ML20148D546

Technical Evaluation Rept of IPE Submittal & RAI Responses for Prairie Island Units 1 & 2 Nuclear Generating Plant

ML20148D546
Person / Time
Site:	Prairie Island
Issue date:	05/16/1997
From:	Bozoki G, Forester J, Lin C BROOKHAVEN NATIONAL LABORATORY
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20148C745	List: ML20148C739 ML20148D544 ML20148D546
References
CON-DE-AC02-76CH00016, CON-DE-AC2-76CH16, CON-FIN-W-6449 NUDOCS 9705300281
Download: ML20148D546 (86)

Text

-

j.. i

!; TECHNICAL REPORT .

j: ,. . , FIN W4449 12/08/96 ii

i

• - '~

! TECHNICAL EVALUATION REPORT Ii l OF THE IPE SUBMITTAL AND RAI RESPONSES FOR THE i

i, PRAIRIE ISLAND UNITS 1 AND 2 ,

l NUCLEAR GENERATING PLANT 1 1 l'

i l

George Bozoki l C. C. Lin l John Forester

~ n - .,- - a - ,. - r., -  !

Upton,New York 11973 i i

i l

I ll bn HUI w====. -

lt i

Attachment to NRC SER dated i' May 16, 1997 h Na6onalLaboratories 9705300281 970516

PDR ADOCK 05000282 P PDR ,_

4

i. . .

CONTENTS t

- )

a Page 1

EXECU'ITVE SU MMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v NOMENCLATURE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii 1 1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....I l 1.1 Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ,, ...... 1  :

1.2 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . ......... 1  !

1 2 TECH NICAL REVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 l 2.1 Licensee's IPE Process .....................................7  :

2.1.1 Completeness and Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 l

) 2.1.2 Multi-Unit Effects and As-Bullt, As Operated Status . . . . . . . . . . . . . . 9 i 2.1.3 Licensee Participation and Peer Review . . . . . . . . . . . . . . . . . . . . . 11 '

2.2 Front End Technical Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1 2.2.1 Accident Sequence Delineation and System Analysis . . . . . . . . . . . . . 12 l 2.2.2 Quantitative Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 l 2.2.3 Interface lssues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1 2.2.4 Internal Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 )

2.2.5 Core Damage Sequence Results . . . . . . . . . . . . . . . . . . . . . . . . . . 26  ;

2.3 Human Reliability Analysis Technical Review . . . . . . . . . . . . . . . . . . . . . . 33 2.3.1 Pre-Initiator Human Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 2.3.2 Post-Initiator Human Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 2.4 Back End Technical Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2.4.1 Containment Analysis / Characterization . . . . . . . . . . . . . . . . . . . . . . 39 l 2.4.2 Accident Progression and Containment Performance Analysis . . . . . . . 47 1 I

2.5 Evaluation of Decay Heat Removal and CPI . . . . . . . . . . . . . . . . . . . . . . . 51

) 2.5.1 Evaluation of Decay Heat Removal . . . . . . . . . . . . . . . . . . . . . . . . 51 2.5.2 Other GSis/US1s Addressed in the Submittal . . . . . . . . . . . . . . . . . . 55 2.5.3 Response to CPI Program Recommendations . . . . . . . . . . . . . . . . . . 55 2.6 Vulnerabilities and Plant Improvements . . . . . . . . . . . . . . . . . . . . . . . . . . 55 3 CONTRACTOR OBSERVA110NS AND CONCLUSIONS . . . . . . . . . . . . . . . . . . 59 4 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 k

1 t

l l

iii 1

r c - - .. .- l

TABLES .' -

11

!- Page j, Table i E-1 Core Damage Frequency by Initiat;ng Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xil l E-2 Accident Types and Delt Contribution to the CDF . . . . . . . . . . . . . . . . . . . . . . . . x111 2

E-3 rantulammat Failure as a Percentage of Total CDF . . . . . . . . . . . . . . . . . . . . . . . . . xv j 1 Plant and Contniamant Characteristics for Pralrie Island Nuclear Generating Station . . . . 5

2 Initiating Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3 Fault Trees Developed in the Prairie Island IPE . . . . . . . . . . . . . . . . . . . . . . . . . . 18 j 4 Comparison of Component Failure Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 5 Comparison of Common-Cause Failure Factors . . . . . . . . . . . . . . . . . . . . . . . . . . 23

, , 6 Core Damage Frequency by Lak1* lag Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

, 7 Accident Types and neir Contribution to the CDF . . . . . . . . . . . . . . . . . . . . . . . . 29 8 leading Accident Classes and Core Damage Sequences by Accident Class . . . . . . . . . 30 9 Important Human Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 i '10 Containment Fallure as a Percentage of Total CDF .......................48 l

~

11 Effects of Selected Initiating Events on the Unavailability of Systems Involved in DH R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 I

l s

n l

l i

i , ,

, ~

EXECUTIVE

SUMMARY

) ~

j Dis Technical Evaluation Report (TER) M'=aats the findings from a review of the Individual Plant t Examination (IPE) for the Prairie Island Nuclear Generating Station. 'Ibe primary intent of the review

[

is to acertain whether or not, and to what extent, the IPE submittal satisfies the major intent of Generic i Letter (GL) 88-20 and achieves the four IPE sub-objectives. De review utilized both the information

! provided in the IPE submittal and additional information (RAI Responses) provided by the licensee, the i Northern States Power Company, in the response to a request for additional information (RAI) by the NRC.

f

) E.1 Plant Characterization i

! De Prairie Island Nuclear Generating Plant consists of two 560 MWe two-loop Westingbouse pressurized j water reactor units, Unit 1 and Unit 2. De reactor coolant system (RCS) of each unit includes the

pressure vessel, two vertical steam generators, two reactor coolant pumps, an electrically heated pressurizer andm* terconnected piping. De RCS is housed inside a large dry containment. Reactors with

aimilar characteristics are

Ginna, Kewaunee and Point Beach 1 and 2.

y~ De plant is located near Red Wing, Minamota. It is operated by the Northern States Power Co. (NSP).  ;

l Full commercial operation began on December 16,1973 for Unit 1 and December 21,1974 for Unit 2.

t A number of design features at Prairie Island 1 and 2 impacts the core damage frequency (CDF). De submittal highlights these features, but does not estimate their effects on the CDF individually.

De following features tend to decrease the CDF

i

• De emergency AC power configuration includes four diesel generators of diverse design and i support system requirements. In the event of an SBO condition, each diesel generator has the capability to supply the power requirements for the bot shutdown loads for its associated unit, as well as one train of essential loads of the blacked out unit through the use of manual bus tie i breakers interconnecting the 4160 buses between units. De crosstie of a safeguards 4160 bus from one unit to the diesel generator for the other unit can be performed from the control room, i within ten minutes of the onset of SBO.

• De cooling water system is diverse. k mnelen of Sve pumps of which two are horizontal motor driven, and three are vertical pumps with one motor driven and two diesel driven. De single

vertical motor driven pump is also backed by safeguard diesel generators (before the SBO rule g the pump was powered by a non safeguards power supply) while the two diesel driven pumps do not rely on AC power for operation, i.e., there are three cooling water pumps available following I a LOOP. De cooling water system consists of a ring header that can be divided into two separate headers on receipt of an SI signal. Each header supplies half of both trains of safeguards

- equipment.

I

• 1he aamad-y cooling function involving the main feedwater and auxiliary feedwater systems is very reliable. Main feedwater is lost on a reactor trip but is easily recoverable from the control room. The feedpumps are motor driven, i.e., independent of main steam availability. Each unit has a turbine and a motor driven auxiliary feedwater pump. De motor driven AFW pumps can V

t s

?

~ ~~~'~'~

.___E_______EZ1TEEE Z'_ ~~~ - _-- 'T~~'~~

- _ - . ~ - _ - - - - - .- - . - - - - .-.- . . -____ - __

l j be crosstied between both units. large condensate storage tanks (CST) are capable of providing  !

water for decay heat removal without the need for makeup.

l f

• De equipment located in the Auxiliary Building does not require room cooling for extended periods of operation. Analysis has been performed which demonstrates that the CS, CC, RHR j and 51 pumps do not require ventilation for erminad periods of pump operation.

• De RWST is large and can provide amany hours of makeup to the reactor for small break LOCA

and SGTR.

De followL m features tend to increase the CDF:

• BS Wdn feedwc:er and feed and bleed cooling are dependent on common support systems;

. le tument air, cooling water and DC power.

• Cooling water, instrument air and control room chilled water systems are shared by both units Dese are systems that are required to be fully operational when either unit is at power.

Maintenance on these systems is normally performed while both units are at power. Maintenance i . activity may influence negatively the availability of these systems.

• De auxiliary feedwater pumps for both units are all located in the same room such that a pipe

, rupture in the loop A or B cooling water line can result in the failure of all auxiliary feedwater for both units.

• The instrument air compressors are also locried in the same room as the auxiliary feedwater pumps such that all the campressors could fail because of a flood, causing loss of instrument air for both units. Loss ofinstrument air results in closure of the main feedwater regulating and

bypass valves which together with auxiliary feedwater failure, results in the loss of secondary cooling. Feed and bleed then falls because the pressurizer PORVs require instrument air to operate. . -

-* De emergency batteries have only two hours of capacity.

• Loss of instrument air wDI cause the control room chiller outlet cooling water valves to close resulting in loss of chilled water and loss of room ecoling to the unit 1480 V safeguards bus

- rooms. Without ciw..w intervention, the rcums can bestup and fail the 4160/480 V transformers naulting in a loss of all unit 1480 V refeguards equipment. His would catse loss of all charging pumps resulting in a ktu of all RCP asal cooling causing an RCP seal LOCA in which the SI system would not '* avsable fbr mitigation.

• Both RCP seal cooling and RCS shott term inventory control are dependent on cong water.

. Cooling water provides the uithnate beat sink for the composant cooling water system which .

1

' l provides cooling to she RCP thermal barrier and the SI pump lube oil coolers. Cooling water i also supplies a best aink for the control room chillers which provide room coollag for the Unit

, I safeguards 480 V bus rooms. On loss of cooling water, room cooling is lost to the Unit 1 -

safeguards 480 V bus room. Without operator intervention the room can bestup and fail the t

I .

t

. vk

\

t p.. . - ~ . ~ . , , , , , . . - - - . ~ , _ -

- 4160/480 V transformers resulting in, as previously =aarlaaad, a loss of all Unit 1480 V l j;i

safeguards equipment. 1 11  ;

jf. According to the licensee's response to the RAI, since the IPE was submitted room ventilation '

iL problems involving the control rooci chilled water system have changed. Each of the 480 V _.: 1 l buses was split into two and now each of the buses carries half of the original loads. In addition,  !

1 *, only one of these buses is now located in a room. Furthermore, new thermal analysis showed I

! that without ventilation and assuming no operator action, these room temperatures do not reach debilitating levels within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. With operator action (to open doors at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) room

semperatures decrease to a steady-state temperature well below operability ul' nits.

i^

• De instrmnant air system has a high failure probability as the system success criterion is such

, that if two out of three compressors fail, instrument air is considered failed. A single compressor j: cannot maintain adequate header pressure for both units.

• Given a medium LOCA, switchover to high head recirculation can not be performed from the l j- control room as the RHR to SI crossover motor valves have their breakers locked in the open position. De switchover to high head recirculation must be accomplished within a small time i

L_ window during which both the SI, CS and/or the RHR pumps are injecting from the RWST. If j the operator fails to stop any of the pumps before the RWST level decreases below approximately j SW., all pumps will be damaged as they do not have suction trips.  ;

! For additional unique features related to the CDF see Section 1.2 of this report. -

\-

! De Prairie Island Nuclear Generating Station milizes a large dry containment with a freestanding steel i shall construction. De steel reactor containmaat vessel is aaelmad by a 2-1/2 foot thick concrete shield  !

! building. De reactor coolant system is a Westingaouse two-loop design. Both the power level and the li *

. - . . ent free volume of Prairie Island are significantly less than those of Zion Surry. However, the l? marminmarit volume to thermal power ratio for Prairie Island is , .t,le to, and between that of Zion j .and Surry. De containment design pressure of Prairie Island is between that of Zion and Surry, and the l amedian containment failure pressure obtained in the Prairie kland IPE is slightly bigher than that obtained l in NUREG-1150 for Zion and Surry.

' ~

He plant characteristics ; yerisst to the back end analysis are:

.;

• A cavky design which facilkmes Sooding of the reactor cavity. According to the IPE, water can I,

readily flow from the upper compartment to the annular containment Soors. Flooding of the cavity is accomplished through an access hatch (located on the instrument tunnel) which is left l open (slightly ajar) during normal operation and allows water flow from the containment floor i down into the cavity for vessel head Sooding. His provides external cooling to the core inside j! 1he reactor vessel. Since the Sow velocity going into the intrument tunnel may be sufficient to pull the doors closed, a rammmandatlan of securing the hatches open by installing a solid bar

!l-i or other device, instead of a chain, is discussed in the IPE submittal.

!I l; .

• A steel shell eneminmare that is vulnerable to direct attack by dispersed cors debris. He access

!j hatches to the instrument tunnel are in an open area on the basement level of the co* 8--a' l and for both of the Prairie Island units one of the two hatches faces toward the steel containment, l: about 30 ft away, with a largely unobstructed path in between. Although a scoping study i

j ' Vii i'

i

i .

i .

j j . performed in the FE shows that the temperature generated by the debris adhering to the steel j wal! is insufficient to melt the steel and breach the containment, details of the scoping study are

4) not provided in the submittal and the potential effect of corium attack on reduc *mg containment

(( pressure capability is not discussed.

jj 1

De large contalamant volume, high eaatalammar pressure capability, and the open nature of

,- compartments which facilitates good atmospheric mixing. .

lj

• Two separate systems for enarmlamant atmosphere cooling and pressure suppression, the Fan Coll

!, Units and the Corsainment Spray system. According to the FE, the low conditional probability 1- of containmeus Silure for core damage sequences that do not bypass containment is due in part -

l' to the availability (f these two completely redundant, diverse means of providing enatalament j heat removal and prusure suppression.

t

!,

• An Emergency Procedure (EP) that requires the restart of the reactor coolant pumps (RCPs).

l3 According to the IPE, the Emergency Procedure " Response to Inadequate Core Cooling" creates j the possibility of inducing a steam generator tube rupture (SGTR) during an event in which l- degraded core cooling conditions already exist. A recommandation of revising the EP is J discussed in the IPE submittal.

lt i E.2 Licensee's IPE Process i:

1 The licensee initiated work on a pmbabilistic risk assessmesit (PRA) for Prairie Island Nuclear Generating Station in response to Generic Letter 38-20. De freeze date for the analysis is 1990.

7 De front-end portion of the submitted IPE is a I.svel 1 PRA. De specific technique used to develop it this PRA was the small event tree /iarge fault tree approach, and k is clearly presented in the submittal.

iI ii Internal lawa: event and internal Scoding were considered. Event trees were developed for all classes i of initiating events. The detalis of the technique applied is extensively described in the submittal:

l Support systems were modeled in the fault trees of the functional top events and accident aequences were ,

j solved by fault tree iinidng. For determlateic best estimate analysis of reactor and contalament response ii during severe accident sequence condition the MAAP 3.0B Revision 19 code was used as principal

!- calmtarianal too!. Mission time for logic model quantification were generally on the order of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

l5 The consequences of system and equipment failure that might occur during this period were mamlaed j :well beyond this mission time. Paarmlammar response and source term analyses were carried out at least i4 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to establish k.ieunt trends in plant response, timing and magnitude of potential releases that I& might occur beyond 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> were established based on these trends where necessary.

It lj Jessitivky studies were conducssd on initiating event frequencies, operator actions, mammaa cause, test j and maintanaam and for certain system components. De evaluations were perfonned to determine the

i global effecs of the parameters ofinterest. Failure rates were increased / reduced by a factor of 5, where j' , a higher level of uncertainty and variability exists such as human asilability, common cause and test and -

i' maiaranaam unavailability. Failure rates for system components were increased / decreased by a factor l1 -of 2 alace actual plant data were used and there was less uncertainty associated with these parameters.

')

~

De licensee did not evaluate explickly the changes in CDF due to credited SBO modifications.

f S 1

k,

}-

!i l>

1 -

- . ~ . _ . _ _ _ - . . . . _ . - - - - - . . . - _ . - . - _ _ . _ . - .

I*

i -

In addition to the sensitivity studies, importance analyses were performed on the same quantities. The importance analyses were. based on use of the Fussel-Vesely and Birnbaum algorithms.

t Sensitivity analyses were conducted also so estimate the reduction in CDF due to certain plant

! improvements (AFW room fire door closed and procedural changes to allow station air to be cross -tied i with instrument air).

I De submittal states that the Northern States Power (NSP) PRA staff was involved in all aspects of the

PRA. Bree of the team members were located at the general office and two were located on site to

" snake it easier to interface with plant staff and to conduct walkdowns to ensure the PRA represents the as built plant." In addition, procedure reviews, discussions with operations and training staff, and walkdowns of some ep-.ius actions helped assure that the IPE HRA represented the as4uilt, as operated plant. Contractors ==v la'M with the Individual Plant Evaluation Partnership (IPEP) supported the PRA.

! Four levels of review were conducted and they included both internal and external reviews. However, a specific review of the HRA was not discussed. Both pre-initiator actions (performed during

' vanlataamare, test, surveillance, etc.) and post-initiator actions (p for.cd as part of the response.to an

. accident) were addressed in the IPE. Important human actions were identified and several

{ recommendations related to improving procedures and operator training were discussed in the submittal.

De back-end containment analysis was performed by Northern States Power Company (NSP) with the help of TENERA, Weingh=w Electric Corporation, and Fauske & Associates Inc.. In addition to the above companies, Gabor, Kenton & Associates (GKA) also provided consulting services to NSP.

According to the IPE submittal, the NSP PRA staff was involved with all aspects of the IPE. Reviews performed in the Prairie Island IPE include an independent in-house review done by NSP personnel other than those on the NSP PRA staff. De review process used in the Prairie Island IPE as described in the submittal seems to satisfy the intent of Generic Letter 88-20.  !

I E.3 IPE Analysis  !

1 E.3.1 Front-End Analysis L

~

The IPE initiating event analysis used the work performed previously in the IDCOR IPEM, but significantly enlarged its scope and employed updated data. De total number of laMatlag events is 23.

They are grouped into seven categories (the internal flooding events and anticipated transients are classified together and the different A'IWS events are collapsed into one category), since k was found that the minimal number of significantly different ways in which the plant responds to challenges is seven.

Transient occurrence data (from the period 1/1/8012/31/90) were used to derive the plant-specific initiator frequencies. Generic initiating event frequencies were ahtalad from published sources. De SCfIR initiator frequency was obtained by Bayesian update. Plant specific system fault tree models were used to estimate the special transient initiating event frequencies Goss of DC Train A and B, loss of

. Instrument Air, etc.) and Interfacing systems LOCAs.

i

'De IPE developed eight event trees to model the plant responses to internal laitiating events: large, i

medium and small LOCA event trees, SOTR event tree, main steam line/feedwater line break event tree, transient event tree, loss of offsite power (including station blackout) event tree and ATWS event tree.

i ix i

- , ~ . _ . , - ~ . . - -

I

} . Ne event analyzed. trees were developed for lig.f.cii g systems LOCAs but'ench ISLOCA source was 1 ; '

i No separate event trees wne developed for fiooding scenarios, the transient event tree was used with

{' additional flood-caused failures flyged in the appropriate fault trees.

[. A total of 21 systemsM>a% are described in Section 3.2.I of the Submittal. Included are descriptio

! ', of the following systems: reactor praterian, AMSAC, CVCS, safety injection, RHR, main feedwater i

and condensate, auxiliary feedwater, pressurizer PORV, marminrnant fan coil units, containme j system, cooling water, component cooling water, instrument air, onsite AC power, DC power,120 V i

instrument AC power, SI signal, safeguards chilled water, SG PORV, MSIV, room cooling.

i End system desaiption includes a discussion of the system design and operation, dependencue, success

!, criteria and role in safety function (s). 1

^

l ji importance analysez (by using Fussel-Vesely and Birnbaum W indicators) were performed for jf the inklating events, the major operator actions and all the systems considered in the plant risk model.

l De inyon.nce analysis also included the corrective 'a=1a'aamaN contributions as well as the preventive i .

' " maintenances and test contributions to the overall CDF.

i+

j >

Sensitivity analyses were conducted on laid =iaa event frequencies, operator action failure rates, common j

I cause, test and maintenance and for certain system components (e.g., EDG failure rates).

4 j

Common cause failures of circuit breakers, swit& gear and relays were not explicitly modeled. Accordin

) to the RAI response they were considered implicily. t For instance, common cause failures of loads j* supplied through th,e breakers, such as pumps, valves and other components that can be attributable to

, common cause mechanisms, were modeled.

i .

l De Prairie Island IPE team systematically examined the plant model for redundant components to address potential common-cause failures (within idividual systems and across both units ). The component groups for which common cause events were defined are given below:

j 1. Diesel generators (failure to start and run),

~

1; 2. Pumps (failure to start and run),

j, 3. MOVs and AOVs (failure to open and close),

j~ 4. PORVs (failure to open or reclose on demand),

}r' 5. Check Valves (failure to open on demand; failure to reclose),

j 6. Batteries (failure to operate on demand),

i 7. Instrn'aaa+='lon and Control components (failure to send signal or actuate equipment),

!- 8. Air compressors (failure to start and run),

l. 9. Cooling fans (failure to start and run),

l' 10. alliers (failure to stan and run).

f De common cause probability model used was the Multiple Greek Letter (MGL) method.

i+

i.

De methodology of the IPE to perform the flooding analysis consisted of three makr steps:

,i t.

-1) Identification of potential floods and areas affected (flood zones),

4 x

i+

4 x

4

!+

i -

- -- .- -..n._.- - - - - - . . - - - - .- -

a

. s

[

J g.

i ).

i 2) Identification and initial screening of flooding scenarios, and l; 3) Quantification of important flooding acenarios.

!i- in addition, extensive plant walkdowns supported the development M the flooding scenarios.

3p

j ji Alter a thorough screening process, six flood zones were retained for more detailed analysis. '

iI To quantify the flood initiating event frequencies the EPRI document TR-102266 was used and several i, assumptions regarding systems and equipment that may be disabled as a result of the flood or as a i consequence of operator actions have been made.

