ML20140F377

Safety Evaluation Supporting Staff Evaluation of Plant, Unit 3 Nuclear Generating Plant IPE

ML20140F377
Person / Time
Site:	Crystal River
Issue date:	04/28/1997
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20140F349	List: ML20140F344 ML20140F377 ML20140F384
References
GL-88-20, NUDOCS 9705020274
Download: ML20140F377 (7)

Text

____

p ""'Go p k UNITED STATES j

%t j t

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001

\, ...../

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REGULATORY RESEARCH SUPPORTING STAFF EVALUATION OF CRYSTAL RIVER UNIT 3 NUCLEAR GENERATING PLANT INDIVIDUAL PLANT EXAMINATION FLORIDA POWER CORPORATION. ET AL.

DOCKET NO. 50-302

1.0 INTRODUCTION

Un March 9,1993, Florida Power Corporation (licensee) submitted the Crystal River Unit 3 (CR3), Nuclear Power Plant Individual Plant Evaluation (IPE) in response to Generic Letter (GL) 88-20 and associated supplements. By letter dated September 19, 1995, the staff issued a request additional information (RAI). The licensee responded in a letter dated November 22, 1995. Also, in July 1996, the NRC staff and its consultant, Brookhaven National Laboratory, had telephone discussions with the licensee.

A " Step 1" review of the CR3 IPE submittal was performed and involved the efforts of Brookhaven National Laboratory in the three review areas: front-end, human reliability analysis (HRA), and back-end. The Step 1 review focused on whether the licensee's method was capable of identifying vulnerabilities. Therefore, the review considered: (1) the completeness of the information, and (2) the reasonableness of the results given the CR3 design, operation, and history. A more detailed review, a " Step 2" review, has not been performed for this IPE submittal. A summary of staff's findings is provided below. Details of the contractors' findings are contained in a technical evaluation report appended to this staff evaluation (SE).

The submittal states that the licensee intends to maintain a "living" probabilistic risk assessment (PRA).

2.0 EVALUATION CR3 is a Babcox & Wilcox Pressurized Water Reactor with a large, dry containment. The CR3 IPE has estimated a core damage frequency (CDF) of 1.4E-05 per reactor-year from internally initiated events, not including the contribution from internal floods, anticipated transients without scram (ATWS), or interfacing systems loss-of-coolant accidents (ISLOCAs). Small loss-of-coolant accidents (LOCAs) contributed 51 percent to plant CDF, station blackout (SBO) contributed 24 percent, medium LOCAs contributed 12 percent, transients contributed 5 percent to the CDF, and steam generator tube rupture (SGTR) contributed 4 percent.

The total flood CDF is approximately 1.3E-06 per reactor-year (in addition to the reported CDF), resulting from two scenarios, service water pipe break in 9705020274 970428 PDR ADOCK 05000302 9 PDR VOc

l the auxiliary building, and overflow from.the decay heat pit onto the auxiliary building floor. ISLOCAs. (and reactor vessel rupture) were considered separately and found not to be significant contributors, on the l order of IE-07 per reactor-year. Similarly, a scoping study was performed for

! ATWS and it was described as only a minor contributor to CDF. .

The staff notes that the CR3 CDF is the lowest of the Babcox & Wilcox plants.

l The low CDF in of itself, is not necessarily indicative of an adequate PRA

! process. It is important to address the weaknesses identified below to understand their role and contribution to the CDF and the overall IPE process.

Neither the front-end, HRA, nor back-end portion of the IPE submittal (including related licensee responses to the RAI) were complete to the extent necessary for the staff to complete its assessment of adequacy with respect to '

the intent of GL 88-20. ,

i The following list provides a summary of the apparent front-end weaknesses: i

1. Two initiating events; loss of de pcwer and loss of non-nuclear  ;

instr'imentation, which have the potential to result in dominant accident sequences, were not included in the CR3 IPE analysis and l their omission requires justification. LOCAs are dominant I contributors to core damage at CR3, as reported by the licensee, i However, the small and large break LOCA frequencies are about an  :

order of magnitude lower, and the medium LOCA about half the l l frequencies described in NUREG/CR-4550. These frequency values l

require justification. The staff believes that these values may be sufficiently low as to erroneously impact the importance of these initiators.

