.1 Licensee's IPE Process.................................. 11 j
2.1.1.QDmpleteness and Methodology 11
{
2.1.2 Multi-Unit Effects and As-Built. As-Onerated Status........ 11 l
2.1.3 Licensee Particination and Peer Review................ 12 2.2 Accident Sequence Delineation and System Analysis............ 12 2.2.1 Initiatina Events................................. 13 2.2.2 Event Trees.................................... 15 2.2.3 Systems Analysis................................ 17 l
2.2.4 System Denendencias 18 2.3 Quantitative Process.................................... 18 i
2.3.1 Quantification of Accident Seauence Freauencies......... 18
(
2.3.2 Point Estimates and Uncertaintv/ Sensitivity Analvses 19 i
i 2.3.3 Use of Plant-Soecific Data 20 l
2.3.4 Use of Ge ne ric Data.............................. 21 2.3.5 Common-Cause Quantification 22 j
2.4 I nte rfa ce i ss ue s....................................... 24 i
2.4.1 Front-End and Back-End Interfaces................... 24 l
2.4.2 H uman Factors Interfaces.......................... 25 j
2.5 Evaluation of Decay Heat Removal and Other Safety issues....... 26
)
2.5.1 Exa mination of D H R.............................. 27 2.5.2 Diverse Means of DH R............................ 27 i
2.5.3 Unious Features of DHR.......................... 27 2.5.4 Other GSI/USIs Addressed in the Submittal...........
28 l
2.6 Inte mal Flooding....................................... 28 j
2.6.1 Intemal Floodina Methodoloov....................... 28
]
2.6.2 Intemal Floodina Results 29
~
j
' 2.7 Core Damage Sequence Results........................... 30 j
2.7.1 Dominant Core Damage Seouences.................. 30 2.7.2 Vulne rabilitie s................................... 32 4
li d
2
?
2.7.3 Procosed imorove,vgjjf atri,Mo.; fications.............. 33
-3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS 37
- 4. DATA
SUMMARY
SHEETS 39 REFERENCES................................................
45 4
{
\\
\\
i lii l
l
l UST OF TABLES l
l Table 2-1. Plant-Specific Component Failure Data...................... 21 Table 2 2. Generic Component Failure Data.......................... 22 Table 2-3. Comparison of Common-Cause Failure Factors................ 23 Table 2-4. Accident Types and Their Contribution to Core Damage Frequency.. 31 i
Table 2-5. Initiating Events and Their Contribution to Core Damage Frequency. 31 l
Table 2-6. Top 5 Dominant Systemic Core Damage Sequences............ 32 t
i i
l l
l l
l l
l
\\
l i
iv i
}
i i
E. EXECUTIVE
SUMMARY
This report summarizes the results of our review of the front-end portion of the Individual Plant Examination (IPE) for the Wolf Creek Generating Station. This review j
is based on information contained in the IPE submittal [lPE Submittal) along with the licensee's responses [RAI Responses] to a request for additional information (RAI).
l E.1 Plant Characterization i
i The Wolf Creek plant consists of a singie unit pressurized water reactor (PWR) designed and constructed under the Westinghouse Standardized Nuclear Unit Power j
Plant System (SNUPPS) concept. The Callaway plant is also a SNUPPS design, and is a sister plant to Wolf Creek.
Design features at Wolf Creek that impact the core damage frequency (CDF) relative j
to other PWRs are as follows:
f Ability to nerform feed and bleed once-throuah coolina. This design feature lowers the CDF by providing an alternative method of core cooling given i
unavailability of feedwater.
Availability of 4 hiah oressure emeraency core coolina system (ECCS) oumos
=
to orovide reactor coolant system (RCS) inventerv iniection and makeuo flow for l
feed and bleed. The plant has 4 high pressure ECCS pumps, specifically two l
safety injection pumps and two centrifugal charging pumps. This design feature j
tends to decrease the CDF.
i l
Ability to use either of the 2 residual heat removal (RHR) oumos to orovide j
suction sunolv to all 4 hiah oressure ECCS numos durina recirculation. This j
design feature tends to decrease the CDF.
Service water svstem flexibility and redundancv. The plant has dedicated standby essential service water (ESW) pumps that are available to provide backup flow to the ESW headers.. During normal operation, non-essential service water pumps provide flow to the ESW headers. This design feature tends to decrease the CDF.
j Ability to use the ESW system as a source of backuo water sucolv for the auxiliarv feedwater (AFW) system. The ESW system can provide a backup source of AFW suction water supply in the event water from the condensate storage tank (CST) becomes unavailable. This design feature tends to i
decrease the CDF.
1 4
i l
Eloht hour batterv canacity. With credit for load shedding, the batteries can provide power for approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The 8-hour battery lifetime is longer than at some other PWRs. This design feature tends to lower the CDF.
Semi-automatic ECCS switchover. The switchover of RHR pumps from injection to sump recirculation is fully automated. However, the establishment of high pressure recirculation requires manual operator actions to align the suction of the safety injection and/or charging pumps to the discharge of the RHR pumps. This design feature tends to increase the CDF over what it would otherwise be with a fully automatic system.
Non-aunlified reactor coolant numo (RCP) seals. Wolf Creek does not utilize high temperature qualified RCP seal package O-rings recently made available by Westinghouse. The licensee is considering the installation of these improved 0-rings. The use of non-qualified RCP seals at Wolf Creek tends to increase the CDF over what it would otherwise be with qualified seals.
Containment fan cooler units. The plant has 4 fan cooler units that provide a means of performing containment cooling that is independent of the containment spray system. However, because the IPE assumed that containment cooling is not required to support core cooling, the availability of the fan cooler units does not impact the CDF.
E.2 Licensee's IPE Process The licensee developed a Level 2 probabilistic risk assessment (PRA) in response to the request of Generic Letter 88 20. The majority of the IPE work was done in-house.
Support from unnamed consultants / contractors was also utilized.
Plant walkdowns were used to support the IPE analysis. Major documentation used in the IPE included: the Updated Final. Safety Analysis Report (UFSAR), system descriptions, piping and electrical diagrams, normal and emergency procedures, licensee event reports (LERs), and Technical Specifications.
i The licensee's Nuclear Safety Engineering (NSE) group performed an independent review of the Wolf Creek IPE. The Union Electric Callaway IPE team also performed a review of the Wolf Creek IPE and its results. In addition, Westinghouse personnel 1
were involved in some aspects of the review process.
1 The licensee intends to use the PRA as a risk-based and decision optimization tool to aid in the continuation and enhancement of safe, reliable, and efficient plant operation.
However, we could find no specific statement in the submittal indicating that the licensee plans to maintain a "living" PRA.
2
i i
The IPE does not represent the as-built plant as of the IPE freeze date. Due to a I
misunderstanding by PRA analysts, the IPE took credit for a modification that will not i
be implemented until 1997, specifically the ability to bypass feedwater isolation dunng i
any accident condition. If this feedwater isolation bypass capability had not been 1
credited in the IPE, the CDF would increase at most by approximately 18.8% (from l
4.2E-05/yr' to 5.0E-05/yr).
i E.3 Front-End Analysis The methodology chosen for the Wolf Creek IPE front-end analysis was a Level 1 PRA. The small event tree /large fault-tree technique with fault tree linking was used to quantify core damage sequences. The success criteria are based on the UFSAR and
, Modular Accident Analysis Program (MAAP) calculations. The success criteria are generally consistent with success criteria used in other PWR IPE/PRA studies.
The IPE quantified 13 initiating events exclusive of intemal flooding: 6 loss of coolant accidents (LOCAs), including steam generator tube rupture (SGTR) and interfacing systems LOCA (ISLOCA); 4 generic translents including loss of offsite power (LOSP);
and 3 special initiating events representing support systems. - Four initiating events appear to have been considered in the flooding analysis.
Plant-specific data were used to support the development of component failure rates and test / maintenance unavailabilities, if a shortage of plant-specific data existed, generic values were utilized as either the actual failure rates or as the prior i
distributions for Bayesian updates. Plant data were also used where possible to
)
quantify initiating events.
The Multiple Greek Letter (MGL) method was used to model common cause failures.
Common cause events were added to the fault tree models.
The flooding analysis considered both submergence and spray effects. The flooding analysis used 3 event tree models to represent various flooding sequences. The Westinghouse WALT code was used for flooding-related core damage quantification.
The total point estimate CDF for Wolf Creek is 4.2E-05/yr, including internal flooding.:
'As used here and in other portions of this report, the term 'yr* refers to reactor-year.
The licensee states that some of the flooding scenarios included in the submittal were identified late in the analysis process and were addressed, due to time constraints, in a " conservative" manner.
In a more refined assessment of intemal flooding performed subsequent to completion of the submittal, the total CDF was reduced to approximately 3.7E-05/yr due to a reduction of the internal flooding contribution.
3 i
The internal initiating events that contribute most to the CDF and their percent contribution are listed below:8 LOSP I ' ~ ' e hi -
57 %
Control Bldg. Switchgear Room Flood 11 %
Loss of all Service Water (SW) 6.4%
Recoverable Control Bldg. Basement Flood 5.2%
Loss of Operating Component Cooling Water (CCW) Train 5.2%
Medium LOCA 4.4%
Large LOCA 3.3%
Non recoverable Control Bldg. Basement Flood 2.1 %
Small LOCA 1.6%
SGTR 1.5%
Core damage contributions by accident type are listed below:
Station Blackout 45%
Internal Flood 18%'
Transient (including LOSP) 13%
Special Initiators 13%
LOCAs 10%
SGTR 1.5%
ISLOCA 0.15%
Anticipated Transient Without Scram (ATWS) 0.08%
The most important non-initiating event' contributors to CDF are (in order):
AC power is not recovered within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after a station blackout Turbine-driven AFW pump falls to start and run during a station blackout Diesel generator NE01 fails to start and run Turbine-driven AFW pump fails to start and run High pressure safety injection (SI) restoration falls after station blackout, SW or CCW falls Operator failure to provide RCP seal cooling in a timely manner Diesel generator NE02 fails to start and run Diesel generator NE01 unavailable due to test or maintenance 8A complete list of initiating event CDF contributors is provided in Table 3.4 2 of the submittal, d As previously noted a refined assessment of intemal flooding was performed. Results from this refined assessment indicate that internal flooding represents approximately 5-6% of the CDF.
4
e E.4 Generic issues The licensee specifically addressed decay heat removal (DHR) and its contribution to CDF. It was shown that several high reliable systems and operator actions would have to failin combination to have an impact on the DHR removal capability. The IPE goes beyond the A-45 definition of DHR by including heat removal during large LOCA events.
1 The licensee identified the dominant CDF cutsets related to loss of DHR with freq'uencies greater than 1E-07/yr. Only two cut sets in this category were identified.
These cut sets involve operator failure to accomplish ECCS switchover following medium or large LOCA initiating events. Together, these cut sets represent a CDF contribution of 1.0E 06/yr, which is less than 3% of the total plant CDF.
I Based on the above findings, the licensee did not further explore cost-effective improvements to the DHR systems. The licensee concluded that there are no significant vulnerabilities for the DHR function.
The submittal states that Unresolved Safety issue (USl) A-17, " Systems interactions in Nuclear Power Plants," was resolved in conjunction with the IPE. The resolution of USl A-17 is based on the IPE finding that no significant hazards are associated with the flooding analysis.
E.5 Vulnerabilities and Plant improvements The licensee adopted Closure Guidelines from the Nuclear Management and Resource Council (NUMARC) to evaluate the PRA results and to identify insights related to severe accidents. The licensee concluded that there are no vulnerabilities at Wolf Creek.
The licensee identified several plant enhancements. The proposed plant improvements, their current status and CDF impact (if available) are summarized below:
Installation of hiah temoerature cualified RCP seal 0-rinas. The licensee is i
currently monitoring industry experience with specially qualified 0-rings and has j
i not yet made a final decision with regard to utilization of the new O-rings at Wolf Creek. If the new O-rings are installed, the installation would occur during the tenth refueling outage (early 1999). New O-rings would reduce the total CDF by approximately 13% (from 4.2E-05/yr to 3.7E-05/yr). The IPE did not take credit for this modification.
