ML20198H321

Safety Evaluation Re Licensee Submittal of IPE for Plant, Units 1 & 2,in Response to GL 88-02, IPE for Severe Accident Vulnerabilities

ML20198H321
Person / Time
Site:	Byron
Issue date:	12/03/1997
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20198H288	List: ML20198H285 ML20198H321
References
GL-88-02, GL-88-2, NUDOCS 9801130254
Download: ML20198H321 (7)

Text

_ . _ _ _ _ .. _ . . . _ . . _ . _..._ _ _ _ _ _ . . . . . . _ . . _ .- . _ . _ . . ._

t i

I I

i i

i BYRON NUCLEAR GENERATING STATION UNITS 1 AND 2 INDMDUAL PLANT EXAMINATION STAFF EVALUATION REPORT December 3,1997 1

k ENCLOSURE

i. -.

!i 9901130254 971203

!- POR ADOCK.05000454 P .. PDR' g)1;

A

c. .

l.L INTRODUCTION .

On April 28,1694, the Commonwealth Edison Co. (Comed) submitted the Individus; Plant -

Examinatior: (IPE) for Byron Nuclear Generating Station (BNGS) Units 1 and 2 (the base IPE) -

in resporise to' Generic Letter (GL) 86 20 and associated supplements.- On February 1,1996, -

the staff sent a request for additional information (RAI) to the licensee identifying concems about the IPE that were similar to those raised previously by the staff for the Zion, Dresden and Quad Cities IPEs. The licensee responded by letter on March 27,- 1997, forwarding

- Responses to NRC Requests for Additicnal information and Modified Byron and Braidwood IPEs" which addressed the concems. The modified analysis also included the revised sequences and the impact on core damage frequency (CDF) as a result of these modifications. Subsequent to the staff review of the modifications to the IPE and the responses to the RAls, teleconferences were held during June 1997 between the licensee, L the staff, and its consultant Brookhaven National Laboratory, for clarification.

A " Step 1" review of the BNGS base IPE submittal and modifications was performed and

' involved the efforts of Brookhaven National Laboratory in the 8ront end and the backend analyses, and Sandia National Laboratory in the human reliability analysis (HRA). The

- Step 1 review focused on whether the licensee's method was capable of identifying vulnerabilities. Therefore, the reviety considered (1) the completeness of the information and (2) the reasonableness of the results given the BNGS design, operation, and history. A more detailed review, a " Step 2" review, was not performed for this IPE submittal. Details of the contractor's tmdings are in the attached technical evaluation report (Appendix A) of this staff evaluation report (SliR).

In accordance with GL 88-20, BNGS proposed to resolve Unresolved Safety lasue (USI)

A 45, " Shutdown Decay Heat Removal Requirements." No other specific USis or generic safety issues were proposed for resolution as pait of the EiNGS IPE.

II. EVALUATION in the RAls sent to the licensee on February 1,1996, the staff expressed concems regarding several areas of the IPE including: a human reliability analysis that did not incorporate important aspects of operator performance and did not appropriately treat human performance under accident conditions; use and application of an optimistic quantification process, including common cause failure (CCF); use of the MAAP cocle to determine core-( cooling success criteria under conditions where it has not been benchmarked, arriving at combinations of equipment of lesser capacity to achieve success; use of " success with accident management" (SAM) end-states without a!gnificant margin beyond the cutoff criteria (24 hr.) for these sequences. The !icensee explicitly addressed the staff's concoms in the modified IPE submittal.

Each of the two BNGS units is a Westinghouse 4 loop pressurized water reactce (PWR) with a large dry containment. In the base IPE submittal the licensee estimated the v'.'al CDF for each unit as 3 E-5/ reactor-year (ry) for intemally initiated events, including intomal flooding.

Loss of offsite power (LOOP) contributes 83% (single unit 57%, dual unit 26%), loss of coolant accidents (LOCA) 4% (small 2.5%, large 1.% and medium 0.5%), transients 7% (loss

. of support systems 4%, others 3%), steam generator tube rupture (SGTR), anticipated p- 1

)

transients without scram (ATWS),-interfacing systems LOCA (ISLOCA) and intomal flooding a1% As an accident type station blackout contributes about 15% in its modified IPE -

submittal the licensee estimated the total CDF for each unit as 4E-5/ reactor year (ry) for

-intomally initiated events, including intomal flooding; The BNGS CDF oomparon reasonably with that of other Westinghouse plants. Transients contribute 50% (loss of support systems 47%, others 3%), LOOP 19% (dual unit 10%, single unit 9%), LOCA 26% (small 13%, large

, 7% and medium 6%), SGTR 5%, ATWS, ISLOCA and intomal flooding <1%- Loss of support systems is cominated by dual unit loss of essential service water (ESW) 24%, single unit loss -

of ESW 15%, and loes of component cooling water 4% As an accident type station blackout contributes shout 16%

While the total CDF '*, not changed, the contributors to CDF have changed. Most notable is the inclusion of J.x sreaks (not previously considered) in the ESW which resulted in a dual unit loss of EW/ J. 6E 64y). Tha inclusion of pipe breaks resulted in the identification and subsequent elimmauon os a " potential vulnerability" wherein the both ESW pump rooms are flooded or the ESW basin inventories am lost (see enhancements, below). In addition,

- the licensee has taken credit for cross-tie of either or both of the 4KV buses (141 to 241,142 to 242) on loss of power to these butts. Further, in the modified IPE, sequences leading to single or Qal LOOP, previously identified as success with accioent management (SAM),

were expanded. The licensee originalh defined SAM sequences as "no core damage at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and for which accident management actions are required after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />..." The licensee analyzed these sequences further and expanded them to either success or core 1 damage. These sequences now contribute a total of about 1.7E 5/yr to the total CDF, in addition to the rnbove, the increase in contribution from Large LOCA was due to the change in success criteria to more typical criteria for PWRs. The medium LOCA contribution increase was due to the increases in human error probability (establish high pressure recirculation from 0.05 to 0.5), as a result of the modification to the HRA and changes to the emergency core cooling flow requirements which had an impact on refueling water storage

- tank refill success.

Regarding the use of low CCFs, the licensee established a threshold value of 0.01 for systems with a two-of-two train configuration. This resulted in an automatic raise of those factors that were previously below 0.01 With this approach, the licensee addressed the staffs concems about very low CCFs, but in a limited way. The values for CCF factors remained lower thu generic and the licensee did not provide a strong support for their applicability at BNGS. The licensee indicated that the sensitivity study performed for the CCF (increasing the beta factor by a factor of ten; which, for a number of components brought the

- beta factor value up to the values identified in NUREG/CR 4550), showed that the total CDF

. increased by a relatively small factor (about a factor of 2 to about 7E 6), and that therefore the IPE results are relatively insensdive to the common cause factors in the range of the values under discussion. However, the staff believes that the resultant increase in the CDF contribution for certain individual events, not displayed or discussed in the modified IPE, may show some sensitivity to common cause failure, irrespective of the impact on the total CDF, Because of this the staff considers the licensee's analysis to be limited due to the uncertain character of CCF analysis as expressed above. Even so the staff believes that it is unlikely that this limitation hrs affected the licensee's overall conclusions from the IPE and its 2-i

capability to identify vulnerabilities. It may, however, have limited the licensee's ability to gain insights and identify improvements.

The licensee performed an HRA to document and quantify potential failures in human system interactions. In the HRA for the modified IPE the licensee searched for pre-initiator human events and in particular for events related to re-alignment of manual valves after test or maintenance and to miscalibration. A.;er examining BNGS procedures and operational history, the licensee identified at ; east four events that were pre-initiator misalignment events, none of which were miscalibration. However, the licens6e qualitatively screened the majority of pre-initiators on the basis of procedural check-offs, independent verification and indications in the control room. The licensee's conclusion was that while errors do occur, they are rare, "no pattems were identified" and "no vulnerabilities existed." The staff finds the licensee's qualitative examination for pre-initiating events in the revised IPE sufficient for identifying a vulnerability at BNGS; however, the staff, does not believe that the elimination of the majority of pre-initiator events from quantitative assessment on the above basis is completely justified.

Very often in a PRA iow probabiltty events such as pre-initiators, because of their common-cause potential, are proven to be important contributors to risk.

In the modified IPE, the licensee completely revised the post-initiator human event analysis.

The licensee primarily used the " Electric Power Research Institute (EPRI) Cause Based Decision Tree Methodology (CBDTM)" describeo in EPRI TR-100259, while the Technique for Human Error Rate Prediction (THERP), described in NUREG/CR-1278, was used in the base IPE. The CBDTM was used to quantify the likelihood of errors in detection, diagnosis, and decision making, and THERP was used to quantify errors associated with task execution.

Compared with the method used in the base IPE for BNGS, the combination of the CBDT and THERP methods provide a more realistic basis for assessing post-initiator human actions. Therefore, most of staff's concems associated with the way THERP had been applied in the original IPE are not applicable for the modified IPE. In order to address these l concems, the licensee reanalyzed approximately 35 "important" post-initiator human actions (importance was based mainly on risk achievement worth values) and new actions added as a result of changes to the fault or plant response trees. The staff finds that the licensee adequately addressed dependencies bety sen human errors, performance shaping factors and with the use of CBDTM, the licensee better incorporated diagnosis errors and actual plant design and operating characteristics.

Regarding the treatment of time, unlike other EPRI methods, the CBDT method incorporates time implicitly. Therefore, in those situations where the time available versus the time required to perform the action is short, the likelihood of an operator failing may be increased due to the short (or perhaps insufficient) time frame since time is not explicitly treated.

Consequently, with the CBDT method, the potential exists for underestimating HEPs for events with short timeframes. However, the licensee did state that time pressure was taken into account by increasing the stress factor (addressed within THERP) in the evaluation of the basic HEPs. A review of these actions, their timing, and the associated HEPs suggests that the revised HEPs are not unreasonable.

Based on the licensee's IPE process used to search for decay heat removal (DHR) and intemal flooding vulnerabilities, and review of BNGS plant-specific features, the staff finds the licensee's DHR evaluation consistent with the intent of the USI A-45 (Decay Heat Removal i

c ,

Reliability) resolution. : No other specific unresolved safety issues (USls) or generic safety.

]'

issues (GSis) were proposed for resolution as part of the BNGS IPE.

The licensee evaluated and quantified the results of the severe accident progression through the use of BNGS plant specific phenomenological evaluation summaries. The licensee's-back end analysis has considered important severe accident phenomena. Among the BNGS conditional containment failure probabilities, the licensee repotted that early containment .

failure is 0%; late containment failure is 36% with overpressurization (due to steam generation or accumulation of non-condensible gases) being the primary contributor, bypass is 5% with SGTR sequences being the primary wntributor; containment isolation failure is-about 1% and the containment remains intact 59% of the time. The values for bypass and late containment failure increased from those in the base IPE to those in the modified IPE.

The increase in the containment bypass release probability (from 0.04% to 5%) is primarily  :

- due to the addition of the SGTR sequences stemming from the change in,the tre_stment of

. the SAV sequences as discussed above. The late containment failure probability increase  ;

(from 8% to 36%) is a result of additional loss of ESW sequences as a result of the inclusion of the pine breaks in the ESW system, as discussed previously.

The staffs overall assessment of the backend analysis is that the licensee has made reasonable use of back-end techniques in performing a back end analysis and that they considered severe accident phenomena it must be noted, however, that in the quantification

' model the BNGS IPE back end analysis did not include important containment phenomena L (i.e., steam explosion, hydrogen combustion and direct containment heating) that may cause l- early containment failure. Although in response to an RAI the licensee provided a rough I estimate of 1% from these failure modes, lack of consideration of these failure modes in the l - lPE in a structured way such as provided by a containment event tree precludes a systematic ,

means to examine the relative imponance of these failure modes and possible recovar/

actions for these modes. The licensee's response to containment performance improvement program recommendations is consistent wi'.h the intent of GL 88-20 and the associated ~

Supplement 3.

t l Some insights and plant safety-specific features identified at BNGS by the licensee are:

l Ability to perform bleed and feed cooling.

1.

2. Each plant has a large condensate storage tank (400,000 gal.) and has an altomate auxiliary feedwater supply from the ESW system, the source of which is the two ESW cooling tower basins.

3. Two auxiliary feedwater pumps; one motor driven and one diesel driven.

4.- Eight hour battery capacity without load shedding.

5. There are two ESW pumps per unit, with a cross-connection capability between the units. One pump per unit is sufficient for shutdown,

6. There are five comment cooling water pumps, two dedicated to each unit and one swing pump which so be aligr'ed to each unit. -l

+ j

_ ~ _ _ - __ ~

i 1

7. There are four reactor containment fan coolers, only one of which is required for  ;

containment cooling. j

8. Establishment of high pressure recirculation from the sump requires manual actions of the operators to align the discharge of the RHR pumps to the suction of the safety i injection or charging pumps.  !

9. Two diesel generators per unit.- The emergency buses can be cross connected, and each diesel generator has the capacity to power one emergency bus at both units at the same time.

In Enclosure 3 (Byron Modified IPE Results) of the modified IPE submittal, the licensee indicated that the results of the BNGS PRA were evaluated against the NUMARC Severe Accident Closure Guidelines (NUMARC 91-04). The licensee did not define a vulnerability, but they did identify plant modifications or enhancements as discussed below:  ;

1. In their letter transmitting the modified iPE the licensee indicated that their analysis did disclose a " potential vulnerability," and indicated that "A modification is being considered... as well as a procedure enhancement.. which will mitigate this potential vulnerability." This potential vulnerability involved a dualloss of ESW from flooding.

Water from a pipe break in the ESW system can flow through a common duct  !

resulting in f5oding of both ESW pump rooms. The licensee did not identify specifics but, in the section of the modified IPE submittal addressing the " Revised initiating Event Frequencies for Loss of Service Water...," the licensee indicated that a modification to the vent duct on the 330 ft, level of the auxiliary building, is being addressed. According to the licensee, this modification will prevent water from the auxiliary building floor drain sump room from overflowing into the ESW pump rooms.

Giving credit for this modification in the modified IPE, in addition to a procedural enhancement to prevent the loss of inventory from both cooling tower basins on ESW pipe break, the CDF contribution for dual loss of ESW due to pipe breaks decreases from 1E-4/ry to about 1E-6/ry.

2. In the modified IPE, the licensee indicated that procedures were available and credit was given for crossticing either or both 4KV ESF buses (141 to 241,142 to 242) to l the other unit on loss of power to the buses on the other unit. Credit for this procedural enhancement reduced the contribution from duel and single loss of power from about 3E-5/ry to about 4E-6/ry.

l Ill. CONCLUSIONS I

On the basis of these findings from the review er the modified IPE submittal, the staff finds that the licensee's IPE is complete with regard to the information requested by GL 88-20 (and associated guidance, NUREG-1335) and concludes that the licensee's IPE process meets the intent of GL 88-20.

It should la noted that the staff's review primarily focused on the licensee's ability to examine the Byron Units 1 and 2 for severe accident vulnerabilities. Although certain aspects of the l

t I

IPE were explored in more detail than others, the review is not intended to validate the accuracy of the licensee's detailed findings (or quantification estimates) that stemmed from the examination. Therefore, this SER does not constitute NRC approval or endorsement of any IPE material for purposes other than it,ase associated with meeting the intent of GL 88-20.

i

?

_. . ~ . . . . _ . , _ _ _. . . _ . . . - . . _ _ _ _ . . . .

..,. y r

I I

f 3

APPENDlX' A

- BYRON NUCLEAR GENERATING STATION 1 INDIVIDUAL PLANT EXAMINATION TECHNICAL EVALUATION REPORT l

i d

i i

h i, -

I1 i-l l1

, TECHNICAL REPORT FIN W4449 07/30/97 ,

"",CHNICAL EVALUATION REPORT OF THE IPE SUBMITTAL AND RA! RESPONSES FOR THE  :

BYRON STATION l

Zoran Musicki i John Forester' l l

C. C. Lin 1 l

I-L Department of Advanced Technology, Brookhaven National Laboratory Upton, New York 11973 l

i I

l y=

l Prepared for the U.S. NurJear Regulatory Commesion W Office of Nucient Regulatory Reneerch Cortract No. DE-ACO2-76CH00016

'Sandia National Laboratories ,

-[ t 5 (( ,

i ,u s.. -

7

. l +

A .;

, CONTENTS

' Page- .;

EXECU11VE SU M M ARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v  !

NOMENCLATURE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 xxiii 1., ~ INTRODU CTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .- 1 1.I' Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.. - TECH NICAL REVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 -

2.1 Licensee's IPE Process . . ...................................7 2.1.1 _ Completeness and Methodology . . . . . . . . . . . . . . . . . , . . . . . . . . . 7 2.1.2 Multi Unh Effects and As-Built,' As Operated Status . . . . . . . . . . . . . . 9 2.1.3 Licensee Participation and Peer Review . . . . . . . . . . . . . . . . . . . . . 10 2.2 L Front End Technical Reviev . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2,2.1 - Accident Sequence Dellneation and System Analysis . . . . . . . . . . . . . . I1 2.2.2 Quantitstive Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2.3 - Interface l.ssues . . ..................................22 2.2.4 , Internal Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 -

2.2.5 Core Damage Sequence Results . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.3 Human Reliability Analysis Technical Review . . . . . . . . . . . . . . . . . . . . . . 301 s 2.3.1. Pre-Initiator Human Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 c 1.3.2 Post Initiator Human Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

! 2.4 Back End Technical Review ................................. 38 2.4.1 Containment Analysis / Characterization . . . . . . . . . . . . . . . . . . . . . . 38 2.4.2 Accident Progression and Containment Performance Analysis . . . . . . . 45 i 2.5 Evaluation of Decay Heat Removal and Other Safety issues and CPI . . . . . . . . 49 L 2.5.1 Evaluation of Decay Heat Removal . . . . . . . . . . . . . . . . . . . . . . . . 49 2.5.2 Other GSis/USIs Addressed in the Submittal . . . . . . . . . . . . . . . . . . 51 2.5.3 Response to CPI Program Recommendations . . . . . . . . . . . . . . . . . . 51 ,

2,6 Vulnerabilities and Plant Improvements . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.6.1 Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.6.2 Proposed Improsements and Modifications . . . . . . . . . . . . . . . . . . . 52 L

3. . CONRACTOR OBSERVATIONS AND CONCLUSIONS . . . . . . . . . . . . . . . . . . 55 L

4. REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 l

i sm_ . , . ,. ,,,# s . - - -.c ' . ., ,,y-,, '_, . , - _

4 e >

TABLES

' Table .Page E -Plantt 'ontainment Characteristics for Byron Nuclear Power Station . . . . . . . . . . . . vil-

- E-2 - Accident Types and Deir Contribution to the CDF . . . . . .-. . . . . . . . . . . . . . . . . . . . x E-3 -Initiating Events and Deir Contribution to the Cl.'F . . . . . . . . . . . . . . . . . . . . . . . xi E4 C~*=h Failure as a Percentage of Total CDF , . . . . . . . . . . . . . . . . . . . . . . . . xv

'1 Plant and Containment Characteristics for Byron Nuclear Power Station . . . . . . . . . . . . 5 2_ Comparison of Fallure Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 -

3 Comparison of Common Caase Failure Factors . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4 Initiating Event Frequencies for Byron IPE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 5- Accident Types and Delt Contribution to the CDF . . . . . . . . . . . . . . . . . . . . . . . . 27 6- Initiating Events and Their Contribution to the CDF . . . . . . . . . . . . . . . . . . . . . . 28 7- Dominant Core Damage Sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 8 Byron Operator Action Top Events . . -. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 9 Containment Failure as a Percentage of Total CDF . . . . . . . . . . . . . . . . . . . . . . . . 47 10 - - NUMARC Categories and DyS Resolution . . . . . , . . . . . . . . . . . . . . . . . . . . . . . 53

+

3 l

1 IV

l-

-4 Y

^

EXECUTIVE

SUMMARY

a

' his Technical Evaluation Report (TER) documents the findings from a review of the Individual Plant Examination (IPE) for the Byron Nuclear Power Station. His technical evaluation report adopts the NRC

review objectives, which include the following:

=e - To determine if the IPE submittal provides the level of detail requested in the " Submittal Guidance Document," NUREG 1335, and ; '

-*1 To assess if the IPE submittal meets the inter.t of Generic LetMr 88-20.

- As stated in Generic Letter (GL) 88-20. the purpose of the IPE program is for the licensee to:

l 1. Develop an appreciation of severe accident behavior.

. ' 2. . Urderstand the most likely severe accident sequences that could occur at the plant. .

3. Gain a more quantitative undsrstanding of the overall probabilities of core damage and fission product releases. __

~ 4. If necessary, reduce the overall probabi!!;ies of core damage and fission product releases by.

modifying, where appropriate, hardware and procedures that would help prevent or mitigate-severe accidents.

His twiew addresses the reasonableness of the ove Al IPE approach with regard to its ability to permit

. the Ikensee to meet these goals of Generic Letter 88-20. The review utilized both the information provided in the IPE submittal and additional information (RAI Responses) ircluding an improved IPE analysis provided by the licensee, the Commonwealth Edison Company (Comed), in the response to a -

request for additional information (RAI) by the NRC.

E.1 Plant Characterization De Byron Station (ByS) l a two-unit nuclear power plant. Each unit is a Westinghouse 4 loop pressurized water reactor (PWR) with an electrical power rating of !!05 MWe. ByS is operated by the Commonwealth Edison Company (CECO). Unit I started commercial operation in September,1985, while the Unit 2 start date was August 1987.

I A number of desige features at Byron impact the core damage frequewy. These are (a more detailed-discussion can be found in Section 1.2 of this report):_

• The plant has a feed and bleed capability. He submittal indicates the block valves are normally

-open, ,

e There are three main feedwaar (MFW) pumps, one motor driven (normally in standby) and two tubine driven (normally operating). In addition, there is also one motor driven stanup feedwater i..  : pump. Here are 4 condensate / condensate booster pumps.

V-4 k

..... , . .m ,... , ,. . . _ , _ .

. . . . . _ . . , , . + ,

I

• nere is one motor driven auxiliary feedwater (MDAFW and one diesel driven auxiliary feedwater (DDAFW) pump. De diesel driven pump has its own support system, making it partially independent of the plant's 125 V de system.

• De condensate storage tank (CST) is relatively large and there are alternate suction sources.

• The reactor coolant pumps (RCPs) employ Westinghouse seals with charging pump injection and component cooling water cooling of the thermal barriers. De seals use the high temperature O-rings.

• De high haad inlection can be provided by either of the two safety injection (SI) pumps, or by either of the tw centrifugal charging pumps (CCPs), thus providing a high level of redundancy.

This applies to the recirculation phase as well. The CCPs and the Si pumps aie physically separated.

• ne high pressure recirculnion is prov!ded by a piggy-back arrangement off the two residual heat removal (RHR) pumps. De swit:lnover to low pressure recirculation is automatic, but if high pressure circulation is neede<t, the operator must align the high pressure pumps to the discharge of the RHR pumps.

• De refueling water storage tank (RWST) is relatively large (414,000 gal) and can bc tefilled.

• ne HVAC system is a distributed system.

• nere is a strong dependence of the RCP seals, diesel generators (DGs) and all high pressure pumps on the essential service water system, however there are two pumps per unit with cross-connection capability.

• De source of water for the essential service water system is the cooling tower basins, which can be drained in certain accidents involving ruptures of connected piping. Several systems are provided for basin makeup, including motor driven pumps, diesel driven pumps and a connection to the firewater system.

• There are five CCW pumps, tvm dedicated to each unit, and one swing pump which can be aligned to either unit, with one pump / unit required for success.

• OrJy one out of four reactor containment fan coolers (RCFCs) is required to prevent containment overprecatzation by steam production. In addition, there are two containment spray trains. De RCFCs can also be used for decay heat removal, in case of failure of RHR beat removal in the recirculation phase (promotes good mixing of containment atmosphere during RCFC operation).

• nere are two 125V DC buses per unit, each with an associated battery, and a charger. De batteries have an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> capacitv 4 ce maximum current (without load shedding). Tie lines are provided for cross-tying rerpective de buses from the two units.

• Dere are 2 diesel generators per unit, cooled bv essential service water and provided with their

- own startup air. The diesel generators depend e ttation batteries. The emergency buses can vi

+

4 be cross connected, and endi diesel generator has sufficient capacity to power one emergency bus at both units at the same time. ,

• - There are provisions in place to feed some non-essential loads as well from diesel generators, such as the air compressors, primary water pumps and nonessential service water pumps (cooling _

for the air compressors).

,

• There are 4 offsite transmission lines feeding into the switchyard, thus providing for a more 1 reliable offsite power supply..

De Byron Nuclear Power Station utilizes a large dry containment design. The containment structure is a prestressed concrete shell made up of a cylinder with a shallow dome roof and flat foundation slab.

Some of the plant diaracteristics important to the baw-end analysis are summarized in Table E 1 below, and compared to those of two other typical large dry containments.

Table E-1 Plani and Containment Characteristics for Byron Nuclear Power Station Characteristic Byron Zion Surry Thermal Power, MW(t) 3411 3236 2441 Containment Free volume, it) 2,800,000 2,860,000 1,800,000 Mass of Fuel, Ibm - 204,000 216,000 175,000 Mass of Zircalloy, Ibm 43,400 44,500 36,200 Containment Design Pressure, psig 50 47 45 Median Containment Failure Pressure, psig 98* 135 126 Containment Volume / Power, ft'/MW(t) 821 884 737 Zr Mass / Containment Volume, Ibm / ft) 0.015 0.016 0.020 Fuel Mass / Containment Volume, Ibm / ft2 0.073 0.076 0.097

+ 'the median eaan==a-t failure pressure is 125 psig for Uant I and 98 psig for Unit 2.

'I)e lower failure pressure for Unit 2 is due to its use of the Bunker Ramo electrical penetrations which was stated in the IPE submittal to have a lower failure pressure.

De plant characteristics important to the back-end analysis are:

I

• A cavity design which allows water to flow from the containment basement to the reactor cavity via the cavity instrument tunnel. Although a removable hatch cover is located at the top of the instrument tunnel, it is not leak-tight for Byron. (It is essentially leak tight for Braidwood.)