De total contribution of internal flooding to the point animm* CDF was estimated to be 1.04E 05/yr, l which is about 21% of the total CDF (from internal events and internal flooding). His is dominatad by a

l, a single flood scenario, that accounts for almost all of the CDF due to flooding. The flood is in zone j, TB1 whidi is the Auxiliary Feedwater Pump / Instrument Air Compressor Room. His room has the main

! cooling water supply headers to the Auxiliary Building running through the overbead.

i

!, De IPE point estimate for the core damage frequency from laternal events and internal flooding is 5.0E-05/yr for Unit I and 5.1E 05/yr for Unit 2. Accident initiators and their percent contribution to the CDF for both units, Unit I and Unit 2 are listed in Table E-1. As can be seen, the core damage contributions l

by initiating event of Unit 2 closely resemble to those of Unit 1. His is because there are only few and i minor asymmetries in the designs and corresponding risk models of the units and the Unit 2 Level 1 l results were obtained essentially from requantifying the Unit I model and replacing appropriate Unit 1 i component failures by their counterpart for Unit 2.

i

! Table E-2 shows the CDF ssults in term of grouped accident types and their percent contribution. De li largest contribution is due to the transient group (including the LOOP events). LOCA and internal flood events are the next largest contributors and they cxmtribute almost equally. De SGTR's contribution is quite significant. _

i .

De CDF results were obtained in the form of functional sequences.. Derefore the submittal used those screening criteria for reporting, which were required for such sequences in Generic letter 88 20. In _;

4 Table 3.41 of the submittal all the accident classes (including those that meet the reporting criteria and ,

! those that are beyond them) constituting the total CDF are presented (altogether 15 accident classes).

l, De table contains also the description of the dominant sequence from each accident class (except accident i 4

class "IBI", from which two leading sequences were considered). Dese dominant sequences cover only

, 36.4% of total CDF. The sequences include: five LOCAs, two SGTRs, six transients, two floodings ,

and one laterfacing LOCA. l

! De i-psz,ce analyses performed on ti.e ! Nag events shows that the most ;-ysir-st initiators at Prairie Island are: the LOOP (SBO) events, the Floods (r1FLD, SHIFLD), the LOCAs (MLOCA, SLOCA,110CA) and the LOCL (loss of cooling / service water) svent.

I i i De '.-yu6 :s analysis on the systems provided the ranking of the systems contributing the most to the l

- notal CDF as follows: 1) the APW,2) AC power,3) the room cooling, and 4) the cooling water 1 systems. First is the AFW, because in many accident sequences due to a variety of initiators (e.g.; I LOOP, TIFLD, Loss of IA, Loss of DC) it is the only ra-talag means of secondary cooling. AC 1 power is in second place; k causes heavy reliance on the TDAFW pump during an SBO when the MFW xi 4

_)

and MDAFW pumps are lost. Room cooling is important, because when I.oss cf IA cr loss cf CL - -

occur, the chilled water, that supplies the room cooling of the Unit 1480 V safeguards bus rooms, fails.

i (This condition is significantly ameliorated, as discussed earlier in the present TER based on the RAI

~

response.)

Table E 1 Core Damage Frequency by Initiating Event CDF from Instating CDF from Initiating 5 of Total CDF Initiating Event 5 dTM GF M Em h Initiating Event Event (per reactor year)

Unit 1 N I*} 8 **

, Unit 1 Unit 2 Unit 2 I TR1 6.4E-07 1.3 6.6E-07 1.3 I-TR2 2.9E-08 c.06 3.1E48 0.06 1-TR3 1.** E-06 2.4 1.2E-06 2.4 5 I-TR4 5.2E-07 1.0 5.5E-07 1.1 '

1-1OCC 5.5E-07 1.1 5.5E-07 1.1 1LOCL 6.4E-07 1.3 6.4E-07 1.3 1-LOCA 2.2E-06 4.4 ~ 2.2E-06 4.3 1-LOCB 4.6E47 0.9 4.8E 07 0.9 l-INSTAIR 3.2E 06 6.3 3.2E-06 6.2 1-LOOP 1.lE-05 21.2 1.lE-05 22.4 1-MSLB * * *

• 3-MFLB * * . *

• I-SLOCA 4.1E 06 8.2 4.2E-06 8.2 I-MLOCA 4.6E-06 9.3 4.6E 06 9.1 1-LLOCA 3.7E-06 7.5 3.8E-06 7.3 I-SGTk 6.6E-06 13.2 6.6E 06 13.0 1-TIFLD IE-05 21 1.04E-05 20.4 1-T13FLD * * *

• A 1-AB7FLD S.5E-10 2E-03 1.5E 09 2.9E 03 1-AB8FLD * * * *

, 1-SHIFLD 4.1E 07 0.8 4.1E 07 0.8 1-SH2FLD 4.3E-10 9E 04 5.6E-10 1.1E 03 V 2.3E 07 0.5 2.27E 07 0.5 t

i A

s

. I

', . . j

!' ~

I

{ :.

Table E 2 Acddent Types and Deir Contribution to the CDF l

. (

t initiating Event Group Contribution to CDF (/r. yr)  % i t )

4 LOCAs 1.22E 05 24.3

\

Steam Generator hbe Rupture 6.6E-06 13.2 j

Interfacing System LOCA 2.27E-07 - 0.5 i Transients (w/o LOOP) - 9.44E-06 < 18.8 l

Anticipated Trans, w/o Scram 3.2E 07 0.6 j laternal Flooding 1.04E 05 20.7 1

)

LOOP (with SBO) 1.1E-05 (3.1E 06) 21.9 (6.2)

TOTAL CDF 5.02E-05 100.0 E.3.2 Huanan Reliability Analysis ,

The HRA process for the Prairie Island IPE addressed both pre-initiator actions (performed during maintenance, test, surveillance, etc.) and post-initiator actions (performed as part of the response to an accident). De analysis of pre-initiator actions considered both miscalibrations and restoration faults, but only restoration faults were explicitly modeled. De pa***ial for miscalibration of a group of sensors or instruments was assumed to be included in the common cause failure mode!!ng of the instruments themselves. With the exception of events excluded on the basis of a qualitative screening applied during she pre-inklator human action selection process, all pre-initiator restoration errors were quantified. One of two HEPs (0.003 or 0.01) was assigned to each event depending on whether or not a post-maintenance verification of component status was required by procedure. Plant-specific component unava11 abilities were then calculated using the HEPs in conjunction with factors such as maintenance frequency and duration, test frequency and interval, refueling outage frequency, and time from completion of the corrective maintenance to the retest of the component. -

! Post-initiator human actions modeled included both responsetype and recovery type actions. De submittal indicated that screening values were assigned "by following a flow chart and answering a series of questions." Neither the questions nor the flow chart was provided, but " plant-specific antimatas of

, the time available to initiate and perform the action" and "PSFs manelatad with degree of difficulty and stress" were considered. De screening HEPs were based on the Handbook (NUREG/CR-1278), Wash-1400 (NUREG-75/014), and "the data sources used in the IDCOR BWR IPE methodology." Post-

initiator response type actions found to be kwrst received detailed HEP development. An action was important if it contributed algnificantly to baseline core probability or "if a change in the failure rate could cause significant increase in overall core damage probability." Most of the actions receiving i ~

detailed analysis were quantified with the ASEP method (NUREG/CR-4772). He response to the NRC RAI states that a more refined estimate for the five most Lwret human actions was obtained using the Handbook (NUREG/CR-1278). De licensee's response to the RAI also indicated that most recovery i probabilities were derived from NSAC-161, " Faulted Systems Recovery Experience" and that recovery

nii 4

i

, - . . _ . _ . _ . _ . . _ ~ - ..

p 1 actions were only added to cutsets when k was apparent that an operator would have sufficient time to -

• perform the additional action. Incal recovery of valves which failed to open or close was credited only when there was control room indication of valve position and the valve was easily accessible. A non-t recovery probability of 0.025 was assigned to these events. Recovery of equipment such as pumps had L

the same criteria, but the no.ms,wy probability was "approximately 0.5." Plant-specific performance shaping factors and dependencies (such as those among multiple actions in a sequence) were considered

' for both response and recovery actions. Human errors were identified as important contributors in accident sequencer leading to core damage and several recommendations to improve procedures and operator training were provided.

E.3.3 Back-End Analysis i 1he Appmach UsedforBack-End Analysis i

De methodology employed in the Prairie Island PE for the back end evaluation is clearly described in  !

( the submittal. Five containment event trees (CETs) are developed for the 14 accident classes (ACs) I obtained in the IPE. Similar to plant damage states (PDSs) in other pes, accident classes are used in she Prairie Island IPE to group the core damage sequences obtained from the I.avel 1 analysis. However, unlike the PDSs used in the ot?w pes, the availability of containment systems are not explicitly included in the definition of the ACs In the Prairie Island IPE, containment system fault trees (for containment spray injection, containment spray recirculation, and containment fan coil units) were quantified as frontline systems along with the Level I frontline and support system fault trees using linked fault tree

' models. De containment systems fault tree cutsets were input to the CET branches as ===y to support CET quantification.

De CETs used in the Prairie Island IPE provkle a structure for the evaluation of most of the containment failure modes discussed in NUREG-1335. De marmlammt failure ~ modes that are assumed negligible and

, thus not included in CET quantification include those from containment shell melt through, vessel thrust force (the rocket mode failure) and penetration failure due to degradation of sealing materials under harsh

' environmental condition. De containment failure modes that are considered as unlikely but are assigned

'small probability values include those from direct containment heating, in-vessel steam explosion, ex.

vessel steam explosion, and hydrogen combustion. Containment isolation failure is also considered as unlikely but is evaluated in CET quantification using the data obtained in containment isolation analysis.

He quantification of the CET in the Prairie Island IPE is based on plant specific phenomenological evaluations, which include modeling and bounding calculations (based upon experimental data),

consideration of phenomenological uncertainties, and MAAP calculations.

De result of the CET analysis are grouped to 17 CET and states. Release fractions for these CET and states are determined by the analyses of representative sequences using MAAP computer codes.

I 1

For the Pralrie Island Nuclear Generating Station PE, the definition of the interface between Level 1 and level 2 analyses is reasonable. De CET is well structured and easy to understand. CET quantification .

and source term grouping and quantification also seem adequate. De IPE process is in general logical i - and consistent with GL 38-20. ,

O h

[

1 m -

- - , . - , v .-

. i q ,

1

i .

l * . *.  :

Bact-End Analysis Results I' - ne conditional probabilities of the ACs obtained in the back-end analysis for the various accident i; initiators are

23% for small LOCA G ACs),22% h transient G ACs),19% for internal flooding G j" ACs),16% for medium or large LOCA G ACs),13% for SGTR G ACs),6% for SBO (1 AC),0.6%

j. for A'IWS G ACs), and 0.4% forISLOCA (1 AC). In terms ofindividual ACs, the leading AC is one i ' with transient inhiator with early core melt and the RCS at high pressure G0% of CDF). His is followed closely by ACs initiated by internal flooding (19%) and small LOCA (17%), both with early j core melt and high RCS pressure, an AC with medium and large LOCAs with early core melt and low RCS pressure (15%), an AC initiated by SGTR (11%), and the AC for SBO accident sequences (6%).

Table E-3 shows the probabilities of contalamaat failure modes for Prairie Island Nuclear Generating Station as percentages of the total CDF. Results from the,NUREG-1150 analyses for Surry and Zion are also presented for comparison.

l Table E 3. Containment Failure as a Pertantage of Total CDF i Prairie Island Nuclear Containment Failure Mode Generating Station l N 1150 NUREG 1150 j IPE+ +

Early Failure 0.8 0.7 1.4 Late Failure 22.6 5.9 24.0 l

l Bypass 44.7 12.2 0.7 l 1 solation Failure 0.02 l' intact CDF (1/ry) 31.8 4.9E-5 81.2 4.0E-5 73.0 3.4E.4 lj

" De data presented for Praine Island are based on Table 4.7-1 of the IPd submittal. About 30%

l cf bypass is due to induced SGTR (ISGTR). However, according to the licensee's responses to j the RAI, ISGTR is effectively precluded by a procedure change recommanded by the Westinghouse Owners Group and implemented at Prairie Island. De probability of bypass failure would decrease, and intact containment increase, by 30% if ISGTR is allminated.'

included in Early Failure, approximately 0.02%

~

. Included in Early Failure, appqpximately 0.5%

1 i

l As abown in the above table, the madirianni probabilky of enat=1amant bypass for Prairie Island is 44.7%

of total CDP. Most of h is from induced steam r.c.arator tube rupture 00%). Excluding ISGTR, lj ==talaman' bypass is i,.Ls rily from SGTR Q.2%) with small contribution from ISIDCA (0.5%).

I it . The conditional probability of early containment failure for Prairie Island is about 0.8% of total CDF.

l;

• It is about equally contributed by internal Sooding G8% of early failure), small LOCA (265), transient GO%) and medium /large LOCA G0%) accident classes. De contribution from SBO sequences is only 4

!t -

about 6%. He smaller contribution from SBO sequences is partly due to the low CDF of SBO sequences j (about 6% of total CDF). Early mnenlamant failure is primarily due to hydrogen burn with vessel breach i

l

! xv i'

s 5

I 9' g , . . - - - + --,- -w , m .%=,,wp .ar "

l at high pressure G4% of early failure CDF). De remaining 26% of early failure is also due to hydrogen

burn, but with no vessel failure, primarily from medium /large LOCA sequences.

'3 De conditional probability of late conta*mment failure for Prairie Island is 22.6% of total CDF. More

!: than half of this probability is from small LOCA sequences (59%), with most of the remaining coming

!, from transient sequences (38%). On a conditional basis,58% of small LOCA sequences results in late l' containment failure and 39% of transient sequences results in late containment failure. De contribution j from SB0 aequences is relatively low in comparison with that from small LOCA or transient sequences

! (25 to total late failure CDF and 7% conditional probability). De low failure probability for SBO is probably due to ac recovery. De time allowed for ac recovery is long for late containment failure.

l i

i For Prairie Island, late containment failure is primarily due to overts.is.are/ overpressure failure l caused by lack of moling to the debris dispersed outside of the reactor cavity 08% of late failure CDF).

Because a significant amount of core debris is' dispersed to outside of the reactor cavity only in high l

pressure vessel failure cases, the conditional probability of late containment failure is low for accident j

classes that involve low pressure vessel failure or no vessel failure (e.g., medium /large LOCA and the i

late core melt accident classes). Besides the above late failure mechanism, another important late failure mechanism is that associated with the loss of decay heat removal (22% of late failure). De contribution from basemat melt 4hrough is small because core debris is assumed to be coolable if RWST water is injected to the containment.

Source terms are provided in the IPE for 17 CET and states using MAAP code calculation results. Four of the 17 source terms are for containment bypass, three each for containment isolation failure, early containment failure and no containment failure, and four for late containment failure. Source term definitions are based on MAAP calculations for 11 selected sequences. Sequence selection is based on the consideration of the dominant sequence in each end state and other factors that influence the source term results. De sequ'ence selection and the assignment of release fractions for source term determination seem adequate.

"Two types of sensitivity studies are performed in the Prairie Island IPE to determine key assumptions on hhe final results. De first type of sensitivity studies are probabilistic in nature and address uncertainties in the quantification of the various containment failure modes modeled in the CET. De second type of sensitivity studies involve deterministic analyses, performed in the IPE to establish the sensitivity of the Level 2 analysis to uncertainties in the pbysical modeling of containment response and the source term.

De issues investigated in the sensitivity studies of the first type include en vessel cooling, RCS depressurization due to hot leg creep rupture, and coolability of the core debris in the reactor cavity and in the containment upper compartment (due to debris dispersal). De parameters investigated in the sensitivity studies of the second type include those recommended in the EPRI Guidance Document for performing sensitivity studies with MAAP 3.08, the augmentations to these recommendations provided in the NRC sponsored MAAP 3.0B code evaluation, and specific areas deemed important for Prairie e Island. De sensitivity studies provkled in the Prairie Island IPE seems to have addressed the issues of significant uncertainties in the IPE analysis.

t i E.4 Generic Issues and Containment Performance Improvements The IPE addresses USI A-45 on decay beat removal (DHR). Several methods of DHR are discussed, including semndary cooldown and depressurization (using either AFW or main feedwater providing the xvi b

e+- . ..e- - - . - - - - . . . . . - o... . ,-. .-4

I .'

~

l .

j steam generator makeup), feed and bleed (i.e., utilizing the SI pumps and pressurizer PORV), safety injection and recirculation cooling (as provided by the Si and RHR systems), and shutdown cooling (by l ,

- the RHR operation) . In addition containment cooling is mentioned. De CDF contributions from each j of the individual DHR methods were estimated neither in the submittal nor in the RAI response.

7 De submhtal provida a fairly detailed description of each of the diverse DHR capbilities at the Prairie j Island plant. De description includes a reiteration of several specific features of the systems involved j in DHR and major modeling assumptions, a discussion of the effects of initiating events on the systems' unavailabilities, and a presentation of the important hardware failures and operator errors contributing to these unavailabilities.

}

De NRC defines two. requirements in NUREG-1289 that have to be met by any system which performs f DHR. Dese are:

f 1. Maintain sufficient water inventory in the RCS to ensure adequate cooling of the fuel.

2. Provide the means for transferring heat from the RCS to an ultimate heat sink.

! In the IPE there are no core damage sequence that do not involve loss of either one or both of the two f requirements. His fact lead the licensee to consider the loss of DHR to be synonymous with core

! damage. Since the overall CDP was found to be acceptably low (5 E 05/yr) and h was shown that there are several redundant and diverse means for DHR, (i.e., several of the DHR systems and operator actions j would have to fail in combination to have a serious negative impact on the DHR capability), the licensee considered that it has fulfilled the " Shutdown Decay Heat Removal Requirements" of " Unresolved Safety

^

Issue A-45," (USI A-45).

I No GSIs'or USIs, other than USI A 45 are addressed in the submittal.

k De CPI recommendation for PWRs with a dry containment is the evaluation of containment and I equipment vulnerabilities to localized hydrogen combustion and the need for improvements. Although the effects of hydrogen combustion on =Walament integrity and equipment are discussed in the submittal,

, the CPI issue is not specifically addressed in the submittal. More detailed information on this issue is I provided in the licensee's response to the RAI (Level 2 Question 10). Hydrogen sources, the condition 7 for hydrogen detonation, and the load for hydrogen deflagration are discussed in the response. According to the response, hydrogen detonation is highly unlikely to occur with the Prairie Island containment g

2 geometry and hydrogen concentration. 7he loading condition generated by hydrogen deflagration has

been pessimistically treated in the IPE and found not likely to cause containment failure.

E.5 Vulnerabilities and Plant Improvements i De criteria used in the Prairie Island IPE to datarmine whether any vulnerability salsted at the plant

! were:

~

1. Are there any new or unusual means by which core damage or containment failure occur as j compared to those identified in other PRAs?

. 2. Is there adequate assurance of no undue risk to public health and safety?.

i XVII t

l 1

I

= - - - -- -

e f De licensee states that neither cf the above criteria lead to the identificatk.o cf potential vulnerabilities .

i for the plant. De IPE process demonstrated that; the accident classes cc ntributing to the CDF are

, wzupar.ble with those calculated in PRAs of similar nuclear plants (indeed the comparison made in Table

! 2.4-1 of the submittal with Surry, Kewaunee, Point Beach supports this viewpoint), and the overall CDF -

.t itself is at an acceptably low level of 5E 05/yr. Derefore the licensee believes that there is adequate

[! assurance of no undue risk to public health and safety. ,

De licensee states that while no vulnerability exists, as a result of the IPE, recommandarians have been generated for plant improvements. These recommandatlans are partly implemt. red partly or only under i consideration but by no means represent any definitive "NRC commitments". De recommendations focus on plant improvements in three areas, such as: procedural / administrative, structural and trairig enhancements.

Depending on further evaluation of potential benefits and practicality, the licensee expects a significant

, decrease in the overall CDF (a decrease of IE-05/yr or greater). In particular, the risk contribution from intemal flooding is anticipated to be reduced from 1E-05/yr to approximately 1E 08/yr.

A =mmary of the Level I related recommendations is provided below:

Procedural / Administrative Enhancements

1. The plant already proceduralized the process establishing crosstie from station air to instrument air in C34 AOP1, Rev.0.

a) If the crosstle could be established within one hour after a CL Loop A break, feed &

bleed or main feedwater cooling could be restored aad core melt could be prevented.(The station air compressors are cooled from Loop B cooling water and are not affected by a break in the other loop.)

b) The new procedure prescribes also that station air crosstle should be used when an IA compressor is in ==1ntanance.

Present (November 28,1995) disposition of the recommendation: a) C34 AOP 1, Rev. 4 incorporates this action (Step 2.4.6); b) C34, Rev 12 incorporates this recommandation.

2. De procedure C35 AOP1, Rev.2,

• Loss of CL Water Hender A or B" should be revised such that the crosstie between CL Loop A and B could be used. Two valves,'one manual and an AOV bave to be opened during 20 minutes to supply cooling water to the MFW pumps' lube oil coolers. De MFW pumps can conservatively operate w/o cooling water for about 20 minutes before possible pump damage.

I Present disposition of the reco===hlan: See the next disposition. '

Structural Enhan=nents

< 1. Constrain the impact of AFW pump room flooding by some simple measures. Evaluations are underway to determine the best long term solution. In the interim the following measures are xviii V-~ * ~ - - +- ---,.-4, _ . . ~ --

y _ _ . .

l1- *

)i l t suggested; modify the side doors to promote water flow out of the room, or close the fire door i between the two halves of the room and render the door to be " water tight".

\;; -

>2 Present diWa of the recomraandehn: De CL beader piping was completely replaced with a piping

! with a 33% thicker wall during the November,1992 dual. unit outage. De internal surface of the new

L pipe is costed with an epoxy coating to inhibk microbiologically induced corrosion (h0C). Also piping i j failure would be noticed by any personnel who periodically walk through these rooms.

Enhanament of Training I I

i 1. Explain the .- " opec-se of the Feed & Bleed process. Put an emphasis to the operator actions that ,

j are necessary for success. It is expected that the training will result in marked radwehn of the l

contribution of accident class 'IME to the overall CDF. l

2. Explain the impurmee of crosstie between the MDAFW pumps. Emphasize the operator actions i that are required for success.

3. Explain the importance of switchover to high and low head recirculation. Emphasize the operator activitics that are required to success. De training may reduce significantly the CDF contribution of the accident r! ass SLL.

4. Explain the importance of RCS cooldown and depressurization to terminate SI before ruptured SG overfill. Emphasize the operator actions that are required for success. It is =W that the training results in reduction of the CDF contribution of accident class GLH.

De following two recommendations are related to the back end:

i 1. Revise the EOP that require the restart of the RCPs under ICC condition. It is recommended in the IPE submittal that the operator checks for adequate steam generator level before attempting to start the RCP. His recommendatica is intended to reduce the probability ofISGTR.

