ML20137U456

Requests Addl Info Re June 1992 Application for Design Certification of AP600.Portion of Submitted Info Being Withheld from Public Disclosure Pending Staff Final Determination

ML20137U456
Person / Time
Site:	05200003
Issue date:	03/12/1997
From:	Joseph Sebrosky NRC (Affiliation Not Assigned)
To:	Liparulo N WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
References
NUDOCS 9704170005
Download: ML20137U456 (8)

Text

_ _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ - . . _ _ _ . _ - . _ _ _ _ _ . _ _ . _ _

heat I-,'fe

@ou  ;

i

,\ p UNITED STATES 4 s* NUCLEAR REGULATORY COMMISSION 4 # f WASHINGTON, D.C. 20066-0001 k*****,o# March 12,1997 l

i Mr. Nicholas J. Liparulo, Manager

Nuclear Safety and Regulatory Analysis s

Nuclear and Advanced Technology Division Westinghouse Electric Corporation  ;

! P.O. Box 355

! Pittsburgh, PA 15230

SUBJECT:

FOLLOWON QUESTIONS REGARDING THE AP600 PROBABILISTIC RISK ASSESSMENT

(PRA)

J i

Dear Mr. Liparulo:

i 3 As a result of its review of the June 1992 application for design certifica-  :

i tion of the AP600, the staff has determined that it needs additional informa-1 tion. Specifically, the staf f has reviewed a December 13, 1996, letter from ,

Westinghouse that provided a sensitivity study on the baseline PRA in response to a request from the staff. The study assumes that systems needed for normal i

plant operation (e.g., ac power) can be available if not affected by the

! initiating event (0 pen Item Tracking System #3969). This review was integrat-I ed with (1) the focused PRA documented in Chapter 52 of the PRA, (2) aisump-tions made in the baseline PRA which are likely to have a significant impact

on the focused PRA results and (3) changes made in common cause failures 1 l (documented in Chapter 29 Revision 7).

i L i As a result of this review some preliminary questions (Enclosure 1) were faxed to Westinghouse and a teleconference was held on February 12, 1997, to discuss l these questions. Based on this teleconference it was decided to turn the

! Enclosure 1 questions into formal reqeest for additional information.

1 Enclosure 2 contains the questions from Enclosure 1 as well as additional i questions that were not discussed during the teleconference. Therefore, it is  !

requested that Westinghouse formally respond to the questions in Enclosure 2.

4

! You have requested that portions of the information submitted in the '

j June 1992, application for design certification be exempt from mandatorr l public disclosure. While the staff has not completed its review of you. j l request in accordance with the requirements of 10 CFR 2.790, that portio; af i j the submitted information is being withheld from public disclosure pendir., the i i staff's final determination. The staff concludes that these followon ques- l

j. 'tions do not contain those portions of the information for which exemption is 1 i

' sought. However, the staff will withhold this letter from public disclosure for. 30 calendar days from the date of this letter to allow Westinghouse the

opportunity to verify the staff's conclusions. If, after that time, you do not request that all or portions of the information in the enclosures be i withheld from public disclosure in accordance with 10 CFR 2.790, this letter

will be placed in the Nuclear Regulatory Commission Public Document Room.

g WOW gg gCMS NI 70 3 >

! i 9704170005 970312 i PDR ADOCK 05200003

! A PDR

{ .

A< >

.3 Mr. Nicholas J! Liparulo . 4 March 12, 1997 If you have any questions regarding this matter, you.may contact me at (301) 415-1132.'

Sincerely, original signed by:

Joseph M. Sebrosky, Project Manager Standardization Project Directorate Division of Reactor Program Management Office of Nuclear Reactor Regulation Docket No.52-003

Enclosure:

As stated cc w/ enclosure:

See next page DISTRIBUTION:

• Enclosure to be held for 30 days

• Docket File , PDST R/F TTMartin

• PUBLIC TTMartin MSlosson TQuay TKenyon DJackson BHuffman JSebrosky WDean. 0-17 G21 JMoore, 0-15 B18 ACRS (11) NSaltos, 0-10 E4 JFlack, 0-10 E4 .,

l l

I DOCUMENT NAME: A:FCPR -

I

.ch n *.. ,.em. - i.i A SN.RAI

.sr. i we c<f ' =noui .ei. chm.nu.new... c copy wiin .ti. cam.nti.ncio.or. n . u. . y 0FFICE PM:PDST:DRPM SPSB:QRS4) D:PDST:DRPM l NAME JMSebrosky:rgd47 JF4ck'$W TRQuay.1TN DATE 03/ (f/97 l) 03/[e7% 03/it/97

\f 0FFICIAL RECORD COPY ,

i s 4 4

s

, i ..

