ML18065A478

Plant TER on IPE Front End Analysis.

ML18065A478
Person / Time
Site:	Palisades
Issue date:	06/27/1995
From:	CLARK R A, DARBY J, RAO D V SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML18065A476	List: ML18065A478 ML18065A479 ML18065A480
References
CON-NRC-04-91-066, CON-NRC-4-91-66 SEA-95-553-015, SEA-95-553-015-A:4, SEA-95-553-15, SEA-95-553-15-A:4, NUDOCS 9602120371
Download: ML18065A478 (38)

Text

• ** -----9602120371 960207 PDR ADOCK 05000255 G PDR Palisades Technical Evaluation Report on the Individual Plant Examination Front End Analysis NRC-04-91-066, Task 15 D. V. Rao J. Darby R. A. Clark W. Thomas J. Lynch, Editor Science and Engineering Associates, Inc. Prepared for the Nuclear Regulatory Commission SEA-95-553-015-A:4 June 27, 1995

• *

• TABLE OF CONTENTS E. EXECUTIVE

SUMMARY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E.1 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E.2 Licensee's IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 E.3 Front-End Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 E.4 Generic Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 E.5 Vulnerabilities and Plant Improvements . . . . . . . . . . . . . . . . . . . . . . 4 E.6 Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1.1 Review

Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• . . . 6 1.2 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2. TECHNICAL REVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

2.1 Licensee's

IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

2.1.1 Completeness

and Methodology . . . . . . . . . . . . . . . . . . . . . 8 2.1.2 Multi-Unit Effects and As-Built.

As-Operated Status . . . . . . . . 8

2.1.3 Licensee

Participation and Peer Review . . . . . . . . . . . . . . . . 9

2.2 Accident

Sequence Delineation and System Analysis . . . . . . . . . . . .

10 2.2.1 Initiating Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10 2.2.2 Event Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11 2.2.3 Systems Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13 2.2.4 System Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14 2.3 Quantitative Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15 2.3.1 Quantification of Accident Sequence Frequencies . . . . . . . . .

15 2.3.2 Point Estimates and Uncertainty/Sensitivity Analyses . . . . . .

15 2.3.3 Use of Plant-Specific Data . . . . . . . . . . . . . . . . . . . . . . . . .

15 2.3.4 Use of Generic Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

16 2.3.5 Common-Cause Quantification . . . . . . . . . . . . . . . . . . . . . .

18 2.4 Interface Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

19 2.4.1 Front-End and Back-End Interfaces . . . . . . . . . . . . . . . . . . .

20 2.4.2 Human Factors Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . .

21 2.5 Evaluation of Decay Heat Removal and Other Safety Issues . . . . . . .

21 2.5.1 Examination of OHR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21 2.5.2 Diverse Means of OHR . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21 2.5.3 Unique Features of OHR . . . . . . . . . . . . . . . . . . . . . . . . . . .

22 2.5.4 Other GSl/USls Addressed in the Submittal . . . . . . . . . . . . .

22 2.6 Internal Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23 2.6.1 Internal Flooding Methodology

...... : . . . . . . . . . . . . . . . .

23 2.6.2 Internal Flooding Results . . . . . . . . . . . . . . . . . . . . . . . . . .

23 2.7 Core Damage Sequence Results .......................

• . . . . 24 2.7.1 Dominant Core Damage Sequences . . . . . . . . . . . . . . . . . .

24 2. 7.2 Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

26 ii

2.7.3 Proposed

Improvements and Modifications . . . . . . . . . . . . . .

27

• 3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS . . . . . . . . . . . . . . . .

28 4. DATA

SUMMARY

SHEETS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

29 REFERENCES

...... *. _ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32 *

• iii

• LIST OF TABLES Table 2-1. Plant-Specific Component Failure Data . . . . . . . . . . . . . . . . . . . . . .

17 Table 2-2. Generic Component Failure Data . . . . . . . . . . . . . . . . . . . . . . . . . .

18 Table 2-3. Internal Flooding Analysis Results . . . . . . . . . . . . . . . . . . . . . . . . . .

24 Table 2-4. Accident Types and Their Contribution to Core Damage Frequency . . 25 Table 2-5. Initiating Events and Their Contribution to Core Damage Frequency . 26 Table 2-6. Top 7 Dominant Systemic Core Damage Sequences . . . . . . . . . . . .

26 iv

• *

• E. EXECUTIVE

SUMMARY

This report summarizes the results of our review of the front-end portion of the Individual Plant Examination (IPE) for the Palisades nuclear plant. This review is based on information contained in the IPE submittal

[IPE Submittal]

along with the licensee's responses

[IPE, Responses]

to a request for additional information (RAI). E.1 Plant Characterization Palisades is a two-loop Combustion Engineering (CE) pressurized water reactor {PWR). Construction of this single unit plant was started on August 25, 1966, and the unit was declared commercial on December 31, 1971. The plant is rated at 2;560 megawatt thermal (MWt) and 845 megawatt electric (MWe). The plant is located on Lake Michigan, 6 miles south of New Haven *. Michigan.

Design features at Palisades that impact the core damage frequency (CDF) relative to other PWRs are as follows:

• Increased power operated relief valve CPORVl capability.

The PORVs were replaced in 1990 to provide increased relief capacity.

Each of the new PORVs can independently provide the required relief capacity needed to support for feed and bleed. This design feature tends to lower the CDF. * * * *

• Operation with PORV block valves closed. The plant nor_mally operates with the PORV block valves kept closed. The submittal states that an overall reduction of risk was achieved with this configuration based on results from a sensitivity analysis.

• Automatic switchover of emergency core cooling system CECCS) from injection to recirculation.

This design feature tends to decrease the CDF over what it would otherwise be with a manual system. [p. 2.1-33 of submittal]

Nitrogen backup systems. A select set of important plant equipment has been . provided with nitrogen backup stations to enable continued operation in the event of loss of normal air. This design feature tends to decrease the CDF. Switchyard power connections.

The Palisades switchyard is supplied by several 345kV lines. Any one of these power lines can provide the required power to either or both of the front or rear 345 Kv switchyard buses. This design feature tends to decrease the CDF. [p. 2.1-21 of submittal].

Independence of high pressure safety injection CHPSI) pumps from low pressure safety injection CLSPI) pumps during recirculation.

The HPSI pumps do not require "piggy-back" suction from the LPSI (or residual heat removal) 1

• * * *

• pumps for operation during recirculation.

This design feature tends to decrease the CDF. Potential single failure of HPSI system. The HPSI system contains two pump minimum flow recirculation valves arranged in series. If either of these valves is closed when the HPSI pumps are started, the HPSI pumps will dead head against the primary coolant system pressure and quickly (within 5 minutes) suffer severe damage. The licensee considers this HPSI failure mode a passive failure (and not a vulnerability), as surveillance and testing is done to verify that the valves remain open. This design feature tends to increase the CDF. [p. 5.0-4 of submittal]

Containment air coolers. The four containment air coolers provide a method of containment cooling that is independent of the containment spray system. This design feature tends to decrease the CDF. [p. 2.1-8 of submittal]

E.2 Licensee's IPE Process The Palisades IPE is Level 1 and 2 probabilistic risk assessment (PRA) performed by the Consumers Power Company (CPCo) personnel with contractual help on the Level 1 analysis from TENERA, L.P. and ABB lmpell. The submittal states that the licensee is extending the IPE effort to include a Level 3 PRA . Plant walkdowns were performed to obtain the latest and most accurate information related to the as-built configuration of the plant. The analysis accounts for all modifications installed before July 1, 1992. A formal independent review of the front-end IPE materials were made by members of the Palisades Plant Safety Engineering Group. In addition to this formal review process, various aspects of the IPE were reviewed by other utility personnel and consultants.

It is not clear if the licensee plans to maintain a "living" PRA. E.3 Front-End Analysis The methodology chosen for the Palisades IPE front-end analysis was a Level 1 PRA. The specific technique used for the Level 1 PRA was a small event tree/large fault tree technique with fault tree linking. The Cutset and Fault Tree Analysis (CAFTA) and Set Equation Transformation System (SETS) codes were used to perform the front-end analysis.