• - A large containment volume, with an open design and significant venting areas for the subcompartments which help ensure a well-mixed atmosphere (a feature which inhibits combusfible gas pocketing).

Vil l

e - A relatively low containment failure pressure of 98 psig for Unit 2 because of the use of Bunker Ramo electrical penetrations and a relatively high containment failure pressare of 125.psig for Unit I which does not use Bunker Ramo penetrations, e Two separate systems for ana*=lamaar atmosphere cooling and pressure suppression: the Reactor -

Containment Fan Coolers (RCFCs) and the Containment Spray system. According to the IPE submittal, one of four RCFCs or one RHR heat eachanger (with associated recirculation train) can provide sufficient containment cooling to prevent containment overpressure failure from steam production', ne RCFC is designed to remove heat from the containment as required following a design basis LOCA and, consequently, _is designed to operate in a pressure ~

environment up to a 50 psig. De containment spray pumps can be aligned to take suction from the RWST, or from the containment recirculation sump and one or more RHR pumps and associated heat exchangers. De operation of containment spray reduces fission product releases.

E.2 - Licensee's IPE Process De licensee initiated work on a probabilistic risk assessment (PRA) for Byron in response to Generic Letter 88-20. The freeze date for the analysis was July 1991. (However, plant specific data was collected through March 1992).

The Byron IPE was performed by consultants with an involvement by the Commonwealth Edison Company, ne CECO staff also performed some specialized facets of the analysis, e.g., MAAP runs for success criteria development in addition, it is stated in the IPE that operations staff was involved in the process to a significant extent.

(Note: De Byron IPE is used as a template for the Braidwood IPE, due to the close similarity of the two CECO plants).

CECO staff managed the IPE, provided insights to the senior management and implemented the improvements.

To support the IPE process, the licensee reviewed several PRA studies: WASH-1400, NUREG-1150, the IDCOR study for Zion, and the Zion IPE.

Utility personnel were involved in the HRA. Procedure reviews, examinations of control room staffing and layout, examinations of the " Detailed Control Room Design Reviews, and over 40 operator action interviews with opera' ors helped assure that the IPE HRA represented the as-built, as-operated plant.

Checklists were filled out during the interviews to document critical plant and scenario-specific aspects of the diagnosis and execution _of an action. Factors evaluated included training on the simulator, adequacy of procedurec, need for local actions, time available for local actions, feedback to the control room for local actions, stress level, potential non-recoverable actions, etc. Other plant specific factors were addressed through the application of the EPRI Cause Based Decision Tree Methodology (CBDTM)

'ne residual Heat Removal (RHR) system for decay heat removal from the RCS, although not a containment system, also provides a means of long-term containment heat removal.

. viii

i -!

n  ;. .

i.from

. EPRI-TR 100259,~ "An - Approach to the' Analysis of Operator Asions in PRAs, June 1992.

l However, the degree to which the Byron /Braidwood modified IPE was independently reviewed was not i

^addressed.- Both pre-initiator actions (performed during maintenance, test, surveillance, etc.) and post-Iaider amions (performed as pan of the response to an accident) were addressed in the IPE. Important

- human actions were identified and at least tsne procedural change related to cross-ticing power was ,

- implemented. .

~

De analysis was reviewed as' the work was progressing as pan of normal QA, by both the CECO -

personnel (including personnel from other CECO plants) and the_ consultants. He high level review vas also performed by CECO managemem and' management from the consultants team (Westinghouse,  ;

- TENERA and Fauske). l ne submittal indicates the intent to maintain a 'living PRA".

E.3 IPE Analysis-E.3.1 Front-End Analysis '

he methodology chosen for the front-end analysis was a Level 1 PRA; the large event tree-small fault tree with support state event tree was used. He computer code used for quantification was WESQT.

The IPE quantified the following initiating event categories: 4 loss of coolant accidents (LOCAs) .

(including one interfacing systems LOCA (ISLOCA ) category broken down into 4 pathways), 5 transients '

(one general transient including several traditional categories, two losses of offsite power and two types of secondary breaks), one steam generator tube rupture (SGTR),7 support system initiators and one flooding category (with two dominant scenarios shown in the initiating events (IE) section). He IPE developed 15 plant response trees and two support state event trees. A flooding analysis was also performed.

Success criteria were based on best estimate plant response verified by MAAP runs and thermal hydraulle analyses.

Small and large LOCA success criteria were changed in the modified IPE to reflect the classical success criteria, according to the documentation provided. - Employment of the condensate pumps (with secondary depressurization) upon failure of AFW and MFW is credited.

Reactor containment fr.a cooler units are given credit for decay heat removal. Credit is also given to RWST refill, as well as accident management strategies, including equipment repair.

Containment heat removal systems are not considered for success in the level 1 analysis.

De RCP seal cooling model assumes that both thermal barrier cooling (CCW) and seal injection must fail in order for the seals to fail His element of the success criteria is consistent with other PWR PRA stud:es. - The seal LOCA model is taken from WCAP-10541, Rev. 2.

. Plant specific data was collected only for pumps, motor operated valves (MOVs) and diesel generators.

- The data for pups and MOVs distinguishes between the systems where the component is employed.

~

ix

-m y-- g y 9 y erea6 -y y4-r-+: wmr y - vw -g=-rww,- q-m-wm-

De das used for some components is significantly lower than expected. On the other hand, some pump failure data are significantly higher than expected.

he multiple greek letter (M'3L) approach was used to characterize common cause failures. Most baportant # facsors seem low, even though CECO established a floor of 0.01 for such values. De floor.

was established in response to an RAI questioning low # values for some+:sp:-- = in the original submittal. De positive feature of the licensee's comunon cause analysis is that'most categories of- ,

composans conunonly associated with comunon cause failures are modeled to exhibit such failures.

De ietsmal core damage frequency (CDF) is 4.0E-5/yr. His includes credit for several unimplammeed

~

modifications, without which the CDF rises to 1.4E-4/yr. De internal accident types and initiating -

events abat contribute most to the CDF and their percent contributions are listed below in Tables E-2 and

-E-3:

Table E 2 Accident Types and heir Contribution to the CDF' Initiating Event Group Cor.tribution to CDF (/yr)  %

loss of support system - 1.88E 47 LOCA 1.07E-5 26 loss of offsite power 7.57E-6 -19

. SGTR 2.16E 5.4 General transient 7.41E-7 1.8 Secondary side breaks 3.78E-7 1.0  ;

laternal flood 3.5E-9 0.01 (Station blackout) (6.32E-6) (16)

(ATWS) (1.9E-7) -(0.5)

- (ISLOCA) . (1.01E-7) (0.2)

T(yTAL CDF 4.00E-5 100.0 i

i Tategories in parentheses (e.g., station blackout) are not separate initiator types but are included in

other categories (e.g., SBO is included under LOvP and transient). ,

4 X

Table Fe3 Initiating Events and Their Contribution to the CDF I IM""#I *"I "I'"" '"  %

Initiating Event CDF (/yr)

(lyr)

Dual unit loss of essmtial service water 9.59E4 9.59E4 23.73 Single unit loss of essential service water 4.64E-4 6.08E4 15.05 Small LOCA 6.10E-3 5.13E-6 12.69 Single unit loss of offsite power 3.22E 2 4.09E-6 10.12 Dual unit loss of offsite power 1.21E-2 3.48E-6 8.62 large LOCA 3.00E 4 2.74E-6 6.78 Medium LOCA 8.00E-4 2.70E-6 6.69 SGTR 1.10E 2 2.16E-6 5.35 Loss of CCW 5.62E-5 1.74E-6 4.30 Loss of 125V dc bus 111 5.05E-4 1.40E-6 3.47 General transient 2.20 1.41E-7 1.83 Feedline break inside containment 1.80E 3 1.36E-7 0.34 ISLOCA 1.01E-7 1.01E-7 0.25 Feedline break outside containment 1.80E 3 1.00E-7 0.25 Steamline break inside containment 1.80E 3 7.13E 8 0.18 Steamline break outside containment 1.80E-3 7.12E-8 0.18 Loss of a single ac bus 141 3.55E-4 4.08E-8 0.10 Loss of a single ac bus 142 3.55E-4 2.36E-8 0.06 less of instrument alt 4.30E-4 5.14E-9 0.01 Internal flooding, zone 11.6-0 1.89E-5 2.32E-9 0.01 Internal flooding, zone 8.3-1 1.30E-4 1.81E-9 0.00 E.3.2 Hurnan Rellability Anaysis

'Ihe HRA process for the Byron /Braidwood modified IPE addressed both nre-initiator actions (performed during maintenance, test, surveillance, etc.) and post-initiator actions (performed as part of the response to an accident). The analysis of pre-initiator actions included both miscalibrations and restoration faults.

xi 1

However, while a thorough analysis and evaluation of plant-specific data relating to pre-initiators was

- performed, only four restoration faults were actually included in the PRA models. All others were - i dismissed on the basis of qualitative (and in a fi..y cases quantitative) screening criteria.

Post initiator human actions modeled included both responset c, e and recovery-type actions.L A post-laitiator screening analysis was not conducted. All human actions included in the logic models were given detailed quantification analysis in the original IPE. For the modified IPE, the (PRT) and fault tree ,'

post-initiator response type human actions with a risk achievement worth ((RAW), "using the original-

- IPE model, enhanced quantification") greater than 2.5 and "those added as a result of changes to the

- PRTs and fault trees," received a complete re-evaluation. In addition, PRTs that " contributed -

signl6 candy to CDF in the original IPE were identified" and "the operator actions (OAs) h these trees, including the conditional probabilities, were evaluated on a sequence specific basis ta. & V conditions of stress, dependency, and availability of recovery opportunities and were requantifioc , .en necessary."

Remaining HEPs were reviewed for reasonableness and "for selectim 'the appropriate value for each

_ branch of the PRTs." De PRT OAs "were also reviewed to k atify those acsions which might be

- described as time-critical." Dat is, "those for which the estimated time to accomplish the action was greater than 25% of the estimated time available before some undesirable state was reached." .

Post initiator response type human actions were quantified using the EPRI CBDTM, which has been referred to as a cause-based approach. Recovery of failed equipment was quantified on the basis of ,

meantime to repair data from WASH-1400. Other recovery type actions modeled were assigned a acreening value of 0.1 Since all of the recovery related sequences were "long-term," an HEP of 0.1 is not unreasonable. Human errors were identified as important contributors in accident sequences leading to core damage, E.3.3 Back-End Analysis i ne methodology employed in the Byron IPE for the back end evaluation is clearly described in the submittal. Unlike most other IPEs, which develop and use containment event trees (CETs) for Level 2 .

analyses, a single event tree, the plant response tree (PRT), is used in the Byron IPE for both I.evel I and Level 2 analyses. De PRT developed in the Byron IPE explicitly includes the ana'ysis of containment systems normally assessed in the Level 2 analysis, he containment condition is addressed in the PRT by the devckywiss of success criteria for containment integrity, determined by deterministic analyses of 4 containment performance using 4 failure pressure of 98 psig. MAAP analyses are used to determine the containment heat removal requirements to prevent containment failure following any event in which mass and energy are released to the containment.

Besides containment bypass and containment isolation failures, only late containment overpressure failure due to loss of containment heat removal is considered in IPE quantification. All other containment failure modes identified in NUREC-1335 are addressed in the IPE by Phenomenological Evaluation Summaries (PESs, prepared in support of the IPE, but not included in the IPE submittal) and, based on the results obtained from the PESs, dismissed as "unlikely failure modes" and not included in containment failure quantification.

Since the containment failure pressure used la the PESs for the determination of the "unlikely failure modes" (98 psig) is the median failure pressure, a small, but finite, containment failure probability is xii

i .

l A l '

8

- obtained if the containment fragility curve, instead of its median value, was used in the PESs . Using the loads estimated in the PESs and the containment fragility curve, the !!censee obtained a inditional

=*alainent failure probability of about 1% for the containment pressurization mechannser.s not included -

in IPE quantification (i.e., steam explosions, DCH, hydrogen deflagration, and hydrogen detonation).'

' Although the estimated contributions to containment failure probabuiry from these ?unlikely fauure 3~

modes" are saall and their exclusion from containment failure quantification may be justifie$, the lack of considersion of these fauure modes in a structured way, such as :an be provided by a CET, precludes a systematic means to' examine the relative (quantitative) is.png,ce of these fauure modes (with the j J

maandaration of uncenainties)* and the effects of some recovery actions (e.g., depressurization) on these .

fauure modes.

. Temperature-induced steam generator tube rupture, which is considered in some IPEs for high-pressuro sequences, is not addressed in the Byron IPE. It is neither included in the PRT nor addressed in the PESs. In response to an RAI, the licensee developed a decomposition. event tree to evaluate the probabuities of temperature-induced RCS creep rupture (including bot leg or surge line failure as well :

as induced SG11t), ne parameters (or top events) considered in the event tree include the probability of RCP restart and the probability of loop seal clearing. Quantification results indicate an overall probability of induced SGTR of 18% De probability is increased to 24% if the RCPs are restarted by the operator. Although these high probability values do not seem to justify the omission of this failure mode from IPE quantification, further discussion is not provided in the response, it is noted, however, that these probability values are obtained based on an analyst's judgement and a / be overly conservative. (he probability of laduced #GTR obtained in the RAI response is much hqher than that

. obtained in NUREG il50.) Since containment bypass from SGTR initiated sequences is the dominant failure mode in the IPE, additional contribution to containment bypass from induced SGTR may not change significantly the release profile of the plant. However, this issue needs to be reexamined if matribution from the SGTR initiated sequences to the total CDF is significantly reduced in a future IPE update.

!' Results of the PRT analysis for Level 2 are grouped to plant damage states (PDSs). Release fractions

' are determined by the analyses of 12 representative sequences using the MAAP computer code. _ Based on containment failure timing, containment failure mode, and the fractional release of fission products, the PDSs are further grouped to eight release categories.

Since a str.gle event tree, the PRT, is used for both Level I and Level 2 analyses, the grouping of Level

1 results to plant damage states (PDSs) is not necessary in the Byron IPE. However, sequence grouping is used in the Byron IPE to consolidate the large number of accident sequences obtained from the PRT

, analysis into a small number of damage semes (or plant damage states, PDSs). De intent of this grouping 4

L 'De conditional containment failure probability can be almost 50% for a containment pressure load close to, but less than,98 psig

, 'The mean pressure load used in NUI't EG-1150 for Zion is higher than that obtained in the PESs. De conditional containment failure probability from the energetic events associated with HPME could be much higher because of the relatively low containment failure pressure for Byron.

Xiii

?

(i.-

.' l l

la that'all sequences within a particular damage state can be treated as a group for assessing accident -

progression, containment response, and fission product release.

Contributions to the total CDF fmm the PDSs with various accident initiators are: 39% from PDSs with -

sequences initiated by loss of essential service water (ESW),15% from SBO sequences,13% from small -

LOCA seguances,7% from large LOCA sequences,7% fmm medium LOCA sequences,5% from SGTR sequences, and 0.2% from ISLOCA sequences. De most probable PDS is X14K (31% total CDF), a PDS of loss of ESW sequences with late core melt, loss of all ECCS injection, and a late containment S

failure with up to 0.1% of the volatiles released. His is followed by SX9S (10% total CDF), a PDS of

. small LOCA sequences, with failure of recirculation injection, and no containment failure; BL4A,.a PDS --

of SBO seguences, with late core melt, high pressure injection failure, and no containment failure within ,.

the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> mission time; and AE6S, a PDS of large LOCA sequences, with early core melt, loss of all ECCS injection, and no containment failure.

Table E 4 shows a comparison of the conditional probabilities of the various rath failure modes obtained from the Byron IPE with those obtained from the Surry and Zion NUREG-1150 analyses.

Results from both the original and the Modified IPE' are presented in Table E-3.

As shown in Table E-4, the conditional probability of containment bypass for Byron is 5.0% of total CDF, all of which is from steam generator tube tupture as an initiating event. As discussed above, induced SGTR is not addressed in the IPE. Inclusion of induced SGTR will increase the total contribution from containment bypass, but is not expected to change significantly the release profile of the plant because of the already significant contribution from SGTR to early bypass releases.

Since all phenomena that may cause an early containment failure are considered in the IPE as "unlikely" to cause containment failure and not included in containment failure quantification, the conditional probability of early containment failure is zero. De probability of containment isolation failure is 1.0%,

and the major contributors to isolation failure are loss of ESW, small LOCA, and steam line break sequences.

De conditional probability of late containment failure for Byron is 35.5% of total CDF. It is primarily

- from containment overpressure failure due to loss of containment heat renoval. Because of the long time it takes to penetrate the cot,tainment basemat, late containment failure by basemat melt-through is not considered as a credible containment failure mode in the IPE even if the debris is not coolable. The primary contributors to late containment failure are loss of ESW sequences (90% of late failure) and SBO sequences (6% of late failure). For individual initiating events, 84% of lou of ESW sequences, 37% of

. steam (or feed) line break sequences and 14% of SBO sequences result in late failure. 'The conditional probability of late failure for LOCA sequences is small, less than 2%. - "

8%e second character of this PDS designator, X, which indicates the core damage timing, is not defined in the IPE submittal (Table 4.1.3-2). ,

' Modified IPE results are provided in Enclosure 3 of the response to RAl.

XIV t

- - - - _ , , , , , . - , , . , - ~ , . - - . , , ,- , -, _ , . - - > -, .,

Table E-4 Containment Failure as a Percentage of Total CDF Containment Failure - Original Byron Motiified Byron Mode IPE+ IPE+ + 1150 1150 Early Failure Negligible + + + Negligible + + + 0.7 1.4 Late Fallere 8.1 - 35.5 5.9 24.0 Bypass 0.04 5.0 12.2 0.7 ,

Isolation Failure 0.7 1.0 Intact 91.2 *" 58.5 *" 81.2 73.0

~

CDF (1/ry) 3.lE-5 4.0E-5 4.0E-5 3.4E-4

+ 'Ibe data presented for Byron are hasoci on Table 7.13 of the IPE subauttal modified by the licensee's response to RAI level 2 Question 11.

++ De data presented in this column are based on Table 3-8 of Enclosure 3 " Byron Modified IPE results" of the licensee's response to RAI.

+ + + The N - -- - that may cause ently containment failure are not consulered in containment failure quantification based on bn-t-gicel Evaluation Summanes prepared by FAl.

• Included in Early Failure, approximately 0.02%

" laciudad ir Early Failure, approximately 0.5%

"* The probaality of "latact" cochinenant for Byron include that from "no cookinenant failure within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, but failure could eventually occur without further mitigating action" (3.0% CDF in the original IPE submittal and 13.7% in the modified IPE results).

Comparison of the results from the modified IPE and the original IPE (see Table E-4) shows a significant increase in containment bypass and late containment failute probabilities for the modified IPE. The

, increase in containment bypass release probability (from 0.04% to 5%) is primarily due to the change in the treatment of the SGTR initiated events in the IPE. While most of the SGTR initiated events were considered in the original IPE to lead to a " Success with Accident Management (SAM)" end state (and ,

thus were not considered for Level 2 source term analysis), some of these sequences, with additional evaluation, were considered as core damage sequences and grouped to the containment bypass release group in the modified IPE. The increase in late containment failure probability (from 8.1% to 35.5%)

is primarily due to the significant increase in the probability of loss of ESW sequences in the modified i IPE (about 3% in the original IPE and almost 40% in the modified IPE). ESW sequences are more likely to lead to late containment failure than other sequences because of the loss of cooling to the frontline systems, For example, Level 2 results indicate that while over 80% of ESW sequences and with late i containment failure, less than 15% of SBO sequences end with late containment failure.

Source terms obtained from MAAP code calculation results are provided in the submittal for 12 sequences. 'Ihe sequences selected for source term calculations include one SGTR sequence,3 SBO sequences,3 small LOCA sequences,3 loss of ESW sequences, and two steam line break sequences.

Sequence selection is based on the frequency of the sequences in the representative PDS in a PDS group, which may include a few PDSs, and is used to reduce the number of MAAP calculations for source term characterization. Although sequence selection and the assignment of release fractions for source term definition seem adequate, there are some questions. For example, the most probable PDS, XL6K with l xv l

l l

l

i31% total CDF, is grouped to a much less likely PDS, XI4K with only 0.4% total CDF, and X14K is _-

seleted as the representative PDS. . De selection of a low frequency sequence (Sequence 37,1.42E-7)-

to represent all the sequences in this PDS group (which includes the number I and number 2 sequences--

with frequencies of 7.6E4 and 4.3E4, respectively) should have been justified by further discussion'.

Even if the source tenns for Sequence 37 can bound those for Sequences I and 2, the sequences with the --

,most dominant CDF contributions (19% of total CDF for Sequence l'and 11% for Sequence 2) should -

oc analyzed (or examined in more detail) to provide data for IPE quantification and source term definition. On the other hand, the MAAP. calculations ; foicd in the IPE provided a reasonable n coverage of the sequences that could occur at Byron to allow a quantitative understanding of accident progression and fission product releases for Byron. j

- Another question related to source term characterization is the assignment of Release Category C for SGTR segmences. According to the IPE submittal, Release Category C has a release fraction of volatile

- fission products of up to 0.01. Since the MAAP calculated release fraction of volatile fission products for the SGTR sequence is 0.27, the assignment of SGTR sequences to Release Category C is not appropriate. He correct assignment should be Release Category T (up to 50% volatiles released). The licensee agreed in a telephone conference call (involving NRC, BNL and Comed personnel) that, based on the information presented in the IPE submittal (including the RAI response) Category T is the correct release category for SGTR sequences. De assignment of all SGTR sequences to the T Category, although conservative, is accepttble. With this change, the conditional probability of significant early release (i.e., for volatiles release greater than 10%) for Byron is 5%,an average value in IPEs for PWR plants with large dry containments.

Although the MAAP calculation performed in the IPE for the SGTR case may be conservative because the relief valves on the secondary side were assumed to fall open (e.g., due to excessive cycling) in the calculation, there is no basis in the IPE submittal and the RAI response to assign the SGTR sequences to the C Category. Any future effort (e.g., additional MAAP calculation) to justify the assignment of the SGTR sequences to Category C needs to address the probability of SG valve failure due to adverse operating conditions in severe accidents.

De sensitivity studies performed in the Byron IPE involve varying certain MAAP model parameters in MAAP calculations for selected base-case sequences. He ranges of MAAP model parameter variation for IPE sensitivity analyses are based on the recommendations provided in EPRI documentation, he parameters investigated include those associated with RPV failure timing, containment failure timing, and

- tission product releases. De effects of containment phenomena (e.g., DCH) on containment failure probabilities are not evaluated in the IPE because most containment failure modes are considered as "utJikely" to cause containment failure and thus not included in the quantification.' However, they are discussed in the PESs, and rough estimates of the effects of some of the phenomena are discussed in a response to the RAl.

%e selection is appropriate in the original IPE submittal because the contribution from XIEK is negligible. XL6K is the dominant contributor only in the modified IPE results, not in the original IPE results.

xvi

44 E.4 Generic Issues and Containment Performance Improvements De IPE addrases decay host removal (DHR). Different methods of decay heat removal are addressed - ,

for different types of accidents.3 Availabilities of these systems due to hardware failures and operator -

errors are discussed. Contribution of DHR to core damage is discussed (over 80% in the orighal IPE, over 60% in the modified IPE), along wkh insights as to the contributing factors. it is stated that failure in the 4kV ac system plays a makr role, and k is shou how utilizbg the inter-unit crosstie helps reduce this contribution substantially. (from 6:e original IPE value).~

No DHR vulnerabilities are found and the licensee considers the DHR issue resolved.

No additio al generic issues are discussed in the submittal.

E.5 Vulnerabilities and Plant Improvements De licensee states there is a potential vulnerability related to flooding and remedied by improvements 2 and 3 below.

' Dree I.Avel I improvements have resulted from the IPE process. De IPE takes credit for all three. In addklon, the submittal states that the CECO's insights process identified numerous insights for procedure enhancemerts to improve operator response, both before and after core damage, as well as strategies and features to be included in Severe Accident Management Guidance, it is stated in the submittal that much of the generic guidance in the Westinghouse Owners Group Severe Accident Management Guidelines is based on the insights from the Zion and Byron IPEs.

De followmg three Level 1 improvements are discussed:

i

1) Crosstying emergency ac buses. Bis insight was identified in the original IPE. Emergency procedures developed as a result of the blackout rule directed use of this crosstle in the event of ,

an SBO. De principal insight from the original IPE was that there were other situations for which the cross tie is valuable, i.e., one bus deenergized and equipment on the other bus failed.

This procedural improvement has been implementu!.

2) Sealing the essential service water pump roons ventilation duct. Bis would prevent a dual unit flooding initiating event which would disable all four essential service water pumps. A modification is being developed to prevent the flooding, although installation dates have not yet '

been established, j 3) Procedural actions to prevent draining down of the cooling tower basins in case of a pipe rupture.

Such a draindown would lead to a dual unit loss of essential service water. His modification is

being developed to guide the operators to cenain acticns, such as closing the essential service l

water cross <ie valves, stopping the essential service water pumps, maximizing the time available, -

etc.

. All three improvements have a significant impact on the core damage frequency.

- No Level 2 related improvements were noted in the IPE submittal.

xvii r

- - - , e -- . . - - - . - . - , . -- - -

. )

l E,6 Observations De licensee appears tolhave analyzed 'the design and operations of Byron to discover instances of particular vulnerability to core damage. it also appears that the licensee has: developed an overall appreciation of severe accident behavior; gained an understanding of the most likely severe accidents at Byron; gained a quantitative understanding of the overall frequency of core dimge; and implemented changes to the plant n help prevent and mitigate severe accidents.

l De strengths of the level 1 IPE analysis are: comprehensive treatment of plant specific initiating events; l applying the common cause analysis to most types of components; the plant specific data which was collected for several systems (such as specific data for pumps and MOVs); good discussion regarding derivation of insights; relatively comprehensive decay hat removal discussion; RAI responses which were generally very detailed and thorough; and the discussion of IPE modifications was also very complete, with generally a credible analysis supporting such modifications.

De weaknesses of the IPE are:

1) There are some questions about data, for example the lack of plant specific data (which was collected only for the diesel generators, the pumps, the MOVs, the RCFCs and the essential

, cooling water fans).