_ 2. Secure open the in-core instrument tube hatches for both units to allow water to flow into the

, reactor cavity to provide cooling to the lower vessel head (i.e., ex-vessel cooling) and improve I debris coolability in the reactor cavity. - l I

E.6 Observations I

, De licensee appears to have analyzed the design and operations of Prairie Island Nuclear Generating Station to discover instances of particular vulnerability to core damage. k also appears that the licensee

! has: developed an overall appreciadon of severe accident behavior; gained an understanding of the most

likely rever9 accidents at Prairie Island Nuclear Generating Station; gained a quantitative understanding i , of the ov.irall frequency of core damage; and implamantad changes to the plant to help prevent and

! ahiga's nevere accidents.

r -

Strengths of the level 1 analysis of the IPE are as follows: Dorough analysis ofinitiating events and their impact for both units of the plant, descriptions of the plant responses, presentation of the results of supporting MAAP calculations (Section 7 of the submittal), reasonable failure data and common cause i

,? -

1

{ factors, usage cf plant specific data whenever possible to support the quantification cf initiating events -

l jt and system unavailabilitics, and an importance analysis on major variables impacting core damage. De l

j effort seems to have been evenly distributed across the various areas of the analysis. , l iI 1j De IPE level I analysis has no fMamantal wanimmaa. Its " leading" minor weakness is the lack of l detail in the individual accident sequence descriptions. The text of the submittal everywhere indicated

that a detailed analysis was done but only highlights were reported.

tt j, De IPE determined that an internal flooding sequence is the primary contributor to core damage. Its j initiator is a cooling water line break inside either the Unit 1 or Unit 2 side of the Turbine Building j- AFW/lA compressor room, which causes failure of these two systems for both units. Dere is a low potential for this pipe rupture (only a small section of piping is hrmived),however, this initiating event represents a potentially important location dependency for several systems at the plant, since the AFW pumps (~M=y heat removal) and the 1A compressors (in Feed & Bleed support for pressurizar PORV) 3

. are located in the same room.

(6 i, As was noted previously, several recommendations for plant improvements have been made as a result of insights obtained from the IPE, particularly to reduce the CDF contribution of the above mentioned f l j flood accident. De CDF impact of these improvamante is expected to be a CDF decrease on the order j of IE-05/yr or greater.

De HRA review of the Prairie Island IPE submittal did not identify any significant problems or errors.

l A viable approach was used in performing the HRA and nothing in the licensees submittal indicated that t k failed so meet the intent of Generic latter 88-20 in regards to the HRA. Important elements pertinent

. to this determination include the followingi I-

• De submittal indicated that utility personnel were involved in the HRA and the procedure i, reviews, discussions with operations and training staff, and walkdowns of operator actions i represent a viable process for confirmlag that the HRA portions of the IPE represent the as-built-as operated plant.

l

• De analysis of pre-initiator human actions focused on restoration faults. De HEPs assigned to the modeled restoration faults and the approach for computing the component unavailabilities appeared reasonable. Dependencies between restoration errors were not addressed because it was

argued that plant practices regarding maintaannem of separate trains assured the independence of

! restoration faults. Miscalibration errors we e " treated through the inclusion of common cause failure modeling for the sensors or instruteents themelvc::," He licensee's treatment of l3 miscalibration events may have precluded identi6 cation of. ' .,,Med pre-initiator events and is i therefore a weakness of the HRA.

!;

• Post-initiator human actions modeled included both responsetype and recwj type actions.

Although the darumanewinn for the acreenlag analysis performed on post-initiators was minimal, k appeared that the screening analysis wm relatively more " plant-speelfic" and detailed than many j{

!i of those id ed for other IPEs. In addition, the licensee stated that if enore than one operator

!' action occurred in the ame cutset, "either independence of the human actions was ceefirmed, or

!' a change was made to correctly model dependence between human errors." he licensee's

!. response to an additional RAI regarding treatment of dependencies confirmed that they were i

1 l

l- _ _ _ _ . . _ _ _ _ _ _ .

i ._ - - - -

l1-

~

4

!'. appropriately addressed. Moreover, the detailed quantification of important post-initiator operator

f actions and the quantification of recovery actions appeared sound.

ji*

[ Plant-specific performance shaping factors (PSFs) and -event timing, were appropriately

.. muMud.

!I l'

ii e' A list of important buman actions based on their contribution to core damage frequency was provided in the submittal.

l De following are the major findings of the back end analysis described in the submittal:

i

• De back-end portion of the IPE supplies a substantial amount of information with regards to the j subject areas identified in Generic latter 88-20.

!

• The Prairie Island Nuclear Generating Station IPE provides an evaluation of all phenomena of 3

importance to severe accident progression in accordance with Appendix I of the Generic Letter.  ;

t  :

ii

• De IPE has identified a plant specific reactor cavity configuration feature that may affect accideat  ;

' progression. Based on the IPE, it is recommended that the in core instrument tube hatches for both units be secured open to allow water to Sow into the reador cavity to provide cooling to the lower ,

l vessel head (i.e., ex-vessel cooling) and improve debris coolability in the reactor cavity.

• De steel shell containment of Prairie Island may be vulnerable to direct attack by dispersed core debris. De access hatches to the instrument tunnel are in an open area on the basement level of the containment, and for both of the Prairie Island units one of the two hatches faces toward the steel containment, about 30 A away, with a largely unobstructed path in between. Although a scoping study performed in the IPE shows that the temperature generated by the debris adhering to the steel wall is insufficient to melt the steel and breach the cont =taa=*. details of the stoping study are not provided in the submittal and the potential effect of corium attack on reducing containment pressure capability is not discussed.

-

• The IPE identified the potential ofISGTR due to the restart the RCPs upon an inadequate core cooling (ICC) condition. Based on the IPE results, h is recommended in the IPE submittal that the EOP that requires the restart of the RCPs under ICC condition be snodified. It is recommended in the IPE submittal that the operator checks for adequate steam generator level before attempting to start the RCP. His recommendation is intended to reduce or eliminate the

• probability ofISGTR.

t

• De con +=1a'a-a' analyses indicate that there is a 68% conditional probability of containment

! failure ifISGTR due to restart of the RCP is included. De conditional probability of conalament bypass is about 45% of which 30% is from ISGTR, the conditional probability of early containment failure is 0.8%, the conditional probability of isolation failure is about 0.02%, and i

the conditional probability oflate cant =1amant failure is 23%. De conditional probability of

, containment bypass decreases by 30% ifISGTR is assumed not to occur.

['

De licensee has addressed the recommandatlans of the CPI program.

i xxi wm,.p 9-a.wg h m m e_ - - 6 @ 4No 4 am==y*emh'- *'+su--

_,, s _ & .m , J.- - . mn ,

e O t

A e-i e

-- *' "'" *w -. -- ,,.~. _. _ ,,

6 k

h 3

Y 1

I' e

4 1

+

4 d

t o

i

'h e I

4 ,

t a i k

~

f 1,

T l

4 e

.h 1

4

+  ; -

( . - .

i t

I se 1

4 f,

4 e-----..--- . - _ ._m _

I I -

s NOMENCLATURE i-y

} AC Accident Class (or Alternating Current) i AFW Auxiliary Feedwater AMSAC ANS Mitigating System Actuation Circuitry

AOP Abnormal Operating Procedure AOV Air Opented Valve i ASEP Accident Sequence Evaluation Program ATWS Anticipated Transient Without Scram BAST , Boric Acid Supply Tank BWR Bolling Water Reactor '

CC Component Cooling System

, CCF Common Cause Failure .

CCW Component Cooling Water CDF Core Damage Frequency CET Containment Event Tree CL Cooling Water CPI Containment Performance Improvement CS Containment Spray CST Condensate Storage Tank CVCS Chemical and Volume Control System DCH Direct Containment Heating DHR Decay Heat Removal EDG Emergency Diesel Generator i EOP Emergency Operating Procedure EP Emergency Procedure

.EPRI Electric Power Research Institute FCU Fan Cooler Units

~

FW Feedwater GKA Gabor, Kenton & Associates GL Generic Letter N GSI Generic Safety Issue HEP Human Error Probability '

HPME High Pressure Melt Ejection HRA Human Reliability Analysis IA Instrument Air

, ICC Inadequate Core Cooling

IDCOR Industry Degraded Core Rul=*ia!

j IFL Internal Flooding .

- IPE Individual Plant Evaluation

IPEM Individual Plant Evaluation Methodology A

IPEP Individual Plant Evaluation Partnership i

ISGTR Induced Steam Generator Tube Rupture i ISLOCA Interfacing Systems LOCA LOCA Loss of Coolant Accident t .

I s

NOMENCLATURE (Cont'd) -

i-I LOCL Loss of Cooling / Service Water l LOOP Loss of Offsite Power MAAP Modular Accident Analysis Program MCC Motor Control Center MDAFW Motor Driven Auxiliary Feedwater MFW Main Feedwater MGL Multiple Greek Letter MIC Microbiologically Induced Corrosion MOV Motor Operated Valve i MSIV Main Stream Isolation Valve

! MWe Megawatt Electric

NRC Nuclear Regulatory Commission NSP Northern States Power Company

PDS Plant Damage State PJ Prairie Island PORV Power Operated Relief Valve PRA Probabilistic Risk Analysis PSF Performance Shaping Factor PTS Pressurized Thermal Shock i

RAI Request for AdditionalInformation RCP I Reactor Coolant Pump  ;

RCS Reactor Cooling System RHR Residual Heat Removal '

RPV l

Reactor Pressure Vessel RWST Refueling Water Storage Tank '

SBO Station Blackout

' SDC Shutdown Cooling SG Steam Generator i SGTR Steam Generator Tube Rupture

. SI Safety injection i SRO Senior Reactor Operator f TDAFW Turbine Driven Auxiliary Feedwater TER Technical Evaluation Report l THERP Technique for Human Error Rate Prediction TRC Time Response Correlation j UFSAR Updated Final Safety Analysis Raport USAR Updated Safety Analysis Report i USI Unresolved Safety Issue f

l 3

3DdV '

e i

p*- me me w - ep , , . . - - - _#epe*ew-*-N-="' e-**, -<w*w+P* * * ' ' ' ' " "

i'

$,, 2 1 INTRODUCTION

~

t r 1.1 Review Process i i

{[

This technical evaluation repor: (TER) dammante the results of the BNL review of the Prairie Island Nuclear Generating Plant (Unit 1 and Unit 2) Individual Plant Eaamination (IPE) submittal [IPE

submittal, RAI Responses). His technical evaluation report adopts the NRC review objectives, which j belude the fo!!owing:

+

• To assess if the IPE submittal meets the intent of Generic Letter 38-20, and

• To determine if the IPE submittal provides the level of detail requested in the " Submittal Guidance k

h== " NUREG-1335.

j i

i A Request of Additional Information (RAI), which resulted from a preliminary review of the IPE l submittal, was prepared by BNL and discussed with the NRC on October 4,1995. Based on this discussion, the NRC staff submitted an RAI to Northern States Power Company on December 21,1995.

The Northern States Power Company responded to the RAI [RAI Responses) in a document dated j February 27,1996 This TER is based on the original submittal and the response to the RAl.

I j 1.2 Plant Characterization  ;

- 1

{

i De Prairie Istard Nuclear Generating Plant consists of two 560 MWe two-loop Westinghouse pressurized j water reactor units,JJnit I and Unit 2. De reactor coolant system (RCS) of each unit includes the

. pressure vessel, two vertical steam generators, two reactor coolant pumps, an electrically heated )

~l pressurizar and interconnected piping. De RCS is housed inside a large dry containment. Reactors with i similar characteristics are: Ginna, Kewaunee and Point Beach 1 and 2.

1 i De plant is located near Red Wing, Minnesota. It is operated by the Northern States Power Co. (NSP).

j Full commercial operation began on December 16,1973 for Unit I and December 21,1974 for Unit 2.

a+

l A number of design features at Prairie Island 1 and 2 impacts the core damage frequency (CDF). De j submittal highlights these features, but does not estimate their effects on the CDF individually.

j'

] He following features tend to decrease the CDF:

i I'

• De offsite switchyard has a highly reliable and diverse dual ring bus arrangement, minimiring the j chance for loss of offsite power. Safeguards buses are nonnally powered from transformers (1R, 2R or CT11, CT12) which are not required to transfer on loss of the main generator.

-

• De emergency AC power configuration includes four diesel generators of diverse design and support j

system requirements. In the event of an SBO condition, each diesel generator has the capability to supply the power requirernents for the bot shutdown loads for its associated unit, as well as one train of manM loads of the blacked out unit through the use of manual bus tie breakers interconnecting the 4160 buses between units. He crosstie of a safeguards 4160 bus from one unit to the diesel generator for the other unit can be performed from the control room, within ten minutes of the onset 1

1 3

i, 4

i j j of SBO. (The present AC power configuration is a consequence of the SBO rule using guidance of NUMARC 87 00 and regulatory guide 1.155. De original AC power configuration included only jj two DGs shared between units, and the plant was classified as an eight hour coping plant. De plant's j i present coping classification is four hours.) '

j. As part of the modifications that were performed on the AC power system by adding two DGs after

!! the SBO rule, the safeguards 480 V power system was also modified such that there are now four ji anfeguards 480 V buses per unit wbere there were only two before. %: power supplies for MCCs i 1ABI and 1AB2, as well as 1T1 and 172, can be cross tied between Unit I and Unit 2. (Ihis

! crosstic capability, however, was not credited in the plant model.) .

l The cooling water system is diverse. It consists of five pumps of which two are horizontal motor driven, and three are vertical pumps with one motor drive and two diesel driven. De single vertical j motor driven pump is also backed by safeguard diesel generators (before the SBO rule the pump was j.* powered by a non safeguards power supply) while the two diesel driven pumps do not rely on AC

power for operation, i.e., there are three cooling water pumps available following a LOOP. De cooling waer system consists of a ring header that can be divided into two separate headers on receipt l, of an Si signal. Each header supplies half of both trains of safeguards equipment.

)

• De secondary cooling function involving the main feedwater and auxiliary feedwater systems is very j reliable. Main feedwater is lost on a reactor trip but is easily recoverable from the control room.

The feedpumps are motor driven, i.e., independent of main steam availability. Each unit has a

!, turbine and a motor driven auxiliary feedwater pump. De motor driven AFW pumps can be j+ crosstied between both units. Large condensate storage tanks (CST) are capable of providing water l for decay heat removal without the need for makeup.

De component' cooling systems of the units have crosstle capability. His capability was not l credited, however, in the plant model, i

j

• De main steam system design is such that in order to fall the isolation of a ruptured SG, the non-

! return check valve together with the MSIVs of both the ruptured and intact steam generators must fall

!! which results in a low probability for SG isolation failure. ..

~

De RCP seal cooling is provided by two independent systems, the charging pumps and the

!: component cooling (CC) system. Although the CC system requires cooling water for cooling, the l, charging pumps do not require CC cooling water to provide RCP asal injection. In addition, the j{

charging pumps do not provide the dual function of SI pumps.

He injection pressure of the SI pumps is high enough such that operator action is not required to i lower the RCS pressure for 51 injection following an "S" alsnal.

t

• Bleed and feed cooling is a proceduralized action.

!:

• De equipment located in the Anaillary Building does not require room cooling for extended periods i, ofoperation. Analysis has been pedormed which demonstrates that the CS, CC, RER and SI pumps do not require ventilation for aneralw periods of pump operation. -

J 4

• 1 l 2

)'

H

i l,

t,

g. ,

}..

• De RWST is large and can provide many hours of makeup to the reactor for small break LOCA and i SGTR.

[.

• De seapoint for containment spray (CS) actuation is high; 23 psig. %1s condition preserves RWST

+ inventory for a large fraction of the RCS break spectrum.

l

• A favorable moderator temperature coeffician; for the majority of the cycle allows the plant to effectively ride out an ATWS with feedwater or 4FW.

i j

• New cooling water header from cormsion resirmW and thicker piping is installed to avoid a potential j single flood failing all secondary cooling and instrument air which then causes failure of feed and j ,

bleed cooling as the pressurizer PORVs need air to operate.

• The plant does not test any of the valves in the ISLOCA pdways while the plant is above cold shutdown.

• De motor operated valves nearest the RCS in the RHR locp return line and the RHR loop suction line have their power removed during normal operation to prevent inadvertent valve manipulation.

J

• The low pressure piping in the RHR and SI systems can withstand full RCS pressure without exceeding the piping ultimate pressure stress. (Conditional probability of low pressure piping failure following exposure to full RCS pressure was considered in the ISLOCA analysis.)

He following features tend to increase the CDF: ,

,

• Both D1 and D2 diesel generators rely on cooling water for engine cooling functions. (The other two

, diesel generators are from a different manufacturer and do not require an external coollrg medium

as they have their own self contained cooling systems.)

• Both main feedwater and feed and bleed cooling are dependent on common support systems; instrument air, cooling water and DC power.

f

• Cooling water, instrument air and control room chilled water systems are shared by both units. Dese are systems that are required to be fully operational when either unit is at power. Maintannam on .

these systems is normally performed while both units are at power. Maintenance , activity may influence negatively the availability of these systems.

• He auxiliary feedwater pumps for both units are all located in the same room such that a pipe rupture in the loop A or B cooling water line can result in the failure of all auxiliary feedwater for both units.

• The instrument air compressors are also located in the same room as the auxillary feedwater pumps j ,

auch that all the compressors could fall because of a flood, causing loss of instrument air for both j units. Loss of instrument air results in closure of the main feedwater regulating and bypass valves which together with auxiliary feedwater failure, results in the loss of secondary cooling. Feed and

. bleed then fails because the pressurizer PORVs require instrument air to operate.

{

• Feedwater regulating and bypass valves fall closed also on loss of a train of DC.

3

^' " ' ' " - * - - -

_-_UIW-.'-__i*WF"WT"__* _l T F."15 % -* f .'$t gu, M

~

<

• De emergency batteries have only two hours of capacity. -

!

• De instmment air supply to containment has two fall closed air operated valves that are in series on l < either sides of the containment penetration. Failure of either valve results in loss of instrument air

t. . . _.

so containment. ..-

I

• Loss of instmment air will cause the control room chiller outlet cooling water valves to close resulting in loss of chilled water and loss of room cooling to the unit 1480 V safeguards bus rooms. Without operator intervention, the rooms can bestup and fail the 4160/480 V transformers resulting in a loss of all unit 1480 V safeguards equipment. His would cause loss of all charging pumps resulting in a loss of all RCP seal cooling causing an RCP seal LOCA in which the SI system would not be available for mitigation.

• Both RCP seal cooling and RCS short term inventory control are dependent on cooling water.

Cooling water provides the ultimme heat sink for the component cooling water system which provides cooling to the RCP thermal barrier and the SI pump lube oil coolers. Cooling water also supplies

! a heat sink for the control room chillers which provide room cooling for the Unit 1 safeguards 480 V bus rooms. On loss of cooling water, room cooling is lost to the Unit I safeguards 480 V bus

, j room. Without operator intervention the room can heatup and fail the 4160/480 V transformers resulting in, as previously mentioned, a loss of all Unit 1480 V safeguards equipment.

. According to the licensee's response to the RAI, since the IPE was submitted room ventilation problems involving the control room chilled water system have changed. Each of the 480 V buses

~

was split into two and now each of the buses carries half of the original loads. In addition, only one of these buses is now located in a room. Furthermore, new thermal analysis showed that without ventilation and assuming no operator action, these soom temperatures do not reach debilitating levels

within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. With operator action (to open doors at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) room ~ temperatures decrease to a steady-state temperature well below operability limits, i .

• In the licensee's response to the RAI a minor new concern was indicated. He concern is associated with the ventilation r,f Unit 14160 V bus rooms. New bus sequencer units are located now in these

! rooms and they are sensitive for large temperature change. De risk impact of their failure due to loss of safeguards chilled water was deemed, however, to be not significant, because additional equipment must be lost before the sequencer would be called upon to operate. Even if this were to .

l cccur, safeguards equipment could still be operated without sequences (nanually) in response to the

, event. Furthermore, operator actions to restore ventilation to these roor .; now are proceduralized.

• He instmment air system has a high failure probability as the system success criterion is such that if two out of three compressors fall, instrument air is considered failed. A single compressor cannot snaintain adequate header pressure for both units.

)

• Feed and bleed cooling is heavily dependent on operator action for success as the operator must l saanually start an Si pump and open a pressurizer PORY for success.

I

• Following a small LOCA the SI pumps are the only irg}ection sources that can be used for short term i RCS inventory control because the RCS pressure remains above the shutoff head of the RHR pumps.

Drough plant specific analysis, it was found that depressurizing the SGs to lower RCS pressure to i enable the RHR pumps to inject was not possible in time to prevent core damage.

4 i i i

i

k I .

{

• Given a medium LOCA, switchover to high head recirculation can not be performed from the control I toom as the RHR to Si crossover motor valves have their breakers locked in the open position. *Ihe switchover to high head recirculation must be accomplished within a small time window during which

[.

r doth the SI, CS and/or the RHR pumps are Iqjecting from the RWST. If the operator falls to stop

[ any of the pumps before the RWST level decreases below approximately 5%, all pumps will be

} damaged as they do not have suction trips.

• De breakers for Si pump suction MOVs from RHR are locked open during power operation.

(

i The Prairie Island Nuclear Generating Station utilizes a large dry containment with a freestanding steel

!' shell construction. De steel reactor contalamant vessel is enclosed by a 2-1/2 foot thick concrete shield building. Some of the plant characteristics important to the back-end analysis are summarised in Table

} I below and compared to the characteristics of the Zion and Surry plants.

! Table 1 Plant and Containment Characteristics for Prairie Island Nuclear Generating Station i

[ Characteristic Prairie Island 2Jon Surry Thermal Power, MW(t) 1650 3236 2441 f RCS Water Volume, ft* 5940 12,700 9200 l Containment Free volume, ft* 1,320,000 2,860,000 1,800,000 lI Mass of Fuel, Ibm Mass of Zircalloy, Ibm 108,000 24,700 216,000 44,500 175,000 36,200 i-s Containment Design Pressure, psig 46 47 45 l[,

l{

Median Containment Failure Pressure, psig RCS Water Volume / Power, ft*/MW(t) 150 3.6 135 3.9 126 3.8

. j i.

i' Containment Volume / Power, ft*/MW(t) 800 884 737

! Zr Mass / Containment Volume, Ibm / ft* 0.019 0.016 0.020 I t Fuel Mass / Containment Volume, Ibm / ft* 0.082 0.076 0.097  !

(!

l =

i' Both the power level and the cont =1amant free volume of Prairie Island are significantly less than those .l j^ of Zion and Surry. However, the containment volume to thermal power ratio for Prairie Island is between if that for Zion and Surry. Similarly, although the reactor coolant system (RCS) water volume, fuel mass, l

5 and Zircalloy mass of Prairie Island are smaller than those of Zion and Surry, the ratio of the RCS water l!

lj volume to reactor thermal power, the ratio of fuel and Zircalloy mass to containment volume for Prairie island are similar to those for Zion and Surry. De median mntainment failure pressure obtained in the j

J Prairie Island IPE is 150 psig. His is slightly higher than those ahtninad in NUREG-1150 for Zion and Surry. It is noted that the parameters prenantad in the above table provide only rough indications of the ll.

li , ,

containment's capability to meet severe accident dallenges and that both the contalament strength and i the challenges associated with the severe accident involve significant uncertainties.