Mr. Nicholas J. Liparulo Docket No.52-003 Westinghouse Electric Corporation AP600 i

cc: Mr. B, A. McIntyre Ms. Cindy L. Haag

] Advanced Plant Safety & Licensing Advanced Plant Safety & Licensing

Westinghouse Electric Corporation Westinghouse Electric Corporation Energy Systems Business Unit Energy Systems Business Unit P.O. Box 355 Box 355 Pittsburgh, PA 15230 Pittsburgh, PA 15230 Mr. M. D. Beaumont Mr. S. M. Modro

i. Nuclear and Advanced Technology Division Nuclear Systems Analysis Technologies Westinghouse Electric Corporation

' Lockheed Idaho Technologies Company i One Montrose Metro Post Office Box 1625

11921 Rockville Pike Idaho Falls, ID 83415 t Suite 350 Rockville, MD 20852 1

Enc ~osure to be distributed to the following addressees after the result of the proprietary evaluation is received from Westinghouse:

Mr. Ronald Simard, Director Ms. Lynn Connor Advanced Reactor Programs DOC-Search Associates Nuclear Energy Institute Post Office Box 34 i

1776 Eye Street, N.W. Cabin John, MD 20818 i Suite 300 l Washington, DC 20006-3706 Mr. Robert H. Buchholz j GE Nuclear Energy

Mr. James E. Quinn, Projects Manager 175 Curtner Avenue, MC-781 l LMR and SBWR Programs San Jose, CA 95125

! GE Nuclear Energy

< 175 Curtner Avenue, M/C 165 Mr. Sterling Franks San Jose, CA 95125 U.S. Department of Energy NE-50

! Barton Z. Cowan, Esq. 19901 Germantown Road Eckert Seamans Cherin & Mellott Germantown, MD 20874

} 600 Grant Street 42nd Floor ~

I Pittsburgh, PA 15219 Mr. Charles Thompson, Nuclear Engineer i AP600 Certification l Mr. Frank A. Ross NE-50 U.S. Department of Energy, NE-42 19901 Germantown Road i Office of LWR Safety and Technology Germantown, MD 20874 19901 Germantown Road Germantown, MD 20874 a Mr. Ed Rodwell, Manager PWR Design Certification Electric Power Research Institute

. 3412 Hillview Avenue Palo Alto, CA -94303 i

+

4 d

4

. - - _ . _ - . - . _ - _ _ _ . _ - _ _ - - - - - - - - - - - - - - - - .n

_ . _ _._ _ . _ . _ _ _ .~. _ _ _ .._ _ _ _ . . _ . . _ . _ _ _ _ _ . . . _ _ _ . -

i i

i p ..

DISCUSSION ITEMS FAXED TO WESTINGHOUSE i

1. Cut set #2: IEV-SGTR

• ADF-MAN 01

• RPX-CB-G0

• ADN-MAN 01C e

l a. Are there any T-H analyses to support this sequence? Can the leak be i stopped before uncovering the core or passing water through the

- secondary side safeties? How fast must the operator act to open ADS l stage #1 valves, given that this is not the preferred means? .(Notice i

that the operator will try to align CVCS in auxiliary spray mode l first; according to W HRA, p. 30-29 of PRA, this action requires a

! long procedure and about 10 minutes of actual implementation time).

l Are there any procedures to follow? l l b. This scenario assumes that even when the operator action ADF-MAN 01 l fails, the accident can be mitigated by manually depressurizing the 4 RCS.using ADS. How is this done? How much time does the operator i

have to perform this action to avoid uncovering the core or overfill-

, ing the SG7 What I&C system can the operator use to manually actuate

j. ADS?

2. Cut sets # 3, 6, 7, and similar including CCX-SFTW. It is not clear why a CCF across both PMS and PLS is considered while PLS is not supporting any system credited in the analysis.

3. Cutset #11. Credit for DAS is taken (ATW-MAN 04). Explain the reason.

4. Cutsets #34 and #65 (SGTR). Similar comments as for cutset #2. Are there any T-H analyses supporting the modeling of this sequence?

5. Cutsets # 40, #55, #59 and similar cutsets including more than one CCF of sensors and transmitters together with operator action (s). Need to i understand how all this I&C failures impact the human error probability. l

6. A change in the modeling of RCS leak events in the focused PRA was

-recently made which has a significant impact on the results. This change was not brought to the attention of-the staff. A failure probability of CVCS of about 4E-3/d was assumed even though one of the two CVCS pumps is in standby during normal plant operation. This implies a high reliability / availability of this system. How is this assured?