2) Some of the common cause factors used are still low, even with establishment of the floor for such values in the modified IPE (this is somewhat offset by performance of a sensitivity analysis).

The HRA review of the Byron /Braidwood modified IPE did not identify any significant problems or errors. A viable approach was used in performing the HRA and nothing in the licensees submittal indicated that, based on the H" A, it failed to meet the objectives of Generic Letter 88 20. Important elements (including weaknesses) pertinent to this determination include the following:

i 1) De modified IPE indicates that utility personnel were involved in the HRA and that the procedure reviews, plant examinations, and operator action interviews represented a viable process for confirming that the HRA portions of the IPE represent the as-built-as operated plant.

2) He analysis of pre-initiator human actions included both miscalibrations and restoration faults.

However, while a thorough analysis and evaluat i on of plant specific data relating to pre-initiators was performed, only four restoration faults were actually included in the PRA models. All others were dismissed on the basis of qualitative (and in a few cases quantitative) screening criteria. While the approach was not without merit, the lack of a full modeling of pre-Initiator events (and the lack of a clear explanation of the pre-initiator quantification technique) must be considered a weakness of the modified IPE.

l

3) ne combination of the EPRI Cause Based Decision Tree Methodology (CBDTM) and THERP (NUREG!CR-1278) provided a reasonable basis for assessing post-initiator response type human actions. He CBDTM as app!!ad in the Byron /Braidwood modified IPE does e good job of l assessing the diagnosis portion of operator actions. In addition, the impact of plant-specific performance shaping factors was adequately addressed. One limitation of the CBDTM is that it does not, in itself, have a unique approach for analyzing time-critical actions. Dat is, those xviii l

actions where the difference between the time available and the time required to perform the actions is short and the possibility exists for the operators to fail to accomplish the actions irr time,' are not evaluated directly as a function of time. = nerefore, even with the CBDTM, the potential exists for underestimating HEPs for short time frame events. However, the licensee performed -an -acceptable evaluation to ensure that short-time frame events were not inappropriately quantified.

4) A thorough treatment of dependencies between post-initiator operator actions was conducted for

- the tradified IPE. y

5) he Byron /Braidwood modified IPE presents a list of the important " operator action nodes" as a function of their contribution to CDF. De licensee noted, however, tnat "in these lists all cases of each operator action are combined." For example, the OSX event includes OSX 1 [ HEP Byron = 1.3E 3] for LSX sequences as well as OSX 4 [ HEP = 1.0] for DSLX sequences. As stated by the licensee, "thus, the operator action importance can be misleading since it includes .

cases of defined failure [ HEP = 1.0]." In addition, the top event toport does not include events la the fault trees. Dus, the list does not provide useful information about the important human ,

actions.

The strengths of the Level 2 analyses are the in depth examination and plant specific evaluation of important containment phenomena in the Phenomenological Evaluation Summaries (PESs), and the extensive MAAP calculations performed for source term definition and sensitivity analyses, it seems that '

the licensee has developed an overall appreciation of severe accident behavior and a quantitative understanding of the overall probability of core damage and radioactive material releases, he licensee has also addressed the recommendations of the CPI program.

Dere are some weaknesses in the Level 2 IPE:

1) De most significant weakness is the lack of consideration of some of the containment phenomena in the IPE quantification model. Except for containment overpressure failure, isolation failure,

- and bypass, all other containment failure modes are considered as "unlikely" to cause containment failure and thus not included in containment failure quantification. These include all phenomena that may cause early containment failure (steam explosion, hydrogen combustion, and j'

DCH), and some phenomena that may__ cause late containment failure (molten core debris interaction and thermal attack of containment pdetetions). Because of_ the uncertainties associ.:ted with these pheessissa and containment pressure capability, their contributions to early containment failure may not be negligible, ne problem is more significant for Unit 2 because of its relatively low containment failure pressure. Although a rough estimate provided in the response to an RAI indicates that the contributions to containment failure probability from these "unlikely failure modes" are small (about 1% of total CDF) and their exclusion from containment failure pH-:=bn may be justified, the lack of consideration of these failure modes in the IPE in a structured way, such as can be provkled by a CET, precludes a systematic means to examine 7

the relative importance of these failure modes and the effects of some recovery actions on these

_ failure modes.

2) De assignment of SGTR sequences to Release Catego C is another problem. Release Category

= C, according to the IPE submittal, involves accident sequences that have up to 1% of the volatiles xix

.l l released. However, the predicted release fraction of volatile fission products' for the sequence selecsed to represent the SG1R sequences is 27%, much greater than the limit of 1% of volatiles '

.for Category C. It is thus more appropriate to use Release Category T (instead of C) to .

r - characterize the release of the SGTR sequences. Release Category T is defined as containment

. bypass with up to 50% of the volatiles released.  ;

De licensee agreed in a telephone conference call (involving NRC, BNL and Comed personnel)  :

that, based on the information pramanead in the IPE submittal (including the RAI response)

- Category T is the correct release category for SGTR sequences. De assignment of all SGTR .

sequences to the T Category, although conservative, is acceptable. With this change, the J conditional probability of significant early release (i.e., for volatiles release greater.than 10%)

for Byron is 5%, an average value in IPEs with large dry containments Although the MAAP calculation performed in the IPE for the SGTR case may be conservative because the relief valves on the secondary side were assumed to fall open (e.g., due to excessive cycling) in the calculation, there is no basis in the IPE submhtal and the RAI, response to assign the SGTR sequences to the C Category. Any future -ffort (e.g., additional MAAP calculation)

! to justify the assignment of the SGTR sequences to Category C needs'to address the probability of SG valve failure due to adverse operating conditions in severe accidents.

< 3) Equipment survivability study in the IPE is limited in scope to a review of the conditions encountered during a successful recovery from each of the initiating events. De equipment is thus- assessed only for the conditions prior to core damage. -For example, the Reactor  ;

Contelr. ment Fan Coolers (RCFCs) are considered as facing their harshest environmental challenge following a Large LOCA initiator, he challenges to the equipment by the harsh environmental conditions following core damage, such as aerosol plugging, were considered to be beyond the scope of the IPE. According to the response to an RAI question, the effects of aerosol plugging of RCFC cooling coils are considered in the Severe Accident Mnagement Guidance provided by the Westinghouse Owners Group for members to use in developing Severe Accident Response procedures.

This is not a sigr.ificant deficiency, however, because containment failure due to equipment failure under hars5 environmental conditions would be late and most likely with low fit.sion product releases. The effect on the overall fission product release profile for Byron should not be significant because of the already relatively high contribution from late containment failure for Byron (35.5 %).

4) The treatment of induced steam generator tube rupture (SGTR) is not well treated in the submittal. Induced SGTR is not included in the PRT model or addressed in the PESs. Rough estimates of the probabilities of hot leg failure and induced SGTR by creep ruptuce using a decompghion avent tree structure are presented in the licensee's response to the RAI. It shows -

an overall probability of induced SGIR of 185. De probability is increased to 24% if the RCPs are restarted by the operator. Although these high probabilhy values do not seem to justify the omitting of this failure mode in IPE quantification, further discussion is not provided in the RAI response, it is noted, however, that these probability values are obtained based on an analyst's

! -- Judgement and may t e overly conservative. (De probability of induced SGTR obtained in the RAI response is much higher than that obtained in NUREG-ll50.) Since containment bypass

.D

i from SGTR initiated sequences is the dominant failure mode in the IPE, additional contribution to containment bypes from inducal SGIR may not change significantly the release profile of the ,

plant. However, this issue needs to be re-examined if contribution from the SGTR initiated ,

sequences to the total CDF is significantly reduced in a future IPE uplate.

5) - Although the sequences selected for source term definition seem adequate, the selection of a sequence with very low frequency to represent a PDS group that includes the most likely sequence, and the lack of sufficient diarnaaba on the selection, is a weakness. Even if the source terms denned by the MAAP calculation for the selected sequence can bound or are representative -

of all the sequences in the PDS group, the most likely sequence with significant CDF contribution c.ould be analyzed (or examined in more detail) to provide data for IPE quantification and source

- term definition. On the other hand, the MAAP calculations performed in the IPE provided a reascc). e' coverage of the sequences that could occur at Byron to allow a. quantitative understanding of accident progression and fusion product releases for Byron.

- De licaaw appears to have fulfilled the objectives of Generic Letter 88-20. Some strengths and several

~

weaknesses of the Level 1, HRA, and Level 2 analysis are identified above.

]:-

.g

W..., ." #

• h e

4 ee XX11

NOMENCLATURE Af ' te Alternating Curtent A. # Auxiliary Feedwater ATW5i Anticipated Transient Without Scram BNL Broothaven National Laboratory BwS Braldwood Station ByS Byron Station CBDTM Cause Based Decision Tree Methodology CCF Common Cause Failure CCI Core Concrete Interaction CCP Centrifugal Charging Pump CCW Component Cooling Water CDF Core Damage Frequency CET Coctainment Event Tree Comed, CECO Commonwealth Edison Company CPI Containment Performance improvement CST Condensate Storage Tank CVCS Chemical and Volume Control System DC,de Direct Current DCH Direct Containment Heating DDAFW Diesel Driven Auxiliary Feedwater DDT Deflagration to Detonation Transition DG Diesel Generator DHR Decay Heat Removal ECCS Emergency Core Cooling System EOP Emergency Operating Procedures EPRI Electric Power Research Institute ESW Es ential Service Water FAI Fauske & Associates, Inc.

GL Generic Letter GSI Generic Safety issue HEP Human Error Probability HPME High Pressure Melt Ejection HRA Human Reilability Analysis HVAC Heating, Ventilating rad Air Conditioning IDCOR Industry Degraded Core Rulemaking IPE Individual Plant Evaluation ISLOCA Interfacing Systems Loss of Coolant Accident LOCA Loss of Coolant Accident IIX)P IAss of Offsite Power MAAP Modular Accident Analysis Program MFC Motor Control Center MDAFW Motor Driven Auxiliary Feedwater MFW M:.in Feedwater xxiil

NOMENCLATURE (Cont'd) {

MGL - Multiple Greek latter MOV Motor Operated Valves MWe Megawatt Electric Mwth Hegawatt Thermal NRC Nuclear Regulatory Commission OA Operator Action PDS Plant Damage State PES Phenomenological Evaluation Summaries PORY Power Opwated Rollef Valve PRA Probabilistic Risk Assessment

. PRT Plant Response Tree PSF Performance Shaping Factor PWR Pressuthed Water Reactor .

QA Quality Assurance RAI Re,uest for AdoltionalInformation RAW Rist Achievement Worth -

RCFC Recirculating Containment Fan Cooler RCP Reactor Coolant Pump RCS Reactor Cooling System RHR Residual Heat Removal RPS Reactor Protection System i

RWST Refueling Water Storage Tank SAM Severe Accident Management SBO Station Blackout SG Steam Generator SGTR Steam Generator Tube Rupture St Safety injection TER Technical Evaluation Report THERP Technique for Human Error Rate Prediction USl Unresolved Safety issue r

C xx V

1. INTRODUCTION-1.1 Review Process his te&nical evaluation report (TER) documents the results of the BNL review of the Byron Nuclear Power Station ladividual Plant Examination (IPE) submitta! (IPE, RAI Responses). Dis technical evaluatiou report adopts the NRC review objectives, which include the following:

• To determine if the IPE submittal provida the level of detail requested in the " Submittal  !

Ouldance Document," NUREG 1335, and 1

• To assess if the IPE submittal meets the intent of Generic Lette- 88 20. i De NRC lasued Generic Letter (GL) 88 20, requesting that all licensees perform an IPE *to identify {

pl.mt specific vulnerabilities to severe accidents and report the results to the Commission" according to  ;

the fonnat and content guidelines outlined in NUREG 1335. As stated in the GL, the purpose of .the  :

l IPE proram is for the licensee to; I. Develop an apr lation of severe accident behavior.

2. Understand the most likely severe accident sequences that could occur at the plant.

3. Gain a more quantitative understanding of the overall probabilities of core damage and fission product releases.  ;

4. If necesary, reduce the overall probabilities of core damage and fission product releases by .

modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.  ;

Dis review addresses the reasonableness of the overall IPE approach with regard to its ability to permit the licensee to most these goals of Generic Letter 88 20. i i

A Request of Auditional Information (RAl), which resulted from a preliminary review of the IPE

. submittal, was prepared by BNL and discussed with the NRC on October 2,1995. Based on this discussion, the NRC riff submlued an RAI to the Commonwealth Edison Company (CECO) on February r 1,1996. Commonwealth Edison Company responded to the RAI in a document dated March 27,1996 l whid was a submittal for a Modified IPE. His document discusses joint Byron /Braidwood issues, as the plants are very similar and the RAls wers identkal for Level 1. In addition to responding to the RAI, this document presents modificadons to the model and the results due to the issues raised in the RAls and '

~

_ the previous NRC-raised issues for the other CECO IPEs (Zion, Dresh Quad Cities). His TER is bened on the original subehtal, modl6 cations to the IPE (modiflM IPE) and its results and the responses to the RAI(RAI Responses). De submittal (and this 'IER) also refer to an anhaami IPE"which was an upgrade to the original IPE but did not include the modifications documented in the modified IPE.

h 4

^~ . . - , , . - ,,- , .~..-..cn,. .

-.~,.,.--....~_..~w

1.2 Plant Characterization no Byron 5tmlon (ByS) is a tweenk nuclear poww plant. - Each unk is a Westinghouse 4 loop L pressurised weer reador (PWR) with an elecsrical power rating of 1105 MWe.- ByS is operated by the Commonwealth Edison Company. Unit I started conunercial operation in September 1935, while the j Unk 2 start due was August 1937.

J A number of daign fesures at Byron impaa the core damage frequency. A more detailed discussion 'l is pnvided in the body of this repon. Dese are: j 1

De plant has a feed and bleed capabi'hy. De power operated relief valves (PORV) block valves  :

are nonnally open, however they are conservatively modeled as closed. One PORV is enough  ;

for success of the feed and (Acad operation. De PORVs are powered from either the lastrument j sit system or the dedicated insomalamaae accumulators. De feed and bleed ~ operation can be - l accomplished whh skher one of the two centrifugal charging pumps, or, at a lower pressure, ons ; ,

of the two safety ledaction (SI) (or high pressure injection (HPI) pumps) (in which case two- ,

PORVs are needed). {

Dare are three main feedwater (MFW) pumps, one motor driven (normally in standby) and two  !

tubine driven (normally operating). In addition, there is also one motor driven stanup feedwater ,

pump nwe are 4 condensate / condensate boostw pumps.

i Dere is one motor driven sulliary feedwater (MDAFW) and one diesel driven feedwater '7 (DDAFW pm De diesel driven pump has its own dedicated se of two redundant 24 V batteries, n at. as it praially independent of the plant's 125 V de system. However, auto start i and remote manual startft rom the control room) of the DDAFW pump dom depend on the 125 Y system. De IPE conservatively does not credit local manual start of the DDAFW p.:mp, i making this pump de dependent in the model (however, it seems that battery depiction is not a problem once the pump has been started). 1 ne condensate storage tank (CST)is relatively large (good for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in an SBO), maintained i at 400,000 gal (however, the toch specs require only 200,000 gal) De alternate suction ,ources ,

, for the AFW system are the other CST and the essential service water system (SX).

i ne reactor coolant pumps (RCPs) employ Westinghouse seals with charging pump injection and  !

component cooling water cooling of the thermt' barriers. De seals use high temperature O-rings. In the submittal it is stated that the new O-rings had been installed on unit 1 RCPs, and,

! 'during the next outage *, will be installed on the unit 2 RCPs' (the submittal has a date of April - ,

1994). Note that a loss of the essential service water system (SX) will eventually result in a loss of all seal cooling, as SX is used to cool both the centrifugal charging pumps and their pump room, as well as to cool the component cooling water (CCW) heat exchangers. _

Dwe are three charging pumps. Two are centrifugal, with SX cooled bearings, and one is a ,

positive d' '= m type whose bearings are cooled by CCW Any one of the three pumps can .

. be used for nonnal charging (which includes RCP seal iq}ection), or emergency boration (taking Mi suelon tom the boric acid transfw pumps), but only the centrifugal charging pumps (CCPs) are ,

used for injection following a safety signal. - .

F 2 --

I a

,. o , ., ,+.- _ - - . - ~ ~ . ~ _ . - ~ _ . , , , , . . . _ . . _ . _ ~ . _ , - _ _ - .

..=

De high head injection can be provided by eithw of the two Si pumps, or by eithw of the two CCPs. thus providing a high level of redundancy. His applies to the recirculation phase as well.

De CCPs and the $1 pumps are physically separated.

De high presure recirculation is provided by a piggy 4mck arrangement on the two RHR pumps. ,

ne switchover to low pressure recirculation is automatic, but the high pressure recirculation i requirw operator action to align high pressure pumps to the discharge of the RHR pumps.

De refueling water storage tank (RWST) normally holds 414,000 gal ('relatively large*, good  !

for 20 bours in a steam generator tube rupture (SGTR)) and is designed with a proceduralized refill capability.

There seems to be a weak dependence on instrument air. Valves in the residual best removal i (RHR) heat eachangers and the AFW system would fall open, not affecting operation of these ,

systems, whereas the semical volume and control system (CVCS) valves would fall as is, again not affecting operation of the system. De steam generator level control could be accomplished l by valves not dependent on instrument air. De MSIVs would fail "r.: is'. De pressurizer i PORVs would be affecteo but have accumulators with enough capacity for 50 openings De l normal pressuriser spray valve would close. Dwe would be a partial effect on the CCW system j and a delayed effect (via HVAC loss) on elocarical switchgear, the RHR pumps, and the charging pumps. De main effect seems to be failure of the main feedwater and the condensate systems, as well as the steam dump capability and the RWST refill capability.  !

However, there are only three instivment air compressors between the two units, two normally

- operating, and one standby, common to both units.

Dere is a relatively weak dependence on the HVAC system. The HVAC system is distributed l (each component room has a dedicated unit, plus a common ventilation system in the auxiliary building which supplements the individual HVAC units). De only components affected, over many houn, would be the chstging pumps, the RHR pumps and the electrical switchgear, ne ,

DDAFW pump, however, would suffer failure within 2 minutes, due to bearing failure; on the other hand, the main components of its HVAC (the SX booster pump and the room ventilation fan) are powered off the engine shaft and are integral components of the pump itself.

De essential service water system (SX) is used to cool the diesel generators, the CCPs, the S1 pumps, the CCW, the recirculating containment fan coolers (RCFCs) and various HVAC units in the auxillary be.iliding and the control room. He flow from this system is gg required for proper cooling of the DDAFW pump bearings (including room cooling), due to existence of the ,

integral SX booster pump. However, SX inventory h required, and this can be lost in catain pipe rupture events (see below).

Dere are four SX pumps, two per unit, with a cross-connection capability between the units.

One SX pump per unit is sufficient for heat removal.

De source of water for the essential service water system is comprised of the two cooling tower basins, whis can be drained in certain wha involving ruptures of connected piping. Several systems are pmvided for basin makeup, including motor driven pumps (circulating water makeup 3 .

_ _ _ _ _ __ _ _ _ _ - . _ .; _ _ _ _ . _ . . _ , _ ~ _ _ . ..,-._.,-._,,,m,_--.._...

pumps powered off nonsafety ac, and two deep well water makeup pumps powered off safety ac buses), two diesel driven pumps (one per cooling tower basin) and a connecslon to the firewster system.

4 he possibility of losing essential service water inventory is the major difference between the Byron and the Braidwood plant designs.

De CCW is used to cool the RCP seal thermal barriers, the RCP upper and lower oil coolers, the positive displacement charging pump (PDP) oil cooler, the normal and excess letdown, and the RHR heat exchangers and the RHR pump seals. s here are five CCW pumps, two dedicated to each unit, and one swing pump which can be aligned to either unit.

Dere is only one PORY per steam generator (SG) (4. steam generators), however there are provisions for manual opening of SG PORVs. Dere are also 12 steam dump valves, sufficient for a 50% load rejection.

ByS has an AMSAC system, which, in case of an anticipated transient without scram (ATWS),

automatically trips the turbine and starts the AFW system.

Or ly one out of four RCFCs is required to prevent containment overpressurization by steam production, in addition, there are two containment spray trains De RCFCs can also be used for decay heat removal, in case of failure of RHR heat renoval in the recirculation phase (they provide good mixing of the containment atmosphere during RCFC operation).

There are two 125V DC buses per unit, each with an associated battery, and a charger. De batteries have an g hour capacity at the maximc current (without load shedding); however it does not appear these batteries are needed for the DDAFW pumps once these pumps are started.

Tie lines are provided for cross-tying respective de buses from the two units (apparently not credited in the analysis).  ;

i nere are 2 diesel generators per unit, cooled by essential service water and provided with their own startup air. De emergency buses can be cross connected, and each diesel generator has sufficient capacity to power one emergency bus a both units at the same time.

There are provisions in place to feed some non-essential loads as well from diesel generators, such as the air compressors, primary water pumps and nonessential service water pumps (cooling for the air compressors).

Dere are 4 offsla transmluion lines feeding into the switchyard.

De Byron Nuclear Power Station utilizes a large dry containment design. The containment structure is a prostressed concrete shell made up of a cylinder with a shallow dome roof and flat foundation slab.

Some of the plant characteristics important to the back-end analysis are summarized in Table 1 below, and compared to those of two other typical large dry containments.

4 u , _ . . -_ _ __ __ _ _ _ . ___

Table ! Plant and Containt. weit Charactwistics for Byron Nuclear Power Station l Characteristic Byron Zion Surry nermal Power MW(t) 3411 3236 2441 Containment Free volume, ft' 2,800,000 2,860,000 1,800,000 Mus of Fuel, Ibm 204.000 216,000 175,000 Mus of Zircalloy, Ibm 43,400 44,500 36,200 Containment Design Pressure, psig 50 47 45 Median Containment Failure Pressure, psig 98' 135 126  ;

~

Containment Volume / Power, ft'/MW(t) 821 884 737 Zr Mass / Containment Volume, Ibm / ft' O.015 0.016 0.020 Fuel Mass / Containment Volume, Ibm / ft' O073 0.076 0.097

+ The median contauunant fadure pressure is 125 psig for Unit I and 98 psig Ior Unit 2.

%e lower failure proseure for Unit 2 is due to its use of the Bunker Ramo electrical penetrations which was stated in the IPE submittal to have a lower failure pressure.

As shown in the above table, the parameter values for Byron are close to those of Zion. The lower containment failure pressure for Byron is due to the use of the Bunker Ramo electrical penetrations (used in Unit 2 only). De parameters presented in the above table provide rough indications of the containment's espability to meet severe accident eblienges, but both the containment strength and the challenges associated with the severe accident involve significant uncertainties, ne plant characteristics important to the back end analysis are:

A cavity design which allows water to flow from the containment basement to the reactor cavity via the cavity instrument tunnel. Although a removable hatch cover is located at the top of the instrument tunnel, it is not leak tight for Byron. (it is essentially leak tight for Braldwood.)

A large containment volume with an open design and significant venting areas for the subcompartments within the Byron containmen which help ensure a well mixed atmosphere (a feature which inhibits combustible gas pocketing).

A relatively low containment failure pressure of 98 psig for Unit 2 because of the use of the Bunker Ramo electrical penetrations and a relatively high containment failute pressure of 125 psig for Unit I which does not use these kind of penetrations.

Two separate systems for containment atmosphere cooling and pressure suppression: the Reactor Containment Fan Coolers (RCFCs) and the Containment Sprey system. According to the IPE submittal, one of four RCFCs or one RHR heat exchanger (with associated recirculation train) can provide sufficient containment cooling to prevent containment overpressure failure from l

5

~

l steam production'. De RCFC is designeo to remove heat from the containment as required l following a design basis LOCA and, consequently, is designed to operate in pressures up to 50 psig. De containment spray pumps can be aligned to take suction from the RWST, or from the containment recirculation sump and one or more RHR pumps and associated heat exchangers.

De operation of containment spray reduces fission product releases.  ;

a T

%e residual Heat Removal (RHR) system for decay heat removal from ths RCS, although not a containment system, also provides a means oflong-term containment he:J removal.

1 6

l 1

. . . . ~ - - - - - _ - , _ . _ . - , - _. .- _ _ ._ ,

2. TECHNICAL REVIEW 2.1 Licensee's IPE Process 2.1.1 Completeness and Methodology t

%e licensee has provided the type of information requested by Generic Later 88-20 and NUREG 1335.

De licensee initiated work on a probabilistic risk assessment (PRA) for Byron in response to Generic Letter 88 20. De freeze date for the analysis was July 1991. (However, plant specific data was collected through March 1992).

De Byron IPE was performed by consultants with an involvement by the Commonwealth Edison Company. De CECO staff also performed some specialized facets of the analysis, e.g., MAAP runs for success criteria development. In addition, it is Stated in the IPE that operations staff was involved in the process to a significant extent.

(Note: De Byron IPE is used as a template for the Braldwood IPE, due to the close similarity of the two CECO plants). .

CECO staff managed the IPE, provided insights to the senior management and implemented the improvements.

De front end portion of the IPE is a Level 1 PRA. De specific technique used for the Level 1 PRA is a support state model using the large event tree /small fault tree technique, and it was clearly described in the submittal.

Event trees were developed for all classes of initiating events considered. A system importance analysis has been performed. A limited sensitivity analysis is shown. No uncertainty analysis was performed.

To support the IPE p,0 cess, the licensee reviewed several PRA studies: WASH 1400, NUREG 1150, the IDCOR study for Zion, and the Zion IPE.

De modified Byron /Braldwood IPE, in conjunction with the licensee's response to the NRCs RAI, was generally complete in scope regarding the HRA process. De HRA process for the Byron /Braldvood modified IPE addressed both pre-initiator actions (performed during maintenance, test, surveillance, etc.)

and post-initiator actions (performed as part of the response to an accident). De analysis of pre-initiator actions included both miscalibrations and restoration faults. However, while a thorough analysis and evaluation of plant-specific data relating to pre-initiator was performed, only four restoration faults were acsually included in the PRA models. All others were dismissed on the basis of qualitative (and in a few cases quantitative) screening criteria.