!f jj

,s

. De plant characteristles *.-yes.st to the back end analysis are: l I>

• A cavity design which facilitates flooding of the reactor cavity. According to the IPE, water can l readily flow from the upper compartment to the annular containment floors. Flooding of the cavity i 5 l!

li t

I a

uo.-a.w.-.-a--egr-w __***-+--e-~'==~w- - - - - - - - - ~_ - - - + - - - - ,-is. ~~

. i -

l is accomplished through two personnel access hatches (located on the instrument tunnel) which are -

k left slightly ajar during normal operation and allows water flow from the containment floor down to i

, the cavity for vessel head flooding.

• Ibis provides external cooling to the core inside the reactor *

} ~

vessel. Sircc the flow velocity going into the lastrument tunnel may be sufficient to pull the doors )

L closed, a recommendation of securing the hatchs epen by installing a solid bar or other device, l

- instead of a chain, is discussed in the IPE submittal. i l

?

• A steel shell containment that is vulnerable to direct attack by dispersed core debris. 'Ibe access  !

, hatches to the lastrument tunnel are in an opes area oc the basement level of the containment, and

' for both of the Prairie Island units one of the two hatches faces toward the steel containmant, about 6 30 ft away, whb a largely unobstruded path in between. Although a scoping study performed in the IPE shows that the temperature generated by the debris adhering to the steel wall is insufficient to melt the steel and breach the containment, details of the scoping study are not provided in the submittal and the pataa'M effect of corium attack on reducing containment pressure capability is not discussed.

t * 'Ibe large containment volume, high coaata-at pressure capability, and the open nature of compartments which facilitates good atmospheric mixing.

• Two separate systems for cobtainment atmosphere cooling and pressure suppression, the Fan Coil Units and the Contairnent Spray system. According to the IPE, the low conditional probability of containment failure for core damage sequences that do not bypass containment is due in part to the availability of these two compInely redundant, diverse means of providing containment beat removal and pressure suppression.

• An Emergency Procedure (EP) that requires the restart' of the reactor coolant pumps (RCPs). l According to the IPE, the Emergency Procedure " Response to inadequate Core Cooling" creates the possibility of inducing a steam generator tube rupture (SGIR) during an event in which degraded core cooling conditions already exist. A recommendation of revising the EP is diametad in the IPE ,

submittal. l l

i

~

l f

t 4

I i

6 f

I

. w.....e, =_+.-..,,-.-----..,m m., .. . ,.

[ }

li..

Is 2 TECHNICAL REVIEW 4

L 2.1 Licensee's IPE Precss -

I In order to fulfill the NRC's request concerning Individual Plant Examination the licensee elected to perform a full scope 1.evel 2 PRA. His was documented in the submittal and the subsequent additional informaion provided by the licensee. He process used to develop this PRA was reviewed by BNL with particular attention to the following areas: complatanama and methodology, multi-unit effects and as-built, as- operated status; and licensee participation and peer review.

~

2.1.1 Completeness and Methodology ir De submittal contains the type of information requested by Generic Latter 88-20 and NUREG-1335.

I De Industry Degraded Core Rulemaking Individual Plant Evaluation Methodology (IDCOR IPEM) was '

. used in the initial development stage of the Prairie Island IPE. The IDCOR IPEM analysis was

complaed early in 1991 parallel with the IDCOR efforts, as part of the initial information gathering for 5

the IPE. NUREG-1150 was reviewed, specifically the Surry PRA, since this plant was deemed by the licensee to be the most closely resembling Prairie Island.

The front-end portion of the submitted IPE is a Level 1 PRA. De specific technique used to develop this PRA was the small event tree /large fault tree approach, and it is clearly presented in the submittal.

, 1 sternal initiaing event and internal Sooding were considered. Event trees were developed for all classes 5

of initiating events. De details of the technique applied is extensively described in the submittal:

Support systems were modeled in the fault trees of the functional top events and accident sequences were i solved by fault tree linking. For determinletic best antimata analysis of reactor and containment response under severe accident sequence conditions, the MAAP 3.0B Revision 19 code was used as principal calculational tool Mission time for logic model quantification was generally on the order of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

De consequences of system and equipment failure that might occur during this period were examined

.well beyond this mission time. Containmant response and source term analyses were carried out at least 1 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to establish important trends in plant response where necessary. Timing and magnitude of l i potential releases that might occur beyond 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> were established based on these trends where l

ancessary.

l

, Sensitivity studies were conducted on initiating event frequencies, operator actions, common cause, test

, and maintanance and for certain system components. De evaluations were performed to determine the y

global effect of the parameters of interest. Failure rates were increased / reduced by a factor of 5 where a higher level of uncertainty and variability exists such as human reliability, common cause and test and

maintanane* unavailability. Failure rates for system components were increased / decreased by a factor

j. . of 2 since actual plant data were used and there was less h.isty associated with these parameters.

. De licensee did not evaluate explicidy'the change in CDF due to credited SBO modifications. His was

, dearly indicated in the RAI responses. (fhe IPE model would need to be requantified again without the SBO modificaions installed.) His review agrees with the licensee's opinion: " Suffice h to say that the j l '

i SBO modifications did provide a significant reduction in CDF over the plant as it existed before."

I 7 1

l

.l 1

' l t

...n_. .. . . _ -

)' , .

f k In addition to the sensitivity studies, knportance analyses were performed on the same quantities. ne

! importance analyses were based on use of the Fussel-Vesely and Birnbaum algorithms. (The results of I the analysis are discussed in more detail in Section 2.2.5.3. of this TER.

'i p Sensitivity analyses were conducted also to = tim =te the reduction in CDF due to certain plant t ' improvernents (AFW room fire door closed and procedural changes to allow station air to be cross -tied

,! with instrument air).

l?I De submittal infonnation on the HRA process was mlaimmt. However, the additional

information/ clarification obtained from the licensee through NRC requests for additional information t indicated that the HRA was generally complete in scope.. De HRA process for the Prairie Island IPE l{' considered both pre initiator actions (performed during ==1atan=aca, test, surveillance, etc.) and post-initiator actions (performed as part of the raponse to an accident). While the analysis of pre-initiator l -

l. actions considered both miscalibrations and restoration faults, only restoration faults were explicitly modeled. De potential for miscalibration of a group of sensors or instruments was assumed to be a included in the common cause failure modeling of the instruments themselves. With the saception of I events excluded on the basis of a qualitative screening applied during the pre-initiator human action eelection process, all pre-initiator restoration errors were quantified. One of two HEPs (0.003 or 0.01) was assigned to each event depending on whether or not a post-maintanane* verification of component

{

status was required by procedure. Plant-specific component unavailabilities were then calculated using the HEPs in conjunction with factors such as maintenanes frequency and duration, test frequency and interval, refueling outage frequency, and time from completion of the corrective maintenance to the retest 2

of the component.

Post-initiator human actions modeled included both response-type and recovery-type actions. De

[ submittal indicates that screening values were assigned "by following a flow chart and answering a series

,of questions." Neither the questions nor the flow chart was provided, but " plant specific estimates of l 'the time available to initiate and perform the action" and "PSFs associated with degree of difficulty and 1' , stress" were considered. De screening HEPs were based on the Handbook (NUREG/CR-1278), Wash-

'1400 (NUREG-75/014), and "the data sources used in the IDCOR BWR IPE methodology." Post-initiator susponse type actions found to be ; rsitard received detailed HEP development. An action was

_ important if k contributed algnificantly to baseline core damage probability or "if a change in the failure

_ . rate could cause significant increase in overall core damage probability." Most of the actions receiving detaBed analysis were quantified wkh the ASEP method (NUREG/CR 4772). De response to the NRC ..

! RAI states that a more refined estimate for the five most important human actions was aht=laad using the

. Handbook (NURG/CR-1278). De licensee's response to the RAI also indicated that anost recovery i probC.!! des were derived from NSAC-161, " Faulted Systems Recovery Experience" and that recovery actions were only added to cutsets when k was apparent that an operator would have sufficient time to perform the additional action. local i.sg of valves which failed to open or close was credited only

) when there was control room indication of valve position and the valve was easily accessible . A non-

, - recovery probability of 0.025 was assigned to these events. Recovery of equipment such as pumps had i the same crheria, but the non recovery probabilky was "approximately 0.5." Plant specific p Lin-sce i shaping factors and dependencies (such as those among multiple actions in a sequence) were .yys aly 6 considered for both response and (most) recovery actions. Human errors were identified as important contributors in accident sequences leading to core damage and several mmandattaae ao improve l procedures and operator training were provided.

t 8

r- .

i l '

l l, i De methodology employed in the Prairie Island IPE submittal for the back end evaluation is clearly decribed. Containment event trees (CETs) were developed to determine the containment response and ultimately the type of release mode given that a core damage accident has occurred. De front-to-back end interface are provided in the IPE by the dermition of 14 Accident classes (ACs). Dese accident

[ classes are identified by a three-character designator addressing the accident initiator, core melt timing,

& and the RCS pressure at the time of core melt. Unlike the PDSs used in some other IPEs, the availability j of containment systems are not explicitly included in the definition of the ACs. In the Prairie Island IPE, i containment system fault trees (for containment spray injection, containment spray recirculation, and

containment fan coil units) are quantified as frontline systems, along with the Level 1 frontline and i support system fault trees, using linked fault tree models. The matninmant systems fault tree cutsets are

' input to the CET branches as necessary to support CET quantification.

I De CETs used in the Prairie Island iPE provide a structure for the evaluation of all of the containment l: failure modes discussed in NUREG-1335. De marniament failure modes that are assumed negligible and I thus not included in CET quantification include those from melt-through of the containment steel shell, i vessel thrust force (the rocket mode failure), andi s,wsion failure due to degradation of sealing l

, I materials under harsh environmental condition. De containment failure modes that are considered as

) unlikely but are assigned small probability values include those from direct containment heating, in-vessel

! steam explosion, ex vessel steam explosion, and hydrogen combustion. Containment isolation failure is

! also considered as unlikely but is evaluated in CET quantification using the data obtained in containment 3

isolation analysis.

The quantification of the CET in the Prairie Island IPE is based on plant-specific phenomenological evaluations. De evaluations include modeling and bounding calculations (based upon experimental data),

, i consideration of phenomenological uncertainties, and MAAP calculations. The result of the CET analysis Ii are grouped to seventeen CET end states. Release fractions for these CET and states are determined by the analyses of representative sequences using MAAP computer codes.

l t

' To complete the IPE process, the comparisons were made with the results of other PRA studies performed for similar plants, like Kewaunee and Point Beach. De comparison showed, that several of g the Prairie Island (PI) accident sequences have similar frequencies as those obtained at these 2-loop

( Westinghouse plants of the same vintage. He comparison identified also, however, that some aspects

[ of the Prairie Island plant design lead to different results than those obtained in the PRAs performed for these plants. (Mion 2.4.2 of the submittal.)

m, m 2.1.2 Multi-Unit Effects and As-Bullt, As Operated Status f l l

l To develop the IPE, a wide variety of up to<1ste information aources were used: the Updated Fina' I f Safety Analysis Report (UFSAR), current Tedmicali S +1'4-3, Plant Operations Manuals, Emergency i Operating Procedures, Plant Surveillance Procedures and Plant Computer Files, Work Requests, plant l drawings, vendor technical manuals, design basis documents etc. Plant walkdowns were performed for j ,

fault tree constructions and spatial interactions for laternal flooding effects.

%e IPE was performed for the plant design as it anlated in the fall of 1993. He relatively recent plant l I - configuration includes changes made to the AC power distribution system that are important to accident I sequences associated i ~ h loss of offsite power initiators and station blackout. j i l l

1 9

I h

i M ' ., w -- - - - - .%,, . . . n- e ._ _ . . .

t.

De plant model considers dual unit effects, those that are explicitly taken into account in the Prairie Island plant model belong to three categories: j i

j 1. Fbared systems or systems capable of being crosstled between unks,

~~

2. ' Dual Unit Initiators, and

~'

^ - '-

3. rwnman Cause modeling. ~

~ ' ~ -~

Sbared Systems: Instrument air, Coollag Water, and Control Room chilled water systems.

Cross Tied Systems: Emergency AC power, and Auxtilary Feedwaters systems. De component cooling water system is also capable being crosstied between unks. It was not snodeled this way, boerever, due to "the low contribution to the overall CDF from CC" (cause given in the submittal),and to reduce modeling effort (cause mentioned in RAI response). De IPE does not take credit for this feature of the system.

Dual Unit Initiators (marked by asterisk in Table 2 "Be PI Initiating Events"): For these events,

,. equipment which could be crossticd from Unit 2 was not credited until it wam demonstrated that the

- ogmpment was not required for a pa'aa't=1 Unit 2 transient or could suppo:t both units simultaneously.

Common Cause Modeling: Analyses for similar components in systems that are shared or could be

~

crosstled was performed by considering the coupled systems as a whole.

Procedure reviews, discussions with control room personnel, and walkdowns of aelected local operator actions and control room panels helped assure that the IPE HRA represented the as built, as operated plant. De licensee :enducted an extensive data collection effort to develop plant specific initiating event

. frequencies and component failure rates. De tal'ta+1ag event frequencies were derived from data

. . collemed for an eleven year period between 1980 and 1990. Plant specific component and maintenance

. unavailability data were collected for a ten year period between 1978 and 1987. Dese data were used

in both Level I and Level 2 event trees and fault trees.

A review of the operator actions identified aeveral that related to multi-unit effects. In fact, two of the nost important buman actions involved multi-unit interactions. One action was to cross tie unit 2 AC i

power to unit I during a station blackout of unit 1. Another involved a cross tie of the unit 2 motor driven AFW pump to unit 1 to restore MFW. Several versions of this event were quantified to reflect

~

diferent contexts, e.g., presence or absence of an "S" signal. Procedure reviews, plant walkdowns, and discussions with operations and training staff helped assure that the IPE HRA represented the as built,  ;

as operated plant. In addition, the licensee stated that no recommended improvements were credited in the reported IPE CDF. However, in the response to the RAI, k is indicated that credit was taken in the level 2 analysis for two procedure changes. One involved ha:Ing an emergency procedure to direct the operators to check for adequate steam generator level before attempting to start an RCP. De intent t was to minimlre the potential for induced SGIR. He second w=madation credited was to make plant design or miminimative contml changes to ensure that the sump C hatch doors remain open to allow j water injected from the RWST following an accident to flow tiuough the doors to the reactor cavity.

1 .

i Insoer a the backet analyses are concerned, k appears that all the Prairie Island eas*=1==== specific

? featuns are modeled.

I >

i k

10 V .a = be ase _ as,>,. .o.... - , - , .,,e-- .e - * - .~-.,..g%., , , ,. _ . . .

-, . .r - _ . _ , _ _ _ . _ . . , . , , . _ . _ . , ,

f l

3 De submittal explicitly indicates (see, e.g., the subminal's cover letter, dated March 1,1994) that the

, licensee intends to maintain the IPE as a *living" PRA. This is to provide continuing insight: for design

change review, procedure enharvemme, training, and shutdown risk planning.

t

~

i 2.1.3 1.Jcensee Participation and Peer Review k

Licensee participation in the IPE process and miew activhles are discussed briefly in Section 1 of Part i , 5 of the IPE submittal. De group responsible for all PRA-related activkles at Prairie Island is the Self Managed Work Team of the Northern Sees Powerr 'a==ay (NSP), beeded by the Director of Licensing

, and Management Issues. De NSP FRA staff was made up of five engineers and one engineer associate.

Two people worked at the Prabe Island she and the rest at the General Office. His pweesect was involved in all aspects of the analysis. In plant expertise was ensured by the fact that two individuals maintained SRO certification at the plant, one of them previously held an SRO license. Dere was also esperience in other nuclear areas, such as: core transient analysis, operations, system engineering, plant I technical staff, nuclear Navy and reactor physics. TENERA, Westinghouse Electric Corporation and

Fauske & Associates Inc., which are part of IPEP (Individual Plant Evaluation Partnership) contributed to help NSP developing the PRA/IPE. Gabor Kenton & Associates (GKA) also provided consulting services.

De NSP PRA/IPE team has been very active in applying PRA methodology to ensure plant sr.fety. .

I Table 5-1 of the submittal lists a significant number of these activities.

The IPE reviews included both independent in-house miews and an external review. The first independent in house review involved the verification of the calculations, i.e., the assumptions ued and the correctness of the results. His review was done by someone other than the preparer. The second review was a miew of other PRA-analyses performed in the industry (i.e., IPE repons submined to NRC by Kewaunee and Point Beach, Surry NUREG-!!50 and NUREG-4550). De third review was performed by the Senior Review Team. His team consisted of four industry experts, which reviewed

'the PRA/IPE to ensure correctness of the methodology and that the results are consistent with other PRA's in the industry. De fourth review was an independent in-house review done t y NSP personnel that was not involved in the development of the PRA. ,

De RAI response details this review: "De draft submittal was distributed widely to the plant staff for

miew and comment. De reviewers were asked to pay particular artmirin to ponions of the repon that

} fell whhin their ares of expenise. Many comments and questions were raised during the review process.

i These were studied and changes were snade to the snodel and/or the report as necessary to answer the

miewer's questions and comments."

4

. Neither the submittal nor the RAI responne discuss the nature and the quality of the miew questions and l

-their resolutions.

From the description provided in the IPE submittal, k seems that the intent of Generic Letter 88-20 is l .

aatisfied.

I' i .

11 I

-. . . . . . _ ~ , _

i =

l .

~

3 2.2 Front End Technical Review '

i* . t

, j 2.2.1 Accident Sequence Delineation and System Analysis .

L 2.2.1.1 Initiating Events i 3 j De IPE initiating event analysis used the work performed previously in the IDCOR IPEM, but J

mignificantly enlarged its scope and employed updated data. Table 2 presents the list of initiating events and provides the frequency for each initiating event. De column " SOURCE" of the Table identifies the j origin and method of the frequency value indicated in the Table; whether it was derived from operating sperience or generic data, or whether it was determined from plant-specific analysis using NRC and/or industry documents.

j. De total number ofinitiating events is 23. Dey are grouped into seven categories (the internal Sooding il events and anticipated transients are classified together and the different A'!WS events are collapsed into

} one category), since it was found that the minimal number of significantly different ways in which the

!' plant responds to challenges is neven.

Transient occurrence data (from the period 1/1/80-12/31/90) were used to derive the plant-specific initiator frequencies (simply by dividing the number of events by the number of years of data). Generic initiating event frequencies were obtained from the published sources given in the table. De SGTR initiator frequency was obtained by Bayesian update. Plant-specific system fault tree models were used to estimme the special transient initiating event frequencies (loss of DC Train A and B, loss ofInstrument Air, etc.) and Interfacing System LOCAs. De main feedwater and main steam line breaks were

, quantified by performing a review of piping from the steam generator to the outside isolation valve

-(MSIV feedwater regulating and bypass valves) A generic pipe rupture frequency was then applied to these piping sections. ' Failure of the isolation function was handled in the main steam lineffeedline event

'tries.

t

~

.in the RAI response the licensee provided reasons why certain initiators were omitted from the plant

, model and explanations about the approach used in the determination of certain initiating event ,

-frequencies. Brief summaries are given below:  !

a) Imss of 120 V vital AC bus events were not considered as initiating events as loss of a alngle 120 V l AC bus will not cause an automatic or imminant reactor trip. Imss of a 120 V bus is also permitted by Technical Specifications. to occur for a period of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> before actions need to be taken to shutdown the affected unit. Loss of two or more 120 V AC bus events, while they cause reactor trip,

- were also neglected as initiating events because they are very rare: "this type of failure has not ,

occurred over the operating history of the plant and there are no published data sources with

dependable failure rates for such initiator."

k -

b) Conunon cause failure of DC buses was not modeled as an laWlag event due to low frequency.

i

, c) Common cause failure of the safeguards 4160 V AC buses was not modeled as an initiating event because of the low frequency of the anmman cause failures of the bu=es, and because such a common

, cause failure does not results in a plant trip, only a forced manual shutdown.

12 Y

a P.%+ w ear,-e p.g na. =es e + e, ee--w... .e-me.-we.ac,negw.q,ge,.,%=.w--*=.-- - - = . - ==

i; .'

• h .

d) Loss of the safeguards matrol mom chilled water system was not in'ciudad in the IPE special initiating f, event analysis, because such an event causes no direct plant shutdown or trip and unavailability of j* aafeguard equipment whhout -= lag additional equipment or operator action failures. He licensee 4 justified the exclusion of this initiator (by new room heat up analyses and by the extensive changes t in the electrical and other systems served by this chilled water system) since the IPE was submitted.

I De licensee considers that the CDF contribution of this initiator is insignificant and no meaningful l Information would have been gained if this initiator had been modeled in the submittal.

! e) De Prairie Island Reactor Pressure Vessel is thought to be not as susceptible to pressurized therma!

shock (PTS) due to the low percentage of copper in the RPV weld joints. Inspection of irradiated

? RPV samples has also confirmed that the vessel is aging slower than expected from the effects of p neutrons and radiation. He reference temperature for PTS is 208'F at the most limiting reactor vessel weld. Plants with higher reference temperature have an estimated CDF due to PTS of about e IE 08/yr, which is considered to be a negligible contribution to CDF at Prairie Island. With the

exception of PTS, no specific credible awh=ahm for RPV failure has been identified and therefore j RPV rupture was not explicitly included as an initiator.

f) The IPE model apparently neglects the small-small LOCA initiating events. ' According to the j licensee, this initiator is implicitly included in the model

partly in the small LOCA initiating events (breaks larger than 3/8'), and partly in the normal transients (breaks below 3/8").

i

, .g) The steam line break and feedwater line break initiating event calculation considered piping only within the containment for two reasons: 1. De frequency of any non isolated line break beyond the first isolation valve is considemd to be insignificant (the low probability of pipe rupture combined

' with the high probability of isolation valve closure) with respect to plant risk; 2. A break outside

! containment, would be contained by the auxiliary building or turbine building steam esclusion

' boundary. Als boundary consists of walls, doors and other barriers to prevent the propagation of

a steam environment to safeguards equipment. Openings in these boundaries are under tight i i administrative control. In addition, required safeguards equipment within the steam environment is qualified for harsh environment. _

k 'h) He licensee states that the frequencies for Imss of Service Water and Loss of Component Cooling

- Water initiating events, which were calculated by fault trees, imply pipe tupture probabilities; they were iMed to the quantified fault tree results.

t- ~

It should be nottd that this plant did experience an SGTR event due to a loose part in the RCS post-l maintenance, which is reflected in a momewhat higher SGTR frequency.

l l De present review fincs the set of initiating events selected for IPE analysis to be acceptable and the i initiating event frequencies to be reasonable and comparable to other PRA studies. l I

i ~

2.1.1.2 Event Tree I

j The IPE developed eight event trees to snodel the plant responses to internal laitiating events: large,

,. unedium and small LOCA event trees, SGTR event tree, main steam line/feedwater lin

ii ' De IPE used a small event tree /large fault tree technique with fault tree linking to quantify core damage

! sequences. Fault tree models were developed for the functional top events depicted in the event trees.

ll Dese high level fault trees, however are not shown, only explained qualitatively ("dermed") in the t submited. De front line systems in these high level fault trees were also modeled by fault trees, as were li

i sheir support systems. De subminal does not show them either. De EPRI's CAFTA fault tree manager was used for development and quantifiction of the top event fault trees. Dey were linked together using j, Imgic Analyst's HPSETS code to desermine the accident frequencies. De front

line systems fault trees j' were developed to allow the support system fault trees to be linked directly into the logic when quantification was performed. Human errors.were included in the fault trees, where an operator action

was necessary in order for a system to operate, such as the operator to switchover to recirculation.