[pp. 2.1-38, 2.1-39 of submittal]

Core damage is defined as sustained core uncovery (approximately 45-120 minutes) due to the unavailability of a specific critical function.

The licensee does not explicitly 2

• *

• list the bases for the success criteria used in the IPE, though several internal memos on success criteria are referenced in the submittal.

The IPE quantified 20 initiating events exclusive of internal flooding:

five loss of coolant accidents (LOCAs), including steam generator tube rupture (SGTR) and interfacing system LOCA (ISLOCA);

ten generic transients, including loss of offsite power (LOSP) and main steam line breaks; and four plant-specific initiating events representing loss of support systems. The IPE used both plant-specific and generic data to quantify initiating events and mitigating system failure events. The binomial failure rate (BFR) and multiple Greek letter (MGL) methods were used to model common cause failures.

The IPE also included an analysis of internal flooding.

The total point estimate of CDF at Palisades is 5.1 E-05/yr, exclusive of flooding.

The point estimate flooding contribution to the CDF is 3.0E-07/yr.

The internal initiating events that contribute most to the non-flooding related CDF and their percent contribution are listed below: small break LOCA LOSP transient w/main condensate available loss of service water SGTR loss of a DC bus loss of instrument air all other transients all other LOCAs (medium, large, ISLOCA) 29.4% 25.5% 15.5% 7.3% 5.1% 5.1% 4.3% 6.3%" 1.5%

• The contributions to non-flooding related CDF by accident category are as follows: small LOCA (no SI injection or no SI recirculation) transient (no PORV or no SI) station blackout LOSP or loss of service water Anticipated Transient without Scram (A TWS) LOCA (no recirculation)

SGTR transient (no recirculation) 22.0% 18.6% 17.8% 13.4% 8.5% 5.8% 4.8% The interfacing between the Level 1 and Level 2 portions of the IPE was accomplished with the use of plant damage states (PDSs) . 3 4.4%

• *

• Based on this review, the following aspects of the IPE modeling process have an impact on the overall CDF:

• Loss of external cooling to the RCP seals will not result in a LOCA.

• A large LOCA can be mitigated without LPSI pumps (flow from 3 accumulators and 1 HPSI pump was assumed to be sufficient);

no technical basis for this assumption was provided.

• The ECCS pumps will not cavitate when drawing suction from a saturated sump. AU three of the above aspects of the modelin*g process tend to lower the CDF. E.4 Generic Issues The IPE addressed unresolved safety issue (USI) A-45, "Shutdown Decay Heat Removal (OHR) Requirements." The results of the licensee's analysis showed that the total CDF related to failure of OHR is 3.0E-05/yr.

The licensee states that there were no unexpected results identified from this analysis.

No OHR-related vulnerabilities were identified in the IPE. The JPE does not address any other USls or generic safety issues (GSls) . E.5 Vulnerabilities and Plant Improvements The licensee used the following questions to determine if any vulnerabilities exist:

• Do the Palisades IPE results meet the NRC's safety goal for core damage?

• Are the results for core damage sequences or containment performance consistent with other PRAs?

• Does the probability of sequences characterized as having large releases exceed 10% of the core damage frequency?

Based on the above criteria, the licensee concluded that there are no vulnerabilities at Palisades.

The submittal states that several corrective actions were considered to reduce the probability of core melt. However, only the two actions are specifically described: (a) installation of a new switchyard transformer, and (b) evaluation of means to provide additional methods for makeup to the safety injection refueling water tank (SIRWT) or primary coolant system following an ISLOCA or SGTR. The installation of a new 4

• *

• switchyard transformer has been completed, and reduces the frequency of LOSP events at the plant. Credit for the new switchyard transformer was taken in the IPE analysis.

The submittal states that evaluation of additional means for makeup to the SIRWT and primary coolant system will be continually reviewed.

However, the submittal states that no further plant modifications are currently planned. E.6 Observations The licensee appears to have analyzed the design and operations of Palisades to discover instances of particular vulnerability to core damage. The licensee has developed an overall appreciation of severe accident behavior, understands the most likely severe accidents at Palisades, has gained a quantitative understanding of the overall frequency of core damage, and has implemented changes to the plant to help prevent and mitigate severe accidents.

Strengths of the IPE are as follows: Plant-specific data were used where possible to support the quantification of initiating events and component unavailabilities.

No major weaknesses of the IPE were identified.

However, the IPE currently does not address the possibility of an ISLOCA caused by leakage of primary coolant into the component cooling water (CCW) system via a RCP thermal barrier heat exchanger failure. The licensee states that a study of this accident type is ongoing and will be completed in October 1995: Significant level-one IPE findings are as follows:

• The station blackout contribution (17.8% CDF) is smaller than at some other PWRs due to the IPE assumption that RCP seal LOCAs will not occur following loss of external RCP seal cooling . 5 I

• *

• 1. INTRODUCTION

1.1 Review

Process This report summarizes the results of our review of the front-end portion of the IPE for Palisades.

This review is based on information contained in the IPE submittal

[IPE Submittal]

along with the licensee's responses to the NRC's request for additional information (RAI). The licensee addressed RAI material via two separate transmittals.

The first transmittal

[IPE Responses

-First Set] contained the licensee's responses to an original set of information requests.

The second transmittal

[IPE Responses

-Second Set] contains the licensee's responses to a second round of questions, some of which are related to a rnagnostic Evaluation Team (DET) review [DET Review Findings].

1.2 Plant

Characterization Palisades is a single unit, two-loop CE P\NR. The turbine generator was supplied by Westinghouse Electric Corporation.

Plant engineering and construction was provided by Bechtel Power Corporation.

Construction was started on August 25, 1966, and the unit became operational on December 31, 1971. The Palisades plant is rated at 2,560 MWt and 845 MWe. The plant is located on Lake Michigan, 6 miles south of New Haven, Michigan.

The Palisades plant is similar to Calvert Cliffs Units 1 and 2. Design features at Palisades that impact the CDF relative to other PWRs are as follows: [p. 5.0-1 of submittal]

• * *

• Increased PORV capability.

The PORVs were replaced in 1990 to provide increased relief capacity.

Each of the new PORVs can independently provide the required relief capacity needed to support for feed and bleed. This design feature tends to lower the CDF. [p. B-13 of submittalJ Operation with PORV block valves dosed. The plant normally operates with the PORV block valves kept closed. The submittal states that an overall reduction of risk was achieved with this configuration based on results from a sensitivity analysis.

Automatic switchover of ECCS from injection to recirculation.

This design feature tends to decrease the CDF over what it would otherwise be with a manual system. [p. 2.1-33 of submittaij 6

• ** *

• Nitrogen backup systems. A select set of important plant equipment has been provided with nitrogen backup stations to enable continued operation in the event of loss of normal air. This design feature tends to decrease the CDF.

• Switchyard power connections.

The Palisades switchyard is supplied by several 345kV lines. Any one of these power lines can provide the required power to either or both of the front or rear 345 Kv switchyard buses. This design feature tends to decrease the CDF. [p. 2.1-21 of submittal]

• Independence of HPSI pumps from LSPI pumps during recirculation.

The HPSI pumps do not require "piggy-back" suction from the LPSI (or residual heat removal) pumps for operation during recirculation.

This design feature tends to decrease the CDF.

• Potential single failure of HPSI system. The HPSI system contains two pump minimum flow recirculation valves arranged in series. If either of these valves is closed when the HPSI pumps are started, the HPSI pumps will dead head against the primary cooiant system pressuie and quickly (within 5 minutes) suffer severe damage. The licensee considers this HPSI failure mode a passive failure (and not a vulnerability), as surveillance and testing is done to verify that the valves remain open. This design feature tends to increase the CDF. [p. 5.0-4 of submittal]

• Containment air coolers. The four containment air coolers provide a method of containment cooling that is independent of the containment spray system. This design feature tends to decrease the CDF .. [p. 2.1-8 of submittal]

7

• *

• 2. TECHNICAL REVIEW 2.1 Licensee's IPE Process We reviewed the process used by the licensee with respect to: completeness and methodology; multi-unit effects and as-built, as-operated status; and licensee participation and peer review. 2.1.1 Completeness and Methodology.