Reolacement of the oositive disolacement charoina oumo. The existing positive displacement charging pump will be replaced during 1996 by the addition of a third centrifugal charging pump. If the new pump can be shown to be 5
i 4
independent of cooling water support systems, the CDF will be reduced by approximately 12 -14% (from 4.2E-05/yr to 3.6E-05/yr). If independence from j
cooling water systems cannot be demonstrated, the CDF reduction will not be j
significant. The IPE did not take credit for this modification.
i j
Provide a switch to bvoass feedwater isolation in order to restore main
=
feedwater. Without such a switch, operators have to manually litt leads and j
install jumpers, a relatively time-consuming process. A switch was installed in 4
March 1993 that allows bypass of feedwater isolation for only for a limited set of-conditions. Because of a misunderstanding of the planned scope of the March 1993 modification, the IPE credited bypass of feedwater isolation for all conditions. A modification planned for 1997 will provide the capability to bypass i
feedwater isolation for all conditions. If feedwater isolation bypass capability j
had not been credited in the IPE, the CDF would increase at most by approximately 18.8% (from 4.2E-05/yr to 5.0E-05/yr).
i Enhance emeroencv orocedures to directiv address total loss of CCW and SW.
^
i The emergency procedures have been modified to specifically address loss of l
CCW or service water. These procedures include guidance for providing
]
alternate cooling to the lube oil coolers for the centrifugal and safety injection, which are normally cooled by CCW.~ The licensee states that the IPE did not
}
take credit for this modification.' The CDF would be reduced by approximately i
7.3% (from 4.2E-05/yr to 3.9E-05/yr) if credit had been taken in the IPE for
)
j procedural guidance related to total loss of CCW or service water.
i i
Develonment of ceneric Accident Manaaement ouldelines. Generic I
=
Westinghouse Severe Accident Management (SAM) Guidelines were issued in June 1994. The licensee intends to complete an assessment of SAM l
capabilities and make any identified enhancements by September 30,1997.
j 1mprovements associated with the SAM program were not credited in the IPE.
Many of the SAM guidelines address plant conditions were core damage has l
occurred, and for these cases the CDF would not be impacted.
Also as a renuit of the IPE, the licensee initiated work on two special studies. These j
special studias are summarized below.
i j
Evaluate eautoment deoendence on room coolina. The interconnecting design i
of rooms containing ECCS equipment is such that cooling provided by one l
pump room cooler may be adequate to support the operation of more l
equipment than just the associated ECCS pump. An engineering evaluation is j
ongoing to identify those room coolers that may support operation of more than l
'However, it appears that credit was taken for an action associated with these procedures, specifically an operator inhibit / trip of high head safety injection pumps to preclude their failure on loss of ESW/CCW j-cooling.
[
6 4
I
,.v-v
i 4
one ECCS pump. It is planned that this evaluation will M completed by i
December 31,1995. No estimates of CDF impact have een performed to 1
date. The IPE assumed that successful operation of an ECCS pump would require cooling from its associated room cooler.
l 1
Reanalvsis of intamal floodina events. As reported in the submittal, internal j.
flooding represents about 18% of the overall CDF. Some of the flooding scenarios included in the submittal were identified late in the IPE process and were addressed, due to time constraints, in a " conservative" manner. A reanalysis of intemal flooding was made to make a more realistic assessment j
of flood-related scenarios. The reanalysis predicts a reduction in the total CDF j
of approximately 13% (from 4.2E-05/yr to 3.7E-05/yr).
1 i
The one Station Blackout Rule activity specifically credited in the analysis was the i
shedding of selected DC loads to extend battery life. This load shedding activity is expected to extend battery life from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Without credit for load shedding, the CDF would increase by about 12% (from 4.2E-05/yr to 4.9E-05/yr).
E.6 Observations t
4 The licensee has committed to reanalyzing the HRA portion of the WCGS IPE in order j-to eliminate deficiencies in the existing HRA method. It is expected that the reanalysis i
will result in significant changes in the human error probabilities. In turn, these will i
result in significant changes in the frequencies of accident sequences, both in an absolute and a relative sense. Therefore, the results contained in the present i
submittal cannot be relied upon as representing the risk perspective expected from the l
licensee's future reanalysis.
i Strengths of the IPE are as follows: The evaluation and identification of HVAC-related initiating events is more thorough than corresponding analyses in some other IPE/PRA studies.
Two weaknesses of the IPE were identified,~one associated with the treatment of common cause failures and the other associated with the use of plant-specific component failure data. These two weaknesses are summarized below.
The licensee has used common cause factors that are generally an order of magnitude lower than corresponding generic data. In deriving these estimates, the licensee has selectively used data from an EPRI common cause database by excluding events judged not applicable to Wolf Creek. In our opinion, the licensee has not provided enough supporting information to demonstrate that the IPE common cause failure data reflect the Wolf Creek plant. It is also not clear that the licensee has properly performed the reported common cause sensitivity analyses, if these sensitivity analyses represent a simple re-quantification of cut set probabilities in the baseline CDF equation (rather than a 7
j
)
complete re-quantification of the accident sequences), the CDF impact of increased common cause unavailability data may be significantly i
underestimated. In summary, we do not have a sufficient basis to conclude that the use of relatively low common cause failure data for important components (such as motor-operated valves, diesel generators, and pumps) supports the 3
t identification of vulnerabilities or the most likely severe accidents.
The number of component types included in the development of plant-specific failure rates is more limited than in some other IPE/PRA studies.
Significant level-one IPE findings are as follows:
}
Station blackout is a relatively large contributor to CDF, as is the case in a number of other PWR IPE/PRA studies. Important contributors to station blackout CDF include failure of the turbine-driven AFW pump due to battery
[
depletion and an unmitigated RCP seal LOCA.
The IPE does not represent the existing as-built plant as of the IPE freeze date.
Due to a misunderstanding by PRA analysts, the IPE took credit for a i
modification that will not be implemented until 1997, specifically the ability to l
bypass feedwater isolation during any accident condition. If this feedwater i
isolation bypass capability had not been credited in the IPE, the CDF_ would increase at most by approximately 18.8% (from 4.2E-05/yr to 5.0E-05/yr).
1
{
' ATWS is a relatively small contributor to CDF. The relatively small ATWS e
i contribution appears to be due to the following: (1) credit taken for local-manual I
actions outside the control room to open circuit breakers to remove power from j
the control rod drive motor generator sets, and (2) apparent credit for the i
possibility of successful ATWS mitigation throughout all portions of the core cycle (a dominant ATWS sequence in some other PWR IPE/PRA studies involves the inability to mitigate an ATWS event during some portion of the early-in-life core cycle due to an unfavorable moderator temperature coefficient).
l l
.f 4
o I
j
- 1. INTRODUCTION 1
1.1 Review Process This report summarizes the results of our review of the front-end portion of the IPE for Wolf Creek. This review is based on information contained in the IPE submittal [lPE Submittal) along with the licensee's responses [RAI Responses) to a request for l
additional information (RAI).
1.2 Plant Charactertration i
i The Wolf Creek plant consists of a single unit PWR designed and constructed under the Westinghouse Standardized Nuclear Unit Power Plant System (SNUPPS) concept.
]
Bechtel provided the architect / engineer (AE) services. Wolf Creek is located in Kansas, approximately 75 miles southwest of Kansas City, Kansas. The plant power ratings are 3,565 megawatts thermal (MWt) and 1,214 gross megawatts electric i
(MWe). The Callaway plant is also a SNUPPS design, and is a sister plant to Wolf Creek. [p. 5-1 of submittal]
{
Design features at Wolf Creek that impact the core damage frequency (CDF) relative to other PWRs are as follows: [p.17 of RAI Responses, pp. 3-47, 3-91, 3-93, 3-96, 3-i 146,'3-172,3-190,6-1 of submittal]
Ability to nerform feed and bleed once-throuah coolina. This design feature lowers the CDF by providing an alternative method of core cooling given
)
unavailability of feedwater.
l Availability of 4 hiah oressure emeroency core coolina system (ECCS) oumos to orovide reactor coolant system (RCS) inventorv inlection and makeuo flow for feed and bleed. The plant has 4 high pressure ECCS pumps, specifically two i
safety injection pumps and two centrifugal charging pumps. This design feature tends to decrease the CDF.
i i
Ability to use either of the 2 residual heat removal (RHR) oumos to orovide suction sunolv to all 4 hiah oressure ECCS oumos durino recirculation. This
{
design feature tends to decrease the CDF.
Service water system flexibility and redundancv. The plant has dedicated j
standby essential service water (ESW) pumps that are available to provide i
backup flow to the ESW headers. During normal operation, non-essential service water pumps provide flow to the ESW headers. This design feature tends to decrease the CDF.
Ability to use the ESW system as a source of backuo water sucolv for the auxiliarv feedwater (AFW) system. The ESW system can provide a backup i
i j
9
.o
4 source of AFW suction water supply in the event water from the condensate I
storage tank (CST) becomes unavailable. This design feature tends to j
decrease the CDF.
i Elaht hour batterv canacitv. With credit for load shedding, the batteries can provide power for approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> battery lifetime is longer than at some other PWRs. This design feature tends to lower the CDF.
Semi-automatic ECCS switchover. The switchover of RHR pumps from injection to sump recirculation is fully automated. However, the establishment of high pressure recirculation requires manual operator actions to align the suction of the safety injection and/or charging pumps to the discharge of the RHR pumps. This design feature tends to increase the CDF over what it would otherwise be with a fully automatic system.
Non-oualified reactor coolant oumo (RCP) seals. Wolf Creek does not utilize high temperature qualified RCP seal package O-rings recently made available by Westinghouse. The licensee is considering the installation of these improved 0-rings. The use of non-qualified RCP seals at Wolf Creek tends to increase the CDF over what it would otherwise be with qualified seals.
Containment fan cooler units. The plant has 4 fan cooler units that provide a means of performing containment cooling that is independent of the containment spray system. However, because the IPE assumed that containment cooling is not required to support core cooling, the availability of the fan cooler units does not impact the CDF.
10
4
- 2. TECHNICAL REVIEW 2.1 Licensee's IPE Process
{
We reviewed the process used by the licensee with respect to: completeness and i
methodology; multi-unit effects and as-built, as operated status; and licensee participation and peer review.
2.1.1 Comoleteness and Methodoloav.
j The submittal is complete with respect to the type of information requested by Generic 4
Letter 88 20 and NUREG 1335.
The front-end portion of the IPE is a Level 1 PRA. The specific technique used for the Level 1 PRA was a small event tree /large fault tree technique with fault tree linking.
[pp.1-3, 3-57, 3-117 of submittal) i Intemalinitiating events and intemal flooding were considered. Support systems were i
modeled with fault trees and linked with the appropriate frontline system fault trees.
An importance anaiysis was performed and described in the submittal. Sensitivity analyses were performed for the front-end portion of the analysis.
2.1.2 Multi-Unit Effects and As-Built. As-Onerated Status.
The Wolf Creek plant is a single unit site; therefore, multi-unit considerations do not apply to this plant.
The IPE team used the current revisions of drawings, design documents, and plant procedures. Specific information sources used in the analysis includes: the UFSAR, Wolf Creek system descriptions, piping and electrical diagrams, normal operating procedures, off normal procedures, emergency procedures, Wolf Creek Licensee Event Reports (LERs), Technical Specifications, and surveillance test procedures.
Plant walkdowns were also conducted to support the IPE analysis. Plant specific data were used to support the quantification of component unavailabilities and initiating events. The IPE human reliabliity analysts studied appropriate plant procedures and discussed these actions with operators. [pp. 2-6, 2-7, 2-9, 3-1, 3-120, 3-121 of submittal)
The freeze date of the analysis is stated to be the end of 1991. However, as further described in Section 2.7.3 of this report, the IPE took credit for a modification that will j
not be implemented until 1997. This modification involves the installation of a switch to bypass feedwater isolati n during any accident condition. The IPE erroneously credited this rnodification due to a misunderstanding by PRA analysts. If feedwater innlaer, bypass capability had not been credited in the IPE, the CDF would increase 11
~
_ __ ~ _ _.
at most by approximately 18.8% (from 4.2E-05/yr to 5.0E-05/yr). [pp. 2,12,13 of RAI Responses) 2.1.3 Licensee Particloation and Peer Review.