!, Operator actions in response to equipment failures were not included in the fault trees, but were later l; included after sequence quantification as tscovery factors.

De cut set truncation limit used was 1.E-09. In the fault trees a. component was not modeled further

> down if no useful insights could be gained by more detailed modeling, i.e., if all the failures of the I subcomponents were encompassed by one failure mode of interest, such as, pump fails to start.

Similarly, negligible faults associated mainly with passive components such as pipes and manual valves were eliminated from further consideration.

• De fault trees developed for the Prairie Island IPE are listed in Table 3.

a . Table 2 Initiating Events .

F y g,,,,,sn f No. ','I laitiatlag Event Designator -

i k ,1 LOCA's Smat! LOCA SLOCA 3.00E 03 PWR IPEM Methodology Medium LOCA MthCA 8.00E o4

{ Large LOCA , L1hCA 3.00E o4 r

2 Anticipued - RX Trip (other than below) TRI 1.68 Plant Data Transients SG HI-H1 LVL TR2 9.00E42 Plant Data j landvertent SI-Signal - TR3 2.SoE-01 Plant Data taas of Peedwater TR4 9.00E-02 Plant Data A lessmal Auz. Bldg. Zone 7 (695* EI) AB7PLD 5.05E-03 EPRI1R.102266

, Rooks Aux. Bldg. Zens 3 (above e95*) AB8PLD 1.34E44 EPRI'IR 102266

i. TB Bldg. Zone 1 (APWP Rm)* T!PLD 1.o4E45 EPRI TR 102266 TB Bldg. Zone 13 (Relay Rm)* T13PLD 2.68E-05 EPRI TR-102266

! Sernhoe Zone 1 (50 Cl Ans) SHIPLD 6.09E-06 EPRI TR 102266 Sernhec Zoos 2 (Noe40 Area) SH2PLD 2.545 03 EPRI TR 102266 l

-3 Special Ames of Cooling Weisr* IDCL 1.82E 05 Feuk Tree Tsemannis imes of Comp. Cool Weaar LOCC . 3.46E43 Pauk Tree -

y Lees of Train A DC Power 1DDCA 8.69E43 Fauk Tree I Loss of Train B DC Power LDDCB 8.69E43 Pauk Tree

less oflastrument Air * . INSTAIR 1.17B42 Pauk Tree ,

} 4 Uematicipated Main Peedweser the Break MPLB 2.50E 05 WASH 1400 Transients Main sisam Line Break MSLB 3.90E44 WASH 1400 i

?

! 16 I

i i

i I

• ~ .  ;

l

' ~

j i h.

it Table 2 Initiating Events (Cont'd) l

'i l

)

?! e

% eeney m

! i.- ..Jdo. Qtegon - - _ , , ~ ,,w g.,g ,,,g _,;,,_, m, _ _ m _ _

=_ l Name -

-(per yr) --

q

]I

• 5 Loss of less of Offske Powes* - IJDOP 6.50E 02 NUREG-1032 1 44 Offske Power NUMARC-4700 i

\

i '

' ~

6 1)DCA , " LOCA ISLOCA 2.27E.07 Fauk Tree. NUREG-5102 l Owsids team Generator Tee Rupters BGTR 1.50E 02 Plant Data I

} Canaa nnened 7 Failure to RX Trip (other than Below) ATWS-TR1 2.52E M U Trip (NIWS) SG HI-H1 Level ATWS-TR2 1.35EW8

! laadvertent SI Signal ATWS-TR3 3.45 EMU taas of Feedwater ATWS TR4 1.35 EMU Less of Cooling Water ATWS-LOCL 2.73E-1F"

' 1ms: of Comp. Cooling Water ATWS.LOCC 5.19E-08w less of Train A DC Power A1WS-LODCA 1.30E M D Less of Train B DC Power A1WS-LODCB 1.30 EMS Less ofInstrument Air ATWS-INSTAIR 1.76EMD f Less of Offsite Power ATWS-LOOP 9.75EMD Main Feedwater Line Break A1WS-MFLB 3.75E-190 Main Steam Line Break ATWS-MSLB 5.89E M u int. Fid. AB Zone 7 (6951) EI) A1WS-AB7 7J8EW' int. Fid. AB Zone 8 (Above 695) ATWS-AB8 2.01EW" f Int. Fid. TB Zone I (AFWP Rm) ATWS-1151 2.55E-105 int. Fid. TB Zone 13 (Rly Rm) ATWS-T13 4.02E-10

Int. Fid. SH Zone 1 (SG Area) ATWS-SH1 9.14E-11(#

int. Fid. SH Zone 2 (Non-SG) ATWS-SH2 3.81 Ego Small LOCA ATWS-SLOCA 4.50 EMU i Medium LOCA ATWS-MLOCA 1.20E-08(#

( Steam Generator Tube Rupture A1WS-SGTR 4.50Equ t s ht #1mf Events Notes:

• Dual Unk Irdiastors:-

84 AE frequencies are mukiplied by the failure to trip desanad este (1.5E45/d) to determine ATWS frequency.

i # Sommes *Plart Data

• ada:etas plantepeelfic operating experianos data. "Fauk Tres* indacetes that a 7'-" , -* fauk true was construmed and quantified for this system to detennine the s .k eine ovset L-; -- y. Referenos to na NRC or 7 industry document indicates that a plant specific analysis was performed no deterndse the lasisting ovest frequency using the rosthodology provided in that document

, . . u- .

f -

w s

l t . 1 1 1

{

1 I

17 ,

i i

i

, 4 l -

l ,

7tble 3 Fcult 'hees Developed in the Prairie Island IPE i -

) Safety Functions /Frontline Systems Support Systems t

[ Reactivity Control Chemical Volume and Control System Station Power

~~

Emergency AC Power

! - DC Power Karandary Heat Removal Cooling Water Auxillary Feedwater Component Cooling Water l Main Feedwater/ Condensate Instrument Air Steam Generator PORVs SI Actuation Signal In:tmment Power 1 i

Short Term Injection CS Actuation Signal I

)' Safety Injection l Pressurizer PORVs Law Head injection (RHR)

, Long Term injection i

High Head Recirculation (SI/RHR)

Low Head Recirculation (RHR)

Caa'=iament Control Containment Spray Containment Spray Recirculation Fan Coil Units RCS Cooldown and Depressurization l l Charging i RHR Shutdown Cooling Auxiliary Spray

( -

2.2.2.2 Point satimatm d U.cataineytsemeway Anairms .

Mean values were used for the point anim* laitiator frequencies and all other basic events. Forma!

, mar 6=ht u-isidy analysis was not performed on the naults. However, the submittal reports point .

estimates of the core damage frequencies by tal+i*ia events separately for Unit I and Unit 2. In

, addition it provides point estimates for the 'y-rd aequence frequencies of Unit 1.

Importance analyses (by using Fussel-Vesely and Birnbaum '#-i.c4 Indicators) were performed for

the initiating events, the major operator actions and all the systems considered in the plant risk model.

The' Wor.ce analysis also included the corrective maintannare contributions as well as the preventive j ==lataamar+a and test contributions to the overall CDF.

t \

Sensitivity analyses were conducted on initiating event frequencies, operator action failure rates, common ,. l

~

cause, test and maintenance and for certain system components (e.g., EDG failure rates). i s

V

! 18 j l'

I t i l' \

l

I.

)

in response to an RAI, an NSP review of the modeling of malatananceiunavailabilities identified several cases in which maintenance on opposite unit equipment for shared and cross-tied systems was not v- correctly accounted for in the IPE. The combined impact of these omissions was then estimatad by t irwipcieting them into the IPE model and quantifying the change in CDF. De RAl response does not sh specify the affected sequences individually; h provides only the approximate value of the total CDF rise, which is 6% (i.e., she total CDF is approalmately 5.3 E-05/yr). It remarks, however, that nearly all of

1. this increase is due to the additional (preventive maintenance) unavailability of Bus 25, which supplies 1

power to the 21 AFW pump.

%e RAI response offers also some explanation about the modeling omission of pressurizer PORV block valves. In the IPE the PORVs are included in the model for feed & bleed and ATWS. However, in neither case are they modeled such that the block valves are required to open.

In the A'TWS modeling, the fraction of time that either block valve was assumed to be closed due to leaking PORVs was estimated as one month per year. That =timata results in an unavailability value of 3.3E 02 for each block valve. De impact of this omission to the ATWS CDF is not estimatad.

In the case of the feed & bleed, however, the omission increases only the feed & bleed unavailability by an amount on order of 1E 06, much smaller than the unavaliability due to human error, which is 4.5E 02,  :

l thus its effect on the CDF is negligible.

l

' \

2.2.2.3 Use of Plant Specific Data

• l

• The submittal emphasizes that many initiating events and all major and significant mechanical l component failure rates were generated using plant specific data. ar component failure data collection the sample period of 1/1/1978-12/31/1987 was selected, because this time period was i l

readily accessible using electronic data retrieval techniques.

During the component failure data collection process system boundaries were established which were used also for system fault tree modeling (e.g., the EDG boundaries included ~ the engine with h's support systems, the governor, the generator, the output breaker, and all control circuitry). Both demand and time related component failure rates were determined.

~

The licensee states that the plant specific failure rates were compared to generic sources to check for reasonableness. When a discrepancy occurred the plant specific value was thoroughly checked.

[

Whenever sufficient plant data were available to unake a statistically ===hle antimata of the failure

< rate, the plant value was used. However, for some components and failure modes which had no recorded data at the plant, generic values were applied.

Plant specific data were applied also to derive the fraction of time a given component or train of

! equipment could be expected to be out of service for malatanance Information to determine component unavailability during testing was ahtalaad from a review of plant surveillance procedures.

j. ,

• De subminal presents both the generic failure rates (used for certain components) along with the list

, of equipment for which plant specific data were used (Tables 3.5-1 and 3.3-2 of the submittal).

In this review Table 4 compares the IPE's plant specific failure data for selected components with values typically used in PRA and IPE studies, using the NUREG/CR-4550 data as a basis for 19 t

t

- e e - x ,

f I

comparison [NUREG/CR 4550, Methodology). One can see, that generally the Prairie Island data -

tend to be smaller than NUREG/CR 4550 data, except for the DG and AFW pump " fail to run"

, failure rates, and for the indicated MOV, AOV failure rates. In some cases, for example for IA g --compressors and check valves, the differences reach more than an order of magnitude.

f The cause of abese differences is apparendy " statistical fluctuation", or " fact of life". The RAI response i depicts for !==== the data analysis of check valves, as follows:

l

"To ca!culate failure rates for valves all valves or check valves were pooled together to create

! a large data pool of damaMs and failures. For check valves this created a pool with over 25,000 open damaMe and an equal number of close damaM<. There were no failures of check valves found in the plant records. However, since no equipment can be amen =M to

' have a zero failure probability, a value of 0.5 was used for the number of failures.1he resulting faUure rate is lower than generic industry values, however, the large pool of 4 damnMt coupled with the lack of failures justifies using the plant specific value."

t t 2 1 2.4 Use or Generic Data l The major components for which generic failure data were used in the IPE are the following: Pressurizer PORV, Circuit Breaker (4160 V/480 V), solid state logic modules, inverters, battery and battery chargers, MCCs, beat exchangers and chillers, relief valves, fans, relays, switches and transmitters.

Generic values were used also for some failure modes on some components due to low demands or i operating hours which did not produce reliable plant specific failure values ( e.g., for the " fail to run" failure mode of the SI/CS pumps).

t'~amaa cause failures of circuit breakers, swit& gear and relays were not explicitly modeled. According

, .to the RAI response they were considered implicitly. For instance, common cause failures of loads

. supplied through the breakers, such as pumps, valves and other components that can be attributable to

} common cause ==+=ntums, were modeled. Common switsgear failure was implicitly analyzed (in terms of function and the effects of failures) with other failures, such as diesel generator common cause failures.

! Relay common cause failures were considered to be covered under common cause failures of

instrumentation and control trains. .

11be following W-a* were used as " sources

• for the generic data :

!' I. NUREG/CR-2815, Probabilistic Safety Analysis Procedures Guide, j

~

2. NUREG/CR 4550, Analysis of Core Damage Frequency,

3. IEEE Standard 500 Data, f 4. EPRI TR 100320, Vol. 2, Reliability Centered Makaa== (RCM) Technical Manual, J 5. WASH 1400, Ranctor Safety Study (NUREG 75A)l4).

t f ,. .

, The Prairie Island IPE team systematically == mind the plant model for reduMant components to address

! potantini common <ause failures (within individual systems and across both units ).1he component J groups for which common cause events were defined are given below: .

, 20 g . - . _ _ _ _ _ . _ . . . _ _ . _

bo l !; - -

)i 1.

2.

Diesel generators (failure to start and run),

Pumps (failure to start anti run),

3. MOVs and AOVs (failure to open and close),

i; 4. PORVs (failure to open or reclose on demand),

j'!

5.

6.

Check Valves (failure to open on demand; falinre to reclose),

Batteries (fallure to operate on demand),

['

7.

8.

Instrumentation and Control ==i-: - = (falltre to send signal or actuate equipment),

Air compressors (failure to start and run),

j 9. Cooling fans (failure to start and run),

j 10. Chillers (failure to start and run).

I De common cause probability model used was the Multiple Greek Latter (MGL) method.

The primary data for the common cause factor mattmates were taken from the documents given below:

, NP-3967, " Classification and Analysis of Reactor Operating Experieoce Involving Dependent Events,"

EPRI, June 1985, NUREG/CR-3289, " Common Cause Fault Rates for Instrumentation and Control Assemblics," U. S. NRC, May,1983, NUREG/CR-2770, " Common Cause Fault Rates for Valves," U. l

, S. NRC, February,1983, " Nuclear Plant Reliability Data System," INPO. l These data were then sorted and classified according to the usual procedures for treating comrnon cause failures in safety and reliability studies. De obtained # and (if applicable) y and 6 factors are reported in the submittal, with discrimination based on the failure modes (e.g., in general, different values of MGL parameters are given to failure to start as opposed to failure to run).  !

For convenience, the # factors for various combinations of component failures are reproduced in Table  !

5 of this report to compare them with some reference # factors suggested in NUREG/CR 4550. De reference # factors are also presented in Table 5 ( NUREG/CR-4550 reports only failure to start #

factors).

Based on the table's data, the general observation is, that the common cause parameters applied in the Prairie Island IPE seem reasonable and consistent with those of recommended in NUREG/CR 4550 (in I addition, the common cause factors for the turbine drivers of the AFW pumps seem also reasonable: for FTS = .17 and for FTR = 0.04).

i 2.2.3 Interface Issues 2.1.3.1 Front-End and Back End Interfaces

. De submittal treats this issue rather concisely. It states that almilar core damage sequences were grouped 2

into classes according to the following criteria:

• Integrity of the containment l

• Initiator type i .

• Relative timing of the core melt with respect to the initiator

• Primary system pressure.

21

1 4

in 1 * '

j Table 4 Comparison of Component Failure Data I

Component Prairie Island + 4550*

EW Punips --

% Mesm- -% --

, inil to start 7.6E44 4.1E44 3.0E43 inil to run 1.4E44 1.3E 04 3.0E 05 TDAPW Punips ThrNee Assy fail to start 9.4E 03 6.1544 3.0E42 fail to run 6.1E 03 1.3E44 :5.0E 03 SI Pumps fail to start 1.15 43 3.0E43 dall to run 3.0545* 3.0E 05 i RHR Punips fail to start 4.6E44 3.0E43 ini! to run ' 2.6E 05 3.0E45 x ;I 11/21 CL (SWS) Pumps fail to start 4.8E 04 3.0E-03 fall to run 1.2E-05 3.0E 05 CCW Pumps init to start 2.7E 04 3.0E43 fail to run 2.7E 06 3.0E 05 i . IAI Compressors i fail to start 2.0E 04 < 4.0E42

• fail to run 4.9E 06 2.0E-04 i

j Geck Valves fall to open 1.8E 05 1.0E44 imil to close J.tE45 1.0E 03 1

-MOV -

p, .g - -

- _- . .- 4.7E43 - --

- - d.0E43

. fail to close 7.6E-03 I

j Air Operated Valve 61! to open 2.6E 03 imil to close 1.7E43 2.0E 03 Diesel Generator (D1 and D2) inils to start 3.4E43 3.0E42 I Mis to run 1.15 02 2.0E43 f

+ Values ladiossed ars semaded for companese.

80mmene pailure Rane from NUREG/CR 4550

Notes

(1) 4550 are sesan values tahan ten NUREG/CR 4550, l.a.', drom to NUREG-1150 asudy of Eve U.S.

[ evenaar power plants.

(2) Demand fatturm = protablutise per demand railurm ao run or operses ar , - empressed in

=* of failures per hour.

'22 E

e.,_...

y. - -

3 e-

! i. _-

l t .* .

Table 5 Comparison of Common-Cause Failure Factors l

ii~

Component Failure Mode Submittal A Factor Reference # Factor

<r i FW pump only, CCF of 2 pumps FTS/FTR 0.035/0.085 0.056

! 4 AFW motor driver, CCF of 2 drivers FI1/FTR 0.15/0.013 li RHR pump, CCF of 2 pumps FIS/FTR 0.16/0,18 0.15 j SI pump, CCF of 2 pumps FTS/ FIR 0.16/0.17 0.21 CL pump, CCF of 2 pumps FTS/ FIR 0.018/0.084 0.026 CL pump, CCF of 3 pumps FTS/PIR 0.018/0.099 0.014 h

[ CCW pump, CCF of 2 pumps FTS/ FIR O.14/0.058 0.026 3

CS (spsy) pump, CCF of 2 pumps FTS/FTR 0.38/0.081 0.11

• i MOV, CCF of 2 valves FTO/FTC 0.078 0.088 3

MOV, CCF of 3 valves PTO/FTC 0.082 0.057 l

AOV, CCF of 2 valves FTO/FTC 0.046 0.057 l l

Pressurizer Safety Valves FTO , 0.048 0.07 Diesel Generator, CQF of 4 DO FTS/FTR 0.027/0.075 Ref. is available only for 3 dos PTS = Fall to start FTR = Fail to run FTO = Fa'd to open PTC = Fall to close t

9 5

I 23 ,

2 I

) - ~

De distribution of sequences among these classes provides insights as to the functional failures which

! may dominate the risk leading to a core damage event. Table 3.1-4 of the submittal contains the j designators and the description of the accident classes. 'De classification of the accident classes .'

I "ly follows *e NUMARC Sevwe Accident luue Closure Guidelines and 6e table aho shows the

j. NUMARC accident class designators along with those used in the Prairie Island IPE.

f - 2.2.3.2 Hamman Facters Interfaces .

? . .

,. The Human Reliability Analysis Technical Review found in Section 2.3 addresses this issue.

2.2.4 Internal Mooding -

l 2.2.4.1 Internal Flooding Methodology f De methodology of the IPE to perform the Sooding analysis consisted of three makr steps: l l

l  !) Identification of potential floods and areas affected (flood zones),

2) Identification and initial screening of Sooding scenarios, and

3) Quantification of important flooding scenarios. .

In addition, extensive plant walkdowns supported the development of the flooding scenarios.

i la the analysis, propagation of Sooding to other areas (including back propagation through the rirains) and holation of the floods were considered. (Backflooding through floor drains was considered but was not credited.) Failure events which could cause flooding were the following: pipe and valve rupteres, l human errors (such as errors in maintenance works), and comb *mation of equipment failures and

! operations staff errors. Water spray on equipment was also taken into account, particularly when multiple systems or components were affected. Spray from a high capacity pipe was automatically included into j nhe analysis, because breaks large enough to flood a zone were conservatively assumed to fail all

' equipment in that zone.

I Flooding from the fire suppression systems was considered to a certain extent; i.e., if it was not bounded 1- by a flooding from a system of higher Sood capacity, such as the cooling water system.

I f Spurious actuation of' fire suppression was not considered. De reason for this, as given in an RAI I respcase, was the low probability of the following failure combination: failure of a fusible link in one cf fire suppression spray noezies, the nazie must be located near annanthi equipment, and the spray from l-the nazie must be able to fail the equipment. Potential plugging of the drains was also not considered i

• a problem.

l

,1he flood analysis included breaks in the cooling water piping, however breaks in the component cooling water system were not considered. De reason for the neglect, also given in the RAI response, was the i' linked amount of the water comment of the deced CC system, which is insufficient to Sood the large areas .

where CC piping exists.  ;

4 i After a thorough screening process, six flood annes were retained for snore detailed analysis. Dese -

were

24 i

?

s w

y es-r w .e--ee w ase ' cume e- > +-*-- e ,e,. .. - . , , .

l' '

ii..

!! Screen house safeguard areas,

{i -

Screen house non-safeguards areas, l Auxiliary building 695 level,

_ Auxiliary building 715 level (control room chiller rooms excluded), _

s Auxillary feedwater pump room in the turbine building,

,I Cable spreading room.

To quantify the flood initiating event frequencies the EPRI document TR-102266 was used and several

assumptions regarding systems and equipment that may be disabled as a result of the Sood or as a a consequence of operator actions have been made.

'Ibe Nag event frequencies daarmined for the various Sood zones are presented in Table 2, alongside i

j. with the initiating event frequencies of the internal events.  ;

De RAI response calls the attention to the fact that the pipe break frequencies used in the flood analysis

j. . and the pipe break frequency used in the initiating event I-LOCL are different. He pipe break frequency l for the initiating event represents a break anywhere in the system. De frequencies calculated for the

'r flooding analysis represent the pipe break frequency only for piping within a specific area of the plant i, which has been designated a flood area. I

!, 2.2.4.2 Internal Hooding Result i

l~ De six potentially significant flooding initiating events selected by the screening process were further analyzed in the transient event tree. Eramiriation of the reactor response established key timing for

. reactor conditions and operator actions and it was found that no new transient analysis was necessary to quantify flooding initiators. '

Each of the flood initiated accident sequences were assigned to the followlag accident classes:

Flood initiated core damage early.at high reactor pressure (designated as: FEH), or Flood initiated core damage early at low reactor pressure (designated as: PLH). .

