NUREG-1335, Staff Evaluation Rept Concluding That Licensee IPE Complete Wrt Info Requested by GL 88-20 & Associated Guidance, NUREG-1335
| ML20211B518 | |
| Person / Time | |
|---|---|
| Site: | Byron, Braidwood  |
| Issue date: | 08/28/1997 |
| From: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | |
| Shared Package | |
| ML17312B782 | List: |
| References | |
| RTR-NUREG-1335 GL-88-20, NUDOCS 9709250259 | |
| Download: ML20211B518 (7) | |
Text
m'.
e e ._
ATTACHMENT 1 BRAIDWOOD NUCLEAR GENERATING STATION UNITS 1 AND 2
. INDIVIDUAL PLANT EXAMINATION STAFF EVALUATION REPORT 9709250259 970828 PDR ADOCK 05000454 P. PDR ,,,
- l. INTRODUCTION On June 30,1994, the Commonwealth Edison Co. (Comed) submitted the Individual Plant Examination (IPE) for Braidwood Nuclear Generating Station (BNGS) Units 1 and 2 (the base IPE)in response to Generic Letter (GL) 88 20 and associated supplements. On January 26,1996, the staff sent a request for additionalinformation (RAl) to the licensee identifying concerns about the IPE that were similar to those raised previously by the staff for the Zion, Dresden and Quad Cities IPEs. The licensee responded by letter on March 27,1997, forwarding " Responses to NRC Requests for AdditionalInformation and Modified Byron and Braidwood IPEs" which addressed the concems. The modified analysis also included the revised sequences and the impact on core damage frequency (CDF) as a result of these modifications. Subsequent to the staff review of the modifications to the IPE and the responses to the RAls, teleconferences were held during June 1997 between the licensee, the staff, and its consultant Brookhaven National Laboratory for clarification.
A " Step 1" review of the BNGS base IPE submittal and modifications was performL and involved the efforts of Brookhaven National Laboratory in the front-end and the back-end analyses, and Sandia Na'ional Laboratory in the human reliability analysis (HRA). The Step 1 review focused on whether the licensee's method was capable of identifying vulnerabilities. Therefore, the review considered (1) the completeness of the information and I (2) the reasonableness of the results given the BNGS design, operation, and history. A more I
detailed review, a " Step 2" review, was not performed for this IPE submittal. Details of the contractor's findings are in the attached technical evaluation report (Appendix A) of this staff evaluation report (SER).
In accordance with GL 88 20, BNGS proposed to resolve Unresolved Safety issue (USl)
A-45, " Shutdown Decay Heat Removal Requirements." No other specific USls or generic safety isst.es were proposed for resolution as part of the BNGS IPE.
II. EVALUATION in the RAls sent to the licensee on January 26,1996, the staff expressed concems regarding several areas of the IPE including: a human reliability analysis that did not incorporate important aspects of operator performance and did not appropriately treat human performance under acc'dont conditions; use and application of an optimistic quantification process, inciuding common cause failure (CCF); use of the MAAP code to determine core cooling success criteria under conditions where it has not been benchmarked, arriving at combinations of equipment of lesser capacity to achieve success; use of " success with accident management"(SAM) end states without significant margin beyond the cutoff criteria (24 hr.) for these sequences. The licensee explicitly addressed the staff's concems in the modified IPE submittal.
Each of the two BNGS units is a Westinghouse 4 loop pressurized water reactor (PWR) with a large dry containment. In the base IPE submittal the licensee estimated the total CDF for each unit as 3 E-5/ reactor year (ry) for intemally initiated events, including intemal flooding.