The Palisades IPE submittal is complete with respect to the type of information and level of detail requested in NUREG-1335.

The front-end portion of the IPE is a Level 1 PRA. The specific technique used for the Level 1 PRA was a small event tree/large fault tree technique with fault tree linking. The CAFT A and SETS codes were used to perform the front-end analysis.

{pp. 2.1-38, 2.1-39 of submittal]

Internal initiating events and internal flooding were considered in the analysis.

Event trees were developed for all classes of initiating events. lntersystem dependencies were discussed and tables of system dependencies were provided.

Data for quantification of the models are provided, including common cause events and human errors. The application of the technique for modeling internal flooding is described in the submittal.

However, no sensitivity analyses are described in the submittal.

2.1.2 Multi-Unit Effects and As-Built.

As-Operated Status. The Palisades plant is a single-unit site; therefore, multi-unit considerations do not apply. Discussions presented in various sections of the submittal reveal that a number of actions were taken to ensure that the IPE models the as-built, as-operated plant. These actions include the following:

• Watkdowns were used to obtain the latest and most accurate information with regard to the as-built configuration of the plant. During the walkdowns, particular attention was given to the development of the human reliability analysis (HRA). IP-1.0-3 of submittal]

Wide use was made of plant-specific data to develop initiating event frequencies and component unavailabilities . 8 --,

• * *

• Licensee staff were heavily involved in the IPE analysis . In our judgment, the IPE models represent the as-built, as-operated plant. The analysis accounts for all modifications installed before July 1, 1992. [p. _ 1.0-3 of submittal]

Finally, it is not clear if the licensee plans to maintain a "living" PRA. 2.1.3 Licensee Participation and Peer Review. The majority of the Palisades IPE was prepared by the PRA Group at Palisades.

The PRA Group was established in 1983, and consists of utility staff. Consulting services for the front-end portion of the IPE were provided by TENERA, L. P., and ABB lmpell. The Palisades PRA Group provided plant knowledge, while the consultants provided general direction and methodology guidance.

The Palisades PRA Group created and quantified the fault and event tree models for both the front-end and back-end analyses.

In addition, the PRA Group was involved in the identification of failure data, the development and evaluation of human error models, and the identification of system dependencies.

[p. 4.0-1 of submittal]

The PRA study was reviewed by several experienced utility staff in addition to a formal independent review team. The independent review team for the front-end review was led by plant safety engineering group at Palisades.

Reportedly, this group of individuals has considerable expertise in the review and approval of 1 OCFR50.59 issues. The review included an evaluation of event trees and system success criteria.

In addition, consultants were used to independently review the IPE methodology to ensure that it is consistent with accepted PRA methodologies and techniques.

Apparently, the IPE was also reviewed by several other experienced utility staff for consistency and accuracy.

[pp. 4.0-1, 4.0-2 of submittal]

Important findings from the review process were provided by the licensee.

In particular, the review process identified the lack of an operator action to initiate feed and bleed cooling in the event all secondary cooling is lost.

• The cutsets were subsequently modified to account for an operator error related to feed and bleed. The review of the event tree success criteria resulted in a recommendation that further evaluation be given to the possibility that 3 charging pumps could successfully mitigate or delay core damage in small LOCA sequences.

The success criteria for the event trees was not refined to the extent necessary to consider this recommendation.

The review also questioned the need for heating, ventilating, and air conditioning (HVAC) in the battery rooms. The PRA models had included HVAC under an assumption that HVAC was necessary to prevent a hydrogen accumulation in the room. However, this HVAC requirement was subsequently eliminated after it was determined that hydrogen build-up would only represent an item of potential significance when the batteries undergo an equalizing charge after a discharge test 9 .1

• *

• that is conducted only during refueling outages. Finally, the draft version of the IPE included a definition of vulnerability that attempted to define the concept in terms of "major and "minor characteristics.

The vulnerability definition subsequently used in the IPE is discussed in Section 2.7.2 of our review. [IPE Responses

-First Set] 2.2 Accident Sequence Delineation and System Analysis This section of the report documents our review of both the accident sequence delineation and the evaluation of system performance and system dependencies provided in the submittal.

2.2.1 Initiating

Events. The identification of initiating events included reviews of PRAs on other plants and several pertinent studies (for example, NUREG/CR-2300).

Palisades historical operating data were also reviewed.

A complete list of initiating events modeled for the Palisades analysis is provided in Table 2.2-2 of the submittal.

This list of initiating events contains:

five LOCAs, including SGTR and 1SLOCA; ten generic transients, including LOSP and main steam line breaks; and four plant-specific initiating events. The four prant-specific initiating events represent loss of service water, loss of instrument air, loss of a DC bus, and loss of a 2,400 or 4, 160 AC bus. Component cooling water (CCW) and loss of HVAC were omitted from the set of IPE initiating events. The licensee stated that loss of CCW should have been included in the IPE as an initiating event. This omission was recognized shortly after the IPE submittal was transmitted to the NRC. Based on a subsequent analysis by the licensee, it was determined that the inclusion of CCW *loss as an initiating event would increase the CDF by less than 2.0E-07/yr, or less than 0.4% of the CDF. With regard to loss of HVAC, the licensee stated that there were no cases identified in which a loss of normal HVAC operation would result in a plant trip or conditions that would necessitate an immediate plant shutdown.

In each case there would either be no significant impact from loss of HVAC (except possible Limiting Condition for Operation situations) or there would be a substantial amount of time for operator intervention to alleviate the condition.

[IPE Responses

-First Set] Unlike some other PWR IPE studies, the Palisades IPE assumed that loss of external cooling to the RCP seals would not result in an RCP seal LOCA. The licensee presented information stating that leakage experience with Westinghouse seals is not applicable to the Byron Jackson RCPs used at Palisades because of design differences.

The licensee also cites Combustion Owners' Group (CEOG) studies that indicate the Byron Jackson seals will not develop leak rates much beyond the leak rates already designed into the seals. [pp. 2.2-9, 2.2-10 of submittal]

10

• Wherever possible, the licensee used plant-specific data to derive initiating event frequencies.

Generic data were used in cases where no plant-specific data were available, including LOCAs. With the exception of the LOSP initiating event, the frequencies used in the IPE were judged to be consistent with other IPE/PRA studies. The value for the LOSP initiating event (0.03/yr) is in the lower range of data typically used in other IPE/PRA studies. However, it is our judgment that this frequency is representative of the plant-specific features at Palisades.

Our judgment is based on features of the Palisades normal power distribution system described below. A major modification to the switchyard was completed during August 1990. The previous plant history of LOSP events (0.21/yr) was determined by the licensee to be too high and a modification was undertaken to improve the reliability of the offsite power source. This modification involved the addition of a new 2,400 VAC safeguards transformer in the switchyard.