2. ISLOCAs were not found to be significant contributors to CDF at CR3.

The ISLOCA analysis, although detailed, appears to have arbitrarily j assumed that only 10 percent of valve ruptures occur in the critical parts of the valve, and the rest occurring in the valve bonnet. This assumption may have significantly influenced the ISLOCA result that they are not significant contributors to CDF at CR3. Since ISLOCAs themselves, can be a large component of the risk of offsite radionuclide release, the assumption regarding valve rupture locations require justification.

, 3. Certain aspects of the flooding analysis, for example, treatment of drains and maintenance induced floods, do not appear to have been included. Inclusion of these aspects may increase flood CDF. Their exclusion may mask potential procedure-based vulnerabilities.

l 4. The staff frequently uses NUREG/CR-4550 as a basis for comparison with

, IPE submittal data. For CR3, the plant-specific turbine driven i emergency feedwater pump failure-to-run probability appears to be two i

i

\

i 1

orders of magnitude lower than NUREG-4550. This is an important plant feature for dealing with SB0 situations and may contribute to an ,

understated contribution to CDF from an SB0.  :

5. As the licensee has indicated, common cause failures play a significant role in the CR3 IPE. While somewhat comparable to NUREG/CR-4550 values, the CR3 common cause beta factors are consistently lower, without adequate justification. In addition, common cause effects between the l turbine driven and motor driven emergency feedwater pumps are not currently in the IPE model. Use of low values may skew the ranking of predominant accident sequences and mask potential vulnerabilities.

The licensee performed an HRA to document and quantify potential failures in I human-system interactions and to quantify human-initiated recovery of failed systems. The licensee identified the following operator actions as important in the estimate of the.CDF (since no human action importance ranking was performed these are not necessarily listed in order of importance): >

1. Failure to transfer to high pressure recirculation during a small break LOCA or SGTR,

2. Failure to refill the borated water storage tank during an SGTR or failure to isolate borated water storage tank transfer to the containment sump.

3. Failure tc transfer to the startup transformer after loss of offsite  ;

power transformer, i

Failure to cross-tie decay heat pump trains, 4.

5. Failure to switch to spare battery chargers.

Despite the fact that a generally viable HRA approach was used in the CR3 IPE submittal, several weaknesses, listed below, have been identified regarding how the analysis was conducted, or at least in the licensee's documentation thereof: l l

1. Post initiator human actions included recovery actions which typically  ;

are not covered by procedures. No justification was provided, however, ,

for any of the modeled non-proceduralized actions and without such t justification there does not appear to be an adequate basis for the human error probabilities (HEPs) assigned to the events.

2. Limited consideration of plant-specific performance shaping factors and dependencies and inadequate treatment of these factors can result in  :

HEPs which are more generic in nature than plant-specific. Thus, an <

opportunity is lost to gain insights into operator performance. Also, ,

the resulting HEPs may be either optimistic or pessimistic, especially '

when dependencies are involved which, if ignored, could lead to low HEPs. i 1

- - - . ~ _ - . . ~ ~ . - - ~ . . . - .-_ . . .-

1 1

_4

3. Documentation was inadequate on the process used to determine the time available for operators to diagnose needed actions and on the time needed to conduct the actions (particularly outside the control room).

In general, because of the sparse documentation, it is not clear that time was appropriately considered in the quantification of operator actions.

The. licensee evaluated and quantified the results of .the severe accident progression through the use of a containment event tree but did not consider uncertainties in containment response through, for example, the use of sensitivity analyses or other methods, as requested in GL 88-20. Table A.5,

" Parameters for sensitivity study," of Appendix A, " Approach to Back-end Portion of IPE," to NUREG-1335 provides a list of suggested in-vessel and ex-vessel phenomena which are likely to have a large effect on containment performance and are, consequently, good candidates for sensitivity studies.

According to the licensee, the CR3 conditional containment failure probabilities are as follows: early containment failure is 3 percent with direct containment heating and hydrogen burns the primary contributors; late containment failures is 63 percent, with gradual overpressurization from loss l of containment heat removal and basemat meltthrough being the primary contributors; and bypass is 5 percent, with SGTR the primary contributor.

