ML20148D544

Safety Evaluation of Prairie Island Nuclear Generating Plant Individual Plant Exam

ML20148D544
Person / Time
Site:	Prairie Island
Issue date:	05/16/1997
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20148C745	List: ML20148C739 ML20148D544 ML20148D546
References
NUDOCS 9705300279
Download: ML20148D544 (6)

Text

. - - __- - - _ . - - - . - . -. - .. _.- - - - - _ - - _. -

, e

~!

4 .

l PRAIRIE ISLAND NUCLEAR POWER PLANT INDIVIDUAL PLANT EXAMINATION

. STAFF EVALUATION REPORT 4

I -

. _ _ . . . . __ u ._

1 . _ . . _ ._ _ _ _

} I. INTRODUCTION i

Dn March 1,1994, Northern States Power Company submitted the Prairie Island

Nuclear Generating Plant Individual Plant Examination (IPE) submittal in

. response to Generic Letter (CL) 88 20 and associated supplements. On December 21, 1995, the staff sent a set of questions to the licensee seeking

additional infonnation and clarification. The licensee provided its formal response to the staff's questions in a letter dated February 27, 1996. On August 2,1996 the staff sent another set of questions to the licensee. The j licensee responded in a letter dated September 5, 1996.  ;

l A " Step 1" review of the Prairie Island IPE submittal was performed and involved the efforts of Brookhaven National Laboratory in the front-end and the back-end analyses, and Sandia National Laboratory in the human reliability analysis (HRA). The " Step 1" review focused on whether the licensee's method 4

was capable of identifying vulnerabilities. Therefore, the review considered

, (1) the completeness of the information and (2) the reasonableness of the results given the Prairie Island design, operation, and history. A more i

. detailed review, a " Step 2" review, was not performed for this IPE submittal.

Details of the contractor's findings are in the attached technical evaluation report (Appendix A) of this staff evaluation report.

In accordance with GL 88-20, Prairie Island proposed to resolve Unresolved d

Safety Issue (USI) A-45, " Shutdown Decay Heat Removal Requirements." No other specific USIs or generic safety issues were proposed for resolution as part of the Prairie Island IPE.

II. EVALUATION -

Prairie Island is a Westinghouse 2-loop pressurized water reactor with a large dry containment. The Prairie Island IPE has estimated a core damage frequency  ;

(CDF) of SE-5/ reactor-year from internally initiated events, including the  !

contribution from internal floods. The Prairie Island CDF compares reasonably 4 with that of other Westinghouse 2-loop PWR plants. Loss-of-coolant accidents i 3

(LOCAs) contribute 24%, station blackout (SBO) 22%, internal flooding 21%,  !

transients (without loss of offsite power) 19%, and steam generator tube l ruptures (SGTR) 13%. The licensee's Level 1 analysis appeared to have 1i examined the significant initiating events and dominant accident sequences.

! Based on the licensee's IPE process used to search for decay heat removal

.. (DHR) vulnerabilities, and review of Prairie Island plant-specific features, 2

the staff finds the licensee's DHR evaluation consistent with the intent of the USI A-45, Decay Heat Removal Reliability, resolution. .

I The licensee performed an HRA to document and quantify potential failures in human-system interactions and to quantify human-initiated recovery of failure ENCLOSURE j

r 9705300279 970516 PDR ADOCK 05000282 P PDR We = -m e oe= gew- e ,w .

e-*- ,r a-t-+-*w-<r=- e

i > <

~

I  :}

l.

events. However, in the analysis of pre-initiator human actions, the licensee

! did not explicitly model miscalibration events. The licensee's treatment of  ;

,! miscalibration events may have precluded identification of important pre-l[ initiator events and is therefore a weakness of the HRA. The licensee identified the following operator actions as important in the estimate of the j )

. CDF: 1. Feed and bleed. 2. Cooldown and depressurize reactor coolant system (RCS) to stop steam generator (SG) tube leak before SG overfill.

3. Transfer to recirculation during large LOCA. 4. Transfer to recirculation during medium LOCA. 5. Open doors on loss of room cooling.