As part of this project, the connection from the new transformer to the plant was made via buried cable to reduce the impact of local weather events. Also, an alteration to the plant operating configuration via the new transformer was made. Under the new configuration, the source of power both before and after a plant tiip is the safeguards transformer so that no active failures (i.e. breaker operations) occur and no interruption of power is associated with the primary power source. A previous licensee PRA analysis of offsite power had demonstrated that approximately 50% of the unreliability of offsite power was associated with potential active failures resulting from transfer operations in the old configuration

[IPE Responses

-First Set]. The licensee also noted that the Palisades switchyard has 6 lines connected to the Consumers Power Co. transmission grid. In addition, there are 2 separate lines connecting the plant to the Indiana/Michigan transmission grid (and the DC Cook plant). [IPE Responses

-First Set] 2.2.2 Event Trees. The Parisades IPE used functional event trees. Separate event trees were developed for: small LOCA, medium LOCA, large LOCA, SGTR, transient, A TWS, and ISLOCA. The event trees were configured to model functional requirements for mitigating specific initiating events through the use of event tree top logic. The IPE used a single "Transient" event tree to model eight different initiators, ranging from miscellaneous reactor trips to LOSP. The use of a single transient event tree requires care in the development and application of the event tree top logic and mitigating system fault trees. However, it is our judgment that the licensee has properly used the single transient event tree to account for the plant response to the various transient initiating events. [IPE Responses

-First Set] As previously noted in Section 2.2.1 of this report, the IPE assumed that loss of external cooling to the RCP seals would not result in an RCP seal LOCA. [pp. 2.2-9, 2.2-10, 3.5-142, 3.5-143 of submittal]

11

• Core damage is defined in the IPE as sustained core uncovery (approximately 45-120 minutes) due to the unavailability of a specific critical function.

Core damage was assumed to occur any time the core was uncovered for an extended period of time, and it was expected that core damage would occur given that critical equipment was not restored to service. Because no credit was taken for the restoration and/or repair of failed equipment (except recovery of offsite power), there was no need to determine the precise timing of core damage. The IPE has taken no credit with respect to CDF for conditions in which core damage was initiated but arrested in the vessel. [IPE Responses

-First Set] The IPE assumes that low pressure safety injection (LPSI) is not necessarily required to mitigate a large LOCA. Rather, the analysis assumes that successful core reflood can be accomplished with injection from 3 safety injection tanks (accumulators) and a high head safety injection (HPSI) pump. This assumption represents a significant deviation from the Updated Final Safety Analysis Report (UFSAR). Also, the HPSI pumps have a much lower capacity than the LPSI pumps, which can significantly affect the ability to refill and reflood the core in time to prevent core damage. The licensee has not piOvided the basis used for the !PE assumption that LPSI is not required following a large LOCA. [IPE Responses

-First Set] Information Notice 89-54, "Potential Overpressurization of the Component Cooling Water System" [IN 89 54], discussed a postulated accident scenario in which leakage of reactor coolant could occur into the CCW system via failure of the RCP heat exchanger.

This scenario dominated the risk profile at another Combustion Engineering plant. No mention of this accident scenario was made in the Palisades IPE submittal.

However, the licensee did acknowledge that a previous evaluation of Information Notice 89-54 has been re-opened.

It was* determined from a review of previous work that two conflicting analyses were not resolved.

In the original Palisades evaluation, it was determined that under certain conditions, 10 CFR 100 limits would be exceeded.

This evaluation assumed that operators would immediately attempt to isolate the CCW flow to containment.

However, given isolation, a portion of piping outside containment could fail, and 10 CFR 100 limits could be exceeded.

Preliminary results from a subsequent PRA analysis indicated that as long as the operators did not immediately isolate containment, the CCW system was not likely to depressurize.

The licensee's re-evaluation to resolve these conflicting analyses will include a better understanding of operator diagnosis and response, as well as an evaluation of the capability of the isolation valves. The licensee's re-evaluation of this potential ISLOCA is scheduled for completion by October 1995. [IPE Responses

-Second Set] The Safety Evaluation Report (SER) related to operation of the Palisades plant [NUREG 1424] indicated that the results of Generic Letter 89-19, which related to steam generator overfill, would be addressed in the Palisades IPE. However, the submittal does not address this topic. At the time of the SER, the Combustion 12

• *

• Engineering Owners Group (CEOG) had submitted material to the NRC pertinent to Generic Letter 89-19. This CEOG submittal took exception to several values used in the regulatory analysis to establish the cost/benefit developed to support the regulatory position.

It had been anticipated that the NRC response to the CEOG submittal would be received in a time frame that would allow incorporation of the results into the Palisades IPE submittal.

However, the final response was not received until September, 1994. The NRC's response provides general concurrence with the overall position of the CEOG that steam generator overfill protection is not required for CE plants provided that plants can (1) demonstrate that the plant-specific analysis is consistent with and bounded by the CEOG analysis, and (2) that training and procedure requirements related to small LOCAs have been met. A plant-specific analysis performed on the Palisades plant indicates that a modification is not beneficial.

An updated analysis pertinent to the SER was to have been submitted to the NRC by January 31, 1995. [IPE Responses

-Second Set] A judgment related to the adequacy of the licensee's response with regard to steam generator overfill can only be made by reviewing the licensee's updated analysis.

Our review did not include an evaluation of the licensee's updated steam generator overfill analysis.

However, based on results from other PWR !PE/PRA studies, we would exped steam generator overfill events at Palisades to represent only a small portion of the overall CDF. Finally, it is noted that a review was made of the structure and assumptions relatellt to other event trees. We have the following points related to the following event trees:

• Large Break LOCA CLBLOCA) Event Tree. The LBLOCA event tree was used primarily to model breaks >18" in the primary piping. The event tree or accident description does not address a requirement for hot leg injection.

It is possible that boron from the SIRW tank could precipitate in the core, with a detrimental effect on heat transfer.

This situation can be avoided by hot leg injection.

It is not clear whether the analysis addressed this consideration.

• Medium Break LOCA CMBLOCA) Event Tree. As noted above for the Large Break LOCA event, tree, it is not clear whether the analysis included a requirement for hot leg injection.

2.2.3 Systems

Analysis.

The front-line systems analyzed in detail in the IPE are listed below: [p. 2.1-42 of submittal]

Auxiliary Feed Water (AFW) System Condensate Pumps Main Feed Water Valves Atmospheric Dump System 13

• * * ----------------------------

Pressurizer PORVs HPSI LPSI Chemical and Volume Control System (CVCS) Containment Spray System Containment Air Coolers In addition, the IPE analyzed 18 support systems, including:

instrument air, component cooling water, service water, electrical power, and ventilation.

For each of the front line and support systems, the IPE submittal presented a brief system description, including system operation, success criteria, modeling assumptions and the schematics.

[p. 2.1-43 of submittal]

From our review, we concluded that Palisades IPE analyzed all the important line and support systems required for prevention of core damage. The IPE submittal does not provide enough detail to determine what diesel generator coping time is available, given the fuel in the day tank, in compaiison with what is actually needed to mitigate severe accidents.

A recent NRC staff report indicated that the day tank coping time is actually less than that originally estimated in the UFSAR. At the time the IPE was performed, the IPE was consistent with a plant analysis that indicated the diesels were capable of operating for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without makeup to the day tanks. Subsequently, it was determined that the effect of added loads to the 2,400 VAC safety buses and other conditions have reduced the coping time of the diesels to approximately 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> with the diesel attached tank and day tank inventories.

At 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, the probability of failure to recover offsite power is expected to be on the order of 1.0E-05. The probability of failure to transfer fuel is expected to be on the order of 1.0E-02 to 1.0E-03. Consequently, the combined probability of insufficient diesel fuel is not expected to appreciably impact the current estimated CDF. The most likely failure of onsite power would remain the diesel generators, as opposed to fuel unavailability.

The analysis models will be modified during Revision 3 of the PRA. [IPE Responses

-Second Set] 2.2.4 System Dependencies.

Dependency matrices are provided in Tables 2.1-4, 2.1-5, and 2.1-6 of the submittal.

These figures display, respectively, the following dependency relationships:

[pp. 2.1-45 to 2.1-63 of submittal]

• *

• support system to front-line system -support system to support system initiating event to front-line system 14

• Depending on the type of the system, related dependencies covered areas such as power supply and control power, actuation, cooling water, and related operator actions. From our review, it is concluded that the IPE accounted for all system dependencies.

2.3 Quantitative

Process This section of the report summarizes our review of the process by which the IPE quantified core damage accident sequences.