According to the licensee, the containment remains intact 29 percent of the time. Early radiological releases are dominated by SB0 sequences and late releases are dominated by LOCA sequences. J The staff noted the following weaknesses in the back-end portion of the IPE:

1. Because a sensitivity study, as recommended in NUREG-1335, was not performed, the IPE did not provide any quantitative insights on how containment failure probabilities would change if uncertainties in containment phenomena were considered.

2. A relatively low source term (i.e., a release fraction less than 2E-06 for iodine and cesium), resulting from the late containment failure mode with no containment systems available, was reported by CR3, without adequate justification.

3. The discussion of plant-specific seal materials and their properties at elevated temperatures is not adequate. The licensee has stated that their gross containment failure pressure is slightly lower than many other similar large, dry containments. Since this failure pressure is approximately the same as the typical failure pressure for seal material

' failure under harsh conditions, they stated that it was not necessary to investigate seal behavior, since either the containment or the seals would fail at about the same time. The staff disagrees since it may be determined that the existing seal material may, itself, have lower performance characteristics than the norm as did the containment structure, and consequently, may fail at a lower failure pressure than the containment.

1

4. Containment isolation failure was not discussed in enough detail for the staff to determine whether the analysis addressed the areas identified

, in GL 88-20.

5. There was virtually no discussion of the containment performance improvements program issue concerning the important phenomenology of hydrogen pocketing and detonation during accident progression following

, a core melt.

I' The licensee reviewed core damage cutsets "for sequences with unusually high  ;

frequencies, sequences hinting of some heretofore unknown dependency, and risk significant sequences which can easily be reduced to risk insignificant via a procedure change or a minor hardware change." Based on this concept, the '

4 licensee did not identify any vulnerabilities. Similarly, no plant 2

improvements were identified. As discussed below, the staff is concerned, however, that the CR3 IPE process, as described in the submittal, including 3 the qualitative definition of a vulnerability, may not be adequate to uncover 1

vulnerabilities or point to appropriate plant improvements.

3.0 CONCLUSION

In addition to the staff concerns raised about the front-end, HRA, and back-

end portions of the IPE, the staff also notes some general issues of concern.

i The sections of the IPE submittal on plant improvements is very brief since none emerged from the analysis. Similarly, there was no discussion of '

insights. This suggests that one of the benefits of GL 88-20 may not have been gained (i.e., "the. maximum benefit from the IPE would be realized if the licensee's staff were involved in all aspects of the examination to the degree that the knowledge gained from the examination becomes an integral part of plant procedures and training programs."). To date, we do not have assurance

that IPE-based knowledge has been incorporated into the plant operations.

In summary, given the information contained in the CR3 IPE submittal, the associated licensee teleconference responses, and their written responses to the staff's Request for Additional Information, the staff is unable to l conclude that: (1) the licensee's IPE is complete with regard to the information requested by GL 88-20 (and associated NUREG-1335), and (2) the IPE results are reasonable given the CR3 design, operation, and history. Areas of

. staff concern have been documented in the three review areas, front-end d analysis, HRA, and back-end analysis, which, taken together, represent

< sufficient weakness in the licensee's approach that we cannot conclude that the four general objectives of the IPE program, listed below, were met by the .

licensee for CR3: 1

1. To develop an appreciation for severe accident behavior,

2. To understand the most likely severe accident sequences that could occur at the plant,

3. To gain a more quantitative understanding of the overall probabilities of core damage and fission product releases, and

l j

4. If necessary, to reduce the overall probabilities of core damage and fission product releases by modifying, where appropriate, hardware and 1 procedures that would help prevent or mitigate severe accidents. l Consequently, the staff cannot conclude that the licensee's IPE process was capable of identifying vulnerabilities that could be fixed with low-cost imprcvements. Therefore, the staff cannot conclude that the CR3 IPE has met the intent of GL 88-20. ,

i Appendix: Technical Evaluation Report Principal Contributor: J. Lane Date: April 28, 1997 l

l l

1 1

I l

I J

4 APPENDIX CONTRACTOR TECHNICAL EVALUATION REPORT