Post initiator human actions modeled included both response-type and recovery-type actions. A post-Initiator screening analysis was not conducted. All human actions included in the logic models were given detailed quantification analysis in the original IPE. For the modified IPE, the PRT and fault tree 7

___. . _e. ,, -

j i

i post initiator response type hutaan action 6 with a risk achievenent worth ((RAW), "using the original IPE model. enhanced quantification") greater than 2.5 and *those added as a result of changes to the  !

PRTs and fault trees," received a complete re4 valuation, la addition, PRTs that " contributed l A; ."--4y to CDF in the original IPE were identified" and "the operator actions (OAs) in these trees, ,

ladeding the condklonal probabilkies, were evaluated on a sequence specific basis to identify condklons  !

of areas, Y My, and avaliability of recovery opportunities and were reguantified when necessary."

Remaining HEPs were reviewed for reasonableness and "for selection of the appropriate value for each {

branch of the PRTs." he PRT OAs *were also reviewed to identify those actions which might be i described as tinw critical." nat is, "those for which the anl=mari time to accomplish the action was  ;

4 greater than 25% of the estimated time available before some undesirable state was reached." J Post laitiator response type human actions were quantified using the EPRI Cause Based Decision Tree f Methodology _(CBDTM), which has been refwred to as a cause-based approach. Recovery of failed l equipenent was quantified on the basis of mean time to repair data from WASH 1400. Otbar recovery  !

type amions modeled wars assigned a screening value of 0.1. Since all of the recovery related sequences were *long term," an HEP of 0.1 is not unreasonable. Plant specific performance shaping factors and ,

dependencies (sudi es those among multiple actions in a sequence) were thcroughly considered for both l response and recovery actions. Human errors were identified as important contributors in accident l sequences leading to core damage. j i

De Byron Nuclear Power Station Individual Plant Examination (IPE) back-end submittal is essentially j consistent with respect to the level of detail requested in NUREG 1335. However, a CET is not developed specifically for level 2. A single event tree, the plant response tree (PRT), is used for both l l the Level I and Level 2 aanlyses. Since most of the phenomena that may challenge containment integrity are dismissed in the IPE as "unlikely" to cause containment failure (based on the Phenomenological Evaluation Summaries prepared by FAl), quantification of containment failure is greatly simplified.  !

Quantification is primarily based on the availability of containment heat removal addressed in the PRT.  ;

Since a single event tree is used for both Level 1 and Level 2 analyses, grouping of core damage  !

sequences to plant damage states (PDSs) is not necessary in the IPE. However, sequence grouping is used to consolidate the large number of accident sequences obtained from the PRT analysis into a small  !

number of damage states (called core damage sequence designators or plant damage states, PDSs, in the IPE submittal) such that all sequences within a particular damage state can be treated as a group for r L assessing accident progression, containment response, and fission product release.

l ,

The PRT developed in the Byron IPE explicitly includes the analysis of containment systems normally assessed in the Level 2 analysis. De containment condition is addressed in the PRT by the development  ;

of success criteria for containment integrity, and, according to the IPE submittal, integrity is maintained if the anmalament is isolated and containment heat removal (CHR) is available. Successful containment E

beat removal, based on plant specific MAAP analyses and containment pressure capability (98 psig), can be provided by one of four RCFCs or one RHR heat exchanger (with associated recirculation train), j Besides containment overpressure failure due to the loss of CHR,' only contalammat bypass and containmentl ealmian failure are included in IPE quantification. All other containment failure modes are .;

L -addressed in the Phenomenological Evaluation Summaries (prepared in support of the IPE, but not u l

$ i l

8 [

T 5

). .: _ _ .- - -.-..-- _ . , _ - _ - - . , _ - - , . , .L ,_.-a. - - --

included in the IPE subminal') and dismissed as "unlikely" and teu not included in failure quantification.

Although the contributions to containment failure probability from these "unlikely" failure modes are -

espected to be small", and their exclusion from failure quantification may be justified, the i.ek of consideration of these failure modes in a structured way, such as can be provided by a CET, precludes a systematic means to examine the relative (quantic.tive) imponance of these modes and the effects of some recovwy actions (e.g., depressurization) on them.

Results of the 11tT analysis are grouped to plant damage states (PDSs). Release fractions are determined by the analyses of 12 representative sequences using the MAAP computer code. Based on ce*ma failure timing, containment failure mode, and the fractional release of fission products, the PD$s are j further grouped to eight release categories.

I 2.1.2 Multi Unit Effects and As Built, As Operated Status l I

Cross connection capability exists between the units for the SX pumps, emergency ac and de buses and

- the condensate storage tanks (CSTs). De CCW and lastrument air (IA) systems have standby swing trains whidi can be connecsed to elher unit. De control room, the switchyard, the cooling tower basins, :

and the non-essential savice watet (used to cool the compressors, the condensate and the MFW pumps) are shared.

he two units et this site are effectively identical, hence the model or the results are not unit specific.

De effect of shutdown of the other unit was not explicitly modeled. However independret failures in  ;

the other unit are accounted for. De technical specifications limit the degradation of important systems in the shutdown unit (i.e., only one train at a time can be undergoing maintenance), nis applies to the SX, CCW, ac and de power, IA.

Dual uni atlators were modeled (e.g., dual unit loss of offsite power, or dual unit loss of service water). .

A wide variety of the most recent versions of information sources were used to develop the IPE: system descriptions, Byron updated FSAR, units 1&2 general arrangement drawings, piping and lastrumentation diagrams, piping physical drawings, electrical drawings, structural drawings, technical rpecifications, abnormal operating procedures, emergency procedures, surveillance procedures, Byron licensee event '

reports, deviation reports, plant operating histor), maintenance records, scram reports, Byron NPRDS information, monthly unavailability diarts, master out of service card logs, general operating procedures,-

, system procedures, system / containment / flooding evaluation walkdowns, plant pump head curves for key

'Part of the PESs are provided in the licensee's response to the RAI.

• ne licensee's naponse to the RAI indicates that the conditional containment failure probability due to the containment pressuriza+1on mechanisms not included in the IPE quantlfication (i.e., steam _

emplosions, DCH, hydrogen deflagration, and hydrogen detonation) could be about IL nis number, .

according to the licensee, is based on bounding estimates of the effects of the above loading mechanisms on containment failure probability.

9 i

t

. - - , , .--.---,,+nm -w-r--~ + -s,,- ,..n.- , ., - , - - , -.,,n.------,,n,:,--,,---.-, 4.-,,.n--nn,- ,

t i

i pua.as, containment HVAC calculations, HVAC normal beat loads for the auxiliary building, vendor l detalspeci6 cations for safety grade components, electric room heatup calculations, Byron /Braidwood fire pove*% report, unit 2 nuclear design report and Byron technical staff experience. De freeas date of j the analysis was July 1991 for the Byron model and March 31,1992 for the data.  :

At least one plant walkdown (for Sooding) was explicidy referenced. Other walkdowns are implied, e.g.,

as when the IPE discusses resolution of differences between the information contained in the above a documents and the actual systems and layout. .

Procedure reviews, examinations of control room staffing and layout, examinations of the " Detailed ,

Control Room Design Reviews and over 40 operator acslon interviews whh operators helped assure that .a the IPE HRA represented the as4ullt, as operated plant. Checklists were filled out during the laterviews [

to document critical plant and scenario specific aspects of the diagnosis and execution of an action. ,

Famors evaluated included training on the simulator, adequacy of procedures, need for local actions, time available for local actions, feedback to the control room for local actions, stress level, potential non-recoverable actions, etc.

De subnittal states the licensee intends to maintain a *living' PRA.

2.1.3 IJeetwee Participation and Peer Review Licensee personnel were involved in all aspects of the analysis. De Byron IPE was performed by consultants from Westinghouse, *lENERA and Fauske (the IPEP team) with involvement, review and help in certain areas of the analysis by the CECO team. De program was managed by the C2Co person in charge of the company's overall IPE/AM effort (i.e., all 6 CECO plants)

De IPE was subjected to a multi tier review process. First, the contractor personnel would review their '

analysis. Als was then reviewed by the appropriate licensee personnel and any comments resolved. A final review of the IPE study was conducted by CECO senior management and the IPEP senior ,

management). Decisions concerning IPE and/or accident management (AM) recommendations were made as part of the CECO management review. Dere was no outside review and the licensee states the internal review was very thorough such that outside review was not deemed necessary, it should be noted that Byron and Braidwood IPE review personnel consisted of people from both plants as well as personnel ,

i familiar with other CECO plants, such that uniformity of modeling across the licensee's plants was a goal of thelicensee.

Dere are no examples of review comments provided in the submittal.

From the description provided in the IPE submittal it seems that the request of Generic Letter 88-20 rossiding licensee' participation and peer review was satirfied.

A 6

i 10 2

. , - + , , . -- , ,. -,e.-m, w .~,.e.wr-- --.c- .,re- ..,,.-..,,-,m_ . -. .-_.~.._ _ m

t 2.3 Front End Technical Review 2.2.1 Accident Sequence Delineation and System Analysis 1.2.1.1 laidating Events De IPE initiating events were developed by considering events which would result in a resaor trip on  ;

a relatively short time scale, i.e., controlled manual shutdown would not qualify.

Generic Westinghouse PWR experience was consulted for types of events to consider, as well as plant specific events which have occurred at Byron. De Byron design and abnormal operating procedures were reviewed to determine whether plant conditions thd may result in addition or deletion of accident  ;

initiators were considered. %e previous and on going analyses of similar plants were reviewed and their ,

applicability to Byron assessed. Finally, the reselts of plant systems analyses were utilized to identify potential initiating events.

Dere were 19 laitiating event categories, as follows:

1.oss of Coolant Accidents (LOCAs):  ;

large LOCA (> 5.2");

medium LOCA (> 1.7" and < =5.2*);

small LOCA (>0.86* and < =1.7*);

SGTR; ISLOCA (several pathways):

-lines through CCPs;

-safety injection pump discharge lines;

-RH discharge lines; RH suction lines; Transients: '

- general transient:

-reactor trip;

-turbine trip;

-loss of main feedwater; loss of condenser;

-power excursions; etc.;

secondary side brehks upstream of the main steam (MSIVs) or downstream of the main feedwater ,

isolation valves (FWIVs);

secondary side breaks downstream of the MSIVs or upstream of the FWIVs; single unit loss of offsite power (LOOP);

dual unit LOOP;-

Support system initiators:

single unit loss of essential service water; dual unit loss of essential service water; loss of component cooling water; 11'

.- e ,- w , , , -r----- ,w- -~.n..,,-.,-., .,...,..m+- n,.- -

e , n.,-, +w -onr - e-e.,

loss of 125V de bus !II; loss of instrument air; loss of 4kV ac bus 141;-

loss of 4kV ac bus 142; Flooding initiators:

flood in zone 3.31 (turbine building grade level); -(

flood in sono 11.64 (auxiliary building elevation 426').  ;

The laitiating event analysis is fairly comprehensivt and encompasses most commonly en==ed initiating events. Furthermore, k was based on plant specific analyses. ,

No reactor vessel rupture initiator is included, however the RAI responses state that, based on WASH- i 1400 frequency of I.E 7/yr, this initiator was neglemed. m

- HVAC systems were considered for lentiating evems. However, based on distributed system design (each m$x safety component has ks own room dedicated HVAC), the slow heatup rates or lack of a plant trip, ,

as well as the proceduralized operator mitigating actions, HVAC failures were eliminated as initiating  ;

i events.

2.2.1.2 Event Trees De IPE developed 2 support system event trees and 15 plant response trees (PRTs). i c

l l  ;

T.m support system event trees developed combinatinnf successes and failures of the following support systems: 4 kV emergency ac buses 141 and 142,480V emergency ac buses 131X and 132X, de buses d 111 and 112, ESFAS channels A and B, cuential service water and component cooling water. One of t l -

the support systems event trees was for the case when offsite power was available at unit 1, while the other was for the case of loss of offsi;e power at unit 1. .  :

De reason for exclusion of instrument air status from the support system event tree is that loss of this

. system only mildly affects important systems (as discussed in section 1.2), hence its status is nucluded in i individaal systems' fault trees, as there are only a few valves affected.

l De reason for exclusion of HVAC status from the support system event tree is because of the distributed

nature of the HVAC system, and only relatively few important rooms tieed HVAC within the mission

. time. Derefore this system, too, is modeled, if needed, in the individual systems' fault trees.

Eadi of the 15 plant response trees (PRTs) is composed of several subtrees, modeling various phases or aspects of the particular type of accident, or modeling various types of it,itiators within the category (e.g., ,

steamline bmaks inside and outside the containment).- Dus there are literally hundreds of event trees in the subitittal. - De 15 PRTs are for: large LOCA, medium LOCA, small LOCA, SG'llt, ISLOCA,

• transient, LOOP, SBO, A'!WS, loss of CCW, loss of a de bus, consequential small LOCA, secondary food and steamline breaks, loss of essential service water and loss of instrument air De flooding i laitiators and ths losses of ac buses 141 and 142 are analyzed by erhploying the transient PRT. .

1

De event trees are systemic. De mission time used in the Core damage analysis was 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. -

12 f

, ,[ , y._%., , ..,, .,_.U._.,,-%._. . ,m. . . . e. ., _ .r,,m._, , - - _ - , . - ,,m_. .- .

he PRTs model both Level I and Level 2 concerns.

De event tree end states, other than transfers to other event trees), are divided into the two possible core conditions: success or damaged (further subdivided into plant damage states). A successful ; ore status is defined to include: a) the hot standby where no further operator actions or system activations are required to mitigate the effects of the initiating event and the operators can proceed to either plant cooldown or raurn to power operation; or b) at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the core is suberitical and being cooled. Any operator actions or system activations required to maintain that configuration beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are not required to be successfully accomplished urtil a time significantly beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

De original IPE also had the

• SAM

• end states (meaning success with accident management). Dese are long term sequences, which would need additional actions in order to keep the core in a stable state past the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time. De SAM endstates have been expanded, in the modified IPE, to either success or core damage, with explanations provided about the actions needed and the failure probabilities used. De SAM endstates contributed a substantial amount to the modified IPE's core damage frequency

- the 50 top SAM sequences contributed a CDF of 1.68E-5/yr or 41.6% of the total CDF in the modified IPE. De total frequency of the 50 top SAM sequences in the original IPE was 1.06E-3/yr.

De expansion of the SAM endstates seems reasonable. Credit is given for component repair on a long time scale.

Core damage means exceedance of a critical peak cladding temperature for a certain time period. No core damage is postulated to occur if the hottest core temperature does not exceed 1600*F and if the time above 1400*F is limited to less than 30 min.

Success criteria were based on a best estimato plant response; when nece:,sary, MAAP runs or thermal-hydraulle analyses were used to validate the success criteria.

The original IPE had some success criteria for the large LOCA and the small LOCA wl.ich were questioned in the RAls. Dese questionable success criteria were removed leaving the more typical success criteria in the modified IPE and resulting in a 6% CDF increase due to large LOCA success criteria changes (and one new dominant seque9ce, i.e., the third highest frecuency sequence) and a 0.1 %

CDF increase due to the small LOCA success criteria changes (and no new dominant sequences).

De success criteria for the large LOCA which were deleted was the use of two HPI pumps, or one HPl pump and one accumulator, if the low pressure injection (LPI) pum;40%) ATWS with no main feedwater, one of the success criteria in the submittal allows for failure of control rod insertion, failure of emergency boration, and failure of turbine trip, as long as both AFW pumps operate together with success of 4 out of 5 steam generator (SG) safety valves on each SG and one HPI is successful, it is implied that a small LOCA would ensue, and no 13 i-t_

. i i

primary pressure relief is necessary. Howevw a subsequent convasation with the licenses revealed that this success path would be invalid due to damage assumed to be sustained by the HPI system, which was considwed failed under theses conditions in the evem trees.

De ANS success criteria take credit for indep6.4ent operation of the control banks (as opposed to alamiawn banks) of the control rod systan, which would be automatically inserted to maintain the RCS T , within limits, j in a convwsation with the licenses, the following was learned about the operation and anodeling of this system, as well as about the AMS success criteria (which are not well described in the submittal): j De control banks' movement is controlled by a diNorent system than the shutdown banks. As the control banks rods are drivec in while engaged, by the control rod drive motors, the =ehnical binding of breakers would not be a considwation. Howevw, it is one possible failure =ehaism for the shutdown banks (i.e., for ATWS laitiation). De shutdown banks are designed to be disengaged from the drives by opening of the brukers and to drop into the core by gravity in case of a reactor. trip. Other failure medianisms for the lasertion of the shutdown banks are in reacsor trip signal generation and the reacsor protection systan. Since the control banks rely on different sensors ud use a different controlling systen, they are not susceptible to sudi failures. De licenses states that mechanical binding of sufficient nwnber of control rods is improbable, therefore the two types of control rods are deemed independent. l De inovanent of the control banks would provide enough power reduction in the early stages of an  ;

ANS, such that the primary pressure rdlef criteria would be ameliorated. For example, without taking i into account this feature, no amount of primary pressure relief wou!d be adequate 18% of the time (i.e., l that la the fraction of time in the fuel cycle in which the moderator temperature coefficient is  :

unfavorable). During about another 12% of the time, both PORVs and all three SRVs are needed for j presure relief; this success criterion would also directly led to core damage in the model, as it is assumed that one PORV is blocked for ANS analysis (in other types of events, both PORVs are assumed blocked). Derefore, without taking into account the control banks insertion,- an ATWS could ,

directly land to core damage in 18% to 30% of the cases, depending on the number of PORV block i valves closed. Due to credit for this system, the primary pressure relief failure does not apper in  ;

dominant sequences; instead, failure of the operators to close the MSIV. which is needed in addition to the AMSAC actuated turbine trip) and failures of the AFW system do. ,

Containment heat removal is not discussed in the submi tal, however, it is a low probability concern due to the diversity and redundancy in the containment heat removal systems and since the dominant failure >

snode of the RCFCs (loss of SX) also disables the core cooling recirculation function.

. De feed and bleed success criteria (including the case of small LOCA, among otheN) call for opening of one pressurizer PORV if a charging pump is used (CCP) or two pressurizer PORVs if an SI pump is i used.  ;

Both pressurizer PORY block valves are assumed closed, contrary _to technical specifications. His provides for conswvative modding, as in reality they are open most of the time, and closed only when  :

' the associated PORV is Inking,  !

14 ,

i f

. = - . = - - . . .- . - - . . . . - . - - . - - - - - .-

i

,u i

.j 4

In case of an 580, the ac power must be restored wkhin 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> if the DDAFW purnp is not operating, and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> otherwise. De two40er non-recovery probability is given a value of 0.136, or about half ,

of the NSAC 147 value. De 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> non-recovery probability is given as 1.16E 2, which seems  !

remmamhte. Offshe power is recovwed only in case of an 580, i.e., no credit is given for offsite poww  !

_ recovery of a dead bus whh success of one diesel generator.

De RCP seal LOCA model is taken from WCAP 10541. Rev. 2. t For transients, credk is given for opermor action to restore main feedwww la case of failure of auxiliary feedwater. Credit is also given for depressurising and opersing only with the condensate punps. j s

Some event tres models contain illogical paths. De IPE submittal implies the these are resolved at the j fauk tres level, ,

- h abould be noted that in the IPE submittal explanation of the modeling of accident sequences, and the j

- ranonale thereof is very poorly documented (there is just a summary section on PRTs and success  :

crheria). On the other har,d, the modified IPE discussion of the SAM sequences expansion and the  :

LOCA success criteria is vwy comprehensive.  !

5 Overall, Byron success crkeria and event tree modeling seem to be reasonable and in line with most other l IPEs or PRAs for similar plants.  ;

i 2.1.1.3 Systems Analysis ,

i A total of 10 systems / functions are described in Section 4.2 of the Submittal included are descriptions  :

4 of the following systems: component cooling water, auxiliary feedwater, RCFCs, essential service water, containment spray, ECCS (including safety ledecsion, RHR, CVCS and accumulators), reactor protection, j elomric power, containment isolation and miscellaneous systems (including RWST refill, main feedwater, condensate / condensate booster, instrument air, nonessential service water s turbine stop and governor i valves, steans dumps, steam generator PORVs, MSIVs, FWlVs and pressurist PORVs. In addition, RAI responses discuss the HVAC system.

De system descriptions in the submittal are oAen not vwy clear, which makes it hard to understand all )

aspects of system modeling and plant features. For example, answers to questions arising from the lack l of description of event tres modeling (see above) could not be found hwe, either. De role of the fire  :

protoaion system in the plant and in the model was not discussed. On the other hand, the RAI responsas' i

. discussion of the HVAC is very detailed and thorough, as is the discussion about the Hyron de system. ,

De results session lucidly discusses unique plant features and plant specific irights, and the dependency matrices and associated footnotes are.very expansive and well documented.

Alao included for some important systems are simplined schemadcs that show major equipment items and -

important flow and configuration information.  ;

Section 1.2 provides a discussion of systems and system arrangements which have a signincent hapact i on the level I analysis.-

i 4

15 i

i

.__.4-,....-, . -..-.,#.. -

.. _ . . . . . . . _ . - 2.__.-._. .

f

. _ . . - - . - - ~ - - .. - . - - . - - - - - - - - - - .

~* l Note that the major diffwence between the Byron and Braidwood designs is the source of water for the j essential service water system. Dere are also some minor dlNorences in dependencia, as explained .j below.  :

De systenu notebook approach was used for systems analysis. }

}

2.2.1.4 System P7

De IPE addressed and considwed the following types of dependencies: shared component, instr =maneariaa and control, isolation, motive power, direm equipment cooling, areas requiring HVAC, .

opermor waions and environmental eNeas. HVAC is not an imponant system at this plant, as only a few 1 systems require it within the mission time (see section 1.2 for the list of HVAC dependent systems). 1 Derefore HVAC is not modeled as an initiating event but is modeled as a subsequent failure in the fault {

tross of systems affected by HVAC failure. l

. De RCFCs are needed to control the containment M=+nre within the PORY qualification limits. i Similady, the pressuriser spray valves will be affected by small LOCA environments in the containment, i auch that the maximum flow rate will decrease. ' Howevw, the IPE calculations show that the flow rate ,

,would still be suffic ient.  ;

Seywal Table in volume 2 show various 'dapendency matrices. It should be noted that Byron's-dependency matrices are of poorer quality than Braidwood's. Dere are several inconsistencies between .,

various dependency matrices in the Byron IPE. For example, some matrices imply that EDGs do not  ;

4epend on essential service water or de power, or do not show complete dependence of main feedwater  :

on either de bus.

Dare seem to be minor diffwences between Byron and Braidwood dependency matrices. For example, f

. at Braldwood, a reactor trip closes the main feedwater valves, and the pressurizer PORVs also depend ,

on 120V ac instrument power (in addition to de and compressed air) for operation of a relay. Dese ,.

dependencies do not exist at Dyron. Dere are differences in logic for operating RCFCs in a slow speed mode (during normal plant operation they are operated at normal speed): at Byron, the safegueds or the  :

safe shutdcwn sequencers do the speed switching, whwoes at Brandwood this is the responsibility of the ESFAS system. Another difference in dependency matrices stene from seemingly different piggyback  :

arrangements for high pressure recirculation at the two plants: at Byron, RHR pump A feeds either of the two centrifugal charging pumps, whereas RHR pump B feeds either of the two Si pumps, with valves betwoon the SI and the CCP pumps in place to alter that arrangement. At Braidwood, it seems that RHR -

. pump A feeds either CCP A or $1 A, and likewise for RHR pump B.

i 2.2.2 Quantitative Process 1.1.1.1 Quantification of Aeddent Sequence Frequends l

De IPE used a large event tres/small fault tree approach with a suppon state model to quantify core

- damage sequences. De event trees are systemic.

q De system and event tree models were quantified using the WESQT software, a

16 m- _ _ _ _ _ _ , _ _ _ . . . . , _ _ . . . . . _ _ . _ _ _ . . _ . . . _ , _ _ . . . _ . _ , _ , . _ , , . . - ~ . _ . . , - _ _ , _ - , _

f De systemic sequences which resuhed from the analysis had a truncation limb of 5.E-10/yr. De  !

residual was 3.E-7/yr (0.80% of the CDF). De IPE took credit for various recovery activkles,  ;

including the recovery of offsite poww and repair of eq11pment. l f

De IPE data used for non-recovery of offsite power are lower (by a factor of 2) than the avwage

, industry data ched in an Electric Poww Research lastitute (EPRI)-oponsored study (NSAC 147).

2.1.2.2 Palet Esthmetas and Unsertainty/ Sensitivity Analyses l

Mean values were used for the point estimate of the data input. No uncertainty analysis was performed.

Linked sensitivity analyses were shown. Top event imponance analysis results were also shown. l 2.1.2.3 Use of Plant Spedric Data

. Plant specific data were collected from October 1,1986 through March 31, 1992 for Unit I and r September 1,1988 through March 31,1992 for Unit 2. - Dis 9.1 year data collection period at Byron  ;

represents all of the p; ant's operating experience, except for the first year ' break in' period for each unit.

Component history from both units was combined to arrive at the raw data used to derive the plant specific data used in the IPE. De licensee stated that there is no statistical difference in data between j the two units.

De following sources were utilized to arrive at the plant specific data: (leviation reports, licensee event  !'

repons (LERs), nuclear plant reliability data system (NPRDS), master out of service card log and mode change logs. ,

De licermee focused hs data gathering effort for plant specific data on relatively few types of components i deemed important by the licensee; the other components were assigned generic data from a variety of sources. De components which were assigned plant specific data were the diesel generators, the pumps  :

and the motor operated valves (MOVs), the RCFCs and the essential service water fans. De pump and  ;

the MOV data were gathered for each individual system, i.e., essential service water pumps were distinguished from the Si pumps, etc. His is a positive feature of the analysis, imwever offset by the relative paucity of plant specific types of components considered.

De plant specific data wwe calculated by dividing the number of failures by the number of demands or  !

hours of tunning time, if zero failures occuned a value of 1/2 was used for the number of failures. No Bayesian updating was used.

De treatment of the MDAFW and DDAFW pumps is not consistent with that of the other pumps. De licensee used generic data for failure to run, due to a limited exposure time and no failures experienced.