It also summarizes our review of the data base, including consideration given to plant-specific data, in the IPE. The uncertainty and/or sensitivity analyses that were performed were also reviewed.

2.3.1 Quantification

of Accident Sequence Frequencies.

The methodology chosen for the Palisades IPE front-end analysis was a Level 1 PRA. The specific technique used for the Level 1 PRA was a small event tree/large fault tree technique with fault tree linking. The CAFTA and SETS codes were used to perform the front-end analysis.

A post-accident mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was used. [pp. 2.1-38, 2.1-39, 2.3-6 of submittal]

A truncation value at or below 1.0E-09/yr was applied to the accident sequence cut sets. Fm event tree sequences whose initiating events had a relatively low frequency of occurrence (i.e., LOCAs), a truncation value below 1.0E-09/yr was used to ensure the validity of the identified sequence frequencies.

[p. 2.3-31 of submittal]

The Palisades IPE took credit for recovery for two actions that would enhance the plant response following a LOSP initiating event. These actions were (1) recovery of 2,400 VAC power during a station blackout, and (2) recovery of a charging source for station batteries during a station blackout.

[pp. 2.3-6 to 2.3-8 of submittal]

2.3.2 Point

Estimates and Uncertainty/Sensitivity Analyses.

The submittal does not specify the statistical significance (mean, median, etc.) of the data used for initiating events, component unavailabilities, or human errors. The CDF results are presented in the form of point estimates.

It is also noted that the IPE submittal does not include any uncertainty or sensitivity analyses.

Fussel-Vesely, risk achievement worth, and risk reduction worth importance measures were generated for components contained in the accident sequence cut sets. 2.3.3 Use of Plant-Specific Data. The licensee compiled a list of plant specific failure data based on Palisades experience over the period from January 1, 1973 to June 30, 1992. Plant specific data for initiators were derived and used based on outage information for all the high 15

• frequency' transients.

However, for those transients for which plant specific data are not recordled at Palisades, industry standard generic data were used. Plant-speclfic component failure data were gathered from a number of pertinent sources, iimcluding maintenance orders, control room log books, event reports, unusual irncident reports, abnormal occurrence reports, outage reports, and shift supervisatr log books. These sources were reviewed to identify past incidences of componernl failures that could be grouped as failure for number of demands (for demand diata) and failure events during a specific time period (for standby and operationa1 data). Information gathered included number of times and length of times componemts were removed for maintenance and testing, which was then used to derive testt .and maintenance and unavailabilities.

[pp. 2.3-4, of submittal]

Plant-speciific data were gathered for a number of *components, including:

batteries, battery DC buses, AC buses, circuit breakers, transformers, diesel generators, air compressors, pumps, check valves, main steam isolation valves (MSIVs), air operated valves (AOVs), motor operated valves (MOVs), atmospheric dump valves (ADVs}, and containment cooling fans.. The statistical form of the data (mean, median, etc.) is not identified.

[pp. 2.3-41 to 2.3-43 of submittal]

Table 2-1 cf this review compares plant-specific failure data for selected components from the IP.E to values typically used in PRA and IPE studies, using the NUREG/CR-4550 data 1br ,comparison

[NU REG/CR 4550, Methodology].

The plant-specific data were ideniified through inspection of Table 2.3-5 of the submittal.

[pp.2.3-41 to 2.3-43 of submittaij In reviewirn_g the comparison of data in Table 2-1, it is *noted that the plant and NUREG/CR-4550 data are generally comparable, with some exceptions.

For example, plant-specific run failure probabilities for the AFW pumps are an order of magnitude lower than corresponding NUREG/CR-4550 data. On the other hand, the plant-specific failure of a motor-driven AFW pump to start is an order of magnitude higher than the NUREG/CR-4550 data. 2.3.4 Use of Generic Data. Generic data were used to estimate initiator frequency for low frequency initiating events. Generic data were also used to support the development of component unavailabilities.

A number of data sources were used to develop the Palisades generic data base, including:

[IEEE 500], [PLG 500], [WASH 1400], and [NUREG/CR 2728]. A !list of generic component failure data is provided in Table 2.3-4 of the submittal.

The statistical form of the data (mean, median, etc.) is not identified.

It appears that .generic data were only used in cases were plant-specific data were not available. (pp. 2.3-39, 2.3-40 of submittal]

16

• Table 2-1. Plant-Specific Component Failure Data Component Submittal Estimate NUREG/CR 4550 Mean Value Estimate Pump -Turbine Driven AFW 3.0E-02 Fail to Start 3E-02 Fail to Start 3.SE-04 Fail to Run 5E-03 Fail to Run Pump -Motor Driven AFW 1.5E-02 Fail to Start 3E-03 Fail to Start 2.6E-04 Fail to Run 3E-05 Fail to Run HPSIPump 5.5E-03 Fail to Start 3E-03 Fail to Start 8.6E-06 Fail to Run 3E-05 Fail to Run LPSIPump 9.2E-04 Fail to Start 3E-03 Fail to Start 3.5E-05 Fail to Run 3E-05 Fail to Run Service Water Pump 3.5E-03 Fail to Start 3E-03 Fail to Start 2.9E-06 Fail to Run 3E-05 Fail to Run Battery 2.6E-06 Fail to Function 1 E-06 (unspecified mode) Battery Charger 1.3E-06 Fail to Function 1 Fail to Operate Diesel Generator No. 1-1 6.1 E-03 Fail to Start 3E-02 Fail to Start 2.SE-03 Fail to Run 2E-03 Fail to Run Diesel Generator No. 1-2 8.1 E-03 Fail to Start 3E-02 Fail to Start 1.2E-03 Fail to Run 2E-03 Fail to Run Notes: (1) Failures to start, open, close, operate, or transfer are probabilities of failure on demand. The other failures represent frequencies expressed per hour. We performed a comparison of IPE generic data to generic values used in the NUREG/CR-4550 studies [NUREG/CR 4550, Methodology].

This comparison is summarized in Table 2-2. [pp. 2.3-39, 2.3-40 of submittaij 17

• It can be seen from Table 2-2 that the licensee's generic data for the listed components is generally consistent with data contained in NUREG/CR-4550.

Table 2-2. Generic Component Failure Data Component Submittal Estimate NUREG/CR 4550 Mean Value Estimate Pressurizer PORV 4.3E-03 Fail to Open 2E-03 Fail to Open Solenoid Operated Valve 1E-03 Fail to Open or 2E-03 Fail to Operate Close Damper 3E-03 Fail to Open 3E-03 Fail to Open Transformer (4 KV and 1.6E-06/hr 2E-06/hr above) Temperature Switch 1 E-04 Fails to Change 1 E-04 Failure to Transfer State on Demand Transmitter 6.2E-06 Flow Trans. Fail 1 E-06 Failure to Operate to Function 1.6E-05/hr Level Trans. Fail to Function 7.6E-06/hr Pressure Trans. Fail to Function Notes: (1) Failures to start, open, close, operate, or transfer are probabilities of failure on demand. The other failures represent frequencies expressed per hour. 2.3.5 Common-Cause Quantification.

The Binomial Failure Rate (BFR) was initially used for common cause event quantification in the original Palisades PRA, though more recent updates of common cause data were performed with Multiple Greek Letter (MGL) method. The IPE models apparently contain a mixture of BFR and MGL data. The MGL analysis was performed in accordance with the methodology presented in a commonly used document [NUREG/CR 4780]. Use was also made of a Pickard, Lowe and Garrick (PLG) common cause data base [PLG 500]. Common cause events were combined into the fault tree models. [p. 2.3-25 of submittal, p. 17 of Licensee Responses

-First Set] 18

• *

• Table 2.3-9 of the submittal lists the components evaluated for the common cause analysis.

These components include: pumps, AOVs, check valves, MOVs, PORVs, diesel generators, air compressors, circuit breakers, relays, switches, and transmitters.

The selection of components included in the common cause analysis appears consistent with other IPE/PRA studies. To identify components for consideration in the common cause analysis, groupings of the major equipment necessary for a given system to complete its function(s) were identified.