6. Crosstie to Unit 2 motor-driven auxiliary feedwater (AFW) pump.

7. Cooldown and depressurize RCS to stop SG tube leak after SG overfill.

i; 8. Transfer Unit 2 AC to Unit I during Unit 1 S80. The HRA review of the IPE i submittal did not identify any significant problems or errors. A viable

!; approach was used in performing the HRA and nothing in the licensee's 1i submittal indicated that it failed to meet the intent of GL 88-20 in regards lp to the HRA.

l The licensee evaluated and quantified the results of the severe accident i, progression through the use of containment event trees. The licensee's back- l end analysis appeared to have considered important severe accident phenomena. l According to the licensee, among the Prairie Island conditional containment failure probabilities, early containment failure is negligibly small (1%) with  !

hydrogen burns being the primary contributor, late containment failure is 23%

with overtemperature/ overpressure being the primary contributor, and bypass is 45% with SGTR being the primary contributor. Also according to the licensee, the containment remains intact 32% of the time. Early radiological releases ,

are dominated by containment bypass sequences and late releases are dominated by small LOCA sequences. The licensee's response to the Containment Performance Improvement Program recommendations is consistent with the intent of GL 88-20 and associated Supplement 3. The back-end review of the IPE submittal did not identify any significant problems or errors. The quantification of the containment event trees seems adequate.

h Some insights and important plant safety features identified at Prairie Island by the licensee are:

[

1. Both D1 and D2 diesel generators '(DGs) rely on cooling water for engine cooling functions. (The other two DGs are from a different manufacturer and do not require an external cooling medium as they have their own self-contained cooling systems.)

, 2. Both main feedwater (FW) and feed and bleed cooling are dependent on common support systems; instrument air (IA), cooling water and DC power.

l 3. Cooling water, IA, and control room chilled water systems are shared i by both units. These are systems that are required to be fully operational when either unit is at power. Maintenance on these systems is normally performed while both units are at power.

Maintenance activity may influence negatively the availability of these systems.

l 1

• - ..-. e. ,.w w -

musimm==w w w-y-

s t i

k. -

(  :

!! 4. The AFW pumps for both units are all located in the same room such

{ that a pipe rupture in the loop A or B cooling water line can result j ?- in the failure of all AFW for both units. ._ .

It 5. The IA compressors are also located in the same room as the AFW pumps such that all the compressors could fail because of a flood. Loss of

IA would fail feed and bleed because the pressurizer power-operated j, relief valves (PORVs) require IA to operate.

4i

, 6. FW regulating and bypass valves fail closed also en loss of a train

of DC. '

a .s i 7. The emergency batteries have only 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of capacity.

!; 8. The IA air supply to containment has two fail-closed air-operated

t valves that are in series on either side of the containment i penetration. Failure of either valve results in loss of IA to containment.

! 9. Loss of IA will cause the control room chiller outlet cooling water

i. valves to close resulting in loss of chilled water and loss of room

? cooling to the Unit 1480 V safeguards bus rooms. Without operator l intervention, the rooms can heat up and fail the 4160/480 V transfomers resulting in a lo:s of all Unit 1480 V safeguards

equipment. This would causa loss of all charging pumps resulting in i a loss of all reactor coolant pump (RCP) seal cooling causing an RCP seal LOCA in which the safety injection (SI) system would not be available for mitigation.

10. Both RCP seal cooling and RCS short-tem inventory control are dependent on cooling water. Cooling water provides the ultimate heat sink for.the component cooling water system which provides cooling to the RCP thermal barrier and the SI pump lube oil coolers. Cooling ~!

water also supplies a heat sink for the control room chillers which provide room cooling for the Unit I safeguards 480 V bus rooms. On loss of cooling water, room cooling is lost to the Unit I safeguards 4

480 V bus room. Without operator intervention the room can heat up and fail the 4160/480 V transfomers resulting in a loss of all Unit 1 480 V safeguards equipment.

After the submittal of the IPE, each of the 480 V buses was split into two and now each of.the buses carries half of the original loads. In addition, the buses are now located in different rooms.

I i 11. The IA system has a high failure probability as the system success

! criterion is such that if two out of three compressors fail, IA is i considered failed. A single compressor cannot maintain adequate I header pressure for both units.

+

12. Feed and bleed cooling is heavily dependent on operator action for success as the operator must manually start an SI pump and open a pressurizer PORV for success.

i k

i

_ ~..._ _ _ _ .. _. __

7 .

.~. -

y * ) f f

it .

1 l l t 13. Following a small LOCA the SI pumps are the only injection sources A that can be used for short-tem RCS inventory control because the RCS

! pressure remains above the shutoff head of the residual heat removal F (RHR) pumps.