A permanently assigned staff of licensee personnel was involved in all aspects of the IPE. Other licensee personnel were involved in various aspects of the evaluation as needed. Support from unnamed consultants / contractors was also utilized. The submittal states that licensee staff members have been trained in those portions of the analysis performed by the outside consultants. The majority of the IPE work was done in-house. [pp. 1 -2, 2-1, 2-3, 5-1, 5-2, 7-1 of submittal]
The licensee's Nuclear Safety Engineering (NSE) group performed an independent review of the Wolf Creek IPE. The NSE group reports to the Chairman of the Wolf Creek Nuclear Safety Review Committee (NSRC) and is responsible for safety audits / surveillance of the plant and other tasks as assigned by the NSRC. The submittal does not state the number of NSE individuals involved in the independent review process. However, the NSE engineers involved in the review are stated to have 73 combined years of engineering experience, including 67 years experience related to the nuclear field and 41 ysers experience at the Wolf Creek plant. [pp. 5-1 of submittal]
The Union Electric Callaway IPE team also performed a review of the Wolf Creek IPE and its results. As previously noted, Wolf Creek and Callaway are sister plants. In addition, Westinghouse personnel were involved in some aspects of the review process. [p. 5-1 of submittal]
The submittal provides three examples of major review comments and their corresponding resolutions. [p. 5-1 of submittal]
The licensee intends to use the PRA as a risk-based and decision optimization tool to aid in the continuation and enhancement of safe, reliable, and efficient plant operation.
However, we could find no specific statement in the submittal indicating licensee plans to maintain a "living" PRA. [pp.1-1,7-2 of submittal]
j 2.2 Accident Sequence Delineation and System Analysis This section of the report documents our review of both the accident sequence delineation and the evaluation of system performance and system dependencies provided in the submittal.
12
2.2.1 initiatina Events.
The selection of initiating events was made from the collection and analysis of plant trip data, supplemented by reviews of previous analyses for similar plants. Wolf Creek trip data were collected from LERs. [pp. 2-3,3-1 of submittal]
The initiating events modeled in the IPE include transients, LOCAs, and special initiators. The initiating events included in the analysis are listed below: [pp. 3-1, 3-138 of submittal]
Generic Transients:
LOSP Transient with power conversion system (PCS) available Transient without PCS availabic Steamline/Feedline break Special initiators:
Loss of component cooling water Loss of all service water Loss of a vital DC bus LOCAs:
Large LOCA (6' or greater)
Medium LOCA (2' to 6')
Small LOCA (3/8" to 2')
SGTR ISLOCA Reactor vessel failure Internal Flooding:
4 separate initiating events The submittal also lists station blackout and ATWS as " initiating events". However, station blackout and ATWS are not initiating events, but instead represent post-initiator plant conditions. As later discussed in Section 2.2.2 of this report, the IPE did in fact j
consider station blackout and ATWS in special event trees as post initiator plant i
conditions. [pp. 3-1,3-35 to 3-37,3-47 to 3-56 of submittal]
The loss of a major non-vital AC bus will cause a plant trip, as important non-safety equipment items will be lost. Loss of a major non-vital AC bus was assumed to result in the loss of main feedwater, and is accounted for in the quantification of the
-" Transient Without PCS Available" initiating event. Loss of a vital AC bus was not included in the IPE as an initiating event, as the licensee determined that such an event would not result in a plant trip. [pp. 2,3 of RAI Responses)
Loss of an Individual DC bus was modeled as an initiating event. While the IPE does not also model complete loss of DC as an initiating event, the logic models account for accidents initiated by loss of an individual DC bus, with subsequent loss of the 13 i
1 I
4 i
remaining DC bus durir'g the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> accident mission time. This type of accident scenario was assumed to lead to core damage. [pp. 2,3 of RAI Responses]
l it was determined that a sustained loss of instrument air could lead to a reactor trip i
with a loss of main feedwater condition. The possibility of loss of instrument air was j
included in the quantification of the " Transient Without PCS Available" initiating event.
[pp. 2,3 of RAI Responses) l The IPE does not include a separate category of initiating events representing loss of j
HVAC. However, the licensee did evaluate HVAC-induced plant trips. Failure of cooling to a DC switchgear room was postulated to result in loss of the associated DC j
bus and a plant trip. Failure of DC switchgear room cooling was included in the
)
j' quantification for the " Loss of a vital DC bus" initiating event. Loss of HVAC to the j
room containing the motor-generator sets could result in a plant trip, but would not
'l-impact the function of other essential plant equipment. Failure of motor-generator room HVAC was included in the quantification of the " Transient With PCS Available" i
initiating event. Failure of main steam system or turbine building HVAC units may l
lead to a plant trip and loss of main feedwater. These types of HVAC failure were accounted for in the quantification of the " Transient Without PCS Available" initiating event. [pp. 2 to 4 of RAI Responses) i The following types of ISLOCA were considered in the analysis:
i l
sl RHR pump suction isolation valves (shutdown cooling path) l RHR pump cold leg injection paths Safety injection pump cold leg injection paths j
RHR pump hot leg recirculation paths l
Safety injection pump hot leg recirculation paths.
j All of the above potential ISLOCA paths involve a transition from high to low pressure piping. Overpressurization of the low pressure portion of the interfacing system was postulated to result in an ISLOCA. No specific determination was made as to whether I
the ISLOCA in the low pressure portion of the system was due to piping failures,
)
gasket failure, or pump / valve seal failure. [pp. 4 to 6 of RAI Responses]
Where possible, transient events were quantified from Wolf Creek plant experience.
j For this activity, the IPE used a data collection period from initial plant startup (May l
1985) through December 1990. The frequency of SGTR was estimated from the l
Westinghouse plant population experience data base through 1989. The frequency of l
LOSP was estimated from EPRI data [NSAC 147) and Wolf Creek /NUMARC station blackout work [NUMARC 87 00), and includes Wolf Creek-specific estimates for j
~ severe weather effects. Steamline/feedline breaks and vessel rupture were quantified from unspecified industry sources. Data for the small, medium, and large break LOCAs were extracted from NUREG/CR-4550. The generic estimate for small LOCAs was modified to include a failed-open power-operated relief valve (PORV) and random i
4 14 I
e 0
3 failure of an RCP seal, while the estimate for medium LOCAs was modified to include l
a failed-open safety valve. Quantitative analyses of Wolf Creek systems were used to derive the frequency estimates for loss of CCW, loss of service water, and loss of a DC bus. Data from NUREG-0677 were used to quantify the frequency of an ISLOCA i
4 (assumed to be unisolable). Sources of data used to quantify initiating events for intemal flooding were not identified. [p. 2 of RAI Responses, pp. 2-4,2-10,3-1, 3 2, 3-19, 3-23, 3-26, 5-1 of submittal]
4 i
The quantification of the initiating events is generally consistent with other PWR i
IPE/PRA studies. A list of initiating event frequencies is provided in Subsection 4 of this report. [p. 3-1 of submittal) 4 i
2.2.2 Event Trees, a
l The following event trees were used in the analysis: [pp. 3-2 to 3 56 of submittal]
Trans! ant with PCS available Transient without PCS available Steamline/feedline break LOSP ATWS SGTR j
Loss of component cooling water Loss of service water j
Loss of a vital DC bus Station blackout l
Srall i OCA 1
A core damage logic diagram was developed to categorize all initiating events for i
coupling into the event tree models. The core damage logic diagram included various j
initiating event categories grouped according to their expected systemic response required to maintain short-term and long-term cooling. [pp. 3-1,3-3 to 3-6 of submittal)
The success criteria are based on the UFSAR and Modular Accident Analysis Program (MAAP) calculations. The mission time of the front-end analysis is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
The back-end analysis has a mission time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. [pp. 3-7 to 3-16,3-160,4-44 of submittal]
The submittal has used two terms, core damage frequency (CDF) and core melt frequency (CMF), to describe the front-end results. While these terms are used interchangeably, it appears that the licensee is actually referring to CDF. Core damage is stated to occur once oxidation of the Zircaloy fuel cladding begins; 15
)
J however, the temperature at which this is assumed to occur is not stated. [p. 4-19 of submittal)
The submittal provides a brief description of the RCP seal LOCA model. It was assumed that failure to stop running RCPs within 10 minutes after a loss of all seal cooling will result in seal damage to such an extent that an RCP seal LOCA of medium LOCA magnitude occurs. Loss of all seal cooling would involve both the loss of CCW to the RCP thermal barriers and loss of seat injection from the chemical and volume control system (CVCS). The IPE seal LOCA model further assumes that j
reco'very of either method of seal cooling within 30 minutes will prevent an RCP seal LOCA provided any running RCPs are stopped within 10 minutes after loss of seal cooling. The submittal does not provide the basis for the RCP seal LOCA model. [pp.
3-39,3-179 of submittal]
)
Like some other PWR IPEs, the Wolf Creek IPE assumes that if high pressure injection falls during a small or medium LOCA, the primary system can be depressurized via the secondary system so that the accident can be mitigated with the low pressure injection system. [pp. 3-13, 3-14, 3-19, 3-22 to 3-24, 3-70, 3-96 of j
submittal]
In the IPE model, containment cooling is not required to support core cooling. To support this aspect of the IPE, the licensee specifically considered net positive suction I
head (NPSH) requirements and temperature operability limits for ECCS pumps.
MAAP analyses showed that NPSH limits for the RHR pumps would not be exceeded even if the sump water is saturated.' In the absence of containment heat removal, the temperature of the sump water would not exceed 354 deg. F, which is the fluid i
saturation temperature at the mean containment failure pressure of 142 psia. The RHR critical mechanical components have temperature ratings from 450 deg. F to 1,000 deg. F, and thus RHR pump survivability would not be jeopardized from high sump water temperatures. [pp.19 to 22 of RAI Responses]
s The IPE does not take credit for the mitigation of an ISLOCA. Therefore, an ISLOCA event tree is not provided. (p. 3-26 of submittal) i i
The ATWS event tree modal does not distinguish between mechanical and electrical failures of the scram function. The model credits two operator actions to trip the reactor following failure to scram, specifically: the insertion of control rods from the control room, and local-manual actions outside the control room to open circuit breakers to remove power from the control rod drive motor generator sets. The latter operator action is not typically credited in IPE/PRA studies because of the short time available for success. The Wolf Creek analysis assumed that 2 minutes would be available to successfully perform this operator action, which is represented by event
'MRT"in Figure 3.1-10 and Table 3.3-4 of the submittal. Credit for this local-manual
- This result is consistent with inforrnation contained in the UFSAR. [pp. 6.2 52,6.3-15 of UFSAF.]
i 16 4
._ ~ _.~
c i
action outside the control room lowers the CDF for the two dominant A'IWS l
sequences by a factor of 6. [pp. 3-12,3-35 to 3-37,3-146 of submittal]
}
l The IPE ATWS model appears to credit the possibility of successful ATWS mitigation during all portions of the fuel cycle. This aspect of the modeling process may be due l
to an analysis assumption or plant safety / relief vaWes that are sized to provide sufficient ATWS relief capacity during the entire fuel cycic.
i Finally, the IPE does not take credit for emergency boration for ATWS mitigation. The i
licensee states that emergency boration is too slow to prevent RCS pressurization for limiting ATWS events. [p. 3-35 of submittal) i 2.2.3 Svstems Analysis.
i I
Systems descriptions are included in Section 3.2 of the submittal. The system descriptions provide information on: system interfaces, system inter-dependencies, modeling assumptions, operator actions, and system interfaces. The system descriptions also contain simplified schematics that show major equipment items and important flow and configuration information. A total of 13 systems are described, including ECCS, electrical power, essential service water, and component cooling water. There is no description of the instrument air system. [pp. 3 61 to 3-114 of submittal]
Wolf Creek has 2 main 67% capacity turbine-driven main feedwater pumps, and a motor driven startup pump having a capacity sufficient to satisfy feedwater requirements up to about 2% power. The two turbine-driven main feedwater pumps will not be available during transients involving main steam isolation or loss of the condenser. [p. 3-106 of submittal]
The RCP seals are cooled via two separate methods, specifically with seal injection provided by the CVCS and thermal barrier cooling provided by the CCW system. The CCW system also provides cooling to the charging and safety injection pumps. The ESW system provides cooling for the CCW system. Therefore, loss of CCW or ESW results in loss of both methods of seal cooling and loss of high pressure primary system makeup. The CCW system also provides cooling to the RHR mechanical seal coolers. However, per information from the NSSS supplier, the RHR pumps can be operated without CCW cooling in either the injection or recirculation modes. [pp. 3-38, 3 68, 3-70, 4-47 of submittal)
There are two HVAC units serving cl, ass 1E electrical equipment. Each unit provides cooling to one set of engineered safety features (ESF) switchgear, DC battery, and DC switchboard rooms. These HVAC units are provided with flow from the ESW system.