1-In response to the RAI about the treatment of the AFW pump data, the licenses reported the results of ,

a limited sensitivity analysis on Byron DDAFW pump data. De plant specific data of zero (i.e., !/2)'

failures in 191 hours0.00221 days <br />0.0531 hours <br />3.158069e-4 weeks <br />7.26755e-5 months <br /> (yleiding a run failure rate of 2.62E 3/ht) was input into the model and the analysis  ;

e rerun. De results showed a modest increase of 35 in the CDF. In addition, if both the DDAFW and .  !

. the MDAFW pumps are treated similarly to other pumpe, the CDF lacrease would be 85.

)

-17 .

l. i o  ;

L  !

-. - .- -_.--.- ---_._-_- - - - . . = . - - . . . -

Table 2 of thl review compares the failure das for selecsed components from the IPE to valum typically used in PRA and IPE studies, using the NUREG/CR 4550 data for comparison [NUREG/CR 4550, i Methodology). Note that the table contains both plant specific and generic (denoted by GNR) data that t the licensee used. ,

I

- Most data are in range of the NUREGICR 4550 data. Some pumps in the Table have a plant specific  :

run failure rate which is significandy higher than the NUREG/CR 4550 data. His is due to treatment  ;

of sero failures and limited number of demands or exposure time. 'the important components with significantly lower failure rates than the NUREG/CR 4550 data are some MOVs and the diesel driven  !

AFW pump failure to start, in response to an RAI the licensee did include the check valve failure to  ;

close in the modified IPE which had little e#ect on the CDF, but the units in which the data was -

presented appear to be incorrect. [

In addklon, the failure rate for the de (drawer two) circuit breaker spurious opening uses a value from 4 i

IEES-Std 500 whidi seems to be at abe low and of the range of data (3.E-8/hr was the value used). His may significantly impact the initiating event frequency for a loss of a de bus. .

De failure rate for the reactor protection system (leading to an ATWS) seems to be low compared to most other IPE: (2.8E4/ demand vs. about 3.E-5/ demand).

In conclusion, the licensee collected plant specific data for only a limited subset of components. The licensee distinguished between various types of pumps and MOVs in its plant specific data. As pointed ,

out above, a limited subset of failure data seems to have significantly lower values than expected, q Table 2 Comparison of Failure Data Component ByS 4550 DDAFW pump fall to start 5 lE 3 3.0E 2 .

fall to run (GNR) 8.0E-4 8.0E-4

MDAFW pump fall to start 1.8E-3 3.0E 3 fall to run (GNR) 1.0E-4 3.0E 5 Motor Driven Pump fall to start 1.E 3 to IE 2 3.0E 3

• i fall to run 6E4 to 2E-3 3.0E 5 Air Compressor (GNR) fall to start not shown 8,0E 2 -

fall to run 5.0E-5 2.0E 1 l

Battery Charger Failure during operation (GNR) 6.0E-7 1.0E4 l

l8 4 l

• j Component ByS 4550 Battery failure (GNR) l' fall on danand not shown -

fait during op. 2.0E4 1.E4 Circuit Breaker (> =480V)(GNR)

- fall to ranain closed spur open 1.0E4 1.0E4 l fall to transfer 3.0E 3 3.0E 3 l

AC Bus Fault (GNR) 3.0E-8 1.0E 7 during operation  ;

1 Check Valve (GNR) fall to open not shown 1.0E 4 fall to close 1.0E-3 1.0E 3 MOV Fall on Danand 1.5E-4 to 4.0E-3 3.0E-3 Pressurizer PORY GNR fall to open 2.0E-3 2.0E 3 fail to close 2.0E 3 2.0E 3 Fan (essential cooling water) fall te start 1.4E 3 3.0E-4' t fall to run 1.0E 5 1.0E 5' '

Emergency Diesel Generator i fall to start 9. lE-3 3.0E 2 fall to run 3.0E-3 2.0E 3 Notest (1) 45W are mean values taken from NULEG/CP 4550, i.e. from the NUREG Il50 study of five U.S. auclear power plants. ,

(2) Demand failures are probabilities per demand. Failures to run or operate are frequencies expressed in number of failures per hour.

ONR scaeric data used for this component.

HVAC fan failure rates shown 2 2 2.4 Use of Generic Datn

'Ihe sources for the generic data were NUREG/CR 2815, and NUREG/CR 4550, for the most part.

'Ihese were supplemented by IEEE Std 5001984, WCAP 10271 (a proprietary Westinghouse report on survell!ance frequencies and out of service times for the reactor protection lastrumentation system),

NUREG/CR 2728 (the IREP procedures guide) and WASH 1400.

I Section 2.2.2.3 above discusses the use of generic data for important components.

l

-19 i - - . _. - . . . - . ;.. = - _ - _ - - . -. . - -

1 3.1.2.3 C m- Cause Quantifiention Most types of redundant components generally associated with common cause failures were examined to address potential common cause failures. De approach used was the multiple greek laster approach ,

(MOL). De # and (if applicable) the y and the 4 factors are reponed in the submittal. De methodology I followed that described in NUREG/CR 4780 (' Procedure for Treating Common Cause Failures in Safety and Reliability Studia'). i l

De categories of components included in the conunon cause analysis are: large ac circok breakws, i reactor trip breakers, diesel generators, containment spray pumps, residual heat removal pump, othw r pumps, check valves, MOVs, HVAC chillers, HVAC fans and the 'aywage" category. De ' average' category includes: air compressors, AOVs, HOVs and manually operated valves, electrical / electronic ,

components (e.g., comparators, lead / lag amplifiers, battery chargws, limit switches, laveners, relays, i swisses, maalmi cam timers, power transionnors, circuit breakers (other than large ac breakers), fan  !

. coolers, best endangers, strainer filters. -

l De list is fairly complete. Dere seem to be no common cause failures modeled for batteries, and l between the DDAFW and MDAFW pumps, or between the PORY valves.

De licensee tailored the generic common cause data to its plant specific conditions, disallowing failure i mesanisms based on maintenance practices and hardware fixes. Dis tends to mask the uncertainty in  :

the state of knowledge of these failures. For example, there could be as yet undiscovered failure i mechanisms, or unintended new failure mechanisms introduced by the maintenance procedures. 7 De modified IPE has different # factors than the original IPE: the # factors which were below 0.01 were l increased to 0.01, thus establishing a floor for # factors. The licensee also did some sensitivity analyses:

establishing the floor on the $ facsors had a negligible impact on the CDF (1 %). Increasing all # factors .

In the modified IPE by a factor of 10 raised the total CDF by a factor of 1.7 (from 4.0E 5/yr to 6.9E-5/yr), w

- A comparison of # factors for 2 out of 2 systems in the submittal vs. those suggested in NUREG/CR-4550 or the ALWR requirements document (number in parentheses), to which the licensee compared their }

data values in the submittal, i.e., ' reference # factor" la presented in Table 3.

• Table 3 shows that the CCF factors used in the IPE are generally lower, and in some cases much lower (order of magnitude) than the ones recommended in NUREG/CR 4550 or the EPRI ALWR requirements ,

document. However, they are generally wkhin range, the licerisee studied common cause failures at their l plant and developed a rationale for these values, and they have also performed a sensitivity analysis. '

Derefore, the conclusion is that the licensee has complied to a limited extent with the accepted way of modeling these types of failures, i u

i 5

20 s

f-+. . [E~, , .,.[,,;.m_mm_,,-_,

i

'. l i-Table 3 Comparison of Common-Cause Failure Factors i

Reference # ,

Camponent Bys Ji facter factor  ;

NRC (EPRI)  !

Large ac breaker 0.039 (0.10)

Reactor trip breaker 0.041 (0.10)

HVAC fans 0.01 (0.10) [

CS pumps 0.062 0.11 (0.067)

RH pumps 0.01 0.15 (0.14) other pumps 0.01 .03 4.21 .

(0.14) ,

MOV 0.011 0.088 (0.05) ,

check valves 0.01 (0.18)

Average 0.011 (0.10)

Dimel Generator 0.01 0.038 (0.073) 2.2.2.6 Imidating Event Fr:;M=

A mixture of pneric data, plant specific data and plant specific analyses was used to derive the initiating event frequencies.

The frequency of general transients is derived from Byron experience within the data window for collection of plant specific data.

De frequencies for single and dual unit loss of essential service water, loss of CCW, loss of de bus 111, losses of ac buses 141 and 142, ISLOCA and flooding initiators were determined based on plant specific analysm, including fault tree analyses.

- For calculation of frequency of losses of component coollrig water and dual unit losses of essential service water, the licenses considered ploing ruptures as a contributing (and the dominant) cause of the initiator.

De licensee used and adapted the piping rupture data from EPRI TR-102266 for the 'PWR Other Systems' category based on the pipe size groups. His was done as part of the analysis for the modified IPE. ,

• ~

Ruptures in the essential service water system effectively make such failures dual unit initiators from the standpoint of the aNacted unit, as no cross connection would be attempted in such a condition due to the diversion through the break, Credit is given for the operators to isolate the break, with a median time 21 L

i L

L

of isolation given as 30 minutes in ordw to calculate the HEPs. However, for break slees needing isolmion in las than 30 minutes, no credit is given (HEPal.0). Two new dual imit initiators of signl6 cant impam were uncovwed by this pipe rupture analysls in the modified IPE: one was a flooding event of all 4 SX pump rooms, the otner a draindown of the cooling tower basins. Neither of these two initiators is shown in Table 4 below. More discussion of the SX mptures is offered in the flooding susion of this TER (2.2.4).- ,

l De following initiators had frequencia developed based on generic data: De loss of lastrument air I frequency was determined by a review of ladustry operating experience. De SGTR frequency was developed from U.S. and international Westinghouse PWR experience. De fregnancy of secondary side ,

breaks was calculated based upon opersing expulence at W=*1=peWigned PWRs. De generic j data bases were consulted for the period January 1,1984 through Marc 6 31,1992.

For losses of offske power (dual and single unit), methodology and site-specific data NUREG 1032 l r

were used for grid relmed, weather relmed and extrane weather reized losses of offsite power. De plant centered losses were calculated from genwie data presental in NSAC-147,166 and 182 for loss of .

offsite poww at dual unit sites.

I De large and medium LOCA frequencies were taken from WASH 1400. De small LOCA frequency includes small pipe breaks, reseming failures of pressurizer PORVs or SRVs and RCP seal failures. De i small pipe break frequency is taken from WASH 1400. De pressurizer PORV and SPV challenge  !'

probabilities were calculated based upon the challenge rate for these components for anticipated transient t

casesories developed for Westinghouse nuclear steam supply systun plants in response to NUREG 0737 and Byron specific anticipatal transient NUREG categories. De reactor coolant pump seal fe"ure frequency was based on data for U.S. Westinghouse PWRs. j De initiating event frequencies used in the IPE are shown in Table 4 -

De initiating event treguencies seem reasor:ble and are comparable to other PRA studies, with possible  ;

exceptions in the case of loss of instrument air, loss of a de bus (see section 2.2.2.3), and small LOCAs.

h is not expected that this will have a large effect on the resu!ts, but in case of some initiators the effect may be measurable (i.e., a 10-20% effect on the CDF).

2.2.3 Interface lasues 2.2.3.1 Front.End and Back-End laserfaces  ;

Failure of core cooling recirculation due to failure of containment heat removal is not modeled. De licanam used probabilistic arguments to remove this issue from consideration. Dere'is ample diversity and redundancy in the containment heat removal systems (2 CS pumps, 4 RCFC units). De dominant failure mode of the RCFCs is a loss of the essential service water (SX) according to the liraata*. His would also disable the core cooling recirmistion, as the RHR heat exchangers are cooled by CCW, which

• ls in turn cooled by SX Dis type of argument still does not totally address the issue, and the licensee  :

~ "

seems to have missed the opportunity to obtain insight on the impact of this failure.

- De RCFCs are needed to control the containment atmosphere within the PORV qualification limits.

4

'1 22

~E...... --.-m.w. _...,m, -, .. . ...,,,,__..r.~, .__.%, ,,___m_.s..-, -..r, , , _ , -- E-e , m--,.-.r..,e

RCFCs are credited with providing cool recirculation water, in addition to providing containment heat i

• l removal, i.e., successful operation of this system obviates the need to align the RHR heat exchangers for CCW cooling. The RCFCs promote mixing of the containment atmosphere, as well as condensing the steam, such that the sump water is maintained at a reasonable temperature.

Further insights into the Level 2 analysis, are presented in Section 2.4 2.2.3.2 Human Factors Interfaces insights into the buman reliability modeling are presented in Section 2.3. l l

Table 4 Initiating Event Frequendes for Byron IPE I Initiating Evat Frequmcy (/yr)

Large LOCA 3.00E-4 Med!um LOCA 8.00E-4 Small LOCA 6.10E-3 SGTR 1.10E 2 ISLOCA 1.01E 7 General transient 2.20 Steamline breaks upstream of MSIVs or feedline breaks downstream of 3.60E 3 FWIVs Steamline breaks downstream of the MSIVs or feedline breaks upstream of 3.60E 3 FWlVs ,

single unit LOOP 3.22E 2 dual unit LOOP 1.21E 2 singe unit loss of essential service water 4.64E 4 dual unit loss of essential servlee water 9.59E-6 loss of CCW 5.62E 5 loss of 125V de bus til 5.05E-4 ,

loss of instrument air 4.30E-4 loss of 4kV ac bus 141 3.55E 4 loss of 4kV ac bus 142 3.55E-4 flood in zone 8.31 1.30E-4 flood in zone 11.60 1.89E-5 23

2.2,4 laterisal Flooding 2.2.4.I lasermal modise Mesteddesy ne snethodology used to perform the flooding analysis consisted of four major steps:

1) Collection of pertinent information; 4

2) Plant wdkdown; .

i

3) - Qualitative analysis to eliminate flood areas;

4) Quantification ofimportant flood scenarios. J Y

De four steps follow the standard flooding analysis methodology. j Flooding scenarios v.hich require a manual abutdown after a time period longer thAn two hour ,

considered controlled shutdowns and wwe screened from the analysis, i ne flooding scenario frequency incl)ded considersion of detection and isolation of the flood, but few

details wwe provided.  ;

At least one senario was screened because the flooding would not damage the critical equipment for at  :

l

leam 30 minutes, implying the there is a low probability of operator failure to detect and isolate ti e flood '

within that time pwlod. However, in response to an RAI, it is stated that ' operator amion to mitigate the impact of a flood is incorporated in several procedures (e.g., B/BwOA PRl4), but was conservatively i nor credited in the initial analysis *, which seems to contradict the above in the IPE modification '

modeling SX piping ruptures, a lognormal distribution for the isolation HEP is developed. His l' distribution has a median isolation tirne of 30 minutes, and a cutoff of 30 minutes (i.e., no isolation is a allowed in less than 30 minutes). .

1-From the information received it appears that the other HEPs, associated with the general transient PRT used for quantification of the flooding scenarios, were not modified to account for flood specific concerns.

Spraying and flooding were both considered as mechanisms for equipment damage, any mitigating measures were also considered (e.g., equipment raised off the floor, anti-spray shields). De doors were assumed to be in their normal position. Flood propagation is considered, including back propagation through drains, ventilation ducts, etc. Based on the information teceived it seems that leakage through doors and drain blockage was not considered, though a statement is made that most general operating >

f!oors of the various buildings have open stairwells and large floor openings and/or gridworks to permit equipment transfer between levels. In the detailed analysis, minimum water levels to a rAuce equipment damage were considered in the flood propagation mones. As a general guideline, watw apray from a pipe -

was annumed to affiam components v%in a 10 foot radius and in line of sight from the pipe. Engineering judgement was used when appropr*mte to extend this range of effect due to other factors such as higher pressure systems, elevated spray sources that could aplash, and cable trays or other items that could redirect the water flow and/or cause waterfall effects at extended distances from the break; a

Credit is given to rigid and durable insulation around some pipes in the plant, it is assumed this insulation would contain the spray from a pipe break, such that only flooding and dripping from the .;

24 ir

,,, . . . ~ _ , , ~ + + . . . _ . . . , . . . _ - . _ _ . _ -..m, _ . . ._ , . _, ... ,m .,,..e, . . . . _ . , ,,,,,..mm._,___ . . _ , , - ~ - . ..m.,, .._m

i seems was considered. Pipes whid are normally free of liquid during normal operation (e.g., uncharged Are lines) were not considwed credible water sources, j Fire protection system piping ruptures, as well as the SX and CCW piping ruptures were considered in i

the modified IPE. A flooding scenario was discovwed related to SX pipe ruptures which would disable all 4 SX pumps by water propagation through a ventilation duct, leading to a dual unit loss of service i water and (according to the snodel) directly to dual unit core damage. Dis scenario has a frequency of about 1.2E 5/yr. A hardware modification prevening overflow of the ,malliary building Soor drain sump  ;

into the SX rooms is currently being considered by the licensee but details wwe not provided, (the modification has not been implemented as of the date of the modified IPE). De modified IPE takes credit for this improvement, thus eliminating this scenario frcm the list of surviving flooding scenarios.

Another 'Gooding* scenario related to SX pipe ruptures would also have a subanaaetal CDP impact, and was also eliminated by crediting a not yet implemented modification. His is really a diversion of water  :

from the coods toww basins, in escens of the makeup capability, again causing a dual unit loss of ,

essential serv!4 watw and dual unit core damage. Procedural changes are being considered, such as ciosing the cross connect valves, stopping the SX pumps, extending the draindown time, etc. Assuming ,

a screening probability of failure of 0.1 of such modifications to stem the loss of SX inventory, and assuming the other flood proofing modification (for the SX pump rooms, discussed above) already in place, lowns the initiating event frequency, and the core damage frequency, byg .5E 5/yr. ,

With these two modifications assumed in place, the residual frequency for dual unit loss of essential service water is reported in Table 4.

Dere is not much discussion about pipe whip and steam impingement, other than a statement that  ;

impingement from pipe breaks was considwed. In response to an RA1, the licensee stated that maintenance induced floods were not judged to be a concern after reviewing the data base of maintenance events for the modified HRA (which does not seem to answer the question about the maintenance induced floods).

Surviving flood scenarios were quantified using internal events event trees (or plant response trees).

Only two flood scenarios survived the screening procus.

In conclusion, it seems the flooding analysis was a credible effort, with some simplifying assumptions and some questions as to the modeling of operator actions.

2.2.4.2 Intemal meding Resuhs De total CDF from flooding is calculated to be 3.5E-9/yr. - His includes the two unscreened scenarios, and not the two scenarios which are currently undwgoing consideration for a fix, ne two unscreened '

Aooding scenarios result from pipe breaks spraying water on equipment which is not qualified for spray operation and is not shielded.

De scenario in zone 3.31, grade level of turbine building would disable two of the three lastrument air couipressors, with a frequency of 1.30E 4/yr, leading to a core damage frequency of 1.5E-9/yr.

P 25

,-ns-,rr-1-,+w-w--r-em-w+ ,e e -"6e , .~nr e erw--%- o,. m,-r m o w w r-.,- m-,-,-ww.r--ee.,,., wwe.,- e,--- , w,-- -,

, ,-. . %,+ a -

-l De scenario in mone i1.64, elevadon 426' in the ausiliary building, would lead to a loss of MCCs 131, l 112 and 134, wkh a frequency of 1.89E 5/yr and s core damage frequency of 2.0E 9/yr.  !

l No estimate of the residual from the e eened scenarios is given.

i 2.2.5 Core Dominge Sequemee Remsks j 2.2.5.1 h=1===# core Dunese 8 t-De f gults of the IPE analysis are in the form of systemic sequences, therefore NUREG 1335 screening 'f

- critee.a fr.r reporting of such seguences are used. De laternal core damage frequencyhas a po int endow f 4.0E-5/yr. Accident types and initiating events that contributed most, to the CDF, and their percent tuntribution, are listed in Tables 5 and 6. .

De submies: lists 100 dorninsa sequences, wkh almost no discussion. De 10 most important sequency [

are sununarised below in Table 7 ,

De loss of offsite power contributes 19% or 7.6E4/yr to the total CDF. His is mostly due to the 580  !

i conditions (16% of the total CDF). De RCP seal LOCA cr,atribution is 2.3E 5/yr or 68%, from all inklators. De ATWS contribution is 0.5%, or 8.9E-7/yr. His is lower than at most PWRs due to a I now probability of RPS failure and ATWS sucosas wineria. De SG11t contribution is 5%. De 15LOCA  :

i contrRation is 0.2%. De flooding does not centribute significantly due to credited plant improvements

~which are under considwation. ]

E 4 De dual loss of service water is a dominant initiator due to the SX dependency of RCP seals, as well as a dependency of all the high pressure pumps. De loss of CCW initiator has a very high conditional core damage probshility, due to an assumed failure of the operator to switch the operating charging pump to a cool water source (necessary possibly due to a loss of letdown heat removal). His leads to an RCP seal LOCA with guaranteed failure of one train of HPl/HPR (no credit given to SI pumps for this .

function in non-LOCA ini'inted events). l De SGilt contribution of 5.4% involves a fair amount of credited ucident management strategies. For example, as seen in the dominant SGTR sequence, operators are credited with correcting an initial operator error. RWST refill also helps reduce this contribution. An example of credit for a SAM aequence can be seen in the second LOCA sequence in Table 7 (8th sequence from the top). Hwe, the

- operator is given about an 84% chance of recovering or repairing failed egulpment, due to long time scales, i

~ ..

Except for the high contribution of the SX losses, the risk profile is not atypical of a PWR.

De following are CDF contribudons (Fussell Weely) of the most importar.t systems (and do not include .;

high level operator actions associated with such systems): i

- essential service water,- 55%;

. - centrifugal charging pumps,14%; 9

- equipment for SX crons41e,14%;  !

- auxiliary foodwater,11%

t 26

- , ' - - _ _-.,' ..i,.,nw~ ,. ..._-_.-.n.s ... . ..~ ___ _ _.-a., - , , , , , . . , , n .,l l'..-.,.nn__,..- . , . , , . . - - a,-- -,,, ni

_ _ - _ _ . . . . . . _ _ , _ _ . . _ . _ _ . _ - ....__.___m__.__..___._. _ _ _

)

)

1

$ - 4160V bus 142,11 %;- '

- 4160V bus 141,:10%; =

- RCFCs, 9% *

- LPI, 851

]

De rist ymfile and risk contributor at Byron are somewhat different than those at Brr.'lwood. a Dis  ;

seems to be due to difference in dva, particularly initiating ovent frequencies, plant specific failure rates .

and operator errors.

Por sunple. the dual unit loss of service water due to pipe ruptures has a significantly higher frequincy  !

of occurrence at Byron.-

Sin 0larly, the single unit loss of essential service water plays a much more prominent role at Byron than I at Braidwood. Als is due to an order of magnitude higher failure probability of event SXX (aanantial '

servios water cross <:ennect hardware), at Byron.- A review of plant specific MOV data for the masametal

, service water system at the two plants reveals a failure to open rate of 4.0E-3/ demand for Byron and i

3.2E 4/ demand for Braidwood, De operator failure rato to cross connect is also higher at Byron (1.3E-3 vs. 5.0E-4).

As another example, the 4 kV buses are significantly more important at Braidwood, partly because the plant specific EDG failure rates are higher.

Table 5 Accident Types and Their Contribution to the CDF"

, initiating Event Group Contribution to CDF (/yr)  %-

less of support system 1.88E-5 47

+

LOCA 1.07E 5 26 IAss of offsite power 7.57E-6 19 SGTR 2.16E-6 5.4 General transient 7.41E-7 1.8 Secondary side breaks 3.78E-7 1.0 ,

laternal flood '3.5E-9 0.01 (Station blackout) (6.32E 6) (16)-

. (A*IWS)1 (1.9E-7) (0.5)

- (ISLOCA) (1.01E-7) (0.2)

TOTAL CDF : - 4.00E-5 100.0

' " Categories in parentheses (e.g., station blackout) are not separate initiator types but are included in other c.tegories (e.g., SBO is included under LOOP and transient).

27 r

...2.4.

Table 6 Initiating Events and Thdr Contribution to the CDF I'""*7 " " I""  %

Initiating Event to CDF (/yr)

(/yr)

Dual unit loss of essential service water 9.59E4 9.59E4 23.73 Single unit loss of essential service water 4.64E 4 6.08E4 15.05 Small LO',A 6.10E-3 5.13E4 12.69 Singir unit loss of offslie power 3.22E 2 4.09E4 10.12 Dual unit loss of offsite power 1.21E-2 3.48E4 8.62 Large LOCA 3.00E-4 2.74E4 6.78 Medium LOCA E.00E-4 2.70E4 6.69 SGTR 1.10E 2 2.16E4 5.35 Loss of CCW 5.62E-5 1.74E4 4.30 A

Loss of 125V de bus til 5.05E-4 1.40E4 3.47 General transient 2.20 7.41E-7 1.83 Feedline break inside containment 1.80E-3 1.36E-7 0.34 ISLOCA 1.01E-7 1.01E-7 0.25 Feedline break outside containment 1.80E-3 1.00E-7 0.25 Steamline break .'nside containment 1.80E 3 7.13E-8 0.18 Steamline break outside containment 1.80E-3 7.12E-8 0.18 l Loss of a single ac bus 141 3.55E-4 4.08E-8 0.10 l Loss of a single ac bus 142 3.55E-4 2,36E-8 0.06 Loss of instrument alt 4.30E-4 5.14E-9 0.01 Internal flooding, zone 11.6-0 1.89E-5 2.32E-9 0.01 Internal flooding, zone 8.3-1 1.30E-4 1.81E-9 0.00 '

4 l

28 l

Table 7 Dominant Core Damage Sequences Dominant Subsequent Failurm in  % of Initiating Event Sequence CDF Dual unit loss of essential service water all the injection systems fall; RCP seal 18.9 LOCA Single unit loss of essentia! service SX cross-connect falls due to hardware 10.7 water failure; all injection systems fall; RCP seal LOCA Large LOCA _ failure of accumulator injection 5.7 Medium LOCA failure to cooldown'depreseurize with 4.3 steam genera *. ors; operator error in establishing high pressure reeltculation Loss of CCW guararse.xl operator failure to align 4.0 charging pump to RWST; failure of charging pump due to high temperature; independent failure of the other charging pump or associated RHR in recirculation Small LOCA failure of LPI in recirculation 3.9 same as sequence I, except have a large 3.5 l Dual unit loss of essential service water consequential small LOCA (> 21 i gpm/RCP)

Small LOCA failure of normal RHR, failure of 3.5 switchover to LPR (given failure of equipment used for normal RHR), failure of recovery of equipment lingle unit LOOP independent failure of essential service 2.8 water causing EDG failure and SBO as ,

well as a seal LOCA SGTR failure of cooldown/depressurization; 2.5 operator fails to discover failure of cooldown/depressurization 29 j l

. 2.3 Human Reliability Analysis Technical Review 2,3.1 Pte-Initiator Human Actions .