Loss of offsite power (LOOP) contributes 88% (single unit 56%, dual unit 32%), loss of coolant accidents (LOCA) 4% (small 2%, large and medium 1 %), transients 7% (loss of support systems 4%, others 3%), steam generator tube rupture (SGTR), anticipated 1
1
1 l
. l transients without scram (AMS), interfacing systems LOCA (ISLOCA) and internal flooding "1%. As an accident type station blackout contributes about 23%. In its modified IPE submittal the licensee estimated the total CDF for each unit also as 3E 5/ry for intemally initiated events, including intemal flooding. LOOP contributes 31% (dual unit 18%, single unit 13%), transients 33% (loss of support systems 30%, others 3%) LOCA 27% (large, medium and small all 9%), SGTR 9%, AMS, ISLOCA and internal flooding <1%. Loss of support systems is dominated by dual unit loss of essential service water (ESW) 20%, single unit loss of ESW 4% and loss of component cooling water (LOCCW) 4%. As an accident type station blackout contributes about 28%.
While the total CDF has not changed, the contnbutors to CDF have changed. Most notable is the inclusion of pipe breaks (not previously considered) in the ESW which resulted in a dual unit loss of ESW (5.6E-6/ry). The inclusior, of pipe breaks resulted in the identification and subsequent elimination of a " potential vulnerability" wherein both ESW pump rooms are flooded (see enhancements below). In addition, the licensee has taken credit for cross tie of either or both of the 4KV buses (141 to 241,142 to 242) on loss of power to these buses.
Further, in the modified IPE, sequences leading to single or dual LOOP previously identified as success with accident management (SAM), were expanded. The licensee originally defined SAM sequences as "no core damage at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and for which accident management actions are required after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />..." The licensee analyzed these sequences further and expanded them to either success or core damage. These sequences now contribute a total of about 1E 5/yr to the total CDF.
In addition to the above, the increase in contribution from Large LOCA was due to the change in success criteria to more typical criteria for PWRs. The medium LOCA contribution increase was due to increases in human error probabilities (establish high pressure recirculation from 0.05 to 0.5), as a result of the modification to the HRA and changes to the emergency core cooling flow requirements which had an impact on refueling water storage tank refill success.
Regarding the use of low CCFs, the licensee established a threshold value of 0.01 for systems with a two-of two train configuration. This resulted in an automatic increase of those factors that were previously below 0.01. With this approach, the licensee addressed the staff's concems about very low CCFs, but in a limited way. The values for CCF factors remainec k.Nc* than generic values and the licensee did not provide a strong support .br their applicability at BNGS. The licensee indicated that the sensitivity study performed for the CCF (increasing the beta factor by a factor of ten; which, for a number of components brought the beta factor value "o to the values identified in NUREG/CR-4550), showed that the total CDF increased by a relatively small factor (a factor of 2 to 6E-6), and that therefore the IPE results are relatively irbensitive to the common cause factors in the range of the values under discussion. However, the staff believes that the resultant increase in the CDF contribution for certain individual events, not displayed or discussed in the modified IPE, may show some sensitivity to common cause failure, irrespective of the impact on the total CDF.
Because of this the staff considers the licensee's analysis to be limited due to the uncertain character of CCF analysis as expressed above. Even so the staff believes that it is unlikely that this limitation has affected the licensee's overall conclusions from the IPE and its capability to identify vulnerabilities. It may, however, have limited the licensee's ability to gain insights and identify improvements.
2
The licensee performed an HRA to document and quantify potential failures in human system interactions. In the HRA for the modified IPE the licensee searched for pre initiator human events and in particular for events related to re alignment of manual valves after test or maintenance and to miscalibration. After examining BNGS procedures and operational history, the licensee identified at least four events that were pre initiator misalignment events (none of which were miscalibration). However, the licensee qualitatively screened the majonty of pre initiators on the basis of procedural check-offs, independent venfication and indications in the control room. The licensee's onclusion was that while errors do occur, they are rare, "no pattems were identified" and "no vulnerabilities existed." The staff finds the licensee's qualitative examination for pre initiating events in the revised IPE sufficient for identifying a vulnerability at BNGS: however, the staff, does not believe that the elimination of the majority of pre-initiator events from quantitative assessment on the above basis is completely justified. Very often in a PRA low probability events such as pre initiators, because of their common cause potential, are proven to be important contributors to risk.