-~ ~- - -

.' 14. Given a medium LOCA, switchover to high head recirculation cannot be i performed from the control room as the RHR to SI crossover motor

{ valves have their breakers locked in the open position. The switchover to high head recirculation must be accomplished within a i small time window (about 26 minutes) during which both the SI, a containment spray (CS) and/or the RHR pumps are injecting from the

- refueling water storage tank (RWST). If the operator fails to stop l

l. any of the pumps before the RWST level decreases below approximately 5%, all pumps will be damaged as they do not have suction trips.

l t; 15. The breakers for SI pump suction motor-operated valves from RHR are locked open during power operation.

t 1 i 16. The cavity design facilitates flooding of the reactor cavity for I i vessel cooling. Flooding of the cavity is accomplished through two personnel access hatches (located on the instrument tunnel) which are l1 left slightly ajar during nomal operation. Since the water going

into the instrument tunnel may pull the doors closed, the licensee recommended securing the hatches open by installing a solid bar or other device, instead of a chain. ,

[ 17. The steel shell containment may be subject to a direct attack by

+

dispersed core debris. The access hatches to the instrument tunnel

! are in an open area on the basement level of the containment, and for i both of the Prairie Island units one of the two hatches faces toward the steel containment, about 30 ft away, with a largely unobstructed i path in between.

18. ---The plant has a large containment volume and a high containment k' pressure capability. In addition, the open nature of containment compartments facilitate good atmospheric mixing.

19. The fan cooler units and the CS system are two separate systems for l containment atmosphere cooling and pressure suppression.

20. The emergency procedure " Response to inadequate Core Cooling" that i requires the restart of RCPs creates the possibility of inducing an i SGTR during an event in which degraded core cooling conditions already exist. A recoseendation was made for revising the emergency procedure.

h. As noted, these improvements were identified by the licensee. The NRC staff has not reviewed them for, and takes no position on, their appropriateness or adequacy.

I The licensee used the following criteria to determine whether any

, t vulnerability existed at the plant:

t t

f r

= .

?

t _

1. Are there any new or unusual means by which core damage or

! containment failure occur as compared to those identified in other probabilistic 1 risk assessments (PRA)?

2. Is there adequate assurance of no undu'e risk to public health and safety? ,

i i

Using these criteria, the licensee identified no vulnerabilities because the i accident classes contributing to the CDF at Prairie Island are comparable with those calculated in PRAs of similar nuclear plants, and the overall CDF at Prairie Island is also comparable with other plants.

The licensee derived several insights regarding potential improvements as a i result of the IPE; improvements that were either under consideration or appear to have been implemented by the licensee are:

1. A crosstie from station air to IA was proceduralized in C34 AOP1,

, Rev. O.

2. The procedure C35 AOPI, Rev.2, " Loss of cooling water (CL) Water Header A or B" should be revised such that the crosstie between CL loop A and B could be used.

3. To constrain the impact of AFW pump room flooding,. the interim measures were to modify the side doors to promote water flow out of the room, or close the fire door between the two halves of the room and render the door to be " water tight." -

. 4. Enhance operator training in the following items:

1. The feed and bleed process.

11. Using a crosstie between the motor-driven auxiliary

.. feedwater pumps.

iii. Switchover to high and low head recirculation.

iv. RCS cooldown and depressurization to terminate SI before ruptured SG overfill.

5. Revise the emergency operating procedure that requires the restart of the RCPs under inadequate core cooling condition. The operator should check for adequate SG 1evel before attempting to start the RCP.

6. Secure open the in-core instrument tube hatches for both units to 4

allow water to flow into the reactor cavity to provide ex-vessel j cooling to the lower vessel head and improve debris coolability in j the reactor cavity.

As noted, these improvements were identified by the licensee. The NRC staff has not reviewed them for, and takes no position on, their appropriateness or adequacy.

f 3..-_.

-. . - ~. - - . .. - - - .

1 III. CONCLUSION i

L . Based on the above findings the staff notes that: (1) the licensee's IPE is complete with regard to the information requested by GL 88-20 (and associated

• guidance in NUREG-1335, " Individual Plant Examination: Submittal Guidance"),

and (2) the IPE results are reasonable given the Prairie Island design, operation, and history. As a result, the staff concludes that the licensee's IPE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities, and therefore, that the Prairie Island IPE has met the intent of GL 88-20.

It should be noted that the staff's review primarily focused on the licensee's i ability to examine Prairie Island for severe accident vulnerabilities. l i Although certain aspects of the IPE were explored in more detail than others, I the review is not intended to validate the accuracy of the licensee's detailed l r findings (or quantification estimates) that stemmed from the examination.

Therefore, this SER does not constitute NRC approval or endorsement of any IPE material for purposes other than those associated with meeting the intent of GL 88-20.

1 Date: May 16, 1997 l

t l~

. 1 6

i

n. - - . . ~ .. . . . -