Errors in the performance of pre-initiator human actions (such as failure to restore or properly align equipment aAer testing or maintenance, or miscalibration of system logic instrumentation), may cause j components, trains, or entire systems to be unavailable on demand during an initiating event. De review  ;

of the human reliability analysis (HRA) portion of the IPE examines the licensee's HRA process to determine the extent to which pre-initiator human events.were considered, how' potential events were identified, the effectiveness of any quantitative and/or qualitative screening processes used, and the- a processes used to account for plant-specific performance shaping factors (PSPs), recovery factors, and 1 dependencies among multiple actions. i a  :

2.3.1.1 Types of Pre-Initiator Henan Actions Consideswd -

The Byron /Braidwood modified IPE considered both of the traditional types of pre-initiator human actions: failures to restore systems aAer test, maintenance, or sutveillance activities and instrument miscalibrations. However, only four restoration events and no miscalibration events were actually ,

modeled in the modified IPE. All other pre-initiators were screened (not modeled in the fault or event trees) on the basis of either a qualitative or quantitative analysis. Desails of the screening process are described below in sections 2.3.1.2 and 2.3.1.3.

2.3.1.2 Proesas for Identification and Selection of Pre-Initiator Hunan Actions he general approach W in the Byron /Braidwood modified IPE to address pre-initiator events was to perform a search of plant records to identify potential pre-initiator vulnerabilities. Records from 1992 - ,

1995 were reviewed to identify events involving personnel error, out-of-service (OOS) error

. (maintenance), testing error, or miscalibration error. De review in:luded licensee event reports (LERs),

nuclear operations notifications (NONs), which are Comed's mechanism for promptly reporting events ,

at one station that may have applicability at other stations, and problem identification forms (PIFs), which is Comed's method for documenting any discrepancy. One goal of the review was to identify any patterns in the different types of possible errors, e.g., OOS errors, or to identify specific errors with systems modeled in the modified IPE, in addition, procedures related to the different types of errors were examined to determine whether adequate independent verification, checking, testing, and/or control room indication of system misalignment existed. Dus, reviews of actual plant events and plant proadures were used to identify potential pre-initiator events, in addition, instrumentation used to initiate automatic actions and instruments used by operators in responding to initiating events were reviewed. De basis for the selection and inclusion of pre-initiator events in the modified IPE models is addressed in the

- next section. ,

l 2.3.1.3 Scrwening Process for PreInitiator Hunan Actions

- The Byron /Braidwood modified IPE documents and dic== error related events that were identified and also discusses the procedures related to performing maintenance, testing, and miscalibrations. The general .

conclusion of the analysis was that while errors do occur, they are rare, no " patterns were identified," ,

and "no vulnerabilities existed." For restorations aAer testing or maint_enance, it was argued that " many of the hundreds of surveillance procedures do not affect systems modeled in a PRA..., many tests _

i 30 1

. 1 l

. performed 'during refooling outages or other shutdown periods cannot cause m-power misalignments because other surveillances are required to prove system operabi'ity before returning to power operation:

. ..., some only invive visual inspection.... and others are performed without any re-alignment of system components fmm their at-power configuration." For the remaining (with only a few exceptions), it was rgued that " component misalignmeat would be indicated or annunciated in the control room..._or independent verificmion of component position ...is required by procedure." Events meeting these criteria ,

were screened out and therefore only a few restoration events were modeled in the modified IPE. ,

De above approach for qualitatively screening restoration events is commendable in one sense because of the level of analysis involved in examining plant specific informaion. Moreover, the screening criteria used are not unreasonable and are consistent with approaches taken by some other licensees. However, other licensees have modeled restoration faults that require independent verificat ion and because of other shortcomings in the restorsion process, some of these events have turned out to be rciatively impor: ant.

Dus, the failure to include such events must be considered a weakness of the Byron /Braidwood modified IPE, Two of the events that were modeled were associated with restoring the containment spray pumps and the other two were for reopening the "RH heat exchanger inlet isoladon valve" after testing. De associated procedures apparently did not have the adequate check-offs or the independent verification needed to be screened out. While several other events were actually quantified "using the current procedures," the resulting HEPs ranged from 1.4E 5 to 5.5E-8 and were considered negligible compared to the failure to start or run data. Events not modeled due to negligible failure contributions included ESFAS slave relay restoration for containment spray and safety injection and restoration of the charging pump manual discharge valve.

Assuming the events that were screened out due to negligible failure contributhns were quantified appropriately, the screening approach is not unreasonable. Moreover, the HEPs for the four restoration events that were modeled appeared reasonable (5.lE 3 to 1.8E-3) given the absence of appropriate check-offs. However, it was impossible to clearly assess the adequacy of the quantification technique used to quantify these events (and those dismissed as having negligible contributions) because the quantification process was not explained in either the original or modified Byron IPE. In response to an NRC RAI, the licensee indicated that THERP was used to quantify the pre initiators. Nevertheless, while the values

> are not obviously unreasonable and the licensee appears to have considered relevant factors, the lack of a clear description of the quantification technique b t weakness of t% modified IPE.

hrning to pre initiator miscalibration events, the hcensee made several arguments that served as the basis for not modeling any miscalibration events in their modified IPE. First, it was argued that "the potential for instrument miscalibration at Byron anx! Braidwood is minimized by the practice that multiple channels of plant instrumentation measuring a para.uer are not worked on in the same day by the same instrument

! technician using the same test equipment." In addition, " calibration results are reviewed to compare the

! recorded "as found" value with the "as left"_ valoe to identify discrepancies, and for parameters with

- more than one channel, miscalibration would be identified at the end of the calibration activity by a simple " channel check - comparing the meter reading of the just calibrated channel to an adjacent meter indicating the same parameter." Furthermore, it was argued that indications used by operators are nonnally "available from multiple channels and/or diverse instrumentation or alarms which are normally active and in constant use_such that a miscalibrated instrument would be readily identified and/or compensated for by a diverse indication."

31

L L ,,

4

- While the above arguments are not unreasonable, as noted regarding the restoration faults, other licensees 1- . have modeled such events and in some instances found thera to be important. Moreover, while failures la these types of actions may be rare, the step by step examination of procedures required during J quantification may have identified some shortcomings. hus, while it may or may not be true_that _

operators would be able to cope with discrepancies between lastruments, the identification of some potentially imponant pre-initiator events may have been precluded. Dus,_the licensee's approach to ,

~

miscalibration events is considered a minor weakness of the modified IPE.

The licensee did anempt to determine "whether miscalibration might have a noticeable effect on the fault tree failure probabilities." Dey noted that "in general, the instrumentation basic events were either not -

found in any of the fault tree cutsats above the cutoff of IE-12, or were in only a few cutsets that did not contribute significantly to the fault tree failure probability. It is not clear, however, how this review -

accounts for the potential impact of miscalibrations. It remains possible that such cutsats might have ,

become important if miscalibration errors (panicularly common cause) had been included.

2.3.1.4 Quantification of Pre-laitiator Human Actions As discussed above, while some pre-Initiator restoration faults were quantified and some of those were

~ included in the modified IPE rrodels, a description of the quantification approach was not provided.

2.3.2 Post-Initiator Human Actions Post-initiator human actions are those required in response to initiating events or related system failures.

. Although differen' labels are often applied, there are two important types of post-initiator human actions that are usually andressed in PRAs: response actions and recovery actions. Response actions are generally distinguished from recovery actions in that response actions are usually explicitly directed by emergency operating procedures (EOPs). Alternatively, recovery actions are usually performed in order to recover a speelfic system in time to prevent undesired consequences. Recovery actions may entail going beyond

- EOP directives and using systems in relatively unusual ways. Credit for recovery actions is normally not taken unless at least some procedural guidance is available.

De review of the human reliability analysis (HRA) portion of the modified IPE determines the types of post initiator human actions considered by the licensee and evaluates the processes used to identify and select, screen, and quantify the post-initiator actions. He licensees treatment of operator action timing, dependencies among human actions, consideration of accident context, and consideration of plant-specific PSFs is also examined.

2.3.2.1 Types of Post Initiator Human Actions Considend De Byron /Braidwood modified IPE addressed both response and recovery type post-initiator hunca actions. De revised submittal and the licensee's response to the NRC's RAI provided a definition of J tmponse type human actions (referred to as type CP actions) that was generally consistert with that-described above. One slight difference was that the Byron /Braidwood function restoratica procedures (FRPs) direct recovery of lost functions and this may include attempting to align alternate systems. Rese _

recoveries are obviously proceduralized and were reasonably treated as response actions in the IPE. In addition, at least one nontroceduralized action was modeled as a response type action (stopping the residual heat removal pumps in degraded power non-LOCA events). A description of the quartification of this event (OSP-2). provided a reasonable explanation.

32

1 he recovery type actions modeled in tia Byron /Braidwood modified IPE included recoveries of failed

. equipment and five events involving crew discovery of previously failed human actions, such as discovery: .

of failure to feed and blood. Dese actions were developed for the modified IPEs as part of the Success '

L wkh Accident Management (SAM) endstate elimination analysis, ne goal was to use plant- procedure-based recoveries to lead SAM sequences with high frequencies of occurrenct to core success, Two other recovery amions modeled the lealatian of the ruptured service water ($X) pipe in "DLSX" sequences and included (applied to Byron only) isolating Train A of SX from Train B SX in "DLSX" sequences to s maintain one recoverable train before the SX cooling tower basins drain through the pipe rupture. i Recovery actions are discussed in more detail below in section 2.3.2.3.

De modified submittal signified that response type actions appeared in the plant response troer (PRTs) r and in the fault troer. Dus, they could occur at the event or fault tree level. Locovery actions were aot t included in the logic models and as noted above were applied in special analyses, e.g., the SAM endstate eliminaion process and the isolation of component cooling weer and service weer pipe break analyses.

2.3.2.2 Proass for Identification and Sal-*h of Post Initiator Human Actions De licensee's response to the RAI indicates that the important operator actions (OAs) had been identified and defined previously (in the original IPE) by the systems analysts in the development of the fault trees and PRTs. Procedural reviews were an important source of information for the identification of response type operator actions. Procedures reviewed included emergency response procedures (EOPs), 'lystem operating procedures, abnormal operating procedures, function restoration procedures, and emergency contingency actions, in addition, opera *.or talk-throughs (including the use of checklists) were used to

• review the solu:ted critical subtasks and to gather plant-specific factors for consideration 6 the HRA quantification." Most recovery actions were identified during the elimination of sequences with SAM g'

endstates. The others were identified by the systems analysts after initial quantification in order to recover component cooling weer and service water pipe breaks by isolating the break. Sequence timing, time available for the operator actions, and success criteria were considered in determining which actions ,

1 to include.-

2.3.2.3 Screening Process for Post Initiator Response Actions

- A screening analysis was not performed for response type post Initiator human actions modeled in the Byron IPE. In the original IPE, all OAs in the event and fault trees were given detailed analysis with I the goal of obtaining a realistic HRA. As is discussed below, the modified IF r.x;uantified important human actioas from the original HRA. '

i However, the recovery acsions modeled in the SAM endstate eliminar analysis involving new discovery  !

of previously failed human actions were assigned screening values of 0.1. In addition, the action (applied i I

to Byron only) to isolate Train A of SX from Train B SX in "DLSX" sequences to maintain one recoverable train before the SX cooling tower basins drain through a pipe rupture was also assigned a I

screening value of 0.1. Neither the basis for the assignment of *his value not a discussion of any revisions to the screening values were provided. - Apparently no revisions to the screening values were made.

2.3.2.4 C E "= of Phot Initiator Human Actions )

For the modified IPE, the PRT and fault tree post-initiator response type human actions with a risk  ;

achievement worth ((RAW), "using the original IPE model, enhanced quantification") greater than 2.5 - )

1 33 i

l l

I

and "those added as a result of danges to the PRTs and fault trees,* received a complete re-evaluation."-

la addition, PRTs that " contributed significantly to CDF in the orig

• mal IPE were identified" and the "OAs in thee trees, including the conditional probabilities, were evaluated on a sequence-specific basis . t to identify conditions of stress, dependency,; and availability of recovery opportunities and were j roquantified when necessary." Remaining HEPs were reviewed for reasonableness and "for selection of the appropriate'value for and brand of the PRTs." he PRT OAs "were also reviewed to identify those }'

actions which might be described as timecritical." Dat is, "those for which the estimated time to accomplish the action was greater than 25% of the estimated time available before some undesirable state was reached."

As described by the licensee, a thorough search was performed to identify human actions for re-L a quantification. Dirty-five human acsions were requantified for both Byron and Braidwood, with different

~

values obtained for the different plants in some lastances, in the original IPE the licensee argued that wkh only one exception (Byron's service water cooling tower) the two plants and.theiFprocedures were identical. - However, in the modified IPE, they noted that since 1994 some differences have developed and a few operator actions were requantified specific to the plant. -De modified submittal and the response to the RAI provide descriptions of HRA related differences and similarities between the plant, 4 e.g., procedures, shift staffing, control rooms, and procedure use.

L Most of the actions identified in the review were requantified using the EPRI Cause Based Decision Tree Methodology (CBDTM) from EPRI TR-100259, "An- Approach to the Analysis of Operator Actions in PRAs," June 1992 (a few special cases were quantified with the THERP Annunciator Response Model, NUREGICR-1278). The CBDTM uses a set of decision trees to model errors in the cognitive element of each action and recommends use of the THERP method to model tha failures to perform the task-execution portion of the action. The failure probability for the action is calculated as the sum of the cognitive and task-execution portions of the action, d

Dis method estimates failure probabilities for the cognitive elements based on an assessment of factors I such as data availability, attention failure, miscommunication and misreading of data, misleading E information, missing or misreading procedural steps, misinterpretation of instructions or decision logic, c and deliberate violations. Recovery factors, such as reviews by other crew members, including the shift te&nical advisor (STA), are allowed to reduce the error probabilities calcuented from the decision trees if there is sufficient time. De criterion of " sufficient time" depends on the particular recovery factor-for example, credit for review by the STA is not permitted unless there is at least 15 minutes from the initiating cues for the operator actions to be completed. In addition, in the modified IPE, credit for an emergency response facility (ERF) was not taken unless the OA took place greater than one hour into the sequence or the time available for the OA was greater than one hour. In contrast to the other EPRI HRA

, me: hods, the CBDTM does not otherwise directly incorporate measures of time in quantifying human error probabilities.

De likelihoods of failures in task execution were quantified using the THERP method, described in NUREG/CR-1278. De essence of the recovery approach for both phases of the action is that additional e

time allows additional control room cues or cues from reviewing procedures to become available, which in turn facilitates self-review and review by other crew members and technical advisors.

Compared with the method used in the original Byron IPE submittal, the combination of the CBDTM and THERP appears to provide a more realistic basis for assessing post-inHator human actions. At a i

l

1 .

y. . L minimum, the diagnosis phase is explicitly modeled (except for the events modeled with the THERP <l Annunciator Response Model that are discussed below) and relevant PSFs are considered. -

However, as noted in NRC Technical Evaluation Reports (TERs) for other IPEs, the CBDTM does not,-

-in itself, have a unique approach for analyzing time-critical l actions. Dat is, those actions where the ,

difference between the time available and the time required to perform the actions is short and the '

possbility exists for the operators to fall to accomplish the actions in time, are not evaluated directly as a ihnetion of time. Derefore, even widi the CBDTM, the pcwential exists for undereshhg HEPs for ,

- short-time frame events.- De licensee did indicate tha '.me pressure w;.s taken into account by lacreasing the stress factor (addrused within 'nlERP) in the evaluation of the basic HEP. De licensee's consideration and treatment of operator response time is discussed in more detail in the next section.

i Before proceeding, however, it was noted above that for a few events, the licensse argued that the "EPRI-CBDTM was inappropriate for estimating p ," (the diagnosis phase). De licensee noted that the operator response to loss of component cooling water and loss of service water are initiated by control board ,

p alarms, rather than reactor trip, and that operator actions are guided by alarm response procedures. For these cases the diagnosis phase of the action was quantified with the THERP Annunciator Response  :

Model, One of the events quantified in this way was the operator action to start the standby service water pump and open the se:vice water crosstle valves (OSX 1, crosstie Unit I to Unit 2 SX). De quantificsion of this event was provided in the response to the RAI and the resulting HEP for Byron was ,

1.3E-3 and for Braidwood was 5.0E 4, Assuming adequate time is available (and this event was not  :

Indicated as being time critical in the reponse to the RAI), the values are not obviously unreasonable and the method appeared to be applied .pywydetely, Fumly why the CBDTM was considered inappropriate for these events was not explained. The four other specific events quantified with this method were not mentioned, but were said to be related to loss of component cooling water and loss of service water sequences.

. 2.3.2.4.1 Estimates and Consideration of Operator iterponse ilme

. In the licensee's response to the RAI, a discussion was provided of events that might be considered time '

critical. Available time and estimated ~ performance times were presented for these events and the i- discussion focused on the promiural guidance provided for these actions. De apparent goal was to illustrate a reasonable expectation of operator success given the time available and procedural guidance.

A review of these actions, their timing, and the associated HEPs suggest that the assigned HEPs were 4 not obviously unreasonable. In the same licensee response to the RAI, differences in timing for similar i events as a function of context was also addressed. De tpparent goal was to illustrate that the differences in timing were not important for the identified events because of the relatively large amounts of time available. In any case, while the CBDTM is not ideal in its treatment of short-time frame events,

it appears that the licensee made a reasonable effort to try to ensure that potentially time critical events were not inappropriatdy quantified, i.e. a " sanity check" was apparently performed, m

he modified IPE and the response to the RAI note that opportunities for recovery are largely a function of time. Decefore, before applying the various recovery failure probabilities 8 ted above, the modified IPE states that sequence timing, time available for the OA, and performance time - were considered. His information was indicated as being documented in the IPE Plant Response Tree and Success Criteria Notebooks and was based on MAAP computer runs and operator and simulator personnel estimates.

[ .

When time was available, recovery credit for failure to diagnose (p.) was given for extra crew, shift .

change and ERF review,; with recovery values of 0.5,0.1 and 0.1, respectively. Credit (0.5) was also li 35 L

. given for recovery immediate action steps" (those performed from memory), when required procedure reading wow we as a check. In addition, if a procedure step involved a system or function '

-that was shared by the tw units, a recovery of 0.5 was applied due to the presence of the other unit's crew.

i Credit for recovery of response execution (p,) could be given for similar reasons, but was based on va lues from THERP. Recovery credit for actions outside the control room was considered only if lack of completion produced a compelling signal in the control room. While the approach used allows substantial credit for recovery, reviews of example calculations for important actions suggests that recovery credit was applied reasonably (particularly given the detailed application of THERP to the step by step ~

performance of procedurally driven actions).

2.3.2.4.2 Other Performance Shpping Faaors Considered Operator action interviews were conducted and checklists were used to assess critical aspects of the diagnosis and execution of an action. Factors evaluated included training on the simulator, adequacy of procedures, need for local actions, time available for local actions, feedback to the control room for local actions, stress level, potential non-recoverable actions, etc. Per the guidance provided in the CBDTM and in 'IHERP, the level of stress in given situanons was objectively factored into determining the HEPs.

Moreover, both errors of omission and errors of commission were modeled for response execution errors as diressed by THERP. De overall consideration of PSPs in the modified IPE represented an adequate consideration of plant-specific influences on human reliability. .

2.3.2.4.3 Consideration ofDependencies As discussed above, dependencies related to the impact of time on within crew performance was .

addressed in determining recovery credit for initially failed actions. Opportunities for recovery will l clearly be dependent on the amount of time remaining. In general, time dependence focuses on the fact I' that the time available for diagnosis is dependent on the total time available and the time needed to L

perform the action. While time dependencies for short4ime frame events are not explicitly addressed with

! the CBDTM, the licensee examined time critical events to assess the reasonableness of the HEPs given the available time, in addition, the licensee indi:sted that sequence related timing (the impact of available

time across a sequence) was considered in determining the time available for specific events (see item e below). Rus, time dependence appeared to be satisfactorily considered in the m3dified IPE.

Another type of dependence concerns the extent to which the failure probabilities of multiple human actions within a sequence are related. Dere are clearly cases where the context of the accident and the pattern of successes and failure can influence the probability of human error. Dus, in many cases it i

would clearly be inappropriate to assume that multiple human actions in a sequence or cut set would be independent. Furthermore, context effects should be examined even for single actions in a cut set. While the same basic action can be asked in a number of different sequences, different contexts can obviously '

lead to different likelihoods of success, Dependence among multiple human actions were tuoughtfully and thoroughly handled in the Byron IPE through use of the following guidelines: .

a. Two operator action failures separated in time by an essentially successful action were regarded as independent.

1 36 l

l

- . - - . - , - .~ . - . - - - - - . _ - . . . - . - - . . . _- .---. . _

b. 1The time available for _most operator actions varied from minutes _to hours. he degree of dependence between OAs varied according to the time between events. Events separated by less than 15 minutes were assumed'to be have high dependence, nose separated by less than 30 _

minutes but more than 15 were assumed moderately dependent and those separated by less than

~ 60' minutes but more than 30 were assumed to have low dependence. Events separated by more -

than an hour were assumed to be independent.

- c. Events initiated by the same cue and on a parallel success path were treated as having a common diagnosis element (p,).

d. Responses to memorized "immediate action" steps were assumed independent of actions later in the procedure and immediate action steps were assumed independent if performed by different crew members,

e. For cases where an OA failure significantly reduced the time window for a subsequent OA, high dependence would be assessed on the second OA.

f. For cases where an OA failure guaranteed failure of a subsequent OA, complete cependence would be assessed.

Once a judgment about the degree of dependence between events was made, the dependency formulae from NUREG/CR-1278 were used to determine the HEP value for a dependent event. De IPE also noted -

that the lower bound for single human actions was set at 1.0E-4.

Potential dependencies between events in the fault trees were also given a qualitative assessment and l documented in the response to the RAI. It was stated tLat no dependencies were identified.

The modified IPE submittal and the response to the RAI also indicated that context effects on single human actions were addressed. Different HEP values were calculated for similar events in different contexts.

2.3.2.4.4 Quantification ofRecomy Type Aalons As discussed above, the method used to quantify the recovery type actions was different from that used for the response type actions, Screening values were assigned to the recovery of previously failed actions and apparently were not revised. While the 0.1 value assigned was not unreasonable given the apparent long-time frame scenarios in which they ware applied, a discussion of the basis for the HEP would have been nelpful. Recoveries of failed equipment were based on mean time to repair values from WASH-1400 and obtained values were reasonable.

2.3.2,4.3 Hanan Aaions in the Flooding Analysis la the Byron IPE, the flooding scenarios examined apparently used whatever human actions were already contained in the models for transients and there was no evidence that the values were adjusted for the flooding context. .In addition, the licensees's response to the RAI indicated that operator actions to mitigate a flood were not credited.

l 37 l

l 1

l

.. _, . - - . . ~ _ . . . . . _ _ . - , . . _ e _ _ ,

- 2.3.2.4.6 Human Actions in she iswl 2 Analysis -

Operator actions were not modeled in the Level 2 analysis, d

2.3.2.5 haportant Hisman Actions The styron response to the NRC's RAI presents a list of the important " operator action nodes" as a function of their contribution to CDF. De top eight operator action top events for Byron in terms of their conenbution to CDF are presented in Table 8 along with the percent contribution to' CDF. %e licensee

" noted, however, that "in these lists all cases of each operator action are combined." For example, the OSX event includes OSX-1 [ HEP Byron = 1.3E-3] for LSX sequences as well as OSX-4 [ HEP = 1.0]

for DSLX sequences. As stated by the licensee, "thus, the operator action importance can be misleading since it includes cases of denned failure [ HEP = 1.0]." In addition, the top event report does not include '

events in the fault trees. _

Table 8 Byron Operator Action Top Events

" I*

Event Name Event i escription CDF OSX Restore SX Via Unit Crosstie 25.22 %

ODS RCS Cooldown/Depressurization 8.37 %

ORC Establish ECCS Recirculation 5.81 %

OAC Establish Cool Suction Source for Charging Pump 4.30 % ,

ORT Establish RWST Refill 3.95 %

ODS2 Recover ODS 2.54 % .

-OSP. l:e RH Pumps 2.21%

ORE Restore Essential Equipment 1.12 %

2.4 Back End Technical Review -

2.4.1 Containment Analysis / Characterization 2.4.1.1 Fmni end Back-end Pg '---12: -

Containment event trees (CETs), which are used in most of the IPEs for Level 2 analysis, are not developed in the Byron IPE. De tradition 4 core damage anslysis (i.e., Level 1) and containment. analysis (i.e., Level 2) portions of the Probabilistic Risk Assessment (PRA) are integrated through. the use of

~

" plant response trees" (PRTs) that depict the combinations of events that model the plant behavior from the initiating event to .n end state characterized by retention of fission products within the Totainment boundary or release of fission products to the environnent.

e 38

1 Since a single event tree (i.e., the PRT) is used for both Level 1 and Level 2, the development of plant damage _ states (PDSs) as interface for the Level 1 and Level 2 ans;yses_is not needed in the IPE. ,

However, grouping of core damage sequences to PDSs is performed.it is used to consolidate the large number of accident sequences into a small number of damage states such that all sequences within a particular damage state can be treated as a group for assessic; :,ccident progression, containment

- response, and fission product release.

Sequence groniping is discussed in Section 4.1.3.3 of the iPE submittal. De parameters used in the IPE '

for sequence grouping include:

1.- Accident initiator, .