In the modified IPE the licensee completely revised the post initiator human event analysis.
The licensee pfimarily used the " Electric Power Research Institute (EPRI) Cause Based Decision Tree Methodology (CBDTM)" described in EPRI TR 100259, while the Technique for Human Error Rate Prediction (THERP), described in NUREG/CR 1278, was used in the base IPE. The CBDTM was used to quantify the likelihood of errors in detection, diagnosis, and decision making, and THERP was used to quantify errors associated with task execution.
Compared with the method used in the base IPE for BNGS, the combination of the CBDT and THERP methods provide a more realistic basis for assessing post initiator human actions. Therefore, most of staffs concerns associated with the way THERP had been applied in the original IPE are not applicable for the modified IPE. In order to address these concerns, the licensee reanalyzed approximately 35 "important" post initiv i human actions (importance was based mainly on risk achievement worth values) and new actions added as a result of changes to the fault or plant response trees. The staff finds that the licensee adequately addressed dependencies between human errors, performance shaping factors and with the use of CBDTM, the licensee better incorporated diagnosis errors and actual plant design and operating characteristics.
Regarding the treatment of time, unlike other EPRI methods, the CBDT method incorporates time implicitly. Therefore, for those situations where the time available versus the time required to perform the action is short, the likelihood of the operator failing may be in" eased due to the short (or perhaps insufficient) time frame since time is not explicitly treated.
Consequently, with the CBDT method, the potential exists for underestimating HEPs for events with short timeframes. Howemr, the licensee did state that time pressure was taken into account by increasing the stress factor (addressed within THERP) in the evaluation of the basic HEPs. A review of these actions, their timing, and the associated HEPs suggesb that the revised HEPs are not unreasonable.
Based on the licensee's IPE process used to search for decay heat removal (DHR) and intemal flooding vulnerabilities, and review of BNGS plant specific features, the staff finds the licensee's DHR evaluation consistent with the intent of the USl A 45 (Decay Heat Removal Reliability) resolution. No other specific unresolved safety issues (USts) or generic safety issues (GSis) were proposed for resolution as part of the BNGS IPE.
3
The licensee evaluated and quantified the results of the severe accident progression through the use of BNGS plant specific phenomenological evaluation summaries. The licensee's back end analysis has considered important severr' accident phenomena. Among the BNGS conditional containment failure probabilities the licensee reported that early containment failure is 0%; late contaircont failure is 30% with overpressurization (due to steam generation or accumulation of non-condensible gases) being the primary contributor; bypass is 7% with SGTR sequences being the primary contnbutor; containment isolation failure is
<1% and the containment remains intact 63% of the time. The values for bypass and late containment failure increased from those in the base IPE to those in the modified IPE. The increase in the containment bypass release probability (from 0.04% to 7%)is primarily due to the addition of the SGTR sequences stemming from the change in the treatment of the SAM sequences as discussed above. The late containment failure probability increase (from 8%
to 30%)is a result of additionalloss of ESW sequences as a result of the inclusion of the pipe breaks in the ESW system, as discussed previously.
The staffs overall assessment of the back-end analysis is that the licensa has made reasonable useof back-end techniques in performing a back-end analysis and that they considered severe accident phenomena it must be noted, however, that in the quantification model the BNGS IPE back end analysis did not include important containment phenomena I (i.e., steam explosion, hydrogen combustion and direct containment heating) that may cause j early containment failure. Although in response to an RAI the licensee provided a rough I estimate of 1% from these unlikely failure modes, lack of consideration of these failure modes in the IPE in a structured way such as provided by a containment event tree precludes a systematic means to examine the relative importance of these failure modes and possible recovery actions for these modes. The licensee's response to containment performance improvement program recommendations is consistent with the intent of GL 88 20 and the associated Supplement 3.
