ML20236Q461

SER for Crystal River Power Station,Unit 3,individual Plant Exam (Ipe).Concludes That Plant IPE Complete Re Info Requested by GL 88-20 & IPE Results Reasonable Given Plant Design,Operation & History

ML20236Q461
Person / Time
Site:	Crystal River
Issue date:	06/30/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20236Q454	List: ML20236Q453 ML20236Q461
References
GL-88-20, NUDOCS 9807200257
Download: ML20236Q461 (7)

Text

_ __ ___ _ --- --

purig -

p k UNITED STATES s* j NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. enana mi

%...../

STAFF EVALUATION REPORT SUPPLEMENT CRYSTAL RIVER POWER STATION. UNIT 3. INDIVIDUAL PLANT EXAMINATION

1. BACKGROUND On March 9,1993, Florida Power Corporation (FPC) submitted the Crystal River, Unit 3, (CR3)

Nuclear Power Plant Individual Plant Examination (IPE) submittal in response to Generic Letter 88-20 and associated supplements. A " Step 1" review of the CR3 IPE submittal was performed and hvolved the efforts of Brookhaven National Laboratory in the three review areas:

front-end, human reliability analysis (HRA), and back-end. The Step 1 review focused on whether the licensee's method was capable ofidentifying vulnerabilities. The review considered:

(1) the completeness of the information, and (2) the reasonableness of the results given the CR3 design, operation, and history. On September 19,1995, the staff sent questions to the licensee requesting additional information. The licensee responded in a letter dated November 22,1995.

Based on the Step 1 review the staff was unable to conclude that the licensee met the intent of Generic Letter 88-20. A letter was sent to the licensee containing the NRC's safety evaluation report on April 28,1997, which outlined IPE review areas the staff believed were inadequate.

On July 11,1997, FPC responded to the NRC letter with additional information. FPC submitted a second set of additionalinformation on February 25,1998. They also requested a meeting with the staff to resolve outstanding staff concems. A meeting was held on February 25,1998, at NRC headquarters between representatives of FPC and the staff.

II. EVALUATION CR3 is a Babcox & Wilcox pressurized-water reactor with a large, dry containment. The CR3 IPE has an estimated core damage frequency (CDF) of 1.4E-05 per reactor-year from intemally initiated events, not including the contribution from intemal floods, anticipated transients without scram (ATWS), orinterfacing systems loss of coolant accidents (ISLOCAs). Smallloss-of-coolant-accidents (LOCAs) contributed 51 percent to plant CDF, station blackout (SBO) contributed 24 percent, medium LOCAs contributed 12 percent, transients contributed 5 percent to the CDF, and steam generator tube rupture (SGTR) contributed 4 percent.

According to the licensee, the total flood CDF is approximately 1.3E-06 per reactor-year resulting from two scenarios, service water pipe break in the auxiliary building, and overflow from the decay heat pit onto the auxiliary building floor. ISLOCAs (and reactor vessel rupture) were considered separately and found not to be significant contributors, on the order of 1E-07 per reactor-year. Similarly, a scoping study was performed for ATWS and it was a small contributor to CDF.

The NRC safety evaluation dated April 28,1997, outlined open items in a!! three review areas:

front end, human reliability analysis (HRA) and back-end, as well as two general issues. The following discussion covers the items identified in the safety evaluation.

9807200257 980630 l PDR ADOCK 05000302 .t

4 Front-End issues

1. Two initiating events, loss of de power and loss of non-nuclear instrumentation, which have the potential to result in dominant accident sequences, were not included in the Crystal River IPE analysis. In addition, some LOCA initiating event frequencies appeared to be unusually low.

Resolution: Loss of de power bus initiating events have been added to the CR3 model.

The licensee found that CDF increased by less than 4E-08 per reactor-year. Regarding non-nuclear instrumentation, the licensee reviewed CR3 system models and found that no single failure of non-nuclear instrumentation, other than main feedwater, would impact safety systems. It is, therefore, captured by the existing loss of main feedwater initiating event.

Sensitivity studies were run to examine the effect on CDF of increasing LOCA initiating event frequencies at CR3 to values more comparable to those used in other IPEs.

Results indicate, for instance, that an increase in large LOCA frequency to a value used by many other IPEs (3E-04 per reactor year) resulted in an increase in CDF of 4 percent.

2. The ISLOCA analysis, although detailed, appeared to have assumed that only 10 percent of valve ruptures occur in the critical parts of the valve, the rest occurring in the valve bonnet.

Resolution: Four generic data sources were subsequently reviewed by the licensee (NSAC-154, NUREG/CR 5604, NUREG/CR-5102, and NUREG/CR-2815) for check valve inter,1al rupture failure rate. The aggregated value resulting from the review was lower than that used in the CP3 IPE analysis. Thus, the value used in the IPE appears ret sonable.