De total contribution of internal flooding to the point estimate CDF was antimarad to be 1.04E-05/yr,

> which is about 21% of the total CDF (from internal events and internal flooding). His is dominatad by a single flood scenario, that accounts for almost .6 of the CDF due to flooding. The flood is in zone s TB1 which is the Auxiliary Feedwater Pump / Instrument Air Compressor Room. His room has the main cooling water supply headers to the Auxiliary Building running throagh the overhead.

De flood scenario consists of a single sequence in which a large break occurs in the Loop A or B cooling

water line above the auxiliary feedwater pump room in the turbine buuding. De resultant flood causes loss of auxiliary feedwater pumps, loss of all lastrument alt compressors and loss of main feedwater due to loss of instrument air and loss of tube ou cooling. Wary cooling falls due to failure of AFW and i MFW. Short term RCS inventory fails due to loss of pressurizer PORVs which fall closed on loss of Instrument air.

i -

No other flood sequence has a significant impact on the total CDP.

, 25

e. . . . - ~ . . . . _ _ . - - . . . . _ . - . - -m. ~ , , . . _. --. ~ . _ . _ . . . . . . . .

O 4 i ~

j 2.2.5 Core Damage Sequence Results

! 2.2.5.1 Core Damase Frequency By Initiatig Events .

5 L De IPE point estimate for the core damage frequency from laternal events and internal flooding is 5.0E-05/yr for Unit I and 5.lE 05/yr for Usik 2. Accident initiators and their percent contribution to the CDF .

i for both units, Unh I and Unk 2 are listed in Table 6. As k can be seen, the core damage contributions i f by inhiating event of Unit 2 closely resemble those of Unit 1. Dis is because there are only few and j minor asymmetries in the designs and corresponding risk models of the units and the Unit 2 level 1

- results were obtained essentially from requantifying the Unit I model and replacing appropriate Unit 1 I component failures by their counterpart for Unit 2.

Since new and significant safety insights were not obtained from the Unit 2 analysis, the submittal and consequently the present review discusses primarily the CDF results obtained for Unh 1.

l Table 7 reproduces the CDF results in term of grouped accident types and their percent contribution, i

! One can see, the largest contribution is due to the transient group (including the LOOP events). LOCA and internal flood events are the next contributors and they contribute almost equally. De SGTR's

( contribution is quite significant.

4 2.2.5.2 Dominant Accident Classes and Accidet en=

I De CDF results were obtained in the form of functional sequences.. Derefore the submittal used those screening crheria for reporting, which were required for such sequences in Generic letter 88-20. In fact,  !

Prairie Island "went one step further in reporting requirement by equating accident classes with functional

! sequences"; i.e., k grouped core damage sequences together according to their similarity in regard to

. initiators, timing of core melt and effect on contata-at pressure at the time of the core melt and treated such a group as a combined functior.al sequence. In Table 3.4-1 of the submittal all the accident classes j (including those that meet the reporting criteria and those that are beyond them ) constituting the total CDF are presented (altogether !.5 accident classes). De table contains also the description of the ilominant sequence from each accident class (escept accident class "1HE", from which two leading i* seguences were considered). Dese dominant sequences cover only 36.45, of total CDF. The sequences include: five LOCAs, two SGTRs, alx transients, two floods and one laterfaelag LOCA.

1 To illustrate the reporting process, Table 8 of this review presents the characterizations of the accident classes as functional sequences for those accident classes whose individral CDF is higher than IE- J 06/r. yr. For completeness, the table also shows the accident class "V" describing ILJ.cing rystems i LOCA sequences. In the table the descriptions of the dominant :,equences by accident class are reproduced, as well.

i j De SGTR contribution is relatively high due to dependence of pressurizar PORVs on instrument air, j zelative vulnerabilky ofinstrumer:t air (due to success crheria and room cooling dependencies) and some ,

' aimplifying conservative assumptions (not modeling g=.dem sprays, not modeling seconday steam .

t dump, not modeling cross connect of instrument air to station air, and ----taa isaam generror PORVs j aticking open with a probability of 1.0 in case of overfill).

26

,i

-- ~~--w. ..%w.w_.a.-- -..~ _ _ . _ _ _ . . . _ -

'i 2.2.5.3 Results of the Importance Analysis

!- De scope of the importance ar.alysis performed in the IPE extends to the following areas: initiating

i events, systems and components, corrective and preventive malnranances ('meluding test), and major

i operator actions. Two standard importance indicators were used

the Fussel-Vesely and the Birnbaum 4

j impucugge. In the subminal the resuhs are mmmarized in two tables (Table 3.4-5 and Table 3.4 6) and six figures (Figure 3.4-1 through 3.4-6).

li~

!

• De importance analyses performed on the nahtelag events asentially conf!rrns the inference previously obtained from Tables.6 and 7, that the most important initiators at Prairie Island are:

i' the 1.OOP(SBO) events, the Floods (T1FLD, SHIFLD), the LOCAs (MLOCA, SLOCA, LLOCA) i and the LOCL (loss of cooling / service water) event. I! l

• De impoiws analysis on the systems provided the ranking of the systems contributing the most

!i ' to the total CDF as follows: 1) the AFW,2) AC power,3) room-cooling, and 4. the cooling water systems. Number one is the AFW, because in many accident sequences due to a variety of initiators (e.g.1 LOOP, TIFLD, less of IA, less of DC) it is the only remaining means of i secondary cooling. AC power is in second place; its loss causes heavy reliance on the TDAFW pump during an SBO when the MFW and MDAFW pumps are lost. Room cooling is important, js' because when I.oss ofIA or less of CL occur, the chilled water that supplies the room cooling of , the Unit 1480 V safeguards bus rooms, fails. (This condition is algnificantly ameliorated, as j discussed earlier in the present TER based on the RAI response.) .

• With respect to corrective maintenance, the maintenance unavailabilities associated with the train -

i B AFW and the charging pumps are the most important: a.) he MDAFW pump train, because it is the most reliable pump to supply AFW to Unit 1 (the TDAFW pump has higher faildre rate and the MDAFW pump of Unit 2 requires operator action to be used), and b.) he charging pumps, because after an SGTR, charging is a requirement for successful RCS cooldown and depressurization. 1

• With respect to preventive maintanane* and test, k was found that among the unavailabilities of these types the most important is the one which is associated with the IA compressors. Als is due

to a combination of two negative factors: the 2/3 success criterion of the IA system (with one compressor in maintenance, a failure of the second compressor causes failure of the system) and the i steady use of the compressors which requires frequent preventive maintananean whose total time rapidly accumulates to a large value.

i e 1 27 t

    ?
   ?
   - - _ _ _ _ _ _ _ _ . . . . . , . _                                   _.                                    _ _ _ _ _ _ . _ . ~ . _ _ _ _ _ _ _ _ _ _

l Tcble 6 Core Damage Frequency by Initiatlag Event - ' CDF fresa Initiating , g .g. CDF fram Initiating 5 of Total CDF p GF h '# I'"" e Jaitiatia8 I Event Eventyear)

                                              - (per reactor     .. . . _ . WHaHar Event                                     W e p)                            WW Event y ,gg 3 b                                                      Unit 1                                                                  Unit 2                                     Unit 2 f         I-TRI                                       6.4E-07                                   1.3                            6.6E47                   .

1.3

   }        I-TR2                                       2.9E48                                  0.06                             3.1E 08                                       0.06

[ I-TR3 1.2E 06 2.4 3.2E46 2.4 1-TR4 5.2E47 -1.0 5.5E47 .1.1

  ?

I-LOCC 5.5E47 1.1 5.5E47 1.1 1-LOCL 6.4E47 1.3 6.4E47 3.3 i

  ~

I-LDCA 2.25 06 4.4 2.2E 06 4.3

  )         I-LOC 3                                     4.6E-07                                 e 0.9                            4.8E 07                                         0.9 I-INSTAIR                                   3.2E 06                                   6.3                            3.2E 06                                         6.2

{ I-LOOP 1.1E45 21.2 1.1E-05 22.4

  ;I        I-MSLB                                          *                                      *                                  *                                            *
  '          g-MFLB                                         *                                      *                                  *

• i I-SLOCA 4.1E 06 - 3.2 4.2E 06 8.2 I-MLOCA 4.6E-06 9.3 - 4.6E 06 9.1

              ~

I-LLOCA 3.7E-06 7.5 3.8E 06 7.3 I-SGTR 6.6E 06 13.2 6.6E 06 - 13.0 I TIFLD 1E-05 21 - 1.04E 05 20.4 I-T13FLD * -* * * { 1-AB7FLD 8.5E-10 2E-03 1.5E49 2.9E 03 i IAB8FLD * * *

• 1-SHIFLD 4.1E47 0.8 4.1E-07 0.8 j 1SH2FLD 4.35-10 11E44 > ~ 5.6E-10 .1.1E 03

  ;          V                                           2.3E-07                                  0.5                            2.27E47                                          0.5 f

i I i . t i I 28 f - t

l

                                                                                                                                 )

Table 7 Acddent Types and 'their Contribution to the CDF 4.

   ?                              Initiating Event Group                   Contribution to CDF (/r. yr)           %

i

LOCAs 1.22E 05 24.3 1; *

1 Janam Generosor 'Dube Rapture 4.6E 06 13.2 5"4=*== Systana LOCA 2.27E 07 0.5 1

4 Transients (w/o LOOP) 9.44E 06 18.8 e i ; Anticipated Trans. w/o Scram 3.2E 07 0.6 i ,

4 Internal Floo&ng 1.04E 05 .20.7 1

IDOP (with SBO) 3.1E4 (3.1E.06) 21.9 (6.2)  !

i l l i . TOTAL CDF 5.02E-05 100.0 i i + ', ? 4 ,

   }

t I l 4

   )

l f S I

   *                                                               - * -                                ~ ...

i t - 29

i [- Tcble 8 Imading Accident Classes and Core Damage y== by Accident Class - i k, l

Aen4Aant Class and

• t Accident Class na==laa=# Sequence IF ~

Designator and _ Aeridans Class Characterisation and . ji - wp -- CDF - % of na t ant Q = Description (per r. year) Total CDF ti

FEH TB1 -Flood whb 1545 21 nis armiaar class includes only .wmquence.

! early core damage at bigh Flood in the AFW pump room froan a beak of !,' RCS pressures a coohng loop bander. All AFW pures fail ]' i along with all IA compremers. MFW fails due so closure of main feed regulating mi bypass valves due to loss of IA and loss ofluke oil 1 coohng to the MFW pumps. Feed and bleed fails due to loss ofIA. See also Section 1 j 2.2.4.2 of abe subanitial.

    ;                                           THE - Transient with early                               1E45             20        The esquences in this class are characterized by core damage at bigh RCS                                                             a loss of MFW through loss of IA/ LOOP /SBO.                                l pressures                                                                           Subsequently, the AFW is lost partially or completely. RCS short term inventory fails due                              l to loss of feed and bleed coohng caused                                     !

through failure of the pressurizer PORV or the j operator, j Dominant Sequence 4.4E 07 8.9 Imes ofIA causes Rx trip due to loss of MFW. RCP seal cooling is successful but 11,12 and 22 AFW pumps fail to run so 21 AFW pump

                                                                          ,,                                                        cannot be used for Unit 1. Feed and bleed fails                             i due to loss of IA and level snetoration of MFW
    .                                                                                                                               is ===-ful.                                                                 l SLL - Lar3e/ Medium                                     8.3E-06           16.6      His class includes medium (break size range:                              .

LOCA with late core 5-12 inches) or large (break size at 12 inches) damage at low RCS LOCAs in which short term inventory using SI pressures or RHR 'is successful but the operators fail to r switeb to recirculatico before the RWST is depleted causing injection to fait lendag to core uncovery. Dommant (large LOCA) 2.5E 06 5 Successful abost-term RCS inventory. Iong Sequence earm RCS inventory fails des to operstar error in laning up for recirculation. Dominant (Medium LOCA) 2.2E 06 4.J Successful seactor trip and short-earm RCS Sequence inventory. Long term RCS inventory fails due to opentor error in lining up for recirculation. s f . S 30 'r

p. _ . _ , _ _ _ , . _ - _ . ..-- _ _ _ _ . , . _ , . . . . . _ . . . _ .

 ~ - - - ,                      . -               _,                   ,

                                                                                                      ~
                               . Table 8 Imading Accident Classes and Core Damage Sequences by Accideat Class

Aed.*mt Cia d

{ -Accident Class Deng tor and w% gg ,g " CDF %g rhaminant Sequence Description (per r. year) Total CDF - SEH - Small LOCA with 8.3E 06 16.4 h esquences within this class are ) early core damese at high abaractensed by either a small LOCA (break RCS prewures aime range: 0.375 - 5 inches) on RCP seal LOCAs caused by a LOOP loss of train A DC 1 power or loss of cooling water. Secondary j ooohng using either MFW or AFW is ' sucomesful but abort-term RCS investory fails

  !                                                          .                           due to failure of the SI system.

Denant Sequence d.3E47 J.3 Imes of cooling water causes seactor trip due to loss of CC to the RCP motors. Imss of CL i causes loss of chilled water and thus loss of ' scom ocohng to the 480 V safeguards bus t ,' scoms. This results in the 480 V AC bus failure causing loss of all charging pumps leading to an RCP seal LOCA that cannot be integrated by the SI pumps as they beve lost CC cooling to their lubs oil coolers. Local operator action to restore cooling water and 480 1 4 V bus room cooling also fail. ) GLH - SGTR with late 6E 06 12 ' lie accident class is charactenaed by SGTR in oore damage at high RCS which reactor trip, ==aaadag cooling, abort-  ; 3 pressure term RCS inventory and ruptured SG isolation  ; are sucomesful. 'Ibe operator then fails to l cooldown and depressurize the RCS before the i suptured SG overfills. Rehof sticks open and I l ee operator fails to cooldown and depressunse the RCS to RHP. ebutdown cooling (SDC) temperature and pressure before RWST j depletion occurs which causes loss of SI  ; inqjection and subsequent oore damage. J Dominant Sequence J.JE 06 2.1 SGTR with opersw failing to cooldown and  ! depressurias the RCS before reptwed SG overfill. The relief sticks open followed by the operator failing to cooldown and 4., nize the RCS to RHR SDC temperstwo and pressure before RWST depletion, [ r . 31 p**- -~--e=4 ,-,.. .. ++ - .+- *. - - ,w . . .

~I Tcble 8 Leading Accident Classes and Core Damage Sequences by Accident Ciass ** fr . Accident Class and i Accident Class nn-1 .d Sequence j -Accident Class Characterhation and l i_ o .l_.. CDF S of Dosninant Sequence Description j (per r. year) Total CDF ?I BEH-NOPWR SBO 2.8E-06 5.6 Sequences within this class are characterned by fl

• with early core damage at as SBO with successful TDAFW pump. He high RCS promouves operator is successful in cooling down and

                 )

4 depressurizing,tbe RCS with the SG PORVs to minimi= RCP esel leakage. Then he fails to seetore both offsite and onsite AC power before

                                                                                                                                     ********"1 i                                             Dominant Sequance                                 2.JE 07               0.5             LOOP and subsequent comunas canes failure of

!) four DGs. To AFW pump runs for 2 hours !I before baneries are depleted med SG level instr-*= tion is lost. The operator is successful to depressurize the SGs with SG i PORVs to reduce RCP seal leakage but he fails i!

• to restore offsite and onsite AC power at 5 hours.

SLH - Small LOCA with 2.4E 06 4.8 His class can be characterund by a small i late core damage at high LOCA (break reage: .375 - 5 inches) in which RCS sneeures 3 , secondary cooling and abort term RCS j , inventory using SI pumps is successM. The iT eparator then fails to cooldown and -

               ;                                                                                                                     depressurias the RCS to allow use of RHR obutdown cooling before RWST depletion 4

l eccurs. High head recirculation fails due to equipment failure or operator action. The core uncovers and is damaged due to loss of snakeup espability, iI Dominant Sequence 3.5E 07 0. 7 Small LOCA, sucomesful Rx trip, ==randary T ~ cooling and abort term RCS inventory. RCS

               ;                                                                                                                      econdown and depreneurhation to RHR SDC
               ;                                                                                                                      conditions is also nuncessful but the CC valves
               ;                                                                                                                      to the RHR heat enchangers fail to open failing

! -RHR recirculation. Local attempts at recovery fi areuneuocessful. ll .. . . .

1 if Il 32 ii 4

h I h; I i ! 5 e < -we.-- n _-w w . . .n. ~~~~w _m.-- ~- 9 ..p . 9 m, - 7 -- 4

            ~

!J t.. i; Table 8 Imading Accident Classes and Core Damage Sequeness by Accident Class i; ) i

;* Aacident Clam ad

Accident Class Dominant "gm p

                                                            *"                                               'Am m wh w

[ on CDF S of Desninant W W

'I                                                                       (per r. year)   Total CDF
       !                                  V -Interfacing Systems            2.3E-07           0.5      This class consists ofinterfacing systems j l                                        LOCA                                                         LOCAs with a bypassed containment. ISLOCA ll                                                                                    ,

pathways include: i: a) RHR to RCS loop B recurs lias; isolatson I configwation: 2 abeck valves and a sonnally closed MOV,

!,                                                                                                      b) RHR suction imm loops A and B, isolation

'g

• configuration: 2 monnally closed MOVs, c) Reactor vessel low band issection line; jl isolation
• configuration: 2 check valves.

j_ rw:-, Sequence . 5.5E.08 0.1 Chtsstrophic failure of both of RHR series loop l, A suctice isolation motor valves followed by ,' the failure of both of the RHR pump seals i enusing small LOCA outside contaiamant. The operator is na=w-=ful in coolmg down and lI depressurizing the RCS before RWST j, depletion. i i i 2>3 Human Reliability Analysis Technical Review i.e 2.3.1 P w-Initiator Human Actions Errors in the performance of pre Inittstar human actions (such as failure to restore or properly align l, equipment after testing or malatannae*, or miscalibration of system logic instrumantation), snay cause components, trains, or entire systems to be unavailable on demand during an initiating event. 'Ibe review of the human reliability analysis (HRA) portion of the IPE *a=1= the licensee's HRA process to

                                 . determine the extent to which pre-initiator human events were considered, how potential events were
       ;                            identified, the effectiveness of any quantitative and/or qualitative screening processes used, and the t                            processes used to account for plant specific performance shaping factors (PSPs), recovery factors, and dependencies among multiple actions.

l 2.3.1.1 Types of Pre-Initiator Bisman Actions Considered I The Prairie Island IPE considered both of es traditional types of pre initiator homen accions: dailures to restore systems aAer test, ==iah=aare, or surveillanos activities and instnuneet miscalibrations. However, while a fairly { , brand range of failurs to restore events was modeled in the fault trees, miscalibration events were act expbcitly - l k modeled. Instead, miscah% ration of various sensors and instnanents was " treated through the inclusion of commnon i j , - cause failure modeling for the sensors or instruments themselves.* In other words, the common eense failure { probability for a group of related instnaments was soeumed to include the potential failure due to - cause t muscabbration. The a6mittal argues that because of =Asadaary in betrumaa*=tiaa for activation of safety systems,

       }                             - cause failures (and miscabbrations) of sensors were detennined to be insignificant contributors to plant 1                                                                                                                                                      i 33 i                                                                                                                                                      !

i 4 i

       "                                                                                                                                                      l

a . .

                                                                                           ~

sisk." While there are >====ht* aspects of such an argument, h abauld be aosed that miscalibraban events havs { been explicitly anodeled in other IPEs and in some instances have basa shown to be significant contributors nus, e the licesase's treatment of mindbestion evuoss anny have precluded identificauon of important pre-initiator events

  !             and is therefore a w==kaa== of the HRA.

t 2.3.1.2 Process for Identification and War *ia= ef Pre-Initiator Banan Actions I *

             - In the licensee's response to an NRC request for additional information (RAI), k was indicated that
            . errors committed during corrective and preventative maintenance and testing (including those during refueling outages) wem considered and their applicability was evaluated during development of the fault trees by reviewing operating procedures, malaten== procedures, administrative control dommante, and EOPs. Testing and maintenance procedures were reviewed to determine if any component is effectively                                              <

I disabled and cannot automatically be restored or realigned on an appropriate initiating signal. If so, then a basic event was added to the fault tree to reflect the potential for failure to restore. However, if an indication of the misalignment is given in the control room, the event was not modeled. If some other indication is given in areas toured by operators during rounds, the error was only considered for the interval between rounds. While no explicit statements regarding discussions with plant personnel on the interpretation and knplementation of procedures were provided, it appears that relevant information sources were examined and that factors which could influence the probability of pre-initiator restoration failures were considered. 2.3.1.3 Screening Process for Pre Initiator Emman Actions

                  *Ibe licensee stated that no screening valus were used when modeling pre-initiator human errors. As will be dkmuM in the next section, values were calculated for all the restoration events that were modeled.

For pre initiator ev.ents included in the fault trees that were later determined to result in indications occurring in the control room, their failure probabilities were set to zero and they were left in the models "for possible use in sensitivity studies." T' 2.3.1.4 Quantification of Pre Initiator Banan Actions l Restoration of components with maintannace procedures calling for post-maintannw verification of 1 component status were assigned HEPs of 0.003. A failure to restore probability of 0.01 was assigned to 9 =i-:-+ without such a verification. Plant-specific component unavailabilities were then calculated l using the HEPs in conjunction with factors such as maintenance frequency and duration, test frequency and interval, refueling outage frequency, and time from completion of the corrective maintan== to the votest of the component. The unavailability equation was indicated as being from ASME paper 91-JPGC- i NE-!! and eppeared reasonable. 'Ibe basis for the selected HEPs was not provided, but the values are tensonable and consistent with those that would be obtained using the method described in NUREGICR- ' 4772 (ASEP) for quantifying pre-initiators. Given plant practices regarding maintanaw of separate

 ;                 trains, all restoration failures were considered independent events. Dependencies associated with miscalibrations were at least indirectly covered by grouping instruments according to potential common
 !                 cause failure mechanisms. Similar instruments would probably have similar calibration procedures, but i              , other factors such as the plant schedule for calibrations could also have been relevant.

