ML20138B143

Affidavit of B Mann Re Treatment of Operator Error in Licensing Process & Likelihood of Reactor Coolant Pump Restart During Inadequate Core Cooling Event.Prof Qualifications Encl

ML20138B143
Person / Time
Site:	Comanche Peak
Issue date:	03/12/1986
From:	Mann B Office of Nuclear Reactor Regulation
To:
Shared Package
ML20138B082	List: ML20138B075 ML20138B107 ML20138B143 ML20138B171
References
OL, NUDOCS 8603200288
Download: ML20138B143 (9)

Text

. _._ _ _ . _ _ _ _. . . __ _ _ .

d t

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE TI!F ATOMIC SAFETY AND LICENSING BOARD >

In the Matter of )

)

j TEXAS UTILITIES ELECTRIC ) Docket Nos. 50-445 i

COMPANY, et al. ~~

) 50-446 l )

i (Comanche Peak Steam Electric )

! Station, Units I and 2) )

i i .

AFFIDAVIT OF BERNARD MANN I, Bernard Mann, do depose and state as follows:

I f

Q1. h' hat is your name and the purpose of your affidavit?

} A1. My name is Bernard Mann. The purpose of my affidavit is to i

provide further explanation of the treatment of operator error in the licensing process and the likelihood of reactor coolant pump restart during an inadequate core cooling event, as requested by the  !

1 i Licensing Ecard in its Memorandun of September 18, 1985.

1 i  !

l i Q2. By whom are you employed and what are your duties?

i A2. I am employed as a Nuclear Engineer with the Reactor Systems i

l Branch, Division of PWR Licensin g-A , Office of Nuclear Reactor ,

Regulation, U.S. Nuclear Regulatory Commission, Washington, D.C.

. My duties include evaluation of the design and safety analysis of l reactor systems of nuclear power plants with respect to nuclear I

safety. As part of my duties, I have been responsible for reviewing I 8603200288 860317 i PDR ADOCK 05000445 G PDR l

i

O a

the safety analyses. for Comanche Peak containment paint effects on ECCS long-term decay . heat removal capability.

03. Have you prepared a statement of professional qualifications?

i A3. Yes, a copy of my professional qualifications is attached to my affidavit.

Q4. Ilow does the licensing process, in general, treat operator errors?

A4 The Staff review of Comanche. Peak included both the plant's safety analyses and vendor emergency response guidelines (ERGS) to ensure the Applicants' safety analyses have properly accounted for expected operator actions. Operations that have to be accomplished immediately or in a short time frame on occurrence of an accident, (e.g., reactor trip and safety injection actuation), are automatic.

If operator actions are assumed in a design basis safety analysis, 4

as they are for many accident scenarios , the Staff ensures that these actions can be accomplished within the time frame assumed and are part of the vendor ERCS. As an example, mitigation of the i

large-break LOCA for almost all PWRs requires operator action to i

accomplish switchover from injection to recirculation phase prior to i

refueling water storage tank (RWST) depletion. Since these actions are mandated in the vendor ERGS and the times and the specific actions assumed are reasonable, the Staff safety evaluation credits i

these actions for accident mitigation.

l l

The Staff does not require applicants to assume operator errors of omission if the ERGS specify these actions, and if the time frame in which these actions are assumed to be taken . is reasonable. The ERGS are structured so that. sufficient time is available for operator 4

actions. Thus, initial operator errors of omission could generally be corrected for in a timely manner without unduly severe consequences. f Also , applicants are not required . to specifically assume operator

errors of commission provided the required actions rire specified i

by the ERGS. If operators are not requi:e'd to take a specific action and if the plant indications would not indicate the need to take a specific action, then the Staff does not require the assump-l tion of that action. Likewise , if there are specific steps in the ERGS to prohibit a specific action, the Staff does not require i

j applicants to assume the operators ignore them. Finally, ERGS 4

usually provide built-in " checks" so that, if an operator does make a i

mistake, the procedures will help the operator realize it and correct l it. Logical transitions are provided from design basis accident (e.g., LOCA guidelines) to contingency guidelines , which may involve "beyond design basis" accidents (e.g. ICC), including situations that may be caused by operator error during accident i mitigation.