The failure of each grouping of equipment was represented by common cause events based on the critical components necessary to the success of the function.

For example, in the case of a cooling water system, the pumping function was represented by common cause failure of the pump trains. In turn, common cause failure of the pump trains was represented by common cause failures of the pumps, flow valves, and flow control instrumentation.

Common cause events were created for each failure mode of a critical component, for example the start and run functions of a pump. [IPE Responses

-First Set] Table 2.3-9 of the submittal lists MGL parameters for components included in the common cause analysis.

For most of the components, a set of beta, gamma, and delta parameters is provided.

In other words, the MGL data presented in Table 2.3-9 of the submittal are based on a group size of four components.

We note that some of the component groups listed in Table 2.3-9 of the submittal consist of less than four components.

For example, there *are only 2 diesel generators at the plant, whereas the MGL data presented in the submittal are based on a set of 4 diesel generators.

In general, MGL data are generated for a specific group size, and the individual parameters are not applicable to other group sizes. It is not clear what MGL data were applied to groups that did not contain *exactly four components.

However, it would be less optimistic to apply MGL parameters for a group of M components to a group size of N components, where M is greater than N. For example, it would be less optimistic to use the beta factor appropriate for a group of four diesel generators to estimate the failure of the two Palisades diesel generators.

Without additional information from the licensee, it is not possible to determine with certainty the application of MGL data to groups that did not contain exactly four components.

Finally, we note that the MGL data for group sizes of 4 components listed in Table 2.3-9 of the submittal appear to be generally consistent with comparable data used in other PRA and IPE studies. 2.4 Interface Issues This section of the report summarizes our review of the interfaces between the end and back-end analyses, and the interfaces between the front-end and human factors analyses.

The focus of the review was on significant interfaces that affect the ability to prevent core damage . 19

---

-

• 2.4.1 Front-End and Back-End Interfaces . The IPE assigned PDS bins to. couple the front and back-end portions of the analysis.

A PDS Bridge Tree was used to sort the core damage event tree into PDSs. The PDS bridge tree accounted for the following conditions, which were judged to be consistent with other IPE/PRA studies: [p. 3.3-13 of submittal]

• AFW available to both steam generators

• CSS available in injection mode

• CSS available in recirculation mode

• One PORV available for depressurization

• SIRWT water is in containment

• Containment air coolers available

• Safety injection available after vessel failure The PDS quantification results are summarized in Table 3.3.8-2 and 3.3.8-3 of the submittal.

These tables more than 140 possible PDSs. This set of PDSs was collapsed to define 18 dominant PDSs that are iisted in Tabie 3.3.8-5 of the submittal.

The total CDF represented by these dominant PDSs is more than 99% of the total CDF. Based on the review of the PDS portion of the IPE analysis, we made the following observations:

[p. 3.3-29 of submittal]

• * * *

• Important Level 1 sequences were retained in the back-end analysis . The analysis identified two accident scenarios that lead to containment pass: ISLOCA (V-sequences), and SGTR and pressure relief of ruptured SG using ADVs. Both sequences were explicitly handled in defining the PDS. The PDS analysis did not address failure to isolate the containment, a situation that could result in early containment failure. [p. 3.3-10 of submittal]

The PDS portion of the analysis explicitly considered all important reactor and containment systems. Additional top events were incorporated in PDS event tree to include containment systems and some of the reactor systems. However, none of the PDS events dealt with recovery of power in case of LOSP or any other late recovery actions. The IPE appears to assume that ECCS pumps will not cavitate when drawing suction from a saturated sump. Cavitation is not a consideration in some other plants where the static head afforded by the drop lines from the sump to the pump's suction is large. However, it is not clear if design features at Palisades eliminate the need to consider pump cavitation during sump saturation conditions . 20

• 2.4.2 Human Factors Interfaces . A list of risk-significant human errors is provided in Table 2.3-6 of the submittal.

The most important human errors include: failure to align makeup to the condensate storage tank; miscalibration of all AFW low suction pressure switches; failure to open PORVs and their associated block valves; and failure to align an alternate AFW pump suction source. [p. 2.3-44 of submittal, HRA.12] 2.5 Evaluation of Decay Heat Removal and Other Safety Issues This section of the report summarizes our review of the evaluation of Decay Heat Removal (OHR) provided in the submittal.

Other GSl/USls, if they were addressed in the submittal, were also reviewed.

2.5.1 Examination

of OHR. Appendix B of the submittal addresses OHR. This section summarizes the overall contribution of OHR systems to CDF. identified in this section are important functional requirements, event initiators, dominant contributors and dominant component failures.

The results show that total core damage frequency due to the failure of decay heat removal is 3JOE-05/yr.

The most important initiating events associated with CDF due to OHR failures were LOSP, transient with main condenser available, loss of service water, loss of instrument air, loss of a DC bus, and SGTR. The licensee states that

• there were no unexpected results identified from this analysis.

No OHR-related vulnerabilities were identified in the IPE.

• 2.5.2 Diverse Means of OHR. The IPE took credit for two principal mechanisms for OHR, specifically:

1) secondary cooling whidh *utilizes the steam generators as the heat sink for decay heat, and 2) once-through (feed and bleed) cooling via the primary system. The systems required to accomplish these functions were explicitly identified and modeled in the IPE. The two primary failure modes that lead to failure of secondary cooling are: 1) station blackout wirh the subsequent failure of turbine driven AFW Pump P-8B, and 2) the late failure of AFW pump due to the inability to provide or align a makeup source for the depleted condensate storage tank. The major contributor to the unavailability of high pressure injection during once-through cooling is due to station blackout.

Major contributors to the unavailability of high pressure injection in the recirculation mode during once-through cooling are: 1) combinations of random failures of HPSI pumps, random failures of sump outlet valves (CV-3029/CV-3030) and loss of a DC Bus; 2) failures of the service water system; and 3) the unavailability of 2400V Bus 1 D and 21

• *

• random failures of the West Engineered Safeguards sump outlet valve {CV-3030) . [pp. 8-3, 8-4 of submittal]

As previously noted in Section 2.2.2 of this review, the IPE assumed that loss of external cooling to the RCP seals would not result in an RCP seal LOCA. Also, as previously noted in Section 2.4.1 of this review, the IPE appears to assume that ECCS pumps will not cavitate when drawing suction from a saturated sump. 2.5:3 Unique Features of OHR. The unique features at Palisades that diredfy impact the ability to provide OHR are as follows:

• Increased PORV capability.

The PORVs were replaced in 1990 to provide increased relief capacity.

Each of the new PORVs can independently provide the required relief capacity needed to support for feed and bleed. This design feature tends to lower the CDF. [p. B-13 of submittal]

• Operation with PORV block valves closed. The plant normally operates with the PORV block valves kept closed. The submittal states that an overall reduction of risk was achieved with this configuration based on results from a sensitivity analysis . * * *

• Automatic switchover of ECCS from injection to recirculation.

This design feature tends to decrease the CDF over what it would otherwise be with a manual system. [p. 2.1-33 of submittaij Independence of HPSI pumps from LSPI pumps during recirculation.

The HPSI pumps do not require "piggy-back" suction from the LPSI {or RHR) pumps for operation during recirculation.

This design feature tends to decrease the CDF. Potential single failure of HPSI system. The HPSI system contains two pump

• minimum flow recirculation valves arranged in series. If either of these valves is closed when the HPSI pumps are started, the HPSI pumps will dead head against the primary coolant system pressure and quickly (within 5 minutes) suffer severe damage. The licensee considers this HPSI failure mode a passive failure (and not a vulnerability), as surveillance and testing is done to verify that the valves remain open. This design feature tends to increase the CDF. [p. 5.0-4 of submittal]

Containment air coolers. The four containment air coolers provide a method of containment cooling that is independent of the containment spray system. This design feature tends to decrease the CDF. [p. 2.1-8 of submittal]

22

• *

• 2.5.4 Other GSl/USls Addressed in the Submittal.