The IPE assumed that failure of HVAC would lead to a consequential failure of the associated ESF battery charges and 120 VAC inverters because of high temperatures.
Consequently, these HVAC units were modeled as a support system for the ESF 125 17
3 i
VDC and 120 VAC power systems. ESW supports room cooling for other equipment i
items, including the ECCS pumps, AFW pumps, CCW pumps, air compressors, and l
control room equipment. [pp. 3-87 to 3-89 of submittal, Table 9.2 3 of UFSAR) j 2.2.4 Svstem Denendencies, i
Dependency matrices are provided in Tables 3.2-3 and 3.2-4 of the submittal. These i
two tables display, respectively, the following dependency relationships: [p. 3-118 of j
i submittal]
Front-line system to support system l
{
Support system to support system.
The support systems listed in these matrices include AC power, DC power, CCW, and emergency service water. However, instrument air is not included. Per Subsection l
3.2.1.1 of the submittal, air-operated control valves are used to regulate flow from the turbine driven AFW pump to each associated steam generator. It may be the case that the PORVs and other equipment items modeled in the IPE also require instrument i
air. it is possible that the licensee has omitted instrument air dependencies from the IPE models, and thus may have underestimated the CDF. However, it is noted that I
other IPE/PRA studies generally have not found instrument air failures to represent i
significant contributors to CDF. [pp. 3-65,3-118 of submittal) 2.3 Quantitative Process This section of the report summarizes'our review of the process by which the IPE
. quantified core damage accident sequences. It also-summarizes our review of the data base, including consideration given to plant-specific data, in the IPE. The uncertainty and/or sensitivity analyses that were performed were also reviewed.
i 2.3.1 Quantification of Accident Seauence Freauencies, i
The IPE used the small event tree /large fault-tree technique with fault tree linking to j
quantify core damage sequences. Fault tree models were developed for systems depicted in the event tree top logic and their support systems. The event trees include i
both functional and systemic headings. The Westinghouse GRAFTER code system i
was used to develop and quantify the fault trees. The accident sequence j
quantification was performed with the Westinghouse WLINK code system. Accident i
sequence cut sets were developed to the level of specific failures or basic events.
l The core damage sequences for each initiating event and majority of individual fault trees were truncated at a probability of 1.0E-15 up to a maximum of 5,000 cut sets.
l The total core damage cut set file which reflects the overall CDF is based on the top l'
10,000 core damage cut sets. -[p.18 of RAI Responses, pp. 2-4, 2-5, 3-57, 3-116, 3-i 117, 3-148, 3-149, 7-1 of submittal)
I 18 i
f
O The IPE has taken some credit for recovery of component failures. For example, credit was taken for the recovery of components in a sequence initiated by loss of service water, though the specific components involved in this recovery are not identified. The recovery data for this loss of service water sequence were developed based on input from licensee staff. Credit was also taken for recovery of diesel generators in various sequences. The source of the diesel generator recovery data is not explicitly stated. [pp. 3-135, 3-136, 3-177, 3-186 of submittal)
Credit was also taken for recovery of offsite power. The IPE offsite power non-recovery data appear to be approximately 2 times lower (more optimistic) than average industry experience reported in an EPRI sponsored study [NSAC 147). The basis for the IPE offsite power non-recovery data is not provided. [pp. 3-135, 3-136, 3-138, 3-152 of submittal) 2.3.2 Point Estimates and Uncertaintv/Sensitivitv Analvses.
The submittal does not generally state the statistical significance of the initiating event data, event tree data, and fault tree basic events. However, failure data for some of the fault tree basic events are based on mean value data provided in generic sources, for example NUREG/CR-4550. The overall CDF is presented in terms of a point value. No statistical uncertainty analysis of the results was performed. [pp. 3-122 to 3-138 of submittal)
The licensee provided results from several types sensitivity analysis. These sensitivity analyses are summarized below.
In one sensitivity analysis, the licensee investigated the impact of including recent (post-IPE) plant-specific reliability data for the turbine-driven AFW pump. If the more recent plant reliability data for the turbine driven AFW pump are included in the analysis (through August 1994), the CDF increases by approximately 6.9% (from 4.2E-05/yr to 4.5E-05/yr). [pp.18,19 of RAI Responses) in another sensitivity analysis, the base case common cause failure probabilities were (1) increased by a factor of three, (2) increased by a factor of five, and (3) reduced by a factor of one-half. The corresponding impacts on CDF were: (1) a 7.8% increase (from 4.2E-05/yr to 4.5E-05/yr), (2) a 15.7% increase (from 4.2E 05/yr to 4.'
-05/yr),
t and (3) a 2% decrease (from 4.2E-05/yr to 4.1E-05/yr). [p. 8 of RAI Responses)
The remainder of the sensitivity analyses are related to CDF impacts from plant modifications, and are further described in Section 2.7.3 of this report. (p.18,19 of RAI Responses]
l l
}
19 i
..- -. -. ~.
i 4
2 2.3.3 Use of Plant-Soecific Data.
)
Plant-specific data were used to support the development of component failure rates and test / maintenance unavailabilities, if a shortage of plant-specific data existed, generic values were utilized as either the actual failure rates or as the prior 4
i distributions for Bayesian updates. [pp. 3-119 to 3-121 of submittal)
}
Plant data were used to derive failure rates for the following types of components:
l motor-driven pumps, the turbine-driven AFW pump, the diesel generators, motor operated valves (MOVs), and the essential service water traveling screens. The j
number of component types considered in the development of plant-specific failure rates is more limited than in some other IPE/PRA studies. Test and maintenance-1 j
related unavailabilities were generally derived on a system train basis. [pp. 3-120,3-121 of submittal]
Failure data were collected and compiled over the time period from the start of I
commercial operation, September 3,1985, through December 1989 for all components except MOVs. The MOV data were collected from the start of commercial operation through December 31,1988. (p. 2 of RAI Responses, p. 3-120 of submittal]
l The control room operating logs were the primary source of data for the majority of l
components. Diesel generator data were compared with the diesel generator start log.
Other sources of plant-specific data included work requests, LERs, and equipment out-of-service logs. [p. 3-120 of submittal]
j Table 2-1 of our review compares Wolf Creek plant-specific failure data for selected components to values typically used in PRA and IPE studies, using NUREG/CR-4550 i
data for comparison. [pp. 3-120,3-121, 3-140 of submittal) l As shown in Table 2-1, the plant-specific failure data for the starting functions of the j
turbine-driven AFW pump and diesel generators are an order of magnitude lower than j
1-the NUREG/CR-4550 data. However, the remainder of the plant-specific data listed in Table 2-1 are in agreement with NUREG/CR-4550 data.
As of the IPE data collection cutoff dates, no failures of either the turbine driven AFW
{
pump and service water traveling screens have been experienced at Wolf Creek; i
therefore, the listed data for these components reflect a Bayesian update of plant data j
j with a generic prior.
4 I
i i
I 20 1
i
Table 2-1. Plant-Specific Component Failure Data' Component I
IPE NUREG/CR 4550 Meen i
Estimets Value Estimats j
Pump - Turbine Driven AFW 4.9E-03 Fall to Start (see note 2) 3E-02 Fall to Start 4.4E-03 Fall to Run (see note 2)
SE-03 Fall to Run Pump - Motor Driven - All Systems 2.0E-03 Fall to Start (see note 3) 3E 03 Fall to Start 3.2E-05 Fall to Run (see note 3) 3E-05 Fall to Run MOV-All Systems 3.7E 03 Fall to Open or Close (see 3E-03 Fall to Operate note 3) j Diesel Generator 5.5E-03 Fall to Start (see note 3) 3E-02 Fall to Start 7.3E 03 Fall to Run (see note 3) 2E-03 Fall to Run ESW Traveling Screen 2.2E-05 Fall to Run (see note 2) 3E 05 Run Failure Due to Plugging of a Strainer Notes: (1) Failures to start, open, close, operate, or transfer are probabilities of failure on demand:
1 The other failures represent frequencies expressed per hour.
(2) Bayesian update of generic data.
(3) Plant data only (no Bayesian update of generic data performed).
i Recent plant experience indicates that the reliability of the turbine-driven AFW pump
)
has decreased. Through August 1994,6 failures of this pump have been experienced j
in 241 start attempts. Five of these failures are classified as start failures, with one classified as failure to run. All of these failures appear to have occurred after the IPE data collection cutoff date (December 1989). This set of updated plant-specific data would suggest a point-estimate start failure probability of 2E-02 for this pump,
. compared to the IPE failure probability of 4.9E-03. The pump run exposure times are not provided; therefore a corresponding comparison of IPE and updated data pump run failure data could not be made. [pp. 3-120, 3-121, 3-140 of submittal)
The licensee investigated the impact of using updated plant reliability data for the turbine-driven AFW pump, if the updated data are used, the CDF increases by approximately 6.9% (from 4.2E-05/yr to 4.5E-05/yr). [pp.18,19 of RAI Responses)
Finally, as previously discussed in Section 2.2.1 of this report, transient initiating events were quantified where possible from Wolf Creek plant experience.
2.3.4 Use of Generic Data, if a shortage of plant-specific data existed, generic values were utilized as either the actual failure rates or as the prior distributions for Bayesian updates. The NUREG/CR-4550 methodology document was used as the primary source of generic data. The other sources of generic data were: [NUREG/CR 2815), [NUREG/CR 2728),
[lEEE 500), and [ WASH 1400). [p. 3-119 of submittal) 21
o 1
1 l'
We performed a comparison of IPE generic component failure data to generic values l
used in NUREG/CR-4550. This comparison is summarized in Table 2-2. (pp. 3-122 to 3-139 of submittal) i Table 2-2. Generic Component Failure Data' A
Component IPE NUREG/CR 4550 Mean Value Estimate Estimate Air Operated Valve 2.0E-03 Fall to Open or Close 2E-03 Fall to Operate I
Check Valve 1.0E-04 Fall to Open 1E-04 Fall to Open j
1.0E-03 Fall to Close 1E-03 Fall to Close
{
PORV/ Relief Valve 3.0E-04 Fall to Open 3E-04 Fall to Open 3.0E 02 Fall to Close 3E-02 Fall to Redose Instrument Air Compressor 8.0E-02 Fall to Start 8E-02 Fall to Start l
2.0E-04 Fall to Run 2E-04 Fail to Run Motor Driven Fan 3.0E-04 Fall to Start 3E-04 Fall to Start 1.0E 05 Fall to Run 1E 05 Fall to Run l
Damper 3.0E-03 Fall to Operate 3E-03 Fall to Open Battery Charger 1.0E 06 Falls 1E-06 Fail to Operate l
Battery 1.0E-06 Falls 1E-06 Failure (unspedfied mode)
Inverter 1.0E-04 Fails to Operate 1E-04 Failure (unspecified mode)
Circuit Breaker 3.0E-03 Fall to Transfer 3E-03 Fall to Transfer l
Transformer 2.0E-06 Falls 2E 06 Short or Open l
Time Delay Relay 3.0E-04 Fall to Transfer 3E-04 Fall to Transfer Notes: (1) Failures to start, open, close, operate, or transfer are probabilities of failure on demand. The other failures represent frequencies expressed per hour.