34

u ! 2.3.2 Post-Initiator Hurnan Actions Ii

• Post-initiator human actinat are those required in response to initiating events or related system failures.

l! j{ Although different labels are often applied, there are two important types of post-initiator human actions ' I that are usually addressed in PRAs: respoese actions and recovery actions. Response actions are generally l} distinguished frorn recovery actions in that response azions are usually explicitly directed by emergency cperating procedures (EOPs). Alternatively, recovery actions are usually performed in order to recover ll- a specific system in time to prevent undesired consequences. Recovery actions may entail going beyond l! EOP directives and usirgg systems in relatively unusual ways. Credit for recovery actions is normally not jj taken unless at least some procedural guidance is avaliable. l{ De review of the human reliability analysis (HRA) portion of the IPE determines the types of post-inhiator hurrr.n aabas considered by the licensee and evaluates the processes used to identify and select, ll [ acreen, anc quantify the post-initiator actions. De licensees treatment of operator action timing, j! dependerzies among human actions, considention of accident context, and consideration of plant specific j1 PSFs !s also examined. i i , 2.3.2.1 Types of Post-Initiator fiumt.c. Aetions Considered De Prairie Island IPE a6 dressed both risponse and recovery type post-initiator human actions. Response i; type actions were those mxleled only when clear procedural guidance (normal, abnormal, or emergency i; procedures) existed for the operator. Recovery actions included cases where procedural guidance may not have been available, but "the operators training or knowledge are assumed to lead him to perform the required action.." Repair activities (e.g., restoration of instrument air or component cooling water), -

   ;                   local operation of systems (e.g., manual opening of valves), and recovery of offsite power or a DG are examples of recovery events modeled in the IPE. Eleven recovery events are described in the submittal
  ;                    and none appeared to require extraordinary behavior on the part of the operators.

t 2.3.2.2 Process for Identification and LRarelaa of Phst-InitiatorBanan Areianc

  !                    A detailed discussion of the initial process for the identification and selection of post-initiator human actions was not provided by the licensee. However, k is noted in the submittal that "only those post-7 accidet operaeor actions required to initiate systems... wete included in the fault trees." Dese actions were described as being based on normal, abnormal, and emergency procedures. Operator actions in l                    response to equipment failures were not modeled until after the sequence cutsets were generated. If more than one operator action occurred in the same cutset, *elther independence of the human actions was confirmed, or a change was made to correctly snodel dependence between human errors." The

[ i subminal also indicated that in the % man factors review performed in support of the HRA," walkdowns

  ;                     of selected local and control room panel operator actions were performed to verify r plans and to
  ;                     "look for factors not previously considered." In addition, control room personnel were interviewed to i                     discuss roles and responsibilities during actions, timing of actions, and performance of specific actions.

t ' hus, k appears that activities were c=whuvad that would to help ensure appropriate modeling of operator l actions. I i , 2.3.2.3 Screening Process for Post-Initiator Rasponse Actions De submhtal indicates that acreening values were assigned "by following a flow chart and answering a

   ;                    series of questions." Neither the q==rinns nor the flow chart was provided, but " plant-specific mattmatn 35 I

p- .--.-s. . - - - - _ . , . _ _ _ . .

                                                                                                                                    - ~ . - -

l, * ' 4

J of the time available to initiate and perform the action" and "PSFs newimM with degree cf difficulty -

,y and stress" were considered. He screening HEPs were based on the Handbook (NUREGICR 1278), 1- Wash-1400 (NUREG-75/014), and "the daa sources used in the IDCOR BWR IPE methodology." Thus, at a minimum a systematic approach was taken in the assignment of post-initiator screening values. }lf i Examples of typical opersor actions and their ==aelad screening values were presented in Table 3.3-10 { of abe submittal. While some of these values (e.g.,1.0E-4 and 1.0E 3) might normally be considered l non-conservative for screening values, they may be justified given the apparent detailed screening analysis j, and the licensee's consideration of dependencies (as is discussed further below). As noted above, the i licensee indicsed that if more than one operator action occurred in the same cutset, "elther independence j of the human actions was confirmed, or a change was made to correctly model dependence between

, human errors." Furthermore, in response to an additional NRC RAI on the consideration of

! dependencies, the licensee stated that each operator action was =aralaM when k was calculsed, to l determine which operator amions were dependent due to the same cognitive process. Actiocs determined j to ame the same cognitive process were given large screening values to ensure that they wwe not truncated

- from the final core damage sequence equation. He final values of these operator actions were later set

!f to values that appear in the relevant tables in the submittal. The licensee also noted that all but six of lj the seventeen human actions left at screening values did appear in the final CDF or containment failure j' seguence equations. De r===talag six actions were said to be unlikely to ever appear in risk significant !, sequences, since they must fail in conjunction with highly reliable components. Dus, the licensees !' screening approach appears to have precluded inappropriate truncation. The licensee also noted that the !4 HEPs obtained for the human actions receiving detailed analysis were "at about the same value or lower ! than the screening analysis results." i i 2.3.2.4 Quantification of Post-Initiator Bisman Actions l~ j' - Pbst-Initiator response type actions found to be important received detailed HEP development. An action i was important if it contributed significantly to baseline core probability or "if a change in the failure rate l could cause significant increase in overall core damage probability." Most of the actions receiving i* daniled analysis were quantified with the ASEP method (NUREG/CR 4772). De response to the NRC

 !                . RAI states that a more refined estimate for the five most important human actions was obtained using the
                 ' 'DIERP Handbook (NURG/CR-1278). He five actions quantified with the Handbook included actions
 ;                   associated with transferring to recirculation following a 14CA and cooling down and depii                Ling t                   during a steam generator tube rupture. De values for the transfer to recirculation ranged from 0.0012
 ;                   to 0.008 and the values for cooldown were 0.011 and 0.0065. While none of these values are grossly anennaleme widi values ibr shnHar events in asher IPEs, k did appear that the switchover to recirculation i                   HEPs could be apet=1*1c given the available time frames for the small, medium, and large LOCA annarios. A description of how these values were obtained using the Handbook mahadology was not provided in the subminal or in the licensee's response to the initial RA1. He submittal does note that the analysis was similar to that used in ASEP, ascept that more detailed analysis is performed for types of procedures used (with or without sign offs), verification steps, crew size and crew response timing, errors of omission and commission, timing, expected stress and dependencies between operator actions.
 ,                   la response to an additional NRC RAI regarding the events quantified with the THERP Handbook, the                    .

j licensee provided detalled calenimian sheets 111ustrating how the HEPs were obtained for the switchover

 ;                   to rect tulation events. While the analyses were reasonable, the licensee apparently took some credit for I                    diagnosis of a 1.OCA and the eventual need for swiedever prior to the occurrence of the low RWST level              -

i alarm. His alarm is apparently the primary cue for the switebover action. De THERP annunciator naponse model was used to determine the post RWST level alarm HEP and the time based cue response i . 36 i i

 +

E p_ - __- - - -. .__ ~ - - , - - - . _ . - -

1 1 . . I . I 1I ,s.- . }} model was used to determine the HEP for diagnosis prior to the occurrence of the critical cue. De l !{_ analysts assumptions were not unreasonable and the approach was consistent with the application of THERP. Given other conservatisms noted by the licensee in the analysis of these events (e.g., l} conservative estimates of time available), the obtained HEPs appear reasonable. ,, j ! A description of the application of the ASEP methodology to the other events appeared aound. A review I* of the obtained values suggested a tendency toward conservatism, as was noted by the licensee and as is i generally the case with applications of ASEP (see Table 3.3-3 of the submittal). The licensee also noted j tha a relatively conservative diagnosis time was assumed for feed and bleed and that the same time was j applied in all instances of the events quantification. Dis approach has the potential to lead to pessimistic j3 HEPs for some cases of feed and bleed.

                    .33.2.4J        Endmates and Consideradon qf Operator Regense 1bne 1

4 . l} 'Ibe determination of the time available for operators to diagnose and perform event related actions is a l l critical aspect of HRA methods which rely on TRCs, such as the ASEP methodology. In the licensee's j* discussion of the application of the method, k is clear that appropriate timing parameters were considered.

MAAP runs were used to determine the latest time an operator action could be completed and guidance i from ASEP was used to assess the time needed to complete actions in control room. For action times j,' outside the control room, an engineer and former SRO was consulted and confirmatory walkdowns were r  : performed in some cases. The time at which a compelling signal is received was considered and

diagnosis times were computed. Examples indicated appropriate use of the timing parammers within the application of the method.

                    ,23.2.4.2       Other Perfonnance Shaping finctors Considered As noted above, the application of the Handbook to five important human actions involved detailed consideration of a set of important PSFs. De PSFs addressed in the application of ASEP included             ;

training, practice during simulator training, and whether the event was covered in the EOPs. In addition, she existence of written procedures for conducting the action, whether the procedural actions were step-by-step or dynamic, stress level, alze of crew and time available for recovery credit were considered.

                      'Ibese PSFs are those normally considered in apply *mg the ASEP methodology.

De submittal also stated that the " control room design review" was reviewed and that walkdowns of

                                                                                                                  ~

selected operator actions and control room panels were made to look for factors not previously considered. Whether and how these factors influenced resulting HEPs outside of the basic treatmant of

  !                    PSPs by the HRA methods was not discussed.

23.2.43 Considendon ofDependenties i ho basic types of dependencies are normally considered in quantifying post-taltiator' human actions:

1) time dependence and 2) dependencies between multiple actions in a sequence or cut net. One type of i time dependence is concemed with the fact that the time needed to perform an action influences the time

available to recognize that a problem has wi4 and to diagnose the need for an action. Dis type of

          .             time dependence was trested in using the ASEP quantification approach. De licensee's response to the l                    RAI also noted that the same timing parameters were used in applying the handbook method.

37 e y e = w we,wm+-,. , -.w.e eena.----,-- - * - --- --%.a ,, ,,- , , m# .._,

L -

• i

'I . i! Another aspect of time dependence is that when sequential actions we considered, the time to complete 'f one action will impact the time available to complete another. Similarly, the sooner one action is ii performed, the slower or quicker the condition of the plant changes. His type of time dependeace is !{ aormally addressed by making conservative assumptions whb respect to accident sequence definitions. l! One aspect of this approach is to let the timing of the Grst action in a sequence initially almmize the time

E window for subsequent actions. De occurrence of cues for later actions are then used as new time origins. Although not explicitly discussed, the lie === clear evaluation of timing factors and i ;[ consideration of dependencies appeared to cover this type of dependence.

1I De second type of dependence considers the extent to which the failure probabilities of multiple human 1j actions witnin a sequence or cutset are related. Dere are clearly cases where the context of the accident and the pattern of successa and failure can influence the pmbability of human error. Dus, in many cases k would clearly be inappropriate to assume that multiple human actions in a sequence or cut set would ji be independent. Furthermore, uontext effects abould be examined evac for slagle actions in a cut set.

While the same basic action can be asked in a number of different sequences, different contexts can i? obviously lead to different likelihoods of success. Several discaissions in the submittal and in the 5

licensee's responses to the RAls indics's that potential dependencies among the operator actions were ji appropriately considered.

ii l' 23.2.4.4 Quangliandon of Recewy type Asdons lt

• De licensee's response to the RAI indicated that all recovery probabilities (with a coupi6 of exceptions)

{i were derived from NSAC-161, " Faulted Systems Recovery Experience" and that recovery actions were i l' culy added to cutsets when it was apparent that an operator would have sufficient time to perform the i aWhional action. Local recovery of valves which failed to open or close was credited only when there , was control room indication of valve position and the valve was easily accessible . A non recovery l l pmbability of 0.025.was assigned to these events. Recovery of equipment such as pcmps had the same

    ~
                                                                                                                                       )

criteria, but the non-recovery probability was "approximately 0.5." i lf %e validity of the derivation of HEPs for .~ y actions from NSAC - 161 was addressed in an l additional RAI to the licensee. De RAI suggested that the nature of the grouping of different recoveries

   ;               in NSAC-161 is fairly " coarse." And that in many cases the grouping appears to be " mixing apples and i!               -oranges." A discussion of the derivation process for recovery HEPs (with examples) was requested.

I r In response, the licensee demonstrated that a thoughtful analysis of the data in NSAC - 161 was i condnaed and that an attempt was made to use the most appropriate information. While k oocid still be e argued that the data in NSAC - 161 is insufficient in many cases for the derivation of recovery HEPs for j, PRA use, the examples provided by the licensee suggested that the data was used conservatively. , lr 3JJ.43 Ruman Asdons in ne Moodin Aan&ds Opensor amions were appaready not quantified in the Prairie Island IPE. However, the submittal states ji that "the minimum time allowed for a zone to Sood was based on the indications that the operators would

i receive to alert them to the Dood." Operators were assumed to find end isolate the source of flooding l! in 20 minutan if an alarm or other indication would tell them azactly where the Sooding was occurring.

ii If the indication occurs, but does not tall thesn azactly where the Sood is located, then 60 minutes is

                 ' assumed before they will isolate the leak. If no indication is given, k was amen =M that the operators ifj5                 would find and isolate the flood during their sounds wkbin three hour .                                         -

h No other discussion of operator actions in regard to the flooding analysis was found. n p 38 ( - 1: w - ._ _ - -

I i - 23.2.4.6 haan Asdons in the Lael 2 Analyds

i A review of the Prairie Island Lovel 2 analysis failed to find any discussion of the quantification of l{l operator actions. Apparently RCS depressurization was discussed, but the related operator action and

                                                                         ~

j. Its quantification was not addressed.

                                                                                                                ~                              '

!! 2.3.2.5 baportant Hassan Actions !) I. 1be Prairie Island IPE provided a list ofimportant human actions as determined on the basis of a Fussel-Veely analysis. Events identified as - *ia= ibr snore than 1% of the total CDF and their HEPs are presented below in Table 9. Each event's percent contribution to CDF is also listed. !{ i! A review of the HEPs associated with each event did not bientify any events with an HEP that would be considered inconsistent with failure probabilities obtained for almilar events in different plants or that ![' . appeared to be excessively low. i i; Table 9 Important Human Acilons i!.. - Event Description (percent contribution to CDF) ,y j Bleed and feed (no "S" signal)- for alngle operator action cutsets G.2%) 0.039 1 Cooldown and depressurize RCS to stop tube leak br/ ore SG overfill (6.7%). 0.011 } lI Transfer to recirculation during large LOCA (5.0%) 0.0084 Transfer to recirculation during medium LOCA (4.3%) 0.0027 Open doors on loss of room cooling (3.4%) 0.067 l Cross tie to unit 2 motor driven AFW pump (3.2%) 0.032 I Cooldown and depressurize RCS to stop tube leak qtter SG overfill (2.2%). 0.0065 l Transfer unit 2 AC to unit I during unit 1 SBO (1.3%). 0.0032 Bleed and feed (no "S" signal)- for multiple operator action cutsats (1.7%) 0.071 2.4 Back End Technical Review

                                                                                                              ~

i , 2.4.1 Containment Analysis /Characterhation t

2.4.!.1 Phug end Back end W f .

1he laterfaces between the tonand and back end analyses are provided in the IPE by the definitio'n of 14 sa:idna dasses (ACs). rwinirian ofIbe accident classed is discussed in Socsion 4.3 of the IPE mhrninal. 'Ibe parameters used in the IPE to define ibe ACh include: [ 39 1 t I

i '[  ! 1. 2. Accident initimor, Core melt timing,

                                                                                                         ~

l l

         ;                                 3. RCS pressure at the time of core melt.                                                            ,

_ ...___ ._. . . - .J

1he as:ident ininmors br the AO analymd in the Prairie Island FE include transient, station blackout (SBO),

           ,                LOCA, SUIR, ISLOCA, and ATWS.1he timing of core melt depends primarily on whether core melt is *

( samed by irsemion (earty) or recinadation failure (late), aw! RCS presure, which is denned in the PE as the primary system pressure being high enough so entrain the core debris out of the esvhy upon vessel failure, 4 d9 mds on the type of accident initiators. For example, sacept for the accident classes involving snedium and 4 inrge IDCA sequences, the RCS pressure for the accident classes imelving other accident sequences is high. The ar==teinn=1 probabuities of the AQ for the various accident initimors are: 23% for small LOCA Q ACs),

         ,                  22% br transient Q ACs),19% for haarnal Sooding Q ACs),16% for medium or large LOCA Q ACs),13%

tr SGIR Q ACs),6% for SBO (1 AC),0.6% hr A'!WS Q ACs), and 0.4% for ISLOCA (1 AC). The most pmbable AC h 'JHE Q0% CDF), an AC with aa:ident sequences inhiated by transient initiators with early core ask and high RCS pnssure. This is fauowed by FEH (19% CDF), an AC initiated by internal Gooding, with early core melt and high RCS pressure. Unlike the PDSs used in some other FEs, the availability of mnrninment systems are not explicitly included in the dennhion of the ACs in the Pmirie Island IPE. In the Prairie Island IPE, containment systen fauh trees (for comainment spray injection, containmars spray recirculation, and containment fan coil units) are quantified as frontline systems, along with the Level I frontline and support systan fault trees, using linked fault tree

models. The containmers symams fauk noe outsets are Iqut to the CET branches as necessary to support CET quann5 cation.

[ The ACs denned in the Prairie Island IPE to provide frontend back end dapanriancies for the 1mel 2 analysis i

                          , of theIPE seem @a Ahhough their dennition does not include the parameters indicating the availability
                          . of containment synems, the use of fault true linking to determine their availability in CET quantification seems           l

- adegume.

                         )14.1.2 Centainment Event Tree Devanag====r                                                  _

L Pmbabuity quantification of severe accident progression is performed using containment event trees (CETs). Ibe development of the CETs is discussed in Sections 4.5 of the FE pe=nkr=1. Five CETs are W in

     ;                       the Prairie IPE for the 14 pocident classes ahrainart in the FE. The CETs includes the following top events:
     ;                                      1. Accident class,

2. Bypass due to SGIR,

3. r~ala aaa' isolation,

4. Inwessel ,wsry, j 5. Reactor depnssurization,

    ;                                       6. Early mnentament challenges, 1

7. Ex vessel 1:section, ,

s. cane ta nent pnssum control,

9. Fission product scrubbing .eme 1,=naar Spray.

I Figms 4.5-1 through 455 of the enhenkr=1 show the struaures of the five CETs. Figure 4.5-2, the CET for j SBO accident class with early core meh, bciudes an additional top eveint to address the probability of ac power

     .                                                                              40 i
    ?

t n-.- - - - - - - . . . _ _ _ . _ _..

t i . 1 i {.- i vuxr.wy. the CETs in the Prairie Island PE have from 22 (fbr medium or large LOCA wkb lae core melt)

                                                                                                                                     \
                                                                                                                                     )

j so 49 and states (for SBO with early core melt). Since matairunent failure is assured for ISLOCA and SGTR 1 l accident sequences 0.e., by containment bypass), CETs are not developed for the ACs ==ceistad with these aequences and all of the them are === mad in the FE to lead to aantalamm bypass. In general, the CETs

 -!            developed in the Prairie Island PE are well structured and easy to understand. The top wants of the CET g             emer the importars issues that determine the RCS integrity, ent=In=m response, and wentual release from j              the containment.                                                                                                     l The quanofication of the CET in the Prahie Island PE is based cLn plant speelBc pherv=nanatogical waluations.

i 1he evaluadons include modeling and bounding calminciant Osased upon experimental data), consideration of phenomenological uncertairsies, and MAAP calcadations. In general,Ibe quantification process used in the FE

is symemade and traceable. Although the value assigned in 6e FE asem adequae, their M cannot be i verified in this te&nical evaluation report because of the limited scope of abis waluation. Some items that are of interest are discussed in the following.

i

 ,I
 ;              Castainment Fallwr Mades not induded in GTQuan@lcation

]* '? Containment failure modes are discussed in Section 4.4 of the FE submittal. Although all isvaiam severe accident containment failure modes that are discussed in NUREG-1335 are addressed in the FE mbmittal, some of them are ignored and not evaluated in CET quantification. These include those associded with the melt through of the containment steel shall 0 e., liner melt through), vessel thrust forces, and thermal arts 4 of maMament penetrations. 1 The potanial failure of the steel shell due to diras contact whb molten corium is discussed in the FE submittal

  ,              and also in the licensee's response to the RAI (Level 2 Question 5). 'Ibe potential of containment shell melt-      )

i through exists only during high pressure melt ejection (HPME) den a significars amount of core debris is  ! dispersed to the outside of the reactor cavity and come into contact with the steel shell structure of the 4

• conninment. Two debris dispusion paths are identified and evalumed in the FE. 'Ibe first one is through the I instrument tunnel to the upper comism.sm, stking the cavity a the seal table strucsure; the ascond one is through the access batches from the containment to the instrument tunnel. Of the two paths, the second one

 ;               presents a more significart challenge to coarmlament integrhy.1he access baches to the instrument tunnel are
 +               in an open area on the basement level of the aantninmant, and for both of the Prairie Island units, one of the

two batches faces toward the steel *-a-t about 30 feet away, whb a largely unnherructed path in between. According to the licensee's response to the RAI (Level 2 Question 5), a scoping study performed

• in the FE shows that the temperature generated by the debris adhering to the mael wall is insuf5cient to melt

( the steel and brea& the containment even whb conservative assumptions about the mass, diarD=*ina, and best i generation of the debris expelled from the instrumrat tunnel. However, details of the scoplag study are not provided in the submnel and the potential effect of corium attack on reducing anarmlamaar pressure capability is not diamecad. f 1he probability of comainment failure he to vasel ibnat forces and thermal stack of anarniamm penetraions are daa==ad in Section 4.4.3 of the FE muhmittal. For thrust forces, an antimmte of the thrust force genermed

                  & sing HPME is runiaad and compared wkb the weight of the reactor vessel and the capabilky of the primary

' i shield wall acting as a restraint to determine the probability of anatalamm failure due to this "W.

        .         For thermal attack, the penetrations and the seal materials used for the penetrations are identified and waluated agains represanative sevue accidst temperature pronia to determine the potential of anat=1amm failure due to excessive lena: age from thermally degraded seals. Resuhs obtained in the FE show the the probabilities of containment failure from both of the above phaanmaan are negligible.

41 P

      . - - --                       - - - - - - - - - ~ _ - . . - - - . -              - - -                   _ __ - - - _ - _ - - - _. -

jf

• Contalmnent Failure Modet CoruMennt er Unfaely but laduded in CET QMm"s fI 7be mentnment failure modes that are considered as unlikely in the FE but are assigned a small failure ,

!;, probabiliry in CET quantification include those manadard with direct containment beating (DCH,1E-3), in-

venet steam explosion (Alpha mode faBurt,1E 4), en wessel maam explosion (IE-3), and hydrogen .Midon i F (5Fe3). Corsainmers innimion failure is also considered a unlikely but is evaluated in the CET quantification ,

j' using the data ottained in the =*=in=*=* halmian analysis (see Secsion 2.4.1.4 of this *IER). in the PE, duerministic evaluation of the espected peak pressures was performed for the phenomena that

  ,                 would eve containment pressure challenges (e.g., DCH and bydrogen bum). 'Ibe es'irnmed pressure loads

)' were 'onen cortpared wkh the containment fragility cauve to determine the probability c f containment failure. ! For stase phenomena with other coreninmme challenga (e.g., steam explosion), a etc61 nation of deterministic i analysen rad expert opinion found in the open literature is used to animma containment failure probability. Became of tre uncertainties associated wkh these phenomena, the values used in the PE for these phenomena l- are described a' qualnmively evaluated values (in the licensee's response to RAI 1Avel 2 Question 3). jt According m the discussion provided in the IPE =#unieral the valuec used in Ibe FE for these phanamaan seem l to be adequate. l' Containment Bypass and induced Steam Generator 1kbe RHprunt GSG3.% !. Casainment bypass is considered in the IPE a one of the dominant containment failure modes (Secsion 4.4.2). J- According to the Prairie Island IPE, containment bypass occurs for the SGTR and ISLOCA events, k also 4 occurs with an induced creep rupture of the steam generator tubes. As mentioned above, CETs are not developed for SGIR and ISLOCA m%r* clanes and containment bypass is assured for these accident classes.