3. Certain aspects of the flooding analysis, for example, treatment of drains and maintenance-induced floods, did not appear to have been included. Inclusion of these aspects may increase flood CDF; attematively their exclusion may mask potential procedure-based vulnerabilities.

Resolution: The licensee reaffirmed that the treatment of drains was included in the IPE analysis in that it was determined that the open design of CR3 precluded, to a great extent, the potential for the accumulation of water.

Maintenance-induced floods, on the other hand, were not included in the original IPE.

Using a maintenance-induced flood initiating event frequency comparable to generic data, as obtained from the Oconee probabilistic safety assessment, the licensee determined that its inclusion would increase CDF by less than 3E-07 per reactor year. In addition, the dominant flood scenarios previously identified at CR3 involved spray sources not affected by the omission of maintenance-induced floods, so no increase in flood-related CDF resulted for those sequences due to maintenance considerations.

4 l 4. The plant-specific turbine driven emergency feedwater pump failure-to-run failure rate l

appeared to be unusually low (about two orders of magnitude lower than NUREG-4550.)

This is an important plant feature for dealing with SBO situations and may contribute to an understated contribution to CDF from SBO.

Resolution: The licensee revised their pump failure-to-run equipment failure rate by using a value of the same order of magnitude as NUREG/CR-4550. Doing so increased the CR3 CDF by 4 percent.

5. CR3 common cause beta factors appeared somewhat low, without adequate justification.

In addition, common cause effects between the turbine driven and motor driven emergency feedwater pumps were not in the IPE model. Use ofinappropriate values may skew the ranking of predominant accident sequences and mask potential vulnerabilities.

Resolution: The common cause failure analysis was redone by the licensee, including common cause effects of the turbine driven and motor driven emergency feedwater pumps. This effect resulted in an increase in CDF ofless than 1E-08 per reactor year.

The revised analysis, based on NUREG/CRs-4780 and -5801, did not result in a significant increase to the CR3 CDF.

HRA lssues The licensee completely revised their post-initiator HRA. The revised analysis is based on an Electric Power Research Institute methodology which is a combination of the established SHARP 1 framework and NUREG/CR-1278 (Swain / Guttman).

1. Post-initiator human actions at CR3 included recovery actions which typically were not covered by procedures. Nojustification was provided for any of the modeled non-proceduralized actions and without such justification there did not appear to be an adequate basis for the human error probabilities (HEPs) assigned to the events.

Resolution: In the revised analysis, only one non-proceduralized action was credited (in a small break LOCA, opening of valve MUV-62 was credited to provide a suction flowpath for pump, MUP-1A.) In this case the available time for action was long, a clear opportunity for success existed, the action required was relatively simple, and there were no adverse environmental factors.

2. Consideration of plant-specific performance shaping factors and dependencies was apparently limited. Inadequate treatment of these factors can result in HEPs which are more generic in nature than plant-specific. Thus, an opportunity might have been lost to gain insights into operator performance. Also, the resulting HEPs may be either optimistic or pessimistic, especially when dependencies are involved which, if ignored, may lead to inappropriate HEPs.

i e

l

. Resolution: In the revised analysis, performance shaping factors were incorporated in

- both the pre-initiator and post-initiator actions. Each post-initiator human action was initially assigned a screening value of 1.0. This was done to ensure that resulting combinations of human actions would exceed the truncation limit and would be examined for independence. The resulting cutsets were examined to insure that human actions

.were not characterized inappropriately as being independent when they were not. In addition, dependencies between operating crew error recoveries were also addressed .

using a range from low to complete dependence of the crew based on the likelihood of another person in the control room, such as the shift technical advisor, to observe the error and the subsequent time available to correct it.

3. Documentation was inadequate on the process used to determine the time available for operators to diagnose needed actions and on the time needed to ccnduct the actions (particularly outside the control room). In general, because of the sparse documentation, it was not clear that time was appropriately considered in the quantification of operator actions.

Resolution: In the revised analysis, a time line was developed based on operator interviews and examination of procedures for each human error event. The time line l- includes the estimated time for diagnosis and execution. Background details for the time lines, such as, event descriptions and a breakdown of operator activities were H documented in individual worksheets.

Back-End issues

1. Because a sensitivity study, as recommended in NUREG-1335, was not performed, the IPE did not provide any quantitative insights on how containment failure probabilities would change if uncertainties in containment phenomena were considered.

Resolution: Sensitivity studies were subsequently performed on containment heat l' removal availability, hydrogen bum probability, induced reactor coolant system rupture l

probability, DCH probability, and coolable debris bed probability. The results are documented in new IPE Section 4.8 and indicate that the overall profile of containment event tree end states is relatively unaffected by individual changes in phenomena; combinations of phenomena, however, may be expected to impact results more significantly.

2. An unusually low source term (i.e., a release fraction less than 2E-06 for iodine and cesium) resulting from the late containment failure mode with no containment systems available was reported by CR3, without apparent justification.