The IPE component failure data listed in Table 2-2 are in complete agreement with NUREG/CR-4550 data, i
.As previously noted in Section 2.2.1 of this report, generic data were used to support the development of an initiating event frequency for LOSP. In addition, generic data
)
were used to derive initiating event frequencies for steamline/feedline breaks, vessel l
rupture, and small, medium, and large break LOCAs.
i 2.3.5 Common-Cause Quantification.
l The estimation of common-cause failure probabilities was based on the Multiple Greek i
Letter (MGL) method. The common cause factors were based on methodology presented in an NRC-sponsored study [NUREG/CR 4780], an EPRI database, and
]
plant-specific considerations. The EPRI database information is contained in the following two documents: [EPRI 3967] and [EPRI Common Cause). The common i
22 i
i.
=
w v
cause events were added to the fault tree models. [pp. 6,7 of RAI Responses, pp. 3-117,3-122 to 3-139 of submittal]
4 The EPRI database events were reviewed by a screening panel consisting of licensee and Westinghouse personnel. Events judged not applicable to Wolf Creek were eliminated from consideration. In many cases, the Wolf Creek plant configuration or component environmental condition (l. e., pumps for salt water service) did not match i
the system / component configuration in the event description. In some cases, events involved common cause failure for the same component located in separate units of a multi-unit site, whereas Wolf Creek is a single unit site. [pp. 7,8 of RAI Responses) i A number of component groups were considered in the common cause analysis, including: diesel generators, pumps, motor operated valves (MOVs), check valves, ventilation fans, HVAC chillers, and safety relief valves. However, common cause failures of batteries and battery chargers were not included in the original IPE model.
The licensee has subsequently expanded the PRA model to include battery and battery charger common failures. The addition of these common cause failures for these components increases the overall CDF by approximately 2.6% (from 4.2E-05/yr to 4.3E-05/yr). [p.10 of RAI Responses, pp. 3-117,3-122 to 3-139 of submittal]
l We performed a comparison of the extracted IPE common-cause beta factors with generic values used in NUREG/CR-4550. This comparison is summarized in Table 2-
- 3. [p. 9 of RAI Responses, pp. 3-132 to 3-139 of submittal]
l Table 2-3. Comparison of Commen-Cause Failure Factors Component IPE Beta Factor (Assuming 2 NUREG/CR 4550 Mean Value Component System)
Beta Factor (2 l
Component System) f Pumr, AFW Motor Driven 0.015 Fall to Start and Run for 24 0.056 Fall to Start hours
,)
Pump - Essential Service Water 0.012 Fall to Start and Run for 24 0.026 Fall to Start i
hours
]
Pump Component Cooling 0.012 Fall to Start and Run for 24 0.026 Fall to Start Water hours Pump - RHR 0.0046 Fall to Start 0.15 Fall to Start 0.0046 Fall to Run Pump Charging /HPSI 0.032 Fall to Start 0.21 Fall to Start 0.032 Fall to Run Valve - MOV 0.0038 Fall to Open 0.088 Fall to Operate Valve - AOV 0.007 Fall to Open 0.10 Fall to Operate Valve - Safety / Relief 0.007 Fail to Open 0.07 Fall to Open Diesel Generator 0.007 Fail to Start and Run for 2.5 0.038 Fall to Start hours 23
______m._..
I I
Taole 2-3 shows that the IPE common cause beta factors for essential service water pumps and component cooling water pumps are about a factor of 2 lower than i
NUREG/CR-4550 data. The IPE beta factor for the moior-driven AFW pumps is about a factor of 4 lower than NUREG/CR-4550 data. For the other components in Table 2-3, the IPE beta factors are generally an order of magnitude lower than the corresponding NUREG/CR-4550 data.
The licensee recognizes that considerable uncertainty exists regarding the common cause quantification process. To help put this uncertainty in perspective, the licensee made a sensitivity study where the base case common cause failure probabilities were (1) increased by a factor of three, (2) increased by a factor of five, and (3) reduced by a factor of one-half. The corresponding impacts on CDF were: (1) a 7.8% increiase (from 4.2E-05/yr to 4.5E-05/yr), (2) a 15.7% increase (from 4.2E-05/yr to 4.9E-05/yr),
and (3) a 2% decrease (from 4.2E-05/yr to 4.1E-05/yr).' (p. 8 of RAI Responses)
In summary, the licensee has used common cause factors that are generally an order of magnitude lower than corresponding generic data. In deriving these estimates, the licensee has selectively used data from an EPRI common cause database by excluding events judged not applicable to Wolf Creek. In our opinion, the licensee has not provided enough supporting information to demonstrate that the IPE common cause failure data reflect the Wolf Creek plant. It is also not clear that the licensee has properly performed the reported common cause' sensitivity analyses. If these sensitivity analyses represent a simple re-quantification of cut set probabilities in the baseline CDF equation (rather than a complete re-quantification of the accident i
sequences), the CDF impact of increased common cause unavailability data may be significantly underestimated.
2.4 interface issues This section of the report summarizes our review of the interfaces between the front-end and back-end analyses, and the interfaces between the front-end and human factors analyses. The focus of the review was on significant interfaces that affect the ability to prevent core damage.
2.4.1 Front-End and Back-End Interfaces.
Containment cooling functions at Wolf Creek are provided by two containment spray trains and four fan cooler units. The containment spray system does not have heat
'It is not clear how these sensit'vity analyses were generated. If the sensitivity analyses represent a simple re-quantification of cut set probabilities in the baseline CDF equation, the CDF impact of increased common cause unavailability may be undarestimated. It is not possible to estimate the CDF contribution of cut sets truncated from the CDF equation when event probabilities are increased. If performed correctly, a sensitivity analysis involving an increase in event failure probabilities will include re-quantification of the accident sequer ces. a potentia'ly time consuming effort.
24
- ~ -. - - - - -.. _ - -. - - -.
4 i
)
j exchangers. The fan cooler units are cooled by the essential service water system.
[pp. 3-74, 3-77, 3-78, 4-3 of submittal)
In the IPE model, containment cooling is not required to support core cooling. To support this aspect of the IPE, the licensee specifically considered net positive suction head (NPSH) requiremems and temperature operability limits for ECCS pumps.
l MAAP analyses showed that NPSH limits for the RHR pumps would not be exceeded even if the sump water is saturated. In the absence of containment heat removal, the i
temperature of the sump water would not exceed 354 deg. F, which is the fluid i
saturation temperature at the mean containment failure pressure of 142 psia. The RHR critical mechanical components have temperature ratings from 450 deg. F to l
1,000 deg. F, and thus RHR pump survivability would not be jeopardized from high sump water temperatures. [pp.19 to 22 of RAI Responses) i l
The containment spray pumps are also expected to remain operable during conditions l
Involving no containment heat removal (no operable RHR heat exchangers or fan j
coolers). Like the RHR pumps, MAAP analyses showed that NPSH limits for the j
containment spray pumps would not be exceeded with saturated sump water. As i
discussed above, the temperature of sump water in the absence of containment heat l
removal would not exceed 354 deg. F. The limiting components of the containment spray pumps are various 0-rings, gaskets, and shaft packing materials constructed j
from EPT (ethylene propylene) materials. These components have manufacturer temperature ratings from 300 deg. F to 800 deg. F. However, based on research data, the licensee believes that the ethylene propylene materials can survive up to at least 550 deg. F. [pp.19 to 22 of RAI Responses)
The IPE considered ISLOCA and SGTR events, which can lead to containment bypass. No credit was taken for ISLOCA mitigation.
A containment safeguards event tree was used to bridge the front-end and back-end analyses. This event tree has top events that represent the status of the containment fan coolers, the containment spray system, and containment isolation. The output from this event tree was used to define plant damage states (PDSs). [pp. 3-57 to 3-60, 4-6, 4-13 of submittal) 2.4.2 Human Factors Interfaces.
Operator actions important to the analysis include: failure to initiate feed and bleed, failure to establish recirculation, and failure to trip RCPs following a loss of CCW. [p.
3-146 of submittal)
The ATWS event tree model credits two operator actions to manually trip the reactor following failure to scram, specifically: the insertion of control rods from the control room, and local-manual actions outside the control room to open circuit breakers to remove power from the control rod drive motor generator sets. The latter operator 25
1 I
action is not typically credited in IPE/PRA studies because of the short time available for success. The Wolf Creek analysis assumed that 2 minutes would be available to successfully perform this operator action, which is represented by event "MRT" in Figure 3.1-10 and Table 3.3-4 of the submittal. Credit for this local-manual action outside the control room lowers the CDF for the two dominant ATWS sequences by a factor of 6. [pp. 3-35 to 3-37,3-146 of submittal]
l Like some other PWR IPEs, the Wolf Creek IPE assumes that if high pressure injection falls during a small or medium LOCA, the primary system can be depressurized via the secondary system so that the accident can be mitigated with the low pressure injection system. Relevant operator depressurization actions for this mitigation activity are represented by events "OP1" (for medium LOCA) and "OP2" (for small LOCA) as listed in Figures 3.1-3 and 3.1-4, and Tables 3.1-1 and 3.3-4 of the submittal. [pp. 3-13, 3-14, 3-19, 3-22 to 3-24, 3-70, 3-96 of submittal)
As previously noted, the IPE has taken some credit for recovery of component failures.
For example, credit was taken for the recovery of components in a sequence initiated by loss of service water, though the specific components involved in this recovery are not identified. The recovery data for this loss of service water sequence were developed based on input from licensee staff. Credit was also taken for recovery of diesel generators in various sequences. The source of the diesel generator recovery data is not explicitly stated. [pp. 3-135, 3-136, 3-177, 3-186 of submittal)
The CCW system provides direct cooling to the charging and safety injection pumps, and RCP thermal barrier cooling. The CCW system is in tum cooled by essential service water (ESWj system. Loss of CCW or ESW will defeat both methods of RCP seal cooling (thermal barrier cooling and seal injection via the charging pumps) and all high pressure primary system makeup (charging and safety injection purrps). For accidents initiated by loss of either CCW or ESW, the IPE considers the possibility of a consequential RCP LOCA. In the event a post-LOCA safety injection actuation signal is generated following loss of.CCW or EF.W, credit is taken for operator actions to inhibit or trip the high head safety injection pumps to preclude their failure from loss of cooling. These pumps would later be restarted in the event cooling is restored. At the time the IPE models were developed, there were no emergency procedures in
~
place concerning loss of all CCW and ESW. The licensee has subsequently implemented procedures for these conditions. [pp. 14,15,51 of RAI Responses, pp.
3-38, 3-40 of submittal]
2.5 Evaluation of Decay Heat Removal and Other Safety lasues This section of the report summarizes our review of the evaluation of Decay Heat Removal (DHR) provided in the submittal. Other GSI/USIs, if they were addressed in the submittal, were also reviewed.
26
4 0
2.5.1 - Examination of DHR.
Section 3.4.3 of the submittal specifically addresses DHR and its contribution to CDF.
This portion of the submittal provides a discussion regarding the redundant means -
]
available for the DHR function. It was shown that several high reliable systems and i
j operator actions would have to fallin combination to have an impact on the DHR removal capability. The IPE goes beyond the A-45 definition of DHR by including f
l decay heat removal during large LOCA events. [pp. 3-190 to 3-192,7-1 of submittal]
The licensee identified the dominant CDF cutsets related to loss of DHR with
{
frequencies greater than 1E-07/yr. Only two cut sets in this category were identified.
These cut sets involve operator failure to accomplish ECCS switchover following I
medium or large LOCA initiating events. Together, these cut sets represent a CDF contribution of 1.0E-06/yr, which is less than 3% of the total plant CDF. The submittal j
{
does not list the combined CDF contribution of all the DHR-related cut sets. [p. 3-192 l-of submittal]
i Based on the above arguments, the licensee did not further explore cost-effective j
improvements to the DHR systems. The licensee concludes that there are no I
significant vulnerabilities for the DHR function. [pp. 3-192, 7-1 of submittal]
l 2.5.2 Diverse Means of DHR.