7. -In the latest revision of the PRA, the failure rate of IRWST check valves was changed from IE-6/hr to 2E-7/hr. Same is true for the failure rate of explosive (squib) valves (changed from 3E-3/d to 5.8E-4/d). These changes, which are not backed up by adequate data or analyses, have a significant impact on the focused PRA results. In addition, common cause failure data either are not available (e.g., squib valves) or could be much higher than those used in the AP600 PRA (e.g., check valves). The staff needs to understand the bases for the above mentioned changes in previously used data in the PRA.

Enclosure 1

- . - - -.~ - . . - - . - .-~ .. - . - - . .. . - - - . - . . - - - - . - -

i REQUEST FOR ADDITIONAL INFORMATION CONCERNING THE AP600 PRA l 720.371 Please explain the events and assumptions of cut set #2 (IEV-SGTR

• l ADF-MAN 01

• RPX-CB-GO

• ADN-MAN 010). In particular, the staff re- '

i quests the following:  !

i

a. Are there any T-H analyses to support this sequence? Can the

leak be stopped before uncovering the core or passing water through the secondary side safety valves?

! b. How fast must .the operator act to open ADS stage #1 valves

(event ADF-MAN 01), given that this is not the preferred means? ,

4 As is documented in the PRA, the operator will try to align CVCS i

in auxiliary spray arcde first. According to the HRA, p. 30-29 l of PRA, this action requires a long procedure and about 10 minutes of actual implementation time. Are there any procedures the operator must follow? Does event ADF-MAN 01 correspond to a  ;

system level actuation or to actuation of individual stage 1 valves using PLS? -

c. This scenario assumes that even when the operator action  ;

ADF-MAN 01 fails, the accident can be mitigated by manually '

depressurizing the RCS using ADS (event ADN-MAN 01C). On what event (s) is the probability of event ADN-MAN 010 " conditional?"

l How much time does the operator have to perform this action to avoid uncovering the core or overfilling the SG, given the other l event (s) will have to be diagnosed and potential actions com-pleted first? Is the modeling of this scenario in agreement I with the procedure that operators must follow? Please explain i by referring to HRA and other analyses documented in the PRA. j

d. Cutset #34 (IEV-SGTR

• RPX-CB-G0

• ADN-MAN 01) and cutset #65 (IEV-SGTR

• RPX-CB-G0

• LPM-MAN 01) imply a different emergency response procedure than cutset #2 for same scenario. What do the emergency response procedures instruct the operator to do when a SGTR event is followed by failure to trip of one or more RCPs? If the operator is instructed to depressurize the RCS, i what are'the times available for diagnosis and action? Please provide the basis for the assumed success criteria for the systems used to mitigate the accident. and for the time windows used in HRA.

720.372 'Several cut sets (such as #3, #6 and #7) include common cause software failure across both PMS and PLS (event CCX-SFTW). It is not clear why event CCX-SFTW is considered, given that PLS is not supporting any system credited in the analysis, instead of common cause software failure within PMS only (event CCX-PMXMODl-SW).

Please explain.

I Enclosure 2

+-,s.+ w v #e. -

r 4

J h l

l 720.373 It appears that credit for DAS (a nonsafety-related system) is taken I in the focused PRA (see event ATW-MAN 04 in cutset #11). Also, 2

, documentation is needed to support the assumptions made, with respect to unfavorable exposure time (UET) and related pressure  !

relief capability, in modeling ATWS events in the PRA. It seems 4

that the AP600 ATWS model was based on work performed for operating Westinghouse PWRs (documented in WCAP-11993, December 1988). There are concerns with the applic sility of the work documented in WCAP-Il993 to the AP600 design. For example: 1

~

I. a. WCAP-11993 indicates that, for a 24-month cycle, the primary pressure will n d exceed 3200 psig if both PORVs open (i.e., UET l 1s zero), given manual rod insertion (MRI) is successful and all

, auxiliary feedwater (i.e.,100 percent flow from both motor driven pumps and the turbine driven pump) is available. This is assumed to be applicable in the AP600 design without the benefit  !

of any thermal-hydraulic and/or neutronic analyses. Please '

provide the basis for the assumption made in the AP600 PRA that if either the PRHR or both SFWS pumps are available the "all l feedwater flow" condition of the WCAP-11993 study is satisfied, i b. According to the WCAP-11993 study, the probability of operator failure to act within one minute to step in the control rods is O.21 (WCAP-11993 page 4-20) which is much higher than the 3.3E-2 assumed in the AP600 PRA. In addition, as stated in WCAP-11993 page 3-8, SECY-83-293 (the basis for the ATWS rule) does not allow for short-term operator action to manually insert control rods to mitigate the transient. Please explain.