1 This does not mean, however, that the Staff allows applicants to omit l safety significant scenarios merely by procedural steps. As an I

! example of this philosopbv, there are electrical interlocks to prohibit operators from inadvertently aligning the low pressure RI!R system

(

i l

, - 4.-

to the reactor coolant system (RCS). when the RCS pressure is high enough to possibly overpressurize -the RHR system. Such a scenario could have severe consequences since the result could be a LOCA that bypasses containment.

i Also, a spectrum of operator errors is inherently considered as part of the single failure analysis. Because the Staff does not require the cause of single failures to be specified, many single failures could be considered to be caused by operator error as well as other causes. systems As pointed out in. the response to Question 5, j required for accident mitigation possess suitable redundancy to l perform their intended safety function with occurrence of a single i failure.

i i

In summary, the Staff allows applicants to take credit for operator actions if the actions are reasonable, timely, and covered in the i

vendor ERGS. The Staff does not require applicants to assume l operator errors of commission if the error is not a reasonable error i

j for the operator to make or if the ERGS specifically direct the i

operator not to take the action in question. In some design basis situations, the Staff requires more than procedural measures to ensure selected inadvertent actions that could have severe

consequences cannot occur. Finally, the ERGS are structured to be i "self-correctin g , " and guidance is provided to help the operator identify abnormal symptoms indicating that a procedural error was j made, and to take the necessary corrective action.

l l

t i

{ QS. What is an Inadequate Core Cooling (ICC) Event? Under what circumstances are the Reactor Coolant Pumps (RCPs) restarted during an ICC?

Q5. ICC is an accident condition caused by a substantial loss of primary 4

i coolant without sufficient makeup (safety injection) and/or secondary l heat removal. The Westinghouse Emergency Response Guidelines

[ (ERGS) describe the symptoms that would alert the operators to the existence of an ICC event as either (1) a core exit temperature greater than 1200oF, or (2) a reactor vessel level indication of less than 33 feet above the bottom of the active fuel combined with a core exit temperature greater than 7000F. For the recirculation phase of a small break LOCA this would only occur in the event of multiple t

ECCS failures and/or a complete loss of the secondary heat sink.

! This combination of failures is well beyond the. design basis accident i considered in licensing of not only Comanche Peak, but for all LWRs.

j In the course of CPSES licensing, the Staff has reviewed the CPSES 1

1 systems required for LOCA mitigation. These include a variety of engineered safety feature (ESF) equipment including the emergency j core cooling system (ECCS), auxiliary feedwater system, component I

cooling water system , service water system, ultimate heat sink ,

I containment heat removal systems , and emergency power systems.

l The ECCS consists of redundant high and low pressure safety injection (SI) subsystems and a passive subsystem (i .e . , the accumulators) . The Staff requires applicants to demonstrate that these systems meet the NRC acceptance criteria, including the  :

l 1 i 1

)

J

. , , , , . . . , . .-.-----._-.,-..._m ,_-,,.m...~.---e ,-..m -- , ,,..m. . , , . , , , , _ _ , . - - - , - - . . .-m-..-- ,..,y,- , -

i I

l i

1 i appropriate GDCs, prior to issuance of an operating license. This includes suitable redundancy, seismic category 1 and nuclear safety grade requirements. Electrical components required for eccident mitigation must have the capability to be powered from emergency sources during the accident. The safety analyses for the large-and small-break LOCA .have been performed utilizing NRC approved codes. Multiple ECCS failures and a loss of the secondary heat sink depressurization capability in the event of a LOCA with consequent occurrence of ICC would be highly unlikely.

Should sufficient failures occur to produce an ICC situation, the major actions to be performed per the Westinghouse guidelines are, in the order of their priority: (1) Attempt reinitiation of high pressure safety injection (HPSI), (2) Attempt rapid secondary depressurization, (3) RCP restart and/or open the pressurizer PORVs. Thus, if the operator were successful in restoring adequate i

core cooling via the HPSI or by rapid secondary depressurization,

both of which rely on redundant , safety grade equipment , there would be no need for RCP restart. If the first two actions were unsuccessful, the RCP would be restarted as a "last resort". This would be beneficial in providing two phase flow through the core, thuc improving core cooling. As noted above, ICC can only occur if multiple failures occur and go uncorrected for an extended period of

time . Also, RCP restart during an ICC event would not be necessary if the other actions (IIPSI actuation or rapid secondary blowdorm) are successful, i

e

., -. . - , - - .-g - -.- , . - - , , -

ag. , - - . , - - - - . - - - . - - - , . . - - . - - . , _ . , , , , , , - - , , , . - . ,.,,-. .,,

4 C6. What is the Applicants' estimate of the likelihood of RCP restart i during an ICC event, .and what is the Staff's assessment of this j evaluation?

A6. The . Applicants have stated that " the event frequency for a small LOCA with a loss of high pressure SI and failure of steam release l capability" [i.e., an ICC event with failure of the HPSI pumps and inability to open the atmospheric dump valves ( ADVs), thus requiring RCP restart] "is less than 10 per reactor year." The l bases provided by the Applicants for this conclusion are: (1) an

-2

initiating event frequency for small LOCA of 3.54x10 / year; (2) a i

failure frequency of primary system feed through SI or charging /SI

-7 pumps of 1.1x10 (presumably per demand); (3) "a failure frequency of a single valve" (presumably an ADV) "to bound the failure frequency of steam release capability of 1x10~ / year."