I The IPE evaluated the diverse means for accomplishing DHR, including: use of the power conversion system, feed and bleed, auxiliary feedwater, and ECCS. Cooling for i
RCP seals was addressed. [pp. 3-19,3-21 of submittal]
l 2.5.3 Uniaue Features of DHR.
l The unique features at Wolf Creek that directly impact the ability to provide DHR are i
l as follows: [pp. 3-47, 3-91, 3-93, 3 96, 3-146, 3-172, 3-190, 6-1, 6 2 of submittal]
l Ability to oerform feed and bleed once-through coolina. This design feature j
lowers the CDF by providing an attemative method of core cooling given i
unavailability of feedwater.
1 Avaliability of 4 hiah oressure emeroency core coolina svstem (ECCS) oumos to orovide reactor coolant svstem (RCS) inventorv iniection and makeuo flow for feed and bleed. The plant has 4 high pressure ECCS pumps, specifically two 1
i safety injection pumps and two centrifugal charging pumps. This design feature i
tends to decrease the CDF.
1 i
Ability to use either of the 2 residual heat removal (RHR) oumos to orovide 1
l suction sucolv to all 4 high oressure ECCS oumos durina recirculation. This design feature tends to decrease the CDF.
i l
27 J
I
' Service water system flexibility and redundanev. The plant has dedicated 1
standby essential service water (ESW) pumps that are available to provide j
backup flow to the ESW headers. During normal operation, non-essential i
service water pumps provide flow to the ESW headers. This design feature i
tends to decrease the CDF.
Ability to use the ESW system as a source of backuo water sunolv for the 4
auxiliarv feedwater (AFW) avstem. The ESW system can provide a backup i
source of AFW suction water supply in the event water from the condensate storage tank (CST) becomes unavailable. This design feature tends to j
decrease the CDF.
l Semi-automatic ECCS switchover. The switchover of RHR pumps from injection to sump recirculation is fully automated. However, the establishment of high pressure recirculation requires manual operator actions to align the suction of the safety injection and/or charging pumps to the discharge of the RHR pumps. This design feature tends to increase the CDF over what it would otherwise be with a fully automatic system.
Containment fan cooler units. The plant has 4 fan cooler units that provide a means of performing containment cooling that is independent of the containment spray system. However, because the IPE assumed that containment cooling is not required to support core cooling, the availability of the fan cooler units does not impact the CDF.
2.5.4 Other GSI/USIs Addressed in the Submittal.
The submit +al states that USl A-17," Systems interactions in Nuclear Power Plants,"
was resolved in conjunction with the IPE. The resolution of USI A-17 is based on the IPE finding that no significant hazards are associated with the flooding analysis. [pp.
3-193,7-1, transmittal letter of submittal) 2.6 Intemal Flooding This section of the report summarizes our reviews of the process used to model internal flooding and of the results of the analysis of internal flooding.
2.6.1 Internal Floodina Methodoloav.
The intemal flooding analysis considered effects from both spray and direct flooding of equipment. The following general steps were used in the analysis process: [pp. 3-155, 3-156 of submittal]
Review possible flood-induced initiating events and select appropriate event tree models 28 r-,
1 o
j 1
i j
Perform qualitative screening to identify significant flood events Further screen flooding scenarios with reviews of flooding calculations and walkdown activities Generate flooding-related accident sequences and CDF contributions, j -
i The licensee performed calculations to assess the vulnerability of components to submergence. Flood zones were chosen to correspond to the existing fire zones 3
i developed for compliance with 10 CFR 50 Appendix R requirements. Barriers i
separating the Appendix R zones were found to be applicable to the intemal flooding analysis. The analysis used 3 event tree models to represent the various flooding g-sequences, specifically: transient without PCS available, transient with PCS avallat.ie, 4
and loss of service water. The Westinghouse WALT code was used for core damage quantification. [p. 3-155,3-156 of submittal) i-
{
An initial flooding walkdown was performed primarily to gain an understanding of the j
special relationships of components and equipment to the various hazards. A 3
subsequent walkdown was performed to obtain these relationships for specific hazards l
Identified in the analysis. [p. 2-7 of submittal]
Initiating events used in the flooding analysis are listed in Table 3.3-1 of the submittal.
l The sources of data used to quantify these initiating events are not identified. [pp. 3-l 138,3-139 of submittal]
i i
2.6.2 Intemal Flooding Results.
The submittal discusses four accident scenarios that were determined to warrant i
further analysis following the screening process. These scenarios are summarized j
below: [pp. 3-157, 3-158 of submittal) l
{
Turbine hall flood. This scenario involves the failure of a condenser expansion l
Joint, and has an estimated CDF of 2.6E-08/yr.
i 1
i ESF switchaear room no. 2 froom 3302) sorav. This room contains two j
unprotected cabinets with ventilation louvers adjacent to a charged fire
{
protection line. The cabinets control two steam generator atmospheric relief l
valves and components associated with the turbine-driven AFW pump. This j
scenario has an estimated CDF of 7.2E-10/yr.
[
Control buildino basement flood. Flooding of room 3101 (elevation 1974 ft) was postulated due to the rupture of a service water pipe. Submersion of several service water MOVs would occur, resulting in a loss of service water. Manual j
recovery actions wotN be required to successfully isolate the non-essential service water from the essential service water. For a complete rupture of the 4
j service water pipe, this scenario has an CDF of 8.9E-07/yr. For a small pipe rupture, the CDF is estimated to be 2.2E-06/yr.
3 29 l
4
a ESF switchaear room flood. This scenario involves the rupture of essential j
service water piping in ESF switchgear room no. 2 (3302), or in either of the diesel generator rooms (5501 or 5503). Because of propagation effects, the resulting flood would essentially result in a station blackout scenario. The 1-
' estimated CDF for this scenario is 4.5E-06/yr.
)
As reported in the submittal, the CDF from internal flooding is 7.6E-06/yr, or i
approximately 18% of the overall CDF estimate for Wolf Creek. However, the licensee
~ tates that some of the flooding scenarios included in the submittal were identified late u
i s
l in th'e IPE process and were addressed, due to time constraints, in a ? conservative" j
manner. A reanalysis of intemal flooding was made to make a more realistic assessment of flood-related scenarios. Results from the reanalysis indicate that the flooding-related CDF contribution is reduced by approximately 72% (from 7.6E-06/yr to 2.1E-06/yr). The total CDF is reduced by approximately'13% drom 4.2E-05/yr to 3.7E-l 05/yr). [p.15 of RAI Responses, p. 3-158 of submittal]
I I
2.7 Core Damage Sequence Results i'
This section of the report reviews the dominant core damage sequences reported in j
the submittal. The reporting of core damage sequences-whether systemic or i
functional-is reviewed for consistency with the screening criteria of NUREG-1335.
l The definition of vulnerability provided in the submittal is reviewed. Vulnerabilities, l
enhancements, and plant hardware and procedural modifications, as reported in the submittal, are reviewed.
2.7.1 Dominant Core Damaae Seouences.
4 i
The IPE utilized systemic event trees, and reported results using the screening criteria from Generic Letter 88-20 for systemic sequences. The total point estimate'CDF for l
Wolf Creek is 4.2E-05/yr, including flooding.' [pp.1-4, 3-159, 3160 of submittal) l The submittal does not provide a listing that displays the breakdown of accident types
{
and their contribution to CDF. However, we were able to extract this type of information from the CDF contributions'of initiating events that are listed in Table 3.4 2 i
of the submittal. Table 2-4 below lists the accident types that contributed the most to the CDF, and their percent contribution. The " Transient" category includes LOSP l
events that do not evolve into a station blackout. The "Special" initiators include loss of service water, loss of CCW, and loss of a DC bus. [pp. 3-159, 3-168 of submittal]
l
'The licensee states that some of the flooding scenarios included in the submittal were identified j
late in the analysis process and were addressed, due to time constraints, in a " conservative" manner.
In a more refined assessment of intemal flooding performed subsequent to completion of the submittal, the total CDF was reduced to approximately 3.7E-05/yr due to a reduction of the internal flooding j
contribution.
l 30
(
L i
,.o*
--2---
m 4-
---4.d.-
ai A+_n-.ae -s 4.hJ.
J A
a.
A
- w
.AE.
.a 4
h a
Q Table 2-4. Accident Types and Their Contribution to Core Damage Frequency CDF Contribution Percent Contribution Accident Type pr yr.
to CDF Station Blackout 1.9E 05 45 i
intemal Flood 7.6E 06 18'
~
Transient (including LOSP) 5.3E-06 13 Special Initiators 5.3E-06 13 LOCAs 4.2E-06 10 SGTR 6.3E-07 1.5 1
2 ISLOCA 6.1 E-08 0.15 ATWS 3.3E-08 0.08 Initiating events that contributed the most to the CDF, and their percent contribution, are listed below in Table 2-5.'
[p. 3-32, 3-47, 3-168 of submittal]
4 1
Table 2-5. Initiating Events and Their Contribution to Core Damage Frequency initiating Event CDF Contribution / yr.
% Cont.
to CDF LOSP coincident with loss of all onsite ac power (station 1.9E-05 45 i
blackout)
LOSP (at least one diesel generator successfully starts) 4.9E-06 12 Control Bldg. Switchgear Room Flood 4.5 E-06 11 Loss of All Service Water 2.7E-06 6.4 Recoverable Control Bldg. Basement Flood 2.2E-06 5.2 1
Loss of Operating CCW Train (leading to RCP seal 2.2E-06 5.2 i
LOCA)
Medium LOCA 1.8E-06 4.4 Large LOCA 1.4 E-06 3.3 Non-Recoverable Control Bldg. Basemen Flood 8.9E-07 2.1 Small LOCA 6.7E-07 1.6 4
SGTR 6.3E-07 1.5 The 5 most dominant systemic core damage sequences are listed in Table 2-6. [pp.
3-38,3-47,3-161,3-172 to 3-176 of submittal) 1
'As noted in footnote (6), a refined assessment of internal flooding was performed. Results from 4
this refined assessment indicate that internal flooding represents approximately 5-6% of the CDF.
"A complete list of initiating event CDF contributors is provided in Table 3.4 2 of the submittal.
31
Finally, the results of an importance analysis are presented in the submittal. This j
importance analysis ranks the key contributors to CDF based on percent CDF contribution. The most important CDF contributors are listed below: [pp. 3-160, 3-171 of submittal]
]
AC power is not recovered within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after a station blackout i
l Turbine-driven AFW pump falls to start and run during a station blackout Diesel generator NE01 falls to start and run Turbine-driven AFW pump falls to start and run High pressure Si restoration falls after station blackout, SW or CCW falls 1
Operator failure to provide RCP seal cooling in a timely manner a
Diesel generator NE02 falls to start and run Diesel generator NE01 unavailable due to test or maintenance
]
Table 2-6. Top 5 Dominant Systemic Core Damage Sequences i
Initiating Event Dominant Subsequent
% Contribution to Failures in Sequence Total CDF I
LOSP Loss of onsite AC power resulting in a station blackout, 14 LOSP not recovered in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; core damage due to either battery depletion (turbine-driven AFW failure), or unmitigated RCP seal LOCA j
Flooding of ESF Loss of plant control due to conditions essentially the same 10 Switchgear Rooms as a station blackout; core damage due to either battery 3301 and 3302 depletion (turbine-driven AFW failure), or unmitigated RCP 1
seal LOCA LOSP Loss of onsite AC power resulting in a station blackout; 6.7 RCP seal LOCA occurs; offsite or at least one onsite source of AC power is restored before battery depletion time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; core damage due to lack of ECCS injection before core in uncovered LOSP Secondary cooling through at least 2 of 4 steam generators 6.7 falls; subsequent failure of feed and bleed cooling LOSP Loss of onsite AC power resulting in a station blackout; 6.5 RCP seal leakage occurs; offsite power is restored before battery depletion time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and before core uncovery; failure of RCS inventory restoration caused by failure of ECCS recirculation mode 2
2.7.2 Vulnerabilities, l
The licensee adopted Closure Guidelines from NUMARC [NUMARC 9104] to evaluate the PRA results and to identify insights related to severe accidents. in applying the Closure Guidelines, all core damage sequences except flooding sequences down to a frequency cutoff of 1E-08/yr were sorted into the functional groups specified in the t
32 4
1
__.-.m L
d O.02% to the total CDF and did'not significantly influence the evaluation results. [pp.
j 3-187 to 3-189 of submittal]
The licensee states that only the NUMARC 1 A grouping at Wolf Creek is of interest from the standpoint of the Closure Guidelines. The 1 A group represents accidents with loss of primary and secondary heat removal in the injection phase. The 1 A group i
at Wolf Creek has a CDF of 1.5E-05/yr, and contributes 36% to the overall CDF.