The IPE does not address USls/GSls other than DHR. 2.6 Internal Flooding This section of the report summarizes our reviews of the process used to model internal flooding and of the results of the analysis of internal flooding.

2.6.1 Internal

Flooding Methodology.

The licensee's internal flooding analysis is described in Appendix A of the submittal.

As part of the flooding analysis, plant walkdowns were conducted with the special purpose of identifying possible flood zones and associated flood sources. From these walkdowns, flood zones were determined.

Subsequently, each flood zone was reviewed for potential flood or spray sources. The review of areas included identification of curbs that protect equipment, the water-tight integrity of equipment, arid any other mechanisms that may prevent loss of equipment.

Consideration was also given to flood alarms, drain paths, and any other mechanism which would either prevent flooding or alert the operators to a flood. Each flood zone was inspected to identify equipment that, if degraded or faulted, would cause either an automatic or manual plant transient or a reactor trip . The plant response to a flooding-initiated event was analyzed with the transient event tree. The quantification process was carried out in two steps. An initial evaluation was done that made a gross assumption that all equipment in a given flood zone is unavailable, i.e., fault tree basic events for systems in *the flood zone were assigned basic event failure probability of 1.0. The accident sequence analysis was then generated to obtain a very conservative estimate of CDF for each flood zone. Additional analyses were carried out when this CDF exceeded 1.0E-7 /yr. [pp. a-4, a-5 of submittal]

2.6.2 Internal

Flooding Results. The analysis considered effects from both spray and direct flooding of equipment.

The results of the analysis showed that the total contribution to CDF from internal flooding is 3.0E-7/yr.

The dominant flooding-related sequence involves the failure of a portion of SIRWf supply piping that is routed in the component cooling room. Table 2-3 below lists the results from the flooding analysis.

[p. a-1 of submittal]

23

• *

• Table 2-3. Internal Flooding Analysis Results Flood Zone Worst Case Line Failure CDF (per yr) Component Cooling Room SIRW Tank Line Rupture 9.6E-08 Aux. Bldg. Areas ATWS and BAST Line Failure 7.3E-08 West Safeguards Room SIRW Tank Line Failure 3.2E-08 Bus 1C Room Service Water Line Failure 3.0E-08 D.G 1-1 and 1-2 Rooms Fire Protection Line Failure 3.0E-08 Turbine Building Circ. Water Line Failure 6.6E-09 East Safeguards Room SIRW Tank Line Failure 6.3E-09 AFW Feed Pump Room Condensate Line Failure 6.3E-09 Screen House Service Water Line Failure 5.2E-09 Condensate Pump Room Condensate Line Failure 5.2E-09 2.7 Core Damage Sequence Results This section of the report reviews the dominant core damage sequences reported in the submittal.

The reporting of core damage sequences-whether systemic or functional-is reviewed for consistency with the screening criteria of NUREG-1335.

The definition of vulnerability provided in the submittal is reviewed.

Vulnerabilities, enhancements, and plant hardware and procedural modifications, as reported in the submittal, are reviewed . 2.7.1 Dominant Core Damage Sequences.

The IPE utilized event trees that have both functional and systemic headings.

As a result, the results were reported using the screening criteria for systemic sequences as specified in NUREG-1335.

The total point estimate of CDF at Palisades is 5.1 E-05/yr, exclusive of flooding.

The point estimate flooding contribution to the CDF is 3.0E-07/yr.

[pp. 2.4-1, 2.4-2 of submittal]

The contributions to non-flooding related CDF by accident category as obtained from* plant damage state (PDS) categorization data are listed below in Table 2-4. [pp. 1.0-4, 1.0-5, 1.0-10 of submittal]

The internal initiating events that contribute most to the non-flooding related CDF and their percent contribution are listed below in Table 2-5. . [p. 2.4-25 of submittal]

24

• *

• Table 2-4. Accident Types and Their Contribution to Core Damage Frequency Accident Type Percent Contribution to CDF Small LOCA (no SI inj. or recirc.) 22.0 Transient (no PORV or no SI) 18.6 Station Blackout 17.8 LOSP or Loss of Service Water 13.4 ATWS 8.5 LOCA (no recirculation) 5.8 SGTR 4.8 Transient (no recirculation)

4.4 Table

2-5. Initiating Events and Their Contribution to Core Damage Frequency Initiating Event CDF Contribution I % Cont. yr. to CDF Small Break LOCA 1.SE-05 29.4 LOSP 1.3E-05 25.5 Transient with Main Condenser Available 7.9E-06 15.5 Loss of Service Water SGTR 2.6E-06 5.1 Loss of a DC Bus 2.6E-06 5.1 Loss of Instrument Air 2.2E-06 4.3 All Other Transients 3.2E-06 6.3 All Other LOCAs (medium, large, ISLOCA) 7.9E-07 1.5 Section 1.3.1 of the submittal lists seven dominant core damage sequences.

These dominant sequences are listed below in Table 2-6. [pp. 1.0-3, 1.0-4 of submittal]

25

• *

• Table 2-6. Top 7 Dominant Systemic Core Damage Sequences Initiating Event Category

• Dominant Subsequent

°lo Failures in Sequence Contribution to Total CDF Transient (includes LOSP) Failure of secondary cooling and 24 once-through cooling Transient (includes LOSP Failure of secondary cooling, 22 and loss of service water) success of once-through cooling in injection phase, failure of once-through cooling in recirculation phase Small LOCA Failure of high pressure injection in 15 the injection phase Small LOCA Failure of high injection in 14 the recirculation phase Transient (includes turbine Failure of secondary cooling, 12 trip with main condenser failure of once-through cooling due . available) to unavailability of PORVs Transient A TWS; electrical scram failure, 3.5 successful relief valve opening, adverse moderator coefficient Transient A TWS; mechanical scram failure, 2.2 successful relief valve opening, adverse moderator temperature coefficient

2. 7 .2 Vulnerabilities.

The licensee used the following questions to determine if any vulnerabilities exist: {p. 1.0-2 of submittal]

• Do the Palisades IPE results meet the NRC's safety goal for core damage? Are the results for core damage sequences or containment performance consistent with other PRAs? 26

• *

• Does the probability of sequences characterized as having large releases exceed 10% of the core damage frequency?

Based on the above criteria, the licensee concluded that there are no vulnerabilities at Palisades.

-The concept of vulnerability was considered to be substantially different from the determination of events and conditions that are the highest contributors to the quantified plant risk, particularly when the quantified risk was considered in line with the level of risk determined in other risk studies. The concept of vulnerability was also considered different from "insights" which were events or conditions that were not in line with the anticipated plant response or not generally known to the plant staff. 2.7.3 Proposed Improvements and Modifications.

The submittal states that several corrective actions were considered to reduce the probability of core melt. However, only two actions .are specifically described: (a) installation of a new switchyard transformer, and (b) evaluation of means to provide additional methods for makeup to the safety injection refueling water tank (SIRWT) or primary coolant system following an ISLOCA or SGTR. The installation of a new switchyard transformer has been completed, and reduces the frequency of LOSP events at the plant. CrecHt for the new switchyard transformer was taken in the IPE analysis.

The submittal states that evaluation of additional means for makeup to the SIRWT and primary coolant system will be continually reviewed.

However, the submittal states that no further plant modifications are currently planned. [pp.1.0-6, 5.0-4 to 5.0-6, 6.0-11 of submittal, FE.8]

• 27

• *

• 3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS This section of the report provides an overall evaluation of the quality of the IPE based on this review. Strengths and weaknesses of the IPE are summarized.

Important assumptions of the model are summarized.

Major insights from the IPE are presented.

Strengths of the IPE are as follows: Plant-specific data were used where possible to support the quantification of initiating events and component unavailabilities.

No major weaknesses of the IPE were identified.