2. Core melt uming, 3.- Functional failure,_

4 Containment status and fission product release. '

Accident initiators include transient,_ loss _of support functions (e.g., loss of amamatial service water, component cooling water or de power), loss of offsite power, loss of all ac power (station blackout,-

SBO), LOCAs, SGTR, ISLOCA, and secondary side breaks. De timing of core melt can be early (within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of accident initiation), intermediate (2 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />), or late (6 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

One parameter, the RCS pressure, which is considered in most other IPEs for PDS definition is not considered here. RCS pressure is not an important parameter in the Byron IPE because all containment challenga mechanisms associated with high pressure melt ejection (HPME), such as direct containment heating (DCH), are dismissed in the IPE as "unlikely" to cause containment failure.

Contributions to the total CDF from the PDSs with various accident initiators are: 39% from PDSs with sequences initiated by loss of essential ser" Ice water (ESW),15% from SBO sequences,13% from small LOCA sequences,7% from large LOCA sequenem,7% from medium LOCA sequences,5% from SGTR sequences, and 0.2% from ISLOCA sequences. We most probable PDS is XL6K (31% _ total CDF), a

- PDS of loss of ESW sequences with late core melt, loss of all ECCS injection, and a late containment failure with up to 0.1% of the volatiles released. His is followed by SX9S" (10% of total CDF), a PDS of small LOCA sequences, with failure of recirculation injection, and no containment failure; BL4A, a PDS of SBO sequences, with late core melt, high pressure injection failure, and no containment failure -

within the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> mission time used for Level 2 andysis; ar.d AE6S, a PDS of large LOCA sequences,

. with early core melt, loss of all ECCS injection, and no containment failure.

2.4.1.2 Contalament Event Tree Development

= As discussed above, a single PRT is used in the Byron IPE for both the Level 1 and Iavel 2 analyses.

De PRT, which is an event tree, is dcd,p.d and quantified for each initiating event. De PRT explicitly includes the analysis of containment systems normally assessed in the Level 2 analysis, and the enntainment condition is addressed in the PRT by the availability of these systems described in the success crkeria for containment integray. According to the success criteria, integrity is maintained if containment "De second character of this PDS designator, X, which indicates the core damage timing, is not defined in the IPE submittal (Table 4.1.3-2).

39

de pressure is less than 98 psig, the median failure pressure for the Byron containment. Based on plant- [

t specific MAAP analyses, containment integrity can be maintained by the operation of one of four RCFCs or one RHR hest exchanger (with associated recirculation train).

De quantification of the containment failure probabilities for Byron is based on plant-specifk MAAP analyses and phenomenological evaluations of the various failure modes, or mechanisms, identified in NUREG-1335. De evaluations are preented in Phr Agical Evaluation Summaries (PESs) which -  :

are not included in the IPE submittal". However, brief discussions of the evaluations and the results

'obtained from them are provided in the subicittal. l The containment failure modes that are addressed in the PESs include those associated with hydrogen m combustion, direct containment heating (DCH), steam explosions, molten core-concrete lateraction (MCCI), vessel blowdown, thermal loading on penetrations, containment isolation failure, containment bypass, and containment overpressurization by noncondensible gas generation, steam generation, or

-. hydrogen burn. According to the submittal, modeling and bounding calculations, based on extensively compiled experimental data, phenomanological uncertainties, and complemented with MAAP calculations in some cases, comprise the general approach taken in these esaluations. Based on these evaluations, all of the above containment failure modes, except for containment overpressure by steaming and/or noncondensible gas generation, containment isolation failure, and containment bypass, are considered as - >

"unlikely" failure modes and thus not included in failure quantification. De lack of consideration of these failure mechanisam in a structured way, such as can be provided by a CET, precludes a systematic twans to examine the relative (quantitative) importance of these failure modes (with the consideration of uncertainties) and the effeus of some romvery actions (e.g., depressurization) en these failure modes.

' Some of the items of interest ar3 the following:

Unlikely Ce%2nt Failure Modes d C* ament failure modes are discussed in Section 4.3.3 of the submittal. Although all important severe accident containment failure modes that are discussed in NUREG 1335 are addressed in the IPE J submittal, most of them are ignored and not evaluated in mntainment failure quantification. Dese include those associated with the following phenomena:

'l. Hydrogen combustion,-

2. Direct containment heating (DCH),

3. Steam explosions,

4. Molten core concrete interaction (MCCI),

5. Thermal attack of containment penetrations, and

. 6. Vessel thrust force.

Phenomenological evaluations were performed in the IPE for the above : phenomena. De Phenomenological Evaluation Summaries (PESs) investigated both the likelihood of occurrence and the probable consequences of these accident phenomena. De PESs were based on available experimental information from the open literature, as well as information developed using the Fauske & Associates,.

Inc. (FAI) experimental facilities.

' "Some are provided in the licensee's response to the RAI.

43 i

~

e,

< For the first two ' phenomena, hydrogen combustion and DCH, conservative estimate of containment presures were obtained and compared _with containment pressure capability to determine their effect on -

containment failure probability, he assessment of hydrogen deflagration assumed in-core hydrogen production imm 100 percent oxidulaa of all Zirconium and metallic constituents of the lower core plates, and burning of all_ available hydrogen inventory in the containment with no energy absorption by -

anmalannent equipment or structures. According to the response to the RAI, this resulted in a containment pressure rise of 62 psi from hydrogen combustion, and a total containment press are less than the median containment failure pressure". For DCH, the containment pressure estimated in the PES is 81 psia if-it is combined with a hydrogen burn, and 52 psia if there is no hydrogen burn. De DCH modeling methodology used in the PES included consideration of the debris mass that could pan ==lally be b particulated in the reactor cavity and the instrumental tunnel, and the fraction of entrained (particulate) debris that couhl escape the reactor cavity and disperse to the containment atmosphere. According to the PES only 15% of entrained core debris was expected to be dispersed to the lower compartment of the containment.

The potential of deflagration-to detonation transition (DDT) was also evaluated in the PES. De DDT potential wm estimated using an empirical technique that involves estimating detonation cell size for some

bourding containment conditions. According to the results, DDT in highly unlikely (to impossible) for any compartment within the Byron containment. For ex-vessel steam explosion, the potential for comalament ovespressurization due to both rapid steam generation or shock wavas were investigated and found unlikely to cause containment failure.

All of the above containment phenomena cause matainment pressure loads, and the dismissal of these phenomena is based primarily on a comparison of the containment pressure loads to the containment pressure capability, which is taken to be the median containment failure pressure (i.e.,50% containment failure probability). Even though the pressure load is less than the median failure pressure, there exists a finite, although small, failure probability if the containment fragility curve (as that presented in the IPE submittal) is considered. Dis issue is discussed in the licensee's response to the RAI (Level 2 Question 5). De licensee's response indicates that the conditional containment failure prob 6bility due to the above mechanisms (i.e., steam explosions, DCH, hydrogen deflagration, and hydrogen detonation) could be about 1% if the containment fragility curve, instead of the median containment failure pressure, is used in the comparison. This probability, according to the licensee, is based on bounding estimates of the effects of the above loading mechanisms on containment failure. Failure from these mechanisms could cause an early release of up to 10% of the volatiles released (According to the result of a MAAP calculation performed for a the sensitivity study).

Although the assessment of hydrogen combustion and DCH in the IPE seems reason 61e, and the estimated containment pressures obtained i>r these phenomena are described in the submittal as conservative (or bounding), they are less than that estimated for the worst case in NUREG 1150 for Zion.

For example, for the worst case, the pressure rise in the containment due to HPME for Zion has a mean "According to the PES attached with the licensee's response to the Level 2 RAI, the post-burn containment pressure based on adiabatic isochoric complete combustion (AICC) is 109 psia for the SBO sequence. His is less than, but very close to, the median containment failure pressure of 112.7 psia (9g psig), and, according to the fragility curve for Unit 2 (Figure c. 3-4), results in over 20%

- probability of containment failure (i.e., conditional failure probability).

41

.~

value of 105 psi, much higher than that obt ined in the PESs for Byron. His indicates the significant uncertainties associated with these phenomena.

Of the containment failure modes dismissed in the Byron IPE, MCCI may cause late containment failure.

Ex vessel debris coolability is not discussed as an issue in containment failure quantification. Rather, MCCI is evaluated in the PESs by a simple bounding analysis using empirical parameters determinod _

from esperimental data.- According to the PES, results of the bounding analysis indicate that molt-through of the containment basemat will not occur within the mission time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. .

Questkins were raised in the kAl regarding the depth of the core debris in the cavity and the effect of- a nonamiform spread of debris on debris coolability. According to the response, the depth of the debris in 4be reactor cavity is 25 cm if the entire initial core mass, the Zlicalloy mass, the lower core support plate, and 10% of the lower head mass were retained in the cavity and its sump. His depth of corium is treated in the IPE as coolable if there is an overlying water pool. According to the response, this assumption is based on experimental results which demonstrate the ability of water to rapidly quench molten debris and ingress into debris beds to maintain them coolable indefinitely. -

Dere is a sump in the Byron cavity which represents a particular case of non-uniform spread within the '_

cavity. According to the response to the RAI the " PES would provide a basis for assessing that non-uniform coricn spreading corresponding to the cavity sump configura:on would be coolable." However, "At some degree of non-aniformity of debris spread... core debris coolability would be diminished and localized concrete erosion would be expected to occur," but "No method was provided in the PES to dowmine how long such concrete erosion might be expected to occur before terminating due to dilution ,

of the corium with the eroded concrete." Although the sump area is more tusceptible to corium attack and is more likely to be penetrated by erosion from CCI, it does not seem to present a significant problem because of the small releases associated with melt-through.

IJkely Contatnment Failure Modes The following containment failure modes are considered in the IPE as likely failure modes and are included in containment failure quantification:

1. Containrnent overpressure,

2. Containment isolation failure, and

3. Containment bypass.

Containment overpressure failure is primarily due to containment pressurization from the generation of steam and non-condensable gases when containment baat removal is not anilable".

"Although the containment integrin success criteria require CHR for success, containment failure is not assured in the larA 2 analysis if CHR is not available. For example, CHR may not be available for the PDSs that are assigned in the IPE to Release Category A, a release category that has no containment failure within the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> mission time, but failure may occur without further mitigating action. .

42

l

'* si L # , '.

Tempermure-induced steam genermor creep rupture, which is considered in other IPEs,- is not considered j L

in the Byron PRTs or addressed in th6 PESs. However, it is discussed in the licensee's response to the RAI (I.evel 2 Question 1). According to the response, ISGTR is not addressed because it is believed that J"

. the primary system loop seals will not clear and the hot leg and pressurizer surge line, which are expected -

to fall before the steam generator tubes, are not likely to reach the temperature levels required for rapid  ;

aosp rupture following core damage. Although temperature-induced hot leg failure is not considered in

the IPE base case, k is investigated in the sensitivity study. On the other hand, induced EGTR is not .  ;

included in the sensitivity study. -

It is also stated in the response that, if the loop seals had cleared, for example by the restart of the RCPs

' per the EOPs, a higher gas temperature throughout the primary system would occur and temperature-

. Weced fauuru of a steam genermor tube would become likely (although the hot leg and pressurizer surge -

noe would remain more likely to fau ikst). Although no detailed probabuistic treatment of this issue was -  ;

L performed during the preparation of the IPE,'an event tree structure was developed in th licensee's

. response to the RAI to estimate the probabilities of temperature induced RCS fauure. De event tree attempted to decompose the p r-- m-iogical issues important to temperature-induced failures. Using .

subjective probabuky values for the issues, the probability of high-temperature induced hot leg or surge line fauure was estimated to be 35% and the probability of induced SGTR was estimated to te; 18%. They were 40% and 24%, respectivaly, if the toerator restarts the RCPs. Dese numbers are based on the assignment of the probability values for the various issues based on an analyst's judgment which are more pessimistic than those used in NUREG-il50 for Zion. De probability ofISGTR used in the NUREG- 4 1150 analysis for Zion has a mean value of 1.8% for RCS at setpoint pressure.- Although the high probability values obtained from the event tree analysis provided in the RAI response lo not seem to justify the omission of this failure mode from IPE _quantification, further discussion is not provided in_

the response. Despite that these ptobability values are obtained based on an analyst's judgment and may

, be overly conservative, the licensee could have benefited from an examination of their implication for IPE quantification.

Containment Failure Modesfrom IPE Results In the Byron IPE, containment bypass is due to SGTR or ISLOCA. Induced SGTR is not included in the quantification. De only failure mode considered for early containment failure is containment isolation fauure, and the only Ime containment failure mode considered is that from containment overpressurization in cases when containment heat removal is not available. A 48-hour mission time is used in the Level 2 ,

analysis. Sequences that involve core damage within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (the mission time for Level 1),

but no containment failure until after 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, are assigned a CAM release class (containment success with accidut management).

2.4.1J Containment Failure Mode and Timlag De Byion containment ultimate strength evaluation is described in Section 4.3.3.1 of the IPE submittal.

f'amminenam failure pressures were obtained by a review of the byron /Braidwood FSAR and a Sargent

& Lundy calculation. Of the several likely containment failure locations identified in the review, the Bunker Ramo electrical penetrations, which are used only in Unit 2, were found to have the lowest mean fauure pressure (108 psig). De connainmad fragility curve used in the IPE was based upon the failure pressures at the limiting failure locations and their associated uncertainties (with an assumed 7%

coefficient of variation). The median containment failure pressure of the fragility curves are 125 psig for 4 . Unit 1 and 98 psig for _ Unit 2.

c

De containment failure pressures and their distributions seem to be consistent with those obtained in other IPEs.

'2.4.1.4 Contalssnent Isolation Failure - ,

Containment isolation status is one of the PRT top events. It is also indicated by the founh digit in the 4<ligk PDS designator. De identincmion of the imponant containment penetrations is d'scussed in some  ;

detail in Section 4.2.1.10 of the IPE submittal. Additional discussion is provided in the licensee's- .

reponse to the RAI (Level 2 Question 2). With few exceptions, only pipes with diameters greater than 2 laches are evaluated". Results show that the frequency of containment isolation failure for Byron is y about 4.lE 7 (Table 3-8 of the Modified IPE Results submitted with the response to the RAI).

Containment isolation failure sequences are dominated by the RWST suction valves to the containment spray pump failing to close, the operator falling to manually initiate phase A containment isolation, and the lastrument bus invener falling to provide power to the slave relays. According to the descriptions provided in the IPE submittal and the licensee's response to the RAI, all five areas identified in the Generic Letter regarding the evaluation of containment isolation failure are addressed in the IPE.

2.4.1.5 System / Human P ;: - -

- De availability of the systems that are imponant to Level 2 accident progression is determined in he PRT and their status is described in the PDS defm' ition.

2.4.1.6 Radionuclide IMa= Characteriantion Since the Byron containment event trees have been incorporated into the PRTs, the PRT end states define the radionuclide release characteristics. As di-~I above in Section 2.4.1.1 of this report, the PRT end y states (or accident sequences) are grouped to a se of PDSs, and each PDS includes sequences with similar damage states in terms of the initiating event, expected timing of core damage, status of the ECCS and containment heat removal systems, and the state of the containment and fission product release. Each PDS .

thus defines a set of faulted functions that summarizes by function a set of system faults that would result in similar radiological consequences. To reduce the number of sequences to be analyzed for source term definition, the PDSs from the top 100 sequences were funher grouped to 12 PDS groups. De highest frequency sequence from the representative PDS in each PDS group was selected and used as a basis for estimating each group's source term characteristics. De CECO-specific version of the MAAP code was used to simulate the 12 sequences of events for source term definition. De sequences were analyzed for the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> mission time used for Level 2 analysis.

De fourth character of the PDS designator, which characterizes containment status and fission product release, is used for release category (RC) definition to summarize the Level 2 results. Among the sixteen RCs defined, eight have non-zero frequencies. ney are (Table 3.8 of the Byron Modified Results):

1. ha. Category S - No containment failure; leakage only, (44.8% total CDF)

"A penetration with diameter equal to 2 inches is retained if it is served as a containment sump line.

De only penetration of diameter equal to 2 inches retained for futuier evaluation is that for containment floor drain sump pump to the Auxiliary Building Drain Tank.

44

--v.-a,- % , - , - ,,,n- n-. ~ v r

I-2, ah Category A - No containment failure within 48-hour mission time; failure could occur

- aAer 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> without accident management; less than 0.1% volatiles released. (13.7% total C DF),-

3. Aelease Category K - Late containment failure; less than 0.1 % volatiles released (containment failure 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or longer aAer vessel failure, 32.4% total CDF) 4.. .

nata == Category L -late containment failure; up to 1% volatiles released (containment failure 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or longer aher vessel failure, l.2% total CDF) 1- Reiemme Category M - Late containment failure; less than 10% volatiles released (containment failure 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or longer aAer vessel failure,1.9% total CDF)

6. Release Category E - Containment isolation impaired; less than 0.1% of volatiles released (0.6% total CDF).

7. Release Category F - Containment isolation impaired; less than 1 % of volatiles released (0.4%

total CDF).

8. blan= Category C - Containment bypassed; up to 1% of volatiles released, (5.0% total CDF),

he release categories are defined to provide a general characterization of the release profile. Although the classification of the accident sequences to the various release categories is in general adequate, the assignment of SGTR sequences to Release Category C is questionable. According to Table 3.6 of the Modified Results, the release fraction of volatile fission products for the SGTR sequence selected to represent this category (RL7C) is 27%, much greater than the limit of 1% of volatiles released used for the C category, it is thus more appropriate to use Release Category T, which according to Table 4.1.3-2 of the submittal, involves releases of volatile fission products of up to 50%, to characterize the release of the SGTR sequences.

De licensee agreed in a telephone conference call (involving NRC, BNL and Comed personnel) that, based on the information presented in the IPE submittal (including the RAI response) Category T is the wrrect release category for SGTR sequences. De assignment of all SGTR sequences to the T Category, ,

although conservative, is acceptable. With this change, the conditional probability of significant ently release (i.e., for volatiles release greater than 10%) for Byron is 5%, an average value in IPEs with large dry containments 2.4.2 Accident Progression and Containment Performance Analysis 2.4.2.1 Severe Accident Progression Sequence selection for fission product release characterization is discussed in Section 4.5.5 of the submittal. Sequences with no containment failure were not evaluated for fission product telease. For the -

remaining sequences in the top 100 sequences, there are 21 different PDSs. Drough combination of PDS: with similar release characteristics,12 PDS groups were selected in the IPE for source term analysir.. De sequence with the highest frequency in the representative PDS in each PDS group was-analysed by a CECO 1pecific version of the MAAP code for the determination of the release fractions for the group. De sequences soleded for source term calculations include one SGTR sequence, 3 SBO sequences,3 small LOCA sequences,3 loss of assential service water sequences, and two steam line break sequences.

We sequences relected for source term analysis seem adequate. However, the grouping of some PDSs and the selection of the sequence for source term analysis in these PDS groups may not be adequate and 45

. . . .- - --. - - - - . - - . . - ~ _ . - . . - - - - - - - - _ .

),. ,

need further discussion. For example, the most probable PDS, XLI>K with 31% total CDF, is grouped l to a much less likely PDS, X14K with only 0.4% total CDF, and XI4K is selected as the representative

' PDS. De selection of a low frequency seguence (Sequence 37,1.42E-7) to represent all the sequences 7 in this PDS group (which includes the number I and number 2 sequences with frequencies of 7.6E4 and g 4.3E4, respectively) should have been justified with further discussion". Even if the saurce terms for -

Sequence 37 (0.35% of total CDF) can bound those for Sequences I and 2", the sequences with the most 1 dominant CDF contributions (19% of total CDF for Sequence l'and 115 for Sequence 2) should be analyasd (or esamined in more detail) to provide data for IPE quantification and source term definition.

i Besides PDS X14K,-the grouping of PDS R14K and VX9K to PDS XI4K would also benefit from 4 additional discussion. PDS RI4K lavolves SGTR initiated sequences and PDS VX9K involves ISLOCA laitiated sequences. Although both have low frequencies (0.3% of CDF for RL9K and 0.24% of CDF for VX9K), the grouping of these bypass sequences to a late failure PDS with less than 0.1% volatiles released would also benefit from discussion.

Despite the above deficiencies, the MAAP calculations performed in the IPE pro ided a reasonable -

coverage of the sequences that could occur at Byron to allow a quantitative understanding of accident progression and fission product releases for Byron.

- 2.4.2.2 Dcaniennt Contributors: l' 3 with IPE Insights

< Level 2 results on radionuclide release character!zation (or containment failure mode definition) are discussed in Section 4.5.5 and summarized in Sectica 7.1 of the submittal. Table 9, below, shows a cow.priison of the conditional probabilities for the various containment failure modes obtained from the Byron IPE with those obtained from the Surry and Zion NUREG-il50 analyses. Results from both the original and the Modified IPEs are presented in Table 9.

As shown in Table 9, the conditional probability of containment bypass for Byron is 5.0% of total CDF (Discussions are based on modified IPE results.). All of it is from steam generator tube rupture as an initiating event. Induced SGIR is not considered as a credible failure mode. ISLOCA initiated sequences

. (in PDS VX9K) have a frequency of about 0.2% of total CDF but are grouped to a late failure PDS (PDS X14K). A small fraction of SGIR initiated sequences (in PDS RL9K,0.3% of total CDF) is also grouped to late failure PDS X14K.

h

'%e selection is appropriate in the original IPE submittal because the contribution from XI4K is

. negligible. XII>K is the dominant contributor only in the modified IPE results, not in the original IPE results. According to a telephone conference call with the licensee (involving NRC,'BNL, and Cond:4 personnel on June 27,1997) although new sequences with dominating CDF contributions were identified in the modified IPE, additional MAAP calculations were not performed for the modified IPE. De source terms of these new sequences were defined by the MAAP calculations for

~

the sequences selected in the original IPE based on an analyst's engineering judgement.

'%e difference batween PDS X14K and PDS X14K are that the former involves late core melt and u

. the loss of all ECCS injection and the latter involves intermediate core melt and the loss of high pressure ECCS injection.

46 L

L

O

,o Since all phenomena that may cause an early containment failure are considered in the IPE as "unlikely" to cause failure and are thus not included in failure quantifict . 'he conditional probability of early containment failure for Byron is zero. De probability of contalnu.. Isolation failure is 1.0%. Most of.

It is from sequences initiated by loss of ESW (24% of isolation failure), small LOCA (21%), and steam / feed line break (19%).

Table 9 Containment Failure as a Percentage of Total CDF Containment Failure Original Byron Modified Byron gg Zion Mode IPE+ IPE+ + NUREG-1150 H50 Early Failure Negligible + + + Negligible + + + 0.7 1.4 Late Failure 8.1 35.5 5.9 24.0 Bypass 0.04 5.0 12/2 0.7 Isolation Fauure 0.7 1.0 Intact 91.2 * " 58.5 "

• 81.2 73.0 CDF (1/ry) 3.lE-5 4.0E-5 4.0E-5 3.4E-4

+ The data pmsented for Byron are b.t. sed on Table 7.13 of the IPE subnutta modified by the license's response to RAI Level 2 Question 11.

++ The data presented in this column are based on Table 3-8 of Enclosure 3

• Byron Modified IPE results" of the licensee's response to RAI.

+ + + The phenomena that may cause early contamment failure are not considered in containment failure quantification based on phenomenological evaluation summaries prepared by FAI.

• Included in Early Failure, approximately 0.02% *

" included in Early Failure. approximately 0.5%

• • • 'Ihe probability of " Intact" containment include that from "no containment failure within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, but failure could eventually occur without further mitigatirg action" (3.0%

CDF in the original IPE submittal and 13.7 % in the modified IPE results).

De conditional probability of late containment failure for Byron is 35.5% of total CDF. It is primarily from containmen' overpressure failure due to loss of containment heat removal. Because of the long time it takes to melt through the containment basemat, late failure by basemat melt-through is not considered as a credible failure mode even if the debris is not coolable. Based on the results presented in the Modified IPE results, the primary contributors to late containment failure ne loss of ESW sequences (90% of late failure) and SBO sequences (6% of late failure). De individual contribution to late failure from other initiators is less than 1%. For the various initiating events, 84% of loss of ESW sequences, 37% of steam (or feed) line break sequences and 14% of SBO sequences result in late failure. De conditional probability of late failure for LOCA sequences is small, less than 2%.

l Comparison of the results from the modified IPE and the original IPE (see Tabie 9) shows a significant l increase in containment bypass and late comainment failure probabilities for the modified IPE. De )

increase in containment bypass release probability (from 0.04% to 5%) is primarily due to the change 1 in the treatment of the SGTR initiated evenu in the IPE. While most of the SGTR initiated events were considered in the original IPE to lead to a " Success with Accident Management (SAM)" end state (and j 47 l

l

.-. - .- - _ - - - ~ - - - - - - . - . - - -.-. . - - ..-

thus were not considered for Level 2 source term analysis), some of these sequences, with additional evaluation, were considered as core damage sequences and grouped to the containment bypass release group in the modified IPE. De increase in late containment failure probability (from 8.1% to 35.5%)

is primarily due to the significant increase in the probability ofloss of ESW sequences in the modified IPE (about 3% in the original IPE and almost 40% in the modified IPE). ESW sequences are more likely to lead to late containment failure than other sequences because of the loss of cooling to the frontline systems. For example, Level 2 results indicate that while over 80% of ESW sequences and with late containment failure, less than-15% of SBO sequences end with late containment failure.

2.4.2.3 Characterization of C '- M Performance ,

As shown in Table 9, the core damage frequency (CDF) for Byron is lower than that obtained in NUREG il50 for Zion but similar to that obtained in NUREG-il50 for Surry. De conditional probability of containment bypass obtained in the Byron IPE is less than that obtained in NUREG-ll50 for Surry, but greater than that obtained in NUREG il50 for Zion. Induced SGTR, which is considered in the NUREG IISO study, is not considered in the Byron IPE.

Another feature of the Byron IPE is the lack of consideration of any early failure modes in containment

' failure quantification. De early containment failure modes that contribute to NUREG-il50 analyses for Surry and Zion include those from steam explosion and containment pressure load associated with HPME.