Therefore, the Wolf Creek 1 A group corresponds to a category of sequence groups 7
j
'specified in the Closure Guidelines that have mean CDF values in the range of 1E-i 04/y'r to 1E-05/yr or that represent 20% to 50% of the total CDF. For this sequence group category, the Closure Guidelines suggest that the licensee: (1) find a cost-
{
effective treatment in emergency operating procedures (EOPs) or other plant j
procedure or minor hardware change with emphasis on prevention of we damage, or
]
(2) if unable to satisfy the above response, ensure the Severe Accident Management Guide (SAMG) is in place with emphasis on prevention / mitigation of core damage or i
vessel failure and containment failure. The licensee does not indicate whether either
}
of these recommendations was used to address the 1 A sequence group. [pp. 3-187 i
to 3-189 of submittal]
I The licensee concluded that there are no vulnerabilities at Wolf Creek. [pp.1-4, 6-1 l
of submittal]
i i
2.7.3 Pronosed imorovements and Modifications, i.
j
_ The licensee identified several plant enhancements. The IPE took credit for only one
{
improvement, specifically a feedwater isolation bypass switch. The proposed plant j
improvements, their current status and CDF impact (if available) are summarized j
below: [pp.10 to 16 of RAI Responses, pp. 6-2,6-3 of submittal).
Installation of hiah temoerature aualified RCP seal O-rinas. Wolf Creek does l-not have the high temperature RCP seal package O-rings recently made l
available by Westinghouse. The licensee is currently monitoring industry i
experience with these specially qualified O-rings and has not yet made a final i
decision with regard to utilization of the new O-rings'at Wolf Creek. If the new i
O-rings are installed, the installation would occur during the tenth refueling outage (early 1999). The licensee estimates that the new O-rings would reduce the total CDF by approximately 13% (from 4.2E-05/yr to 3.7E-05/yr), and reduce
{
the station blackout CDF by approximately 29% (from 1.9E-05/yr to 1.3E-05/yr).
J The IPE did not take credit for this modification.
Reolacement of the oositive disolacement charaino oumo. The licensee plans
=
j to replace the existing positive displacement charging pump by adding a third j
centrifugal charging pump. The planned installation will be accomplished in two i
stages, namely (1) necessary modifications to existing systems to be performed j
during the eighth refueling outage (spring 1996) and (2) actual pump installation l-33 i
4
during the eighth refueling outage (spring 1996) and (2) actual pump installation 1
during normal plant operation following the refueling outage. While the new pump will not have a direct dependency on the CCW 'or service water systems, 4
an analysis has not been performed to determine if the new pump will be
[
independent of CCW (for pump minimum flow cooling) or service water cooling (for room cooling). If the new pump is indeed independent of these cooling j
water systems, the licensee's preliminary estimates show that the CDF will be reduced by approximately 12-14% (from 4.2E-05/yr to 3.6E-05/yr). On the other j
hand, if independence from one or both of these cooling water systems cannot be demonstrated, the reduction in CDF will not be significant. The IPE did not j
take credit for this modification.
Provide a switch to bvoass feedwater isolation in order to restore main feedwater. The installation of this type of switch would facilitate the bypass of i
feedwater isolation during various accident conditions. Without such a switch, operators have to manually lift leads and install jumpers, a relatively time-l consuming process. A switch was installed in March 1993 that allows bypass j
of feedwater isolation for only for a limited set of conditions. However, _
feedwater isolation generated from a SI signal, or a " low-low" or "high-high" steam generator level signal cannot be bypassed with this switch. Because of a misunderstanding of the planned scope of the March 1993 modification, the IPE credited bypass of feedwater isolation regardless of the type or presence of the originating signal. A modification planned for the ninth refueling outage (fall 1997) will provide the capability to bypass feedwater isolation for all conditions, if feedwater isolation bypass capability had not been credited in the IPE, the licensee estimates that at most the CDF would increase by approximately 18.8% (from 4.2E-05/yr to 5.0E-05/yr).
I Enhance emeroency orocedures to directiv address total loss of CCW and SW.
The emergency procedures have been modified to specifically address loss of CCW or service water. These procedures include guidance for providing alternate cooling to the lube oil coolers for the centrifugal and safety injection, which are normally cooled by CCW. The licensee states that these procedural improvements were not credited in the IPE analysis." The licensee estimates that the CDF would be reduced by approximately 7.3% (from 4.2E-05/yr to 3.9E-05/yr) if credit had been taken for updated procedural guidance related to total loss of CCW or service water. The licensee does not have a CDF estimate for updated procedural guidance related to loss of one train of "This statement is made on p.14 of the RAI Responses. However, in a later portion of the RAI Responses (p. 51), the licensee indicates that the IPE took credit for operator actions to inhibit or trip the high head safety injection pumps to preclude their failure from loss of ESW/CCW cooling. These pumps would later be restarted in the event cooling is restored. At the time the IPE models were developed, there were no emergency procedures in place concerning loss of all CCW and ESW.
34 ew--
g u
-+
r
o 4
Develooment of aaneric Accident Manaaement auldelines. Generic e
Westinghouse Severe Accident Management (SAM) Guidelines were issued in June 1994. The licensee intends to complete an assessment of SAM
^
capabilities and make any identified enhancements by September 30,1997.
Activities or improvements associated with the SAM program were not credited i
in the IPE. Many of the SAM guidelines address plant conditions were core damage has occurred, and for these cases the CDF would not be impacted.
Also as a result of the IPE, the licensee initiated work on two special studies. These
. special studies are summarized below.
i Evaluate eaulomant deoendence on room coolina. The interconnecting design of rooms containing ECCS equipment is such that cooling provided by one pump room cc,oler may be adequate to support the operation of more equipment than just the associated ECCS pump. An engineering evaluation is j
' ongoing to identify those room coolers that may support operation of more than one ECCS pump. It is planned that this evaluation will be completed by j
December 31,1995. No estimates of CDF impact have been performed to l
date. The IPE assumed that successful operation of an ECCS pump would require cooling from its associated room cooler.
l Reanalvsis of internal floodina events. As reported in the submittal, intemal i
flooding represents about 18% of the overall CDF. The licensee states that j
some of the flooding scenarios included in the submittal were identified late in j
the IPE process and were addressed, due to time constraints, in a l
" conservative" manner. A reanalysis of intemal flooding was made to make a more realistic assessment of flood-related scenarios. Results from the j
reanalysis indicate that the flooding-related CDF contribution is reduced by approximately 72% (from 7.6E-06/yr to 2.1E-06/yr). The total CDF is reduced by approximately 13% (from 4.2E-05/yr to 3.7E-05/yr).
i i
The licensee also provided Information concerning plant changes made in response to the Station Blackout Rule, and other modifications separate from the Station Blackout Rule that reduce the station blackout CDF. The one Station Blackout Rule activity j
specifically credited in the analysis was the shedding of selected DC loads to extend i
battery life. This load shedding activity is expected to extend battery life from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Without credit for load shedding, the CDF would increase by about 12%
4 (from 4.2E-05/yr to 4.9E-05/yr). The station blackout CDF contribution would increase j
by about 32% (from 1.9E-05/yr to 2.5E-05/yr). [pp.16 to 18 of RAI Responses]
j i
A potential modification separate from the Station Blackout Rule that would reduce the station blackout CDF is the possible installation of high temperature qualified RCP seal
]'
O-rings previously described above. The licensee also notes that use of industry LOSP initiating event data more current than that used in the IPE might result in i
35 i
a
,i
~
-. station blackout CDF reductions on the order of 10 to 25% (from 1.9E-05/yr to 1.4E-05/yr). [pp.16 to 18 of RAI Responses)
?
4 6
i 4
s j
i f
1 3
i-l I
k i
1 i.
N-
)
36 l
I 1
- 3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS i
l This section of the report provides an overall evaluation of the quality of the IPE based i
on this review. Strengths and weaknesses of the IPE are summarized, important j
assumptions of the model are surenarized. Major insights from the IPE are i
presented.
j Strengths of the IPE are as fotows: T.Se evaluation and identification of HVAC-related initiating events is more thorough than corresponding analyses in some other IPE/PRA studies.
4 1
j Two weaknesses of the IPE were identified, one associated with the treatment of common cause failures and the other associated with the use of plant-specific j
component failure data. These two weaknesses are summarized below.
i j
The licensee has used common cause factors that are generally an order of i
j magnitude lower than corresponding generic data, in deriving these estimates, j
the licensee has selectively used data from an EPRI common cause database j
by excluding events judged not applicable to Wolf Creek. In our opinion, the j
j licensee has not provided enough supporting information to demonstrate that i
the IPE common cause failure data reflect the Wolf Creek plant. It is also not clear that the licensee has properly performed the reported common cause sensitivity analyses. If these sensitivity analyses represent a simple re-i quantification of cut set probabilities in the baseline CDF equation (rather than a l
complete re-quantification of the accident sequences), the CDF impact of j
increased common cause unavailability data may be significantly underestimated. In summary, we do not have a sufficient basis to conclude that l
the use of relatively low common cause failure data for important components (such as motor-operated valves, diesel generators, and pumps) supports the identification of vulnerabilities or the most likely severe accidents.
l The number of component types included in the development of plant-specific failure rates is more limited than in some other IPE/PRA studies.
l Based on our review, the following aspects of the IPE modeling process have an impact on the overall CDF:
Credit for depressurization of the primary system with the steam generators as I
a method to mitigate small and medium LOCAs if all high pressure injection is l
lost j
Core cooling systems that can function independently of the status of j
containment cooling (as demonstrated by analysis) i I
j l
37 i
i
e e
4 i
Credit for local-manual actions outside the control room to open circuit breakers a
}
to remove power from the control rod drive motor generator sets I
Credit for recovery of failures of some components i
j Credit for offsite power non recovery data that are more optimistic than average industry experience.
I All of these aspects of the modeling process tend to lower the CDF, Significant level-one IPE findings are as follows:
4 Station blackout is a relatively large contributor to CDF, as is the case in a number of other PWR IPE/PRA studies. Important contributors to station blackout CDF include failure of the turbine-driven AFW pump due to battery depletion and an unmitigated RCP seal LOCA.
The IPE does not represent the as-built plant as of the IPE freeze date. Due to a misunderstanding by PRA analysts, the IPE took credit for a modification that -
will not be implemented until 1997, specifically the ability to bypass feedwater isolation during any accident condition. If this feedwater isolation bypass capability had not been credited in the IPE, the CDF would increase at most by approximately 18.8% (from 4.2E-05/yr to 5.0E-05/yr).
ATWS is a relatively small contributor to CDF. The relatively small ATWS contribution appears to be due to the following: (1) credit taken for local-manual actions outside the control room to open circuit breakers to remove power from the control rod drive motor generator sets, and (2) apparent credit for the possibility of successful ATWS mitigation throughout all portions of the core cycle (a dominant ATWS sequence in some other PWR IPE/PRA studies involves the inability to mitigate an ATWS event during some portion of the early-in-life core cycle due to an unfavorable moderator temperature coefficient).
38
- 4. DATA
SUMMARY
SHEETS This section of the report provides a summary of information from our review.