720.374 Several cutsets include more than one CCF of sensors and transmit-ters together with operator action (s), such as #40 and #59. Please  !

verify that all these I&C common cause failures do not adversely impact the human error probabilitics (as calculated in the PRA) and provide documentation of your finding in the focused PRA.

720.375 A change in the modeling of RCS leak events was made in the latest revision of the focused PRA which has a significant impact on the results. A failure probability of CVCS of about 4E-3/d was assumed even though one of the two CVCS pumps is in standby during normal plant operation. This implies a high reliability / availability of this system. How will this reliability / availability be assured?

720.376 In the latest revision of the PRA, the failure rate of IRWST check valves was changed from IE-6/hr to 2E-7/hr. Same is true for the failure rate of explosive (squib) valves (changed from 3E-3/d to 5.8E-4/d). These changes, which are not backed up by adequate data or analyses, have a significant impact on the focused PRA results.

In addition, common cause failure data either are not available

(e.g., squib valves) or could be much higher than those used in the AP600 PRA (e.g., check valves). The siaff needs to understand the

~

i

~

bases for the above mentioned changes in previously used data in the PRA. Following a telephone conversation with the staff, Westing-house submitted data (obtained from Sandia National Laboratories) which were used to develop the revised failure rates for squib valves. The Sandia data, however, are for a specific design of i standardized mini-valves used in weapons systems. Please explain  !

how the Sandia data can be applied to AP600 squib valves.

720.377- No reason is documented in the PRA for not modeling common cause l failure (CCF) of. check valves belonging to different systems, such '

as CMTs and Accueiulators. This can have a significant impact on the focused PRA results. Please provide the basis for not including such CCFs in the PRA.

720.378 The reactor vessel failure frequency assumed in the AP600 PRA was  !

recently changed from 3E-8/yr to IE-8/yr without any explanation. i This is an order of magnitude lower than the WASH-1400 value of I lE-7/yr. Please explain.

720.379 The common cause failure (CCF) probabilities for one IRWST injection line (event IWX-EVI-SA for squib valves and event IWX-CV1-A0 for check valves) were calculated as the failure of 2 out of 4 valves instead of 2 out of 2 valves. Please explain.

720.380 The staff could not find in the PRA an explanation of the assumed common cause failure probability for the reactor trip breakers  ;

(failura to open). In Chapter 32 of the PRA (Data Analysis and l Master Data Bank), the failure rate of PWR reactor trip breakers is listed to be 3E-3/d (page 32-13) while the common cause multiplier for a group of four breakers is listed as 6E-2 (page 32-27). This  !

implies a much higher CCF probability for the reactor trip breakers than the 8.lE-6 value currently used in the AP600 PRA. In page j 32-13, however, it is mentioned that a different failure rate was l used in the PRA and that this was explained in Chapter 26 of the  ;

PRA. The staff was unable to find such explanation in Chapter 26.

Please explain how the assumed CCF probability for the reactor trip breakers was calculated. Compare the calculated Also, please list the reasons the AP600 reactor trip breakers are assumed to be significantly more reliable than similar breakers in operating and evolutionary PRW reactor designs.

720.381 In Chapter 26 of the PRA (page 26-3) it is stated that "the value of 1.8E-06 failures / demand is used for mechanical failure of multiple rod cluster control assemblies to insert." Please explain why this failure does not appear in the submitted cutsets (for both baseline  ;

and focused PRA).

720.382 The probability of failure to trip the reactor through the Motor-Generator set, which involves the failure of both 480 V breakers to open (event MGSET), was calculated assuming a failure rate of

t 2

1 1

IE-7/hr and a two-year test interval (see page 31-4 of PRA).  !

According to Table 32-1, the failure rate of IE-7/hr was derived i

i from the demand failure rate of IE-3/d (recommended in EPRI's URD) '

by assuming monthly testing (note #4, page 32-18). However, using {

= the above assumptions, the staff calculated a standby failure rate i of about 3E-6/hr which is much higher than the IE-7/hr used in the

- AP600 PRA. Please explain. Also, list assumptions with associated i ' bases used in the model for converting the demand failure rate to hourly failure rate, such as test interval, failures from standby stresses (e.g., corrosion, dirt, lack of lubrication) and failures from stresses put on the component when it is demanded or operated (e.g., vibration, wear and torque).

i 720.383 It is assumed that the majority of the transient initiating event

categories (grouped as event IEV-ATWS-T) do not require reactor trip j for about 10 minutes (see page 6-58). This assumption may be optimistic since event IEV-ATW3-T includes some relatively frequent transients which tend to produce RCS pressure transients, such as

loss of RCS flow, turbine trips and loss of main feedwater to one 1

steam generator. Please explain.

i

j.  :

i i

i l

4

)

,- ~~