Should the data used in the NUREG-1150 analyses for in-vessel steam explosion (0.8% and 0.08% for low pressure and high pressure sequences, respectively) and HPME (higher estimated pressure in NUREG ll50 than in Byron IPE) be used in the Byron IPE, the conditional probability of early containment failure could be comparable to, or greater than, those obtained in NUREG-il50 (because of the smaller containment failure pressure for Byron).

i 2.4.2.4 Impact on Equipment Behavior Equipment important for prevention of core damage anJ/or containment failure was evaluated for -

survivability for a range of accident conditions postulated. To accomplish this task, the By an equipment survivability study was divided into three phases, and the Phase !! study covers the IPE conditions.

According to the licensee's response to the RAI (Level 2 Question 10), the Phase 11 equipment survivability study was limited in scope to a review of the conditions encountered during a successful recovery from a a of the initiating event. He equipment was thus assessed only for the conditions prior to core damage. For example, as part of the Phase II assessment, the Reactor Containment Fan coolers (RCFCs) were considered in the IPE to face their harshest environmental challenge following a Large LOCA initiator. The challenges to the equipment by the harsh environmental conditions following core damage, such as that from aerosol plugging, were considered to be beyond the scope of the IPE.

According to the response to the RAI, the effects of aerosol plugging of RCFC cooling coils are considered in the Severe Accident Management Guidance provided by the Westinghouse Owners Group for members to use in developing Severe Accident Response procedures.

2.4.2.5 Unces1ainties and Sesuiitivity Analysis Sensitivity studies were performed in the IPE to evaluate the effects of uncertainties of in-vessel and ex-vessel phenomena on containment failure timing and related source term release. Uncertainties were addressed by performing MAAP sensitivity studies. His was accomplished by varying certain MAAP model parameters in selected base-case sequences. He ranges of MAAP model parameter variation for 48 I

1 senskivky analyses were based on the recomrnendations provided in EPRI documentation. De parameters l Investigated in the Byron sensitivity studies (for source terms) include: j

- 1. - RPV failure timing -De sensitivity study includes the evaluation of the influence of core melt progression model (e.g., the MAAP core blockage model), induced hot leg rupture, and primary system loop seal clearing on timing of RPV failure.

2. Containment failure timing - De sensitivity study includes the evaluation of the influence of the core melt progression model, ex vessel core debris coolability, external vessel cooling, containment failure pressure, increased fragmentation of core debris expelled at vessel failure, delayed vessel failure, and induced hot leg rupture on containment failure timing.

3. Fission product release - De sensitivity study includes the evaluation of ti:e influence of containment failure timing and size on fission product release.

One sensitivity analysis that is of panicular interest is the one that involves external vessel cooling. De external cooling model used in the CECO-specific version of the MAAP code basically prevents reactor vessel failure as long as the lower head is submerged by water. As a result, reactor vessel failure was effectively prevented during sequence calculation for these sensitivity cases. Because of external cooling, containment failure time was delayed (by about 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />) but the release of volatile fission product releases significantly increased (by about 40 times) relative to the base case which assumed vessel failure one minute after corium relocation to the lower head. In addition to the above effects, the high I'.CS temperatures that result from preventing vessel failure by successful external vessel cooling may increase the likelihood of creep rupture of the RCS (in the hot leg, surge line, and in steam generator tubes) and result in higher fission product release. De licensee's response to the RAI (Level 2 Questions 7 and 8) provide

• some discussion on these issues.

De sensitivity studies reported in the submittal investigated the effects of uncenalnties of some parameter values used in the MAAP code on calculation results. De effect of uncertainties of accident phenomena on containment failure probability are not included in the sensitivity studies of the IPE submittal but are dismctM in the Phenomenological Evaluation Summaries prepared by the licensee in support of the IPE and in the licensee's response to the RAl. De probabilities of induced SGTR and early containment failure due to energetic events such as those from hydrogen combustion or those associated with HPME are discussed in the response to the RAl.

15 Evaluation of Decay Heat Removal and Other Safety Issues and CPI 2.5.1 Evaluation of Decay Heat Removal 2.5.1.1 Examination of DHR De IPE addresses decay heat removal (DHR). De decay heat removal is accomplished by the following Byron features:

1) During small LOCAs and transient events, decay heat is removed via the auxiliary feedwater system or via alternate feedwater (malr. feedwater, startup feedwater or condensate / condensate booster pumps with depressurization) through the secondary side. If secondary side cooling is 49

not available, feed and bleed operations are needed on the primary side. He feed and bleed requires high pressure injection systems, the pressurizer PORVs and the associated operator actions;

2) During medium and large LOCAs, decay heat is removed by the break flow and the ECCS. This includes the Si system, the RHR (or LPI) injection and recirculation subsystems, the charging system and the associated operator actions. These systems are backed up by the containment fan coolers and the shotdown cooling mode of the RHR.

The IPE describes in detail each system, associated operator actions and hardware and HRA unavailabilities, along with any simplifying assumptions in modelhg the sy-tem. For example, alternate sources of auxiliary feedwater (from the other unit CST and from the SX system) were not modeled. For non-LOCA cases, only the charging system was modeled for success of feed and bleed cooling. De RWST refill is credited, as is the operation of the RCFCs for the decay heat removal. 'It should be noted that the RCFCs have a very low unavailability due to the success criteria used (one~out of 4).

he licensee notes that a review of NUMARC closure guidelines for the Byron sequence quantification indicates that over 50% of the core damage sequences (in the original IPE) involve a loss of primary and secondary heat removal in the recirculation phase, while 30% (in the original IPE) involves a loss of both primary and secondary heat removal in the injection phase, De licensee then notes that one of the causes of failure in the sequences in question is a degraded state of the 4kV system, with one bus failed. His has led to the revision of the procedures to effect the cross-tie even if one bus is energized (previously the cross-tic was effected only in an SBO). This improvement reduces the CDF by 62% and reduces the contribution of AFW and ECCS recirculation failures by approximately 20% each, relative to the original IPE.

The modified IPE has many modifications (e.g., in the area of HRA, SAM states resolution, CCF modeling) so that a direct comparison of the impact of these changes was not made (the sensitivities above are not a comparison between the original and the modified IPE). For example, the AFW failure contribution to the CDF sequences was about 82% in the original IPE, but only about 11% in the modified IPE.

Two sensitivity studies were completed relative to decay heat removal, in the first study, an SX pump was modeled as providing sufficient AFW flow through an idle AFW pump (after depressurization) to remove the decay heat. This led to a 67% reduction in the total core damage frequency. In the second study, local action to start the train A AFW pump was considered following a loss of de bus 111. He CDF reduction due to credit for this action was about 5%. Both of these actions were already proceduralized, but they were not credited in the base model.

Note that the numerical data in this section comes from the original IPE, as the modified IPE did not include this section.

He licensee appears to have fulfilled the request of the generic letter with respect to this issue. No DHR vulnerabilities were identified and the licensee considers the DHR issue resolved.

2.5.1.2 Diverse Means of DHR he IPE evaluated the diverse means for DHR, as described In the section above.

50

a

2.5.1.3 Unique Features of DHR he unique features at Byron that direedy impact the ability to provide DHR are described in Section 1.2

(* Key Features").

2.5.2 - Other GSis/USIs Addressed in the Submittal No GSis or US!s, other than USl A 45 (DHR Evaluation) are addressed in the submittal.

2.5.3 Response to CPI Program Recommendations De CPI recommendation for PWRs with a dry containment 1.: the evaluation of containment and equipment vulnerabilities to localized hydrogen combustion and the need for improvements. Although the effects of hydrogen combustion on containment integrity and equipment are discussed in the submittal, the CPI issue is not specifically addressed. More detailed information on this issue is provided in the licensee's response to the RAI (Level 2 Question 12). According to the response, hydrogen combustion 11 sues are addressed in the PESs, which conclude that hydrogen deflagration and detonation are an un!!kely containment failure mode.10 addition to the PESs, plant walkdowns were performed at Byron as part of the containment performance evaluation conducted for the Byron and Braidwood IPEs. De walkdown team identified the likely hydrogen release points into the containment from the primary system and a couple oflocations which had a potential for hydrogen pocketing (i.e., the seal table room and the space between the primary shield wall and the secondary shield wall). Subsequent investigation showed that the Byron containment has a very low likelihood of localized detonation and the accompanying potential for missile generation.

Severe accident management procedures are currently being prepared for Byron and Braidwood Stations.

This guidance is based on the WOG Severe Accident Management Guidelines (SAMGs). He SAMGs include SAM strategies fdr controlling containment hydrogen concentrations to preclude hydrogen burns and/or detonation.

2.6 Vulnerabilities and Plant Improvements 2.6.1 Vulnerability The licensee stated that a potential vulnerability exists with respect to flooding. This potential vulnerability is addressed in improvements #2 and #3 in section 2.6.2 below, in addition, the licensee used the NUMARC severe accident issue closure guidelines to assess if any improvements are necessary.

he NUMARC guidelines group sequences in the categories defined in Table 10, with instructions as to what action is needed if a category CDF exceeds a certain threshold value. De Table also shows contributions of the NUMARC category to the CDF at Byron. His table is taken from Table 3-4 of Enclosure 3 of the RAI Responses.

De licensee states "For mast bins, adequate treatment is to ensure such sequences are covered in severe l accident management guidance. For some bins, no action is necessary. Bins IIA and VB require consideration of procedure changes, minor modifications, or treatment in severe accident management guidance For IIA, it is believed that the quantification is conservatively high, and that investigation and 51 l

i reAnement of the loss of SX-related procedure changes, discussed above, will result, ultimately, in CDF

' lower thu that shown. For VB, Comed's conclusion is that there is not cost effemive procedure or hardware changes to reduce the risk. Derefore, in response to this analysis of the response to the NUMARC Closure Guidelines, Comed's Byron Station will " flood proof" the SX pump rooms, and develop procedure changes to respond to.an SX pipe break large enough to threaten drainage of the SX -

cooling tower basins."-

As indicated above, the licensee does commit in this secslon to " flood proof" the SX pump rooms, and develop procedures for deallag with the loss of cooling tower basin event in response to the NUMARC closure guidelines. De sequences in question are discussed in the flooding section, and result in a dual unit loss of service water, have a dual unit core damage frequency of close to 1.0E-4/yr, and are not

included in Table 10, or any other results. Dat sequences are similar to sequence 1 in Table 7, and

- would fall into category IIA in Table 10.

Also, the licensee did implement or consider several other improvements, as a result of the IPE (but not as a result of NUMARC guidelines), which are discussed in the next section. .

- Vulnerability is not defined in the IPE subminal for Level 2, and no vulnerabilities were identified in the

' IPE process.

2.6.2 Proposed Improve nents and Modifications Wree Level 1 improvements have resulted from the IPE process, ne IPE takes credit for all three, in addition, the submittal states that the CECO's insights process identified numerous insights for procedure enhancements to improve operator response, both before and after core damage, as well as strategies and features to be included in Severe Accident Management Guidance. it is stated in the submittal that much of the generic Fuldance in the Westinghouse Owners Group Severe Accident Management Guidelines is based on the insights from the Zion and Byron IPEs.

De following three i.evel 1 improvements are discussed: ,

1) .Crosstying emergency ac buses. His insight was identified in the original IPE. Emergency procedures developed as a result of the blackcut rule directed use of this crosstle in the event of an SBO. The principal insight from the original IPE was that there were other situations for which the cross-tie is valuable, i.e., one bus deenergized and equipment on the other bus failed.

Crosstying when only one bus is deenergized had therefore been implemented in the procedures, even prior to the IPE submittal (but was not credited in the original IPE).-De CDF change (relative to the original IPE) is a reduction of 1.9E-5/yr (fmm 3.lE-5/yr, a 62% reduction),

while the SBO CDF was reduced from 4.5E4/yr to 3.6E4/yr, a 21% reduction, ne modi 6ed IPE credits crosstying of enher or both 4 kV buses (141 and 142) to the other unit.-

. De original and the enhanced IPE (prior to the modified IPEj just credited crosstying of the bus 141..- Crediting both crosstics, (on top of allowing crossties in case of one bus energized),

reduced the Byron enhanced IPE CDF a further 11% (the SBO CDF was reduced a further.28%). '

52 d

.A .

l i

Note that the enhanced IPE apparently differed from the originalIPE in allowing the cross-tie with one bus (re) energized.  !

Table 10 NUMARC Categoria and 3yS Resolution EyS NUMARC Action Required "III"

Category CDF / r) II '" I')

IA loss of primary and secondary heat 1.iE4 108 - 104, SAMC removal in injection phase IB loss of primary and secondary heat 1.5E4 10 104, SAMG removal in recirculation phase IIA induced (seal) LOCA with loss of 2.0E-5 104 - 108, consider injection procedural, minor hardware modifications or SAMG IIB induced (seal) LOCA with loss of 2.2E4 10 104, SAMG recirculation Illa small LOCA with loss of injection 1.5E-7 < 104, do nothing IllB small LOCA with loss of 4.5E4 10 10*, S AMG recirculation lilC large/ medium LOCA with loss of 2.4E4 10 104, SAMG injection IllD large/ medium LOCA with loss of 2.7E4 108 - 104, SAMG recirculation IV accident sequences invoH ig failure 1.7E-7 < 104, do nothing of reactivity control VA interfacing system LOCA 7.6E-8 < Itt', do nothing VB steam generator tube rupture 1.8E4 108 - 104, consider accidents procedural, minor hardware modification, SAMG 1

2) Scaling SX pump room ventilation duct. This arose out of consideration of pipe rupture events in the SX system some of which may lead to a loss of SX or flooding events. The ventilation duct in question would allow piopagation of flooding from such an event from a sump room to all SX pump rooms, leading to a dual unit loss of essential service water event (discussed in the 53 i

flooding section) with a high frequency. A modification is being developed to prevent the flooding, although installation dates have not yet been established. The IPE model assumes that this modification perfectly removes this scenario from consideration.

The sensitivity for this modification is discussed after modification 3, as both would be implemented together.

3) Develo ing procedure for coolir.g tower basin loss due to $X ruptures. If the pipe size exceeds certain limit, the flow out of the break will exceed the cooling tower basin makeup capacity, and a loss of all SX will result. Operator procedures are being investigated which would minimize the frequency of such an event (e.g., closing the cross-tie valves, stopping the SX pumps, etc.).

The modified IPE results for the dual unit loss of essential service water contain the assumed residual from such actions, where a 10% failure probability to prevent loss of the basins' inventory was assumed.

If the credit for modi 0 cations 2 and 3 is removed, the resulting core damage frequency will rise by approximately 1.0E-4/yr.

The SBO rule changes are also discussed in the RAI responses. De crosstying of the emergency ac buses in case of an SBO was the modification implemented for the SBO rule. No sensitivity was available for this modification as this procedure change is already embedded in the original IPE.

De plant enhancement resulted from the Level 2 analysis in Braidwood, i.e., the installation of an opening in the reactor cavity cover plate, is not needed for Byron. The cover plate for Byron is not leak tight and thus allows water to Dow from the containment basement to the wor cavity.

54

1

.e

3. - CONTRACTOR OBSERVATIONS AND CONCLUSIONS  ;

i i

De arengths of the level 1 !PE analysis are:

1) De treatment of plant specific initiating events is comprenensive; I

2) Common cause analysis is applied to most types of components;

3) De plant speenfic data which was collemed for the pumps and the MOVs discriminated based on i

- the system ($1 pumps versus CCW pumps, etc.)

'l

~

De subminal contains a good discussion of insights on plant featu os as well as a comparison of  !

4) l

. deste differences wkh anoeber CECO plant (Zion) and their impact on the diffwences in results.

5) De decay best removal discussion is relui/ely comprehensive; i l

6) - De RAI resoonses wwe generally very detailed and thorough; ,

1

7) The discussion of IPE modifications was also very compime, with generally credible analyses  !

- justifying the modifications.  ;

l De weaknesses of the levd I analysis are:

1) Dere are some questions about data, for example the lack of plant sralfic data (which was collec;rd only for the dimel generatars, the pumps, the MOVs, the RCFCs and the essential cooline water fans). l

2) ' Some of the common cause factors used are still low, even with establishment of the floor for such values in the modified IPE (this is somewhm olhet by performance of a sensitivity analysis).

3) De documentation for certain aspects of the analysis is not very clear, making it vwy hard to understand the analysis or some of the results. For example, there is no description of modeling 1 of accident sequences for specific plant respoase trees (i.e., the PRT logic), nor is there a ,

thorough discussion of the top sequences in the results sation. V' *muld not find a complete discussion of the RCP seal LOCA model utillred, offsite power ravwy model or anodeling of containment failure feedback to the status of ECCS oporte. ion. De syman section was also not very helpfbl in answering these questions. Dere was no discussion of success crkeria where they deviated froen the established PWR practice. Subsequent conversations with the licensw led to 1 a satisfactory resolution of these issues. l De HRA avview of the Byron modified IPE :did not idendfy any significant problems or errors. A viable .;

o approach was used in performing the HRA and nothing in the licensees submittal indicated that, based  ;

on the HRA, it failed to mwt the objectives of Generic latter 88 20. Important elements (including weaknesses) pertinent to thP .stenninstion include the following:

4 55 -

s F

__.2.. a _. _ x._ - ,u __._a__._._.._,. . _

.. i

1) De modified IPE indicates that utility personnel were involved in the HRA and that the procedure reviews, plant examinations, and opermor acslon interviews represented a viable  !

process for conArming the the HRA portions of the IPE tcpresent the as built as operated plant.  ;

1 i

2) De analysis of pre initiator human actions included both miscalibrations and restoration faults, Howevw, while a thorough analysis and evaluation of plant apacific data relating to pre-laitiators  !

was performed, only four restoration faults were actually included in the PRA mudels. All l others wwe dismissed on the basis of qualitative (and in a few cases quantitative) screening 1  ;~

~

critula. While the appreadi was not without merit, the lack of a full modeling of pre-laitiator

• events (and the lack of a clear explanation of the pre laitiator quantification technique) must be ,

considered a wannaan of the modified IPE. 1

3) De combination of the EPRI Cause Based Decision Tree Methodology (CBDTM) and T}lERP ' l (NUREO/CR 1278) prvvided a raamanaMe basis for assessing post initiator response type human actions. The CBDTM as applied in the Byron modified IPE does a good job of assessing the l diagnosis portion of operator actions. In addition, the impact of plant specific performance t shaping factors was adequately addressed. One limitation of the CBDTM is that it does not, in knolf, have a unique appronJi for analyzing time-critical actions. Dat is, those actions where the ,

difference between the time available and the time required to perform the actions is short and ,

the possibility exists for the operators to fall to accomplish the actions in time, are not evaluated I directly as a function of time. Therefore, even with the CBDTM, the potential exists for l underestimating HEPs for shortalme frame events. However, the licensee performed an ,

acceptable evaluation to ensure that short time frame events were not inappropriately quantified.

4) A thorough tientment of dependencies between post initiator operator actions was conducted for  ;

the modified IPE.

t i

5) The Byron modified IPE presents a list of the important " operator action nodes" as a function of their contribution to CDF. The licensee noted, however, that "in these lists all cases of each operator action are combined." For example, the OSX event includes OSX 1 [ HEP Byron =

1.3E 3) for LSX sequences as well as OSX-4 [ HEP = 1.0} for DSLX sequences. As stated by .

the licensen, "thus, the operator action importance can be misleading since it includes cases of defined failure (HEP = 1.0]." In addition, the top event report does not include events in tht  ;

fault trees. Dus, the analysis of important human actions could have been done in a more useful  ;

manner.

l \

De strengths of the Level 2 analyses are the in<lepth examination and plant specific evaluation of l l

-important containment phenomena in the Phenomenological Evaluation Summaries (PESs), and the estensive MAAP calculations performed for source term dormition and sensitivity analyses. It seerns that the lloonsee has developed an overall appreciation of severe accident behavior and a quantitative understanding of the overall probability of core damage and radioactive material releases. De licensee

- has also addressed the recommendations of the CPI program. '

l Dare are some weaknesses in the Level 2 IPE' '

I i

~

1) : De most significant weakness is the lack of ocasideration of some of the containment phenomena

• In the IPE quanthication model. Except for containment overpressure failure, isolation failure, i

. f se l

l s  :

i and bypass, all other containment failure modes are considwed'as "unlikely" to cause l

4 containment failure.md deus not included in containment failure quantification. Done include all  :

W shat snav cause early anntainmem failure (steam es;,sosion, bjdrogen combustion, and l

DCH), and sons phenomena the may cause late ccatainmem failure (molten core debris  :

lateraction and thermal attack of containment penetrations). Because of the uncertainties j associated wkh these & r and containment pressure capability, their contributions to early  !

'

• containmem failure may not be negligible. De problem is more significam for Unit 2 because  !

of its.relatively low namaalamane failure pressure. Although a rough estimate provided in the reposse to an RAI indicates that the contributions to containmem failure probabilky fhun these j "unlikely failure modes" are small (about 15 of total CDF) and their exclusion from containment  ;

dallure quantification may be justified, the lack of consideration of these failure modes in the IPE in a struaured way, audi as can be provided by a CET, precludes a systematic means to examine  !

tha relative importance of these failure modes and the effems of some recovery actions on these .;

failure modes.  !

2) De assignment of SGTR sequences to Release Category C is another problem. Release Category l C, according to the IPE subminal, involves accident sequences that have up to 1 % of the volatiles -

1

, released. However, the predicted release fraction of voimile fission products for the sequence ,

solemed to represent the SGTR sequences is 27%, much greater than the limit of 1% of volatiles i for Category C. It is thus more appropriate to use Release Category T (instead of C) to [

characterine the release of the SGTR saquences. Release Category T is defined as containment  !

bypass with up to 50% of the volatiles released.  !

De licensee agreed in a telephone conference call (involving NRC, BNL and Comed personnel) I that, based on the i ' ' ~lon presented in the IPE submittal (including the RAI response)  !

Category T is the ao . .. lease category for SGTR sequences. De assignment of all SGTR

[

sequences to the T Category, although conservative, is acceptable. With this change, the conditional probability of significant early release (i.e., for volatiles release greater than 10%)

for Byron is 5%, an average value in IPEs with large dry containments Although the MAAP calculation performed in the IPE for the SGTR case may be conservative .  ;

because the relief valves on the secondary side were assumed to fell open (e.g., due to excessive 1

cycling) in the calculation, there is no basis in the IPE submittal and the RAI rerponse to assign l

the SGTR sequences to the C Category. Any future effort (e.g., additional MAAP calculation) ,

to justify the assignment of the JGTR sequences to Category C needs to address the probability of SG valve failure due to adverse operating conditions in severe accidents.

l

3) Equipment survivability study in the IPE is limited in scope to a review of the conditions encountered during's successful recovery from each of the initiating events. De equipment is  :

thus assessed only' for the conditions prior to core damage. For example, the Reactor  ;

, Containment Fan Coolers (RCFCs) are considered as facing their harshest environmental challenge followig a large LOCA laitiator, ne challenges to the'equipmem by t ie harsh

- environmental coaditions followleg core damage, such as aerosol plugging, were considered to be beyond the scope of the IPE According to the response to an RAI question, the effects of aerosol plugging of RCFC cooling coils are considered in the Severe Accident Management Guidance provided by the Westinghouse Owners Group for members to use in developing Severe Accident Response procedures.

~

$7 l t

I s i Dis is not a signlAcant deficiency, howevw, because containment failure due to equipment  ;

failure under harsh environmental conditions would be ime and most likely with low fission -  ;

product releases. De effect on the overall fission product release profile for Byron should not j be significant because of the already relaively high contribution from late containment failure for i

Byron (35.5 %). j

4) The treatmern of induced steam generator tube rupture (SGTR) is not well treated in the  !

submittal, induced SGTR is not included in the PRT model or addressed in the PESs. Rough , ,

estimates of the probabilities of hot leg fauure and induced SGTR by creep rupture using a - l decomposkion event tres structure are presented in the licensee's response to the RAI. It shows

{

an overall probability of induced SGTR of 185. De probability is increased to 24% if the RCPs  ;

are restarted by the operator. Although these high probabuity values do not seem to justify the q omittirig of this failure mode in IPE quantification, Auther discussion is not provided in the RAI  :

response, h is noted, however, that these probability values are obtained based on na analyst's  ;

judgement and may be overly conservative. (ne probability of laduced SGTR obtained in the  :

RAI response is much higher than that obtained in NUREG il50.) Since o>ntal.unent bypass j

hom SGTR initiated sequences is the dominant failure mode in the IPE, additional contribution to containment bypass from induced SG1R may not change significantly the release profile of the j plant. However, this issue needs to be re-examined if contribution from the SGTR initiated sequences to the total CDF is significantly reduced in a future IPE update. j 5)- A' augh the sequences selected for source term definition seem adequate, the selection of a [

sequence with ury low frequency to represent a PDS group that includes the most likely  !

seguence, and the lack of sufficiert discussion on the selection, is a weakness. Even if the source l I

terms defined by the MAAP calculation for the selected sequence can bound ce are representative of all the sequences in the PDS group, the most likely sequence with significant CDF contribution (

should be analyzed (or examined in more detail) to provide data for IPE quantification and source term definition.

On the other hand, the MAAP cWculations performed in the IPE provided a reasonable coverage of the sequences that could occur at Byron to allow a quantithtive understanding of se:ident  :

progression and fission product releases for Byron.  !

i It appears that the licensee has met the objectives of Generic Letter 88 20. Some strengths and several  ;

weaknesses of the Level I, HRA, and Level 2 analyses have been identified above.  ;

q t

~

58 4

• (

I

4. REFERENCES llPE) Hyron Nuclear Power Station Individual Plant Examination, Commonwealth .

Edison Company, April,1994. l lRAI Responses) Response to NRC Requestfor Additional ligformation and Modyled IndMdual Plant Examination, Byron /Braidwood Nuclear Power Station IPE," >

Commonwealth Edison Company, March,1997.

(EPRI TR LOO 259) G. W, Parry, et al. An Approach to the Analysis of Operator Actions in PRA, l

- Electric Power Research Institute Report, EPRI TR 100259 Palo Alto, CA,  !

June,1992, j (NUREGICR 1278) A. D. Swnin and H, E. Guttman, flandbook ofHuman Reliability Analysis strh l Emphasis on Nuclear Powr Applications : Technique for Human Error Rate 1 Prediction, NUREG/CR 1278, U.S. Nuclear Regulatory Commission,  ;

Washington D.C.,1983.

i F

59 I

_ _ _ . ._. ,. _ __ , _ _ _ _ . ,