Initiatina Event Freauencies Initiating Event Frequency per Year Loss of Offsite Power 5.10E-02 Control Bldg. Switchgear Room Flood 4.47E-06 Loss of All Service Water 1.76E-05 Recoverable Control Bldg. Basement Flood 8.04E-06 Loss of Operating CCW Train (Leading to Seal 1.13E-02
~
]
Large LOCA 5.00E-04 Non-Recoverable Control Bldg. Basement Flood 8.94E-07 Small LOCA 2.50E-03 Steam Generator Tube Rupture 1.10E-02 j
Loss of Component Cooling Water 1.62E-04 Vessel Failure 3.00E-07 Transients - With Power Conversion System 4.30 Transients - Without Power Conversion System 1.90E-01 interfacing Systems LOCA 6.11 E-08 Loss of DC Bus 1.78E-03 Terbine Bldg. Flood 2.26E-02 Steamline/Feedling Break 5.00E-04 Room 3302.cpray (Flood) 7.45E-05 Overall CDF The total point estimate CDF for Wolf Creek is 4.2E-05/yr, including internal flooding.'8 l
J l
"The licensee states that some of the flooding scenarios included in the submittal were identified late in the analysis proces.s and were addressed, due to time constraints, in a " conservative" manner, in a more refined assessment of internal flooding performed subsequent to completion of the submittal, the total CDF was reduced to approximately 3.7E 05/yr due to a reduction of the internal flooding i
contribution.
39
..... -. ~ ~..
l Dominant Initiating Events Contributing to CDF" LOSP 57 %
Control Bldg. Switchgear Room Flood 11 %
Loss of all Service Water 6.4%
Recoverable Control Bldg. Basement Flood 5.2%
Loss of Operating CCW Train (leading to RCP seal LOCA) 5.2%
Medium LOCA 4.4%
Large LOCA 3.3%
Non-recoverable Control Bldg. Basement Flood 2.1 %
Small LOCA 1.6%
SGTR 1.5%
Dominant Hardware Failures and Ooerator Errors Contributina to CDF Dominant hardware failures contributing to CDF include:
Turbine-driven AFW pump fails to start and run during a station blackout Diesel generator NE01 fails to start and run Turbine-driven AFW pump falls to start and run Dominant human errors and recovery factors contributing to CDF include:
AC power is not recovered within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after a station blackout j
High pressure Si restoration falls after station blackout, SW or CCW fails j
Operator failure to provide RCP seal cooling in a timely manner Dominant Accident Classes Contributina to CDF Station Blackout 45%
intamal Flood 18%"
Transient (including LOSP) 13%
Special Initiators 13%
LOCAs 10%
SGTR 1.5%
ISLOCA 0.15%
ATWS 0.08%
"A complete list of initiating event CDF contributors is provided in Table 3.4-2 of the submittal.
"As noted in footnote (8), a refined assessment of intemal flooding was performed. Results from this refined assessment indicate that intemal flooding represents approximately S-6% of the CDF.
40
i i
i Availability of 4 hiah oressure emeraencv core coolina system (ECCS) oumos e
to orovide reactor coolant system (RCS) inventerv inlection and makeuo flow for 3
l' feed and bleed. The plant has 4 high pressure ECCS pumps, specifically two j
safety injection pumps and two centrifugal charging pumps. This design feature tends to decrease the CDF.
Ability to use either of the 2 residual heat removal (RHR) numos to orovide j
suction sunolv to all 4 hiah oressure ECCS numos durina recirculation. This j
design feature tends to decrease the CDF.
a Service water system flexibilitv and redundanev. The plant has dedicated standby essential service water (ESW) pumps that are available to provide l
backup flow to the ESW headers. During normal operation, non-essential service water pumps provide flow to the ESW headers. This design feature i.
tends to decrease the CDF.
a i
Ability to use the ESW system as a source of backuo water sunolv for the e
i auxiliarv feedwater (AFW) system. The ESW system can provide a backup j
source of AFW suction water supply in the event water from the condensate storage tank (CST) becomes unavailable. This design feature tends to j
decrease the CDF.
i Eloht hour batterv caoacitv. With credit for load shedding, the batteries can
{
provide power for approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> battery lifetime is longer j
than at some other PWRs. This design feature tends to lower the CDF.
i Semi-automatic ECCS switchover. The switchover of RHR pumps from l
Injection to sump recirculation is fully automated. However, the establishment of high pressure recirculation requires manual operator actions to align the i
suction of the safety injection and/or charging pumps to the discharge of the i
RHR pumps.'This design feature tends to increase the CDF over what it would otherwise be with a fully automatic system.
I i
Non-aualified reactor coolant numo (RCP) seals. Wolf Creek does not utilize e
j high temperature qualified RCP seal package O rings recently made available i
by Westinghouse. The licensee is considering the installation of these j
improved 0-rings. The use of non-qualified RCP seals at Wolf Creek tends to l
increase the CDF over what it would otherwise be with qualified seals.
l Containment fan cooler units. The plant has 4 fan cooler units that provide a means of performing containment cooling that is independent of the containment spray system. However, because the IPE assumed that l
containment cooling is not required to support core cooling, the availability of i
the fan cooler units does not impact the CDF.
i
+
f j
41 1
j Containment fan cooler units. The plant has 4 fan cooler units that provide a means of performing containment cooling that is independent of the containment spray system. However, because the IPE assumed that containment cooling is not required to support core cooling, the availability of the fan cooler units does not impact the CDF.
l Modifications The licensee identified several plant enhancements. The proposed plant improvements, their current status and CDF impact (if available) are summarized below:
Installation of hiah temoerature aualified RCP seal O-rinas. The licensee is currently monitoring industry experience with specially qualified O-rings and has I
not yet made a final decision with regard to utilization of the new O-rings at Wolf Creek. If the new O-rings are installed, the installation would occur during the tenth refueling outage (early 1999). New O rings would reduce the total CDF by approximately 13% (from 4.2E-05/yr to 3.7E-05/yr). The IPE did not take credit for this modification.
Reolacement of the oositive disolacement charaina numo. The existing positive e
displacement charging pump will be replaced during 1996 by the addition of a third centrifugal charging pump. If the new pump can be shown to be independent of cooling water support systems, the CDF will be reduced by approximately 12 -14% (from 4.2E-05/yr to 3.6E-05/yr). If independence from cooling water systems cannot be demonstrated, the CDF reduction will not be significant. The IPE did not take credit for this modification.
Provide a switch to bvoass feedwater isolation in order to restore main feedwater. Without such a switch, operators have to manually lift leads and install jumpers, a relatively time-consuming process. A switch was installed in March 1993 that allows bypass of feedwater isolation for only for a limited set of conditions. Because of a misunderstanding of the planned scope of the March 1993 modification, the IPE credited bypass of feedwater isolation for all conditions. A modification planned for 1997 will provide the capability to bypass feedwater isolation for all conditions. If feedwater isolation bypass capability had not been credited in the IPE, the CDF would increase at most by approximately 18.8% (from 4.2E-05/yr to 5.0E-05/yr).
Enhance emeroency orocedures to directiv address total loss of CCW and SW.
The emergency procedures have been modified to specifically address loss of CCW or service water. These procedures include guidance for providing alternate cooling to the lube oil coolers for the centrifugal and safety injection, which are normally cooled by CCW. The licensee states that the IPE did not 42
i i
Develooment of aeneric Accident Manaaement auidelines. Generic Westinghouse Severe Accident Management (SAM) Guidelines were issued in June 1994. The licensee intends to complete an assessment of SAM capabilities and make any identified enhancements by September 30,1997.
1 Improvements associated with the SAM program were not credited in the IPE.
Many of the SAM guidelines address plant conditions were core damage has occurred, and for these cases the CDF would not be impacted.
l Also as a result of the IPE, the licensee initiated work on two special studies. These l.
special studies are summarized below.
{
Evaluate eautoment deoendence on room coolino. The interconnecting design of rooms containing ECCS equipment is such that cooling provided by one pump room cooler may be adequate to support the operation of more l
equipment than just the associated ECCS pump. An engineering evaluation is ongoing to identify those room coolers that may support operation of more than i
one ECCS pump. It is planned that this evaluation will be completed by l
December 31,1995. No estimates of CDF impact have been performed to date. The IPE assumed that successful operation of an ECCS pump would l
require cooling from its associated room cooler.
u Reanalvsis of intemal floodina events. As reported in the submittal, internal i
e
{
flooding represents about 18% of the overall CDF. Some of the flooding j
scenarios included in the submittal were identified late in the IPE process and 4
l were addressed, due to time constraints, in a " conservative" manner. A reanalysis of intemal flooding was made to make a more realistic assessment of flood-related scenarios. The reanalysis predicts a reduction in the total CDF l-of approximately 13% (from 4.2E-05/yr to 3.7E-05/yr).
1 The one Station Blackout Rule activity specifically credited in the analysis was the
]
shedding of selected DC loads to extend battery life. This load shedding activity is expected to extend battery life from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Without credit for load 1
shedo, g, the CDF would increase by about 12% (from 4.2E-05/yr to 4.9E-05/yr).
Other USI/GSis Addressed The submittal states that USI A-17, " Systems Interactions in Nuclear Power Plants,"
was resolved in conjunction with the IPE. The resolution of USl A-17 is based on the IPE finding that no significant hazards are associated with the flooding analysis.
Sionificant PRA Findinas Significant level-one IPE findings are as follows:
43
Station blackout it a relatively large contributor to CDF, as is the case in a number of other PWR IPE/PRA studies, important contributors to station l
blackout CDF include failure of the turbine-driven AFW pump due to battery depletion and an unmitigated RCP seal LOCA.
The IPE does not represent the as-built plant as of the IPE freeze date. Due to 4
a misunderstanding by PRA analysts, the IPE took credit for a modification that will not be implemented until 1997, specifically the ability to bypass feedwater isolation during any accident condition. If this feedwater isolation bypass capability had not been credited in the IPE, the CDF would increase at most by i
approximately 18.8% (from 4.2E-05/yr to 5.0E-05/yr).
i ATWS is a relatively small contributor to CDF. The relatively small AWIS contribution appears to be due to the following: (1) credit taken for local-manual actions outside the control room to open circuit breakers to remove power from i
the control rod drive motor generator sets, and (2) apparent credit for the possibility of successful ATWS mitigation throughout all portions of the core cycle (a dominant ATWS sequence in some other PWR IPE/PRA studies involves the inability to mitigate an ATWS event during some portion of the f
early-in-life core cycle due to an unfavorable moderator temperature coefficient).
J e
l I
I l
3 i
4 l
i i
44 i
REFERENCES
[lEEE 500] Guide to the Collection and Presentation of Electrical, Electronic, Sensing, Component, and Mechanical Equipment Reliability Data for Nuclear Power Generating i
Stations, IEEE Std. 500-1984, December 1983.
[lPE Submittal) Wolf Creek Generating Station, September 1992.
i
[EPRI 3967) Classification and Analysis of Reactor Operating Experience involving Dependent Events, EPRI NP-3967, June 1985.
[EPRI Common Cause) A Database of Common Cause Events for Risk and Reliability Evaluations, EPRI draft report, September 1990.
[NSAC 147] Losses of Offsite-Power at U. S. Nuclear Power Plants Through 1989, 4
EPRI (Nuclear Safety Analysis Center), NSAC-147, March 1990.
[NUMARC 87 00] Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout of Light Water Reactors, NUMARC 87-00, August 31,1987.
4
[NUMARC 9104) Severe Accident issue Closure Guidelines, NUMARC Document 91-04, January 1992.
[NUREG/CR 2728] Interim Reliability Evaluation Program Procedures Guide, NUREG/CR-2728, January 1983.
4
[NUREG/CR 2815) Probabilistic Safety Analysis Procedures Guide, NUREG/CR-2815, Vol.1, Rev.1, August 1985.
[NUREG/CR 4780) Procedures for Treating Common Cause Failures in Safety and Reliability Studies, NUREG/CR-4780, Vol.1, February 1988 and Vol. 2, January 1989.
l
[RAI Responses) Response to the Request for Additional Information Concerning the Individual Plant Examination, Letter from N. S. Carns, Wolf Creek Nuclear Operating Corporation, to NRC, WM 95-0128, August 30,1995.
[UFSAR) Updated Final Safety Analysis Report for Wolf Creek
[ WASH 1400) Reactor Safety Study, October 1975.
1 45
l APPENDIX B WOLF CREEK GENERATING STATION INDIVIDUAL PLANT EXANINATION TECHNICAL EVALUATION REPORT (BACK-END) i
,