Resolution: The cesium release fraction is consistent with that reported in NUREG/CR-4551, Vol. 7, " Evaluation of Severe Accident Risks: Zion, Unit 1," although the iodine portion of the CR3 release is significantly Icwer than that reported for Zion. The licensee's analysis was performed using three established computer codes (MARCH 3, I

l' 1

I i

TRAPMELT3, and CONTAIN 1.1) in which was input plant specific CR3 reactor and containment data. As such, it represents the licensee's best estimate for source term release given the aerosol deposition models employed.

3. The discussion of plant specific seal materials and their properties at elevated temperatures was not adequate.

Resolution: The licensee expanded their discussion of seal material failure to include the two types of materials of concem in severe accident applications-gasket material (silicone rubber) for large penetrations, such as equipment hatches, and rubber seats for containment purge and vent valves. For the silicone gasket material, failure of the inner gasket was not expected within the first 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> following an accident, well beyond the IPE mission time. For the purge / vent valve seats, no significant leakage was anticipated, although some might occur late in accidents involving extended loss of containment heat removal. For this case, however, the outcomes are already assumed to eventually lead to gross containment failure.

4. Containment isolation failure wcs not discussed in enough detail for the staff to determine whether the analysis addressed the areas identified in Generic Letter 88-20.

Resolution: Additional details were provided to indicate that the containment isolation failure evaluation was performed by modeling each penetration to determine the probability of non-isolation. The modeling included individual hardware failures, operator actions, and limited applicability for the failure, as for instance when a specific accident is required before a leak path may exist. The penetration failure probabilities were then added to appropriate front-end cutsets. Two penetration failures emerged during loss of offsite power scenarios as being potentially important (Penetrations No. 333 and No. 377). These results were used to evaluate backend plant damage states for an unisolated containment.

5. There was virtually no discussion of the containment performance improvements (CPI) program issue conceming the important phenomenology of hydrogen pocketing and detonation during accident progression following a core melt.

Resolution: The licensee expanded their discussion of CPI issues. The CR3 containment was determined to be very open with good communication between compartments. A subsequent review by the licensee did not identify any close-ended compartments where hydrogen accumulation was likely to occur.

GeneralIssues

1. The section of the IPE submittal on plant improvements was very brief since none apparently emerged from the analysis.

l Resolution: The licensee's July 11,1997, letter clarified that plant improvements were made at CR3 resulting from the IPE. The licensee revised the operation of the flush valve in the nuclear service and decay heat seawater system to eliminate the possible loss of flow to all raw water pumps. In addition, the emergency operating procedures were revised in areas such as the refilling of the borated water storage tank.

2. There was no discussion ofinsights. Consequently, the staff has no assurance that the IPE knowledge has bt.cn incorporated into the plant operations.

Resolution: The licensee's July 11,1997, transmittal indicated that they have developed training courses on PRA results at CR3, and developed a summary document describing (

the CR3 PRA model and applications. Simulator training is being revised to include drills on selected dominant core damage sequences. The licensee has also incorporated PRA into plant operations via an on-line risk monitor based primarily on the IPE model.

In accordance with Generic Letter 88-20, resolution of Unresolved Safety issue (USI) A-45,

" Shutdown Decay Heat Removal Requirements,"was subsumed into the IPE process. Based on the staff's review of CR3 plant-specific features and the licensee's search for decay heat removal vulnerabilities, we conclude that the decay heat removal evaluation is consistent with the intent of the USl A-45 resolution and is, therefore, acceptable.

111. CONCLUSION The four general objectives of Generic Letter 88-20 are for each nuclear plant licensee:

1. To develop an appreciation for severe accident behavior,

2. To understand the most likely severe accident sequences that could occur at the plant,

3. To gain a more quantitative understanding of the overall probabilities of core damage and fission product releases, and

4. If necessary, to reduce the overall probabilities of core damage and fission product releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.

Based on the informatie., cont &ad in the CR3 IPE submittal, including subsequent transmittals, the staff concludes that: (1) the licensee's IPE is complete with regard to the information requested by Generic Letter 88-20 (and associated NUREG-1335), and (2) the IPE results are reasonable given the CR3 design, operation, and history. As a result, the staff concludes that CR3's IPE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities, and, therefore, the CR3 IPE meets the intent of Generic Letter 88-20.

7 It should be noted that the staff's review primarily focused on the licensee's ability to examine CR3 for severe accident vulnerabilities. Although certain aspects of the IPE were explored in l

more dsis!! than others, the review was not intended to validate the accuracy of the licensee's detallea innd ngs (or quantification estimates) that stemmed from the examination. Therefore, the SER does not constitute NRC approval or endorsement of any IPE material for purposes other than those as:tociated with meeting the intent of GL 88-20.

Principal Contributor: J. Lane, RES Date:

.