However, the IPE currently does not address the possibility of an ISLOCA caused by leakage of primary coolant into the component cooling water (CCW) system via a RCP thermal barrier heat exchanger failure. The licensee states that a study of this accident type is ongoing and will be completed in October 1995. Based on this review, the folfowing aspects of the IPE modeling process have an impact on the overall CDF: *

• Loss of external cooling to the* RCP seals will not result in a LOCA.

• A large LOCA can be mitigated without LPSI pumps (flow from 3 accumulators and 1 HPSI pump was assumed to be sufficient);

no technical basis for this assumption was provided.

• The ECCS pumps Wlll not cavitate when drawing suction from a saturated sump. . All three of the above aspeds of the modeling process tend to lower the CDF. Significant level-one IPE findings are as follows: .

• The station blackout contribution (17.8% CDF) is smaller than at some other PWRs due to the IPE assumption that RCP seal LOCAs will not occur following loss of external RCP seal cooling . 28

• 4. DATA

SUMMARY

SHEETS This section of the report provides a summary of information from our review. Overall CDF The total point estimate of CDF at Palisades is 5.1 E-05/yr, exclusive of flooding.

The point estimate flooding contribution to the CDF is 3.0E-07/yr.

Dominant Initiating Events Contributing to CDF Small Break LOCA LOSP Transient w/Main Con. Avail. Loss of Service Water SGTR Loss oi a DC Bus Loss of Instrument Air All Other Transients All Other LOCAs (medium, large, ISLOCA) 29.4% 25.5% 15.5% 7.3% 5.1% 5.1% . 4.3% 6.3% 1.5% Dominant Hardware Failures and Operator Errors Contributing to CDF

• Dominant hardware failures contributing to CDF include: * (Importance measure results were not included.

in Submittal.)

Dominant human errors and recovery factors contributing to CDF include: Operator fails to align makeup to the CST Miscalibration of all AFW low suction pressure switches Operator fails to open PORVs and their associated MOV block valves Operator fails to align alternate AFW suction Dominant Accident Classes Contributing to CDF Small LOCA (no SI Injection or no SI Recirculation)

Transient (no PORV or no SI) Station Blackout LOSP or Loss of Service Water ATWS LOCA (no recirculation)

SGTR Transient (no recirculation) 29 22.0% 18.6% 17.8% '13.4% 8.5% 5.8% 4.8%

4.4%

• Design Characteristics Important for CDF The following design features impact the CDF:

• Increased PORV capability.

The PORVs were replaced in 1990 to provide increased relief capacity.

Each of the new PORVs can independently provide the required relief capacity needed to support for feed and bleed. This design feature tends to lower the CDF. [p. B-13 of submittal]

• Operation with PORV block valves closed. The plant normally operates with the PORV block valves kept closed. The submittal states that an overall reduction of risk was achieved with this configuration based on results from a sensitivity analysis.

• Automatic switchover of ECCS from injection to recirculation.

This design feature tends to decrease the CDF over what it would otherwise be with a manual system. [p. 2.1-33 of submittal]

• Nitrogen backup systems. a select set of important plant equipment has been provided with nitrogen backup stations to enable continued operation in the event of loss of normal air. This design feature tends to decrease the CDF. * * *

• Switchyard power connections.

The Palisades switchyard is supplied by several 345kV lines. Any one of these power lines can provide the required power to either or both of the front or rear 345 Kv switchyard buses. This design feature tends to decrease the CDF. [p._ 2.1-21 of submittal]

Independence of HPSI pumps from LSPI pumps during recirculation.

The HPSJ pumps do not require "piggy-back" suction from the LPSI (or RHR) pumps for operation during recirculation.

This design feature tends to decrease the CDF. Potential single failure of HPSI system. The HPSI system contains two pump minimum flow recirculation valves arranged in series. If either of these valves is closed when the HPSI pumps are started, the HPSI pumps will dead head against the primary coolant system pressure and quickly (within 5 minutes) suffer severe damage. The licensee considers this HPSI failure mode a passive failure (and not a vulnerability), as surveillance and testing is done to verify that the valves remain open. This design feature tends to increase the CDF. IP* 5.0-4 of submittal]

Containment air coolers. The four containment air coolers provide a method of containment cooling that is independent of the containment spray system. This design feature tends to decrease the CDF. [p. 2.1-8 of submittal]

30

• *

• Modifications The submittal states that several corrective actions are being considered to reduce the probability of core melt. However, only the two actions are specifically described: (a) installation of a new switchyard transformer, and (b) evaluation of means to provide additional methods for makeup to the safety injection refueling water tank (SIRWT) or primary coolant system following an ISLOCA *or SGTR. The installation of a new switchyard transformer has been completed, and reduces the frequency of LOSP events at the plant. Credit for the new switchyard transformer was taken in the IPE analysis.

The submittal states that evaluation of additional means for makeup to the SIRWT and primary coolant system will be continually reviewed.

However, the submittal states that no plant modifications are currently planned. Other USl/GSls Addressed The IPE does not address any other USls/GSls other than OHR. Significant PRA Findings Significant findings on the front-end portion of the IPE are as follows: Significant level-one IPE findings are as follows:

• The station blackout contribution (17.8% CDF) is smaller than at some other PWRs due to the IPE assumption that RCP seal LOCAs will not occur following loss of external RCP seal cooling . 31

• *-, )

• REFERENCES

[DET Review Findings)

Diagnostic Evaluation Team Report on Palisades Nuclear Generating Facility, March 14-25 and April 18-22, 1994, USNRC. [GL 88-20] Individual Plant Examination for Severe Accident Vulnerabilities

-10 CFR 50.54 (f}, Generic Letter 88.20, U. S. Nuclear Regulatory Commission, November 23, 1988. [IEEE 500] Guide to the Collection and Presentation of Electrical, Electronic, Sensing, Component, and Mechanical Equipment Reliability Data for Nuclear Power Generating Stations.

IEEE Std. 500-1984, December 1983. [IN 89 54] Potential Overpressurization of the Component Cooling Water System, NRC Information Notice 89-54, June 23, 1989. [IPE Responses

-First Set] aoocket 50-255 -License DPR-20 ".'Palisades Plant -Individual Plant Examination (IPE) -Additional Information (TAC No. 74444)," letter and attachmel!lt from D. W. Rogers, Consumers Power, to NRC Document Control Desk, July 22, 1994. [IPE Responses

-Second Set) aDocket 50-255 -License DPR-20. -Palisades Plant -1ndividual Pfant Examination (IPE) -Additional Information (TAC No. 74444)," letter and enclosure from K. M. Haas, *Consumers Power, to NRC Document Control Desk, December 5, 1994. [IPE Submittal]

Palisades Plant IPE Submittal, January 29, 1993 [NUREG 13351 Individual Plant Examination Submittal Guidance, NUREG-1335, August 1989. [NUREG 1424] Safety Evaluation Report Related to the Full-Term Operating License for Palisades Nuclear Plant, NUREG-1424, November 1990. [NUREGJCR 2728) Interim Reliability Evaluation Program Procedures Guide, NUREG/CR-2728, January 1983. [NUREG/CR 4550, Methodology)

NUREG/CR-4550, Vol. 1, Rev. 1, Analysis of Core Damage Frequency:

Internal Events Methodology, January 1990. (NUREG/CR 4780) Procedures for Treating Common Cause Failures in Safety and Reliability Studies, NUREG/CR-4780, Vol. 1, February 1988 and Vol. 2, January 1989 . 32

• * [PLG 500] PLG-0500, "Database for Probabilistic Risk Assessment of Light Water Nuclear Power Plants", Pickard, Lowe and Garrick, 1989. [UFSAR] Updated Final Safety Analysis Report for Palisades

[WASH 1400] Reactor Safety Study, October 1975 . 33

• APPENDIX B PALISADES NUCLEAR PLANT INDIVIDUAL PLANT EVALUATION TECHNICAL EVALUATION REPORT (HUMAN RELIABILITY ANALYSIS)

Enclosure 3