Element (3) should have been stated in terms of " failure frequency per demand" rather than "feilure frequency per year." The Applicante concluded that RCP restart following a small LOCA is an

! extremely low probability event, i

i The Staff considers the failure frequency of the SI pumps of 4 -

~

{ 10 '/ demand assumed by the applicants to be optimistic. As

{

1 indicated in the response to Question 5, the SI system is safety i

j grade and possesses suitable redundancy. Nevertheless, these

[ systems are vulnerable to common cause failures , auch as j maintenance and operator error, loss of support system or loss of a common water source. Based on probabilistic safety studies on l i

l

1 I.

ea-------m-w- --r-e + w-w--- r- - - - - - - - =ime 9 yc wm----w- 9e> -,-ki-e-r -m*-pi-w---wi---e-v-m,-w=etg-----g-eww w e- +- o w e eWc7Ter--T --y

similar plants , the ' range of system unavailabilities for the high pressure recirculation system is estimated to be 5.8x10' to 5.9x10' per demand and range for the low pressure recirculation system is estimated to be 4.9x10' to 3.0x10-3 per demand.

The Staff does not believe it necessary to quantify this event probability, but nevertheless concludes that RCP restart during an ICC situation is a low probability event. As noted in the response to Question 5, RCP restart during an ICC is a "last resort" action.

If an ICC condition did exist, and the first two operator actions (reinitiation of IIPSI and rapid secondary system depressurization) i were unsuccessful in eliminating the ICC symptcms, then the

, operator is instructed by procedure to start the RCPs. This is

! because, without any action, the ICC event will most likely progress to a core melt situation.

l Th erefore , the Staff believes it is preferable to restart the RCPs j under ICC conditions, even if paint debris had been introduced in

the sump, since restarting the pumps can only serve to extend the i time available for operator action (e.g., reattempt restart of an SI l

l pump or reattempt steam dump) before core melt occurs.

OLL'Wk CLL W 13ernard Mann

! Subscribed and sworn to before me l this (7h day of fhQ,[h . 1986 C h i@ l Notary Public i

My Commission expires: I

)

e 1

1

i e

PROFESSIONAL QUALIFICATIONS 4 ,

I

" BERNARD .MANN Reactor Systems Branch

! Division of Systems Integration j- Office of Nuclear Reactor Regulation a

U.S. Nuclear Regulatory Commission i

i I am employed as a Nuclear Engineer with the Reactor Systems Branch, Division of PWR Licensing-A, office of Nuclear Reactor Regulation, U.S.

i Nuclear Regulatory Commission, Washington, D.C. My duties include evaluation of the design and safety analysis of reactor systems of nuclear power plants with respect to nuclear safety. As part of my duties , I have been responsible for reviewing the safety analyses for i Comanche Peak containment paint effects on ECCS long-term decay heat removal capability, i I have been associated with nuclear energy licensing, design, systems i analysis , project and test engineering. From 1955 to 1960 I was 2

employed by the Westinghouse Electric Corporation, Bettis Atomic Power

, Laboratory, where I performed systems design , analysis and process

! engineering work on pressurized water systems for naval reactors. From j 1960 to 1968 I was a senior engineer with Aerojet-General Corporation, l performing project, systems, and test engineering work connected with 1

space nuclear power programs. From 1968 to 1969 I was employed by 4 Battelle-Northwest on the Fast Flux Test Facility (FFTF) program as I resident engineer in their Atomics International Office. From 1970 to i 1972 I was a senior engineer with C. F. Braun & Co., where I i performed systems design work on nuclear power and process projects, including the fast breeder reactor, l From 1972 to 1977 I was employed by the Atomic Energy Commission 1 (subsequently NRC) in the Auxiliary and Power Conversion Systems Branch and Effluent Treatment Systems Branch. From 1977 to 1980 I ,

i was a Nuclear Engineer with Fnergy Research and Development Administration (subsequently Department of Energy) in the Division of

! Nuclear Research and Application and subsequently in the Division of l Nuclear Waste Management. 'n 1980 I rejoined NRC as a senior systems

{ engineer with the Auxiliary Systems B ranch. In 1982 I commenced l working for. the Reactor Systems Branch.

l I attended the University of Louisville where I received a P.achelor of I

Chemical Engineering degree in 1948. I received a Master of Science

, degree in chemical engineering from the Univesity of Cincinnati in 1949.

1 I also attended specialized courses in nuclear technc ogy offered by the i NRC, Westinghouse, Acrojet-General Corporation. and University of Cali-fornia-Los Angeles, i I am a licensed professional engMeer, registered in Pennsylvania.

I

! )

_ . . _ ., _ ___ _ . _ _._..__ _ -_-_ _ _ _ __ _ _ _ _ . _ _ _