Some insights and plant specific safety features identified at BNGS by the licensee are:
- 1. Ability to perform bleed and feed cooling.
- 2. Each plant has a large condensate storage tank (400,000 gal.) and has an alternate auxiliary feedwater supply from the ESW system cooling pond.
- 3. Two auxiliary fer water pumps; one motor driven and one diesel driven.
- 4. Eight hour battery capacity without load shedding.
- 5. There are two ESW pumps per unit, with a cross-connection capability between the units. One pump per unit is sufficient for shutdown.
- 6. There are five component cooling water pumps, two dedicated to each unit and one swing pump which can be aligned to each unit.
- 7. There are four reactor containment fan coolers, only one of which is required for containment cooling.
4
- 8. Establishment of high pressure rocirculation from the sump requires manual actions of l the operators to align the discharge of the RHR pumps to the suction of the safety injection or charging pumps.
- 9. Two diesel generators per unit. The emargency buses can be cross connected, ano each diesel generator has the capacity to to power one emergency bus at both units at the same time. ,
in Enclosure 4 (Braidwood Modified IPE Results) of the modified IPE submittal, the licensee indicated that the results of the BNGS PRA were evaluated against the NUMARC Severe t Accident Closure Guidelines (NUMARC 9104). The licensee did not define a vulnerability, but they did identify plant modifications or enhkncements as discussed below:
- 1. In their letter transmitting the modified IPE, the licensee indicated that their analysis did disclor a " potential vulnerability", and indicated that "., a modification is being considered.... which will mitigate this potential vulnerability." This potential vulneraUility involved a dual unit loss of ESW from flooding. Water from a pipe break in the ESW system can flow through a common duct resulting in flooding of both ESW pump rooms. The licensee did not identify specifics but, in the section of the modified IPE submittal addressing the " Revised initiating Event Frequencies for Loss of Service Water," the licensee indicated that a modification to the vent duct on the 330 ft. level of the auxiliary building, is being addressed. According to the licensee, this modification will prevent water from the auxiliary building floor drain sump room from overflowing into the ESW pump rooms. Giving credit for this modification in the modified IPE, the CDF contribution for dualloss of ESW due to pipe breaks decrease from about 4E 5/yr to about 6E 6/ry.
- 2. In the modified IPE, the licensee indicated that procedures were available and credit was given for crosstleing either or both 4KV ESF buses (141 to 241,142 to 242) to the other unit on loss of power to the buses on the other unit. Credit for this procedural enhancement reduced the contribution from dual and single loss of power from about 2E 5/ry to about SE 6/ry. .
- 3. The BNGS has a cavity design that does not allow water to flow from the containment basement to the reactor cavity by way of the cavity instrument tunnel. As a plant enhancement resulting frsm the Level 2 analysis, an opening has been provided ir.
the access plate to the instrument tunnelin Unit 1, and a similar one is planned for Unit 2 for the "next" refueling outage, Ill, CONCLUSIONS On the basis of these findings from the review of the modified IPE submittal, the staff finds that the licensee's IPE is complete with regard to the information requested by GL 88 20 (and associated guidance, NUREG 1335) and concludes that the licensee's IPE process meets the intent of GL 88 20.
It should be noted that the staff's review primarily focused on the licensee's ability to examine the Braidwood Units 1 and 2 for severe accident vulnerabilities. Although certain aspects of 5
1
, ~.,- , ,. ..,,. .,,- -,..e.--.- , . . . - g---m-. ,.c py-.,-w ,, v%~~ -,,,5 ,, , me.- ,. ,-, . - - - , - -.- , m -re
the IPE were explored in more detail than others, the review is not intended to validate the accuracy of the licensee's detailed findings (or quantification estimates) that stemmed from the enmination, Therefore, this SER does not constitute NRC approval or endorsement of any IPE material for purposes other than those associated with meeting the intent of GL 88 20.
f 1
6