'Ibeir contdbutions to the total CDF are 135 and 0.4%, respectively. On the other band, ISGIR is evaluated l, ^ 1n the CET as one of the CET top events (Semion 4.5.3.1). According to the PE, ISGIR occurs only for i- '. cases with the RCS a high pressure, wkb dry steam generators, and wkb the restan of the rencsor analant

• pumps (RCPs). Although the pmbabuity value used in CET quannfication for ISGTR is not pmvided in the y: - adunieral, results presented in the submktal show a significant contr u melan froen ISGTR (about 31% of CDF).

                      'Ibe high ISGrR probability obtained in the FE is primarily due to the procedures that call for the restan of 4e ROs under severe accident condmons. According to the licensee's response to the RAI (Level 2 Question                                    .

l? Ii~ 7), these emergmcy pmcedures bsve been changed to pmbibit the restart of a reactor malam pump with a dry

l. suam smensor under sevent accident conditions (based on recommendations imm the Westingbouse Owners l' Group). This procedure change is ==,=*ad to reduce algnihely the probability ofISG'rR. Because of the l! change of the EOPs, the C-Matrix provided in the Ilmaw's response to the RAI (Level 2 Question 7) does ji mot include the contribution from ISGTR.

h VenelRectnery Tee means for in vessel recovery are considered in the IPE: restoration of injection and er +essel cooling of in vessel core debris. According to the IPE, the recovery of core indemion bas minor e5ect on preventing pl l vessel failure 0.e., in*essel recovery). ' Ibis is because of the short time available for injurion recxrvery for . j; 6e core melt sagtunces in which core damage is caused by the loss of iq}emion (i.e., the early melt sequences). i' On the other band, external cooling is sammed very e5 scrive in provueting vessel faDare for core melt O asquences in which the RWFT water has been iq}ected into the maniam=* (and thus the lower vessel bend q is submerged). In the PE, the probabilky oflower bend failure is assumed to be 0.1 if the RWST bas been h iqiased. since significant uncertausy k maocised wkb ibis probabuky value, k is mciudad in se senskivky I 42 [ L f-

i"* ,

mudy. Results of the smshivity sudy shows tbst mneninawn failure probabilities are not significantly affected  !

! ,by the probability value used for this vesad cooling mode. Ahbough the sensitivhy studies perfonned in the Prairie Island PE shows little effect of ex vessel cooling on 1 i containment failure, source terms obtained from containment failure may be affected by ex vessel cooling l l because fission product produaion and release path are modified (e.g., in-vessel release from a dry debris i versus ex vessel release from a debris bed covered by waer). Since ex-vessel cooling is not included in the , MAAP model which is used in the FE for source term caladation, the source terms obtained for the casm whb l low precure v=el breach are used for cases with no vessel failure. k is argued in the licensee's response to j the RAI 0.evel 2 Question 1) that this is a conservative approach because the former involve the release of i non volatile fission products from core concrete interamion. However, no quantitative information is provided l h ibe response to support this argument. $ According to the data provided in the C-Matrh (provided in the limname's response to Ibe RAI, Invol 2 Quesdon 7), the probabilio; of in vessel recovery 0.e., no vessel failure) is over 99% for late core melt sequences and zero for erly core melt sequences. De frequency of all ACs that involve in vessel recovery is about 23% of total CDF. De primary contnbutor to this probability is medium or large 1.OCA with late core melt (15% CDF). His is followed by small LOCA (6% CDF) and transient (25 CDF). RCSDrpressuriration RCS depressurization is one of the CET sop events. According to the submhtal, RCS depressurization from abe operation of both the pressurizer PORVs and the steam generator PORVs are credited in the FE. However, because of time constraint, RCS depressurization by the above awhanisms is assumed to be successful only for late melt casm when vessel lower head penetration is delayed by ex vessel cooling. De conditional probability of all late failure sequences in which RCS depressuriution may be effemive is about 8% (of CDF). De primary contributor is small LOCA (6% CDF). His is followed by transient Q%) and A*IWS (0.4%). In addition to the above two machanlams, RCS depresurization by creep rupture of the RCS synem is also . credited in the FE. In the CET r**' dan. Ibis RCS depressurization nwhanian is considered to be effemive only if the core can be retained in the vessel for an extended period of time such tha the RCS pressure boundary can bested to tempermures that can muse creep rupture. It is assumed in abs PE that this is effecsive i enly if abe lower vessel head is submerged, and RCS depressurization is minas assured under this condition > (a probability value of 0.99). Because of uncertainties associated whb this nwhaninrn, k is included in the sensitivhy studies of the IPE.

                  - As demissed above, in the Prairie Island FE model, both in-vessel recovery 0.e., no vessel failure) and RCS 3                   depressurization are effective only for cases wkb the vessel lower beed submerged, occurring in accident classes with las core melt. For thesa cxident classes, the probabilhy of leevessel sw,4ri 0.e., no vessel failure) is over 995. Since there is no vessel lower head failure for these cases, RCS pressure is not significant and                ,

thus not reported in the IPE submhtal. For the . =t=t=51% of these accident classes, the RCS pressure is i ! , low. Derefore, for late core melt seguances, the RCS either rammina intaa or fails at low pnssure. s - Enfy Containment Failure ~ Although containment failure timing is defined in the Prairie Island IPE a relative to the dedaration of a General Emergency (Table 4.3-3), enriy mneminment failure modes considered in the CET involve those 43

t . I occurring ber= or a ihe time a vasa bosom bead es= (p 4.5-iO). De um mechanisms mnsidered h the CET for early containment failure include bydrogen burn berore or at RPV failure, direct containmert 3 basing (DCH), in-vessel and ex vessel maam explosions, and vessel bkmdown forces. As discussed above, , l . all of these phenomena are considered in the IPE as unlikely to cause containment failure. However, a small

 ;       containment failure probability is assigned in the IPE for CET quantification.                                                    l f      De freguency of early containmera failure h about 0.8% of total CDF. De acciders class that has the highest                       )

l conditional probability of early erumminmare failure is that associated with internal flooding (1%). His is  :

        'followed by medhun/large LOCA (0.9%), small LOCA (0.7%), and transiere and SBO (both of 0.6%).                                    l l

I Debrir Coolability amt Late Contalmnent Falla l IJte containment failure occurs if the debris discharged from the reamor vessel is not coolable or if all decay has semoval systems fall. Because of the thin debris layer exposed on the containment floor following vessel

 ,        failure Gess than 25 cm for Prairie Island), the debris is assumed to be coolable if the RWST water is injected

m the anneminmert. Exwessel debris is thus assumed to be quenched if one train of any of the following three systems works : high bead safety injection, low head safety injection, or nar*=inmaar spray.

 !         Even wkh a coolable debris, decay bem removal is still required for containment pressure control. ila the IPE, containment pressure control is assumed to be successful if one fan cooler unit or one train of RHR in recirculation is available. De only excep: ion to the above requirement is tha associated with high pressure melt ejecxion. Since a significant amount of core debris is expected to be relocated to the upper wowunent of the mntainment, which cannot be cooled by the water in the reactor cavity, successful opersion of 4          corsainmet spray is required to prevent long-term reveninment overpressure failure for this case. According to the CET results, containment overtemperature/ overpressure failure due to lack of debris cooling for the debris relocated to the upper ww,.ruusst is the most significant late containment failure mode (about 17%

5

         'of CDF). His is followed by that caused by the loss of all decay best removal systems (6% of CDF), and A       .basemat melt 4hrough when most of the debris rummina in the reacsor cavity (0.1%) with no cooling water.

De condaional probability of tse coreninment failure is about 23% of total CDF. De accident class that has l

'          the highest conditional pmbabUity of late containment failure is small LOCA (58%). His is followed by                           l l          transient (39%) and SBO (7%). He conditional probabilities of has containment failure for the remaining
        . accident classes (i.e., mediumharge LOCA, IFL, and ATWS) are less than 1%. Since the availability or                             i secovery of the containment systems are obtained in the CET quantification by fault tree linking and detailed 4           hformation is not provided in the IPE me=nimal or the Ikansee's reponse to the RAI (Level 2 question 3), the                   l l           sennons for the differences in ime failure probabilities for the different accident classes are not known. Since the spantification process for systern availability is Idarvie=1 to that used in I.evel 1, it is espeasd to be

. enadwantly maintained throughout the CET analysis. i

;          MHPCf M ECF3OI4I 1

Oedit is take in the IPE for fisskm produa scrubbing by the operation of enneminmara spray. Umirad credit is taken for the opersion of fan cooler unit. '. j 2.4.1.3 Centaimnent FaDure blodes and nahg b De Prairie Island containment ultimate strength evaluation is described in Section 4.4.1 of the IPE submittal. ) nurminmere failure pressures were r**=inad in the Prairie Island IPE by a simplified plant specific structural 1 1 f

ig* 4 - 3 ., i! analysis using aaual nutorial failure erass. r'areninmare failure presures were calmised for four locations. ), Uncertainties of corsainmmt failure pressures due to variability in material properties and analytical modeling

               'were animmM e establish containment fauure distributions. The assumed coefficists of variations (i.e., the j[*

atandard deviation divided by the mean) for Ibc four animmad failure pressures varied thxn 11% to 15%. ii e an=b failure pressure distributions for Prairie Island were then determined frtun the results r**=iaM for '! abe four failure pressures.1be median car ==*mman failure pressure r**=ined in the Prairie Island PE is 150 pSl8-i ! 1be mrrainmers faDure pressure and their distr #=ninna chtained in the Prairie Island FE seem to be annaler=* i with those obtained in other FEs. For Prairie Island, a large catastrophic failure of the steel sheU is assumed in the FE if containment is failed by overpressure. This seems adequate for the free standing steel abeu anr*=inmara aructures used in Prairie Island. i i

 ;              2.4.L4 r ne.i-nard Isolation Fhilurt Containment nonleinri fsBure is one of the top event in the Prairie Island CETs. The evaluation of containment isolmion is dan =ed in Semion 4.4.3 of the FE mewnle=1. Additional discussion is provided in the licemee's response to RAI (level 2 Question 4). In the IPE, only pipes with diammars greater than 2 inches are evaluated, and resuhs show that the probabilky of matainment isola:5on failure for Prairie Island is about SE 4 (Table 4.43). Because ofits small probability, enreninment isolation failure is identified in the PE as t:likely containment failure modes. Nonesbeless, containment isolation failure is included in the CET quantatation and three of the seventeen CET end states that are selected in the FE for source term calm 1miant molve enraalament isolmion failure. Based on the C-Matrix provided in the licensee's response to the RAl (IJvel 2 f>eian 7), the conditional probabilitis of containment isolation failure for the various accident classes vary from 0 (e.g., for transient with late core melt) to 6E 4 (i.e., for internal Sooding with early core melt). The conditional probability of containment enimian l      failure for aU accident classes is about 2E-4.

According to the descriptions provided in the PE submhtal and the licemee's respoese to the RAI, all five areas idatified in the Generic Latter regarding the evaluation of anr*=inman isolation fauure are addressed in I

                 ,tbe FE.                                                                                                                   )
 ~

2.4.13 System /HunnaResponses j

                                                                                                                                            \

Both primary and aaaaad=ry depressurizations are enneidared in the CET.1bese involve the opening of the l primary and secondary PORVs by opersor actions.1be probabHity of anocessful RCS depresurization is evaluated as part of Ibe fault tree linking and the probabHity values used in the CET quantification are not provided in the FE =4=nirent. Siruz RCS depresurization is considered only for accident classes with late core melt and high RCS presure, which corartstes only abow E5 of meal CDF, the effect of RCS depressuritation on CET quantification is not expected to be ='g "== i i Recovery of ac power is included in the SBO CET as one of the top events. Addiriaanfly, avaBability and/or

    ;               secovery of anreninmare systems may also be considered in the PE analyses'. The probabuity values used in I

[ ' Akbough apairs of iniled equipment is ===*inad in the FE =4=aiet=1 (e.g., p 4.5-12), secovery of 4 containmant systems probably is not sradiend in CET ry=reibeian It h assied in the risponse to one of the RAI questmas (Invel 2 Question 11) abat "No audit for ripair and recovey of enreminmmt spray socirculation was given in the baealme IPE analysis". Since the recovery of this systan would have the most signi&=nr effect on 45 a

c . i -

                                   .e FE fo, .e          e nems -- provided in e FE . - bn:.se .ey - - udmmed m ,oi. vaium

! but are obtained from equadons 64ed for the CEF event tree bendings by linked fault tree models , ,g traponse to Izvel 2 Question 3). Because they are not normal output to CET quantification and a significant i j; T

                                   ==v of effort would be requiraf to scalculme and report these values, they are not provided in the response.                      l in general, abe treatment of systern availability and recovery in the CET analysis is similar and revaiene to

}, dat used in the Level 1 analysis. - I Another hsue that is related to systen recovery is the change of procedures at Prairie Island that may affea i the availabilley of containment spray in reciradation. In the Prairie Island FE, me*minm=* apray in socirculanon mode is required to provide long4enn cooling of the debris relocated to the upper compartment so provus tate consninmara failure. Results of e Lky mullat abow that the probability of late avvalammt a failure incnmes significantly (from 21% to 63 %) if the relocated debris is not coolable. A almilar dange in , avenlamme failure probability is exposed if mremla==v sprey is not available. At the time of FE the transfer l to mrvninment spray recitadation was pmceduralmed in the plant EOPs. However, changes of the EOPs made ij after the FE has this guidance removed. 'Ibe potendal impact of this procedure change on CET ;= :~-='- a is asked in one of the RAI questions (Level 2 Quation 11). De licensee's response to this quesdon is to f ~ the long time recpired for aveniamme failure by this ==Annimm (on the order of 3 to 4 days) such ,. est ample time would be available to align the system for operation despite the unavailability of procedures.

it also emphashes the low source terms ==wv4 mat with sveninmas failure =ww4 mat wkb the loss of l, aveniam-t spray in recirculation anode.

I i 2.4.1.6 mhu. Release Characterbation ! *Ibe and stas of the CET ylefined as damage stas in the Prairie Island FE submittal) are discussed in Section

4.3.2 of the IPE submittal.11uw parametess are used to define a damage state. hey are

1; J. L Reactor status, i , ii. Containment status, and iii. Cnarminmara failure timing. ll i . l Table 4}3 of the FE submittal shows the values acceptable for these parameters. A total of 17 CET and states ], se de6ned in the Prairie Island IPE for source term definition. Source terms of are determined by the analyses

i. of repreamrative sequences using MAAP computer codes. - . .

I t 1be CET and states defined in the Prairie Island FE using the above three parameters me not as detaUed as tone defined in some other IPEs in which more parameter are considered. Although the approach used in the Prairie kland FE makes the CET simuhs more traceable, it may occasionally lead to the grouping of sequences !'j wbkb do not bebsve in an androly similar way. His is realized in the Prairie Island FE and anantina is paid I 1 on the selection of the accident sequences. From the descripdon provided in the FE mhmirem1 it seems that - l ! the CET and stue smuping for soures tunn Mairlaa in the Prairie Island IPE is adequate. I(  ! j~ . D e T T -- S

• remhs provided ki*nble 4.61 of the FE powahral abow 17 CET and states that have I j: man sero fr=% Among these TT and states are three bypass and states that are ahrelami directly from j A

sanovery of other contmiammt systems are notsaedned ' CET--*% 46 4 i em . ,_ - 4 - -4_m- ~ ~ . ., ,. ~ - .

1* l

}.

j- . l

               - 6e accident classes (i.e., two SG7R and one ISLOCA) and two induced SGTR and states.7he 12 non bypass

CET atstes include 4 with late mat =1amare failure,3 with early cruentarnent failure,2 with containment i Innistian failure, and three with no containment failure. Including induced SGIR2, the percentage contributions of there CET and states to the total CDF are 32% for no failure,23% for late failure,1% for early failure, 4

~

455 for bypass failors. The probabuky ofISGIR is about 30%. The probability of bypass failure is skunased by 30% and the probability of no faBure is increased by 30% ifISGIR is not included. l Source terms for the CET end stats are determined by accident progression analyses using MAAP code

,                  (MAAP 3.0B Revision 19.0). Source terms ahrainad froen the ==p- code calculations are presented in Table 4.7.-2 of the IPE subminal. Source terms are presented in these tables in terms of release fractions of some of the repramantative radionuclida (e.g., CsI).

De use of the computer code calculations for source term definition is discussed in the following section of this report. 2.4.2 Accident Progression and Containment Performance Analysis 2.4.2.1 Severe Accident T.,. ___*= Sequence selection for fission product release characterization is discussed in Section 4.7 of the Prairie Island IPE. According to the Prairie Island IPE, the purpose of sequence selection is to choose specific accident progression sequences that best appmulmate the representadve source term results for end relevant CET and states based on the consideration of the dominant sequence in each end state and other factors that influence the source term results. De ==gnWs of fission product release are taken directly from MAAP calcadations. Typically, the MAAP calculations are mnrinued for 48 hours from sequence insistion or for 24 hours following containment failure, whichever is longer. Results of MAAP calculations are shown in Table 4.7-2. According a the results priserted in the table, MAAP calculations are performed for the selected sequences for 11 of the

-                    17 CET and states. De release fractions for the r==1ala 6 CET and states are assigned the values ahrninad l

for the CET and states with more severe risults. De seguence selection and the assignment of release fractions i for source term determination seem adequate. i Because of the uncertaindes in the MAAP modeling of fission product behavior and variarians in the specific sequence definition, the representative source term results are further grouped to provide snore general conclusions about the risults. De smuping is based on the magnitudes of the release fractions of noble gases, volatile releases (characterized by Cs! and CSOH releases), and no Helatile releases (characterized by the largest of the tellurium, strontium, or barium release) Six pummary source term types art obtained by the grouping. Results of source term grouping shows that 31% of all core damage sequences has releases limited a those w w er4ing c to normal leakage (Type 1), and 52% has high noble gas releases, but wkh low (Ins shan 1 %) or low 4ow (ims than 0.1%) volatile and omseladie fission products releases (IYPE D). One CET and state in Type B that is of particadar interest is that associated with Iriduced SGIR (about 30% of total CDF). De low release for this bypass sequence is due e the assumption used in the IPE regarding r ee mese genermor valve conditions. k is asumed in the IPE that the steun genermor valves, whid open to i 8 Acconing to the bcensee's response to the RAI (Level 2 Q==rian 7) ISGTR is effectively precluded by a procedure change. De C-Matrix provided in the response does not include ISGTR. 47 A aummeh whWim.- m. -%hmeahw att "t'" ".-^ prrea- M3 aum

i setieve the steam generator presmre, would reclose successfully. His limits the release to a relatively short { duration puff, followed by a series of shorter puffs. All releases are terminated upon vessel failure when the primary systern depressurizes to matalament pressure, ne effect of the harsh environmental conditions on l

• i the proper operation of valves are discussed in the licensee's response to the RAI (Level 2 Question 6).

However, the concern over ISGTR may be moot because, at this point, the EOP to restarts the RCPs, the

      ~

pr' unary reason for the high ISGTR probability, is danged. If the probability of ISGTR is removed, the ,  ; probability of Type I release would increase from 31% to 60%, and the probability of Type Il release would decrease from 52% to 22%. [ The release types that have high aabte ga and volatBe fission products releases are Type V (14.6%) and Type VI (0.5%), both of whid involve mnenlamant bypass. Type V includes SGTR as an initiating event and ISGTR with the steam generator valves not resenting property. Type VI includes ISLOCA sequences, ne seguences that involve enriy containmers failure are grouped to Types III (0.3%) and IV (0.6%), both of which have relese fractions for volatile fission products releases between 1% to 10%. i r , ne sequences selected for source term analyses and the source terms definition used in the IPE seem to be adequate. 2.4.2.2 Dominant Contributors: r- , with IPE Insights CET end states (or containment failure modes) and their frequencies ahtninM from the Prairie Island CET quantification are discussed in Section 4.6 of the submittal. Table 10, below, shows a comparison of the conditional probabilities for the various aantalament failure modes ahtalad from the Prairie Island IPE witt those ahtalad from the Surry and 2.lon NUREG-1150 analyses.

                                               .            Table 10 Containment Failure as a Percentage of Total CDF i                                               Prairie Island Nuclear                        Zion l                                            Containment Failure Mode          %h                          NUREG-1150 IPE                                  1150 Early Failure                        0.8                    0.7           1.4 i                                                    Late Failure                        22.6                    5.9         24.0 Bypass                           44.7                    12.2          0.7 f

isolation Failure 0.02 * " j Intact 31.8 81.2 73.0 CDF (!Iry) 4.9E-5 4.0E-5 3.4E.4

                                   **The data pnsented for Prairie Island are based on Table 4.7-1 of the IPE submittal, widch inclutte the
   ;                                 contribution imm induced So7m 00% of CDF). According to the recensee's resposes to the RAI, ISGIR is effectively precluded by a procedure change mawM by the Westinghouse Owners Group and i                                 implanented at Prairie Island, ne probabnity of bypass failure would decreme, and intaca en==iament
  ;                                  increase, by 30% if ISGIR is elimlantM.
  !

• Included in Eariy Failure, approrimstaly 0.02%

j - "' Included in Eariy Failure appr=l=*1y 0 5%

  +                                                                                                                                                      ,

4: s-y,a . - - . - . . , . . - .

                        .---.-m.

4 I

f. ,

'i                                                                                                                                            i i-                                                                                                                                           1

! As shown in the above table, the condidonal pmbabilky of containment bypass for Prairie Island is 44.7% of

meal CDF. Most of k is from induced steam genermor tube rupture (30% of total CDF). Excluding ISGTR, i* cxstainmers bypass is primarily from SGTR as an initiating event (13.2%). He contribution from IS14CA

is small (0.5%), but k results in the highest releases. -.

  !                        ne conditional probability of early enneminment faDure for Prairie Island is about 0.8% of total CDP'. k is about equally contributed by internal Boodmg G8% of early failure), small 1.DCA G6%), transient GO%), and medsum/large LOCA GO%) accident classes. De contribution from SBO aequences is only about 6%. De i                        smser cunnhtion from SBO sequences is partly due to the low CDF of SBO sequences (about 6% of total CDF). Early containmers failure is primarily due to hydrogen burn with vessel breadi at high pressure G4%

j , of early failure CDF). De r lala 26% of early failure is also due to hydrogen burn, but wkh no vessel

   ;                       failure, primarily from medium /large LOCA sequences.

[, ne conditional probabDky oflate corsninmera faDure for Prairie Island is 22.6% of total CDF. More than half of this is from small LOCA sequences (59%), with most of the reruaining coming from transient sequences 08%). On a conditional basis,58% of small LOCA sequences result in late containment failure and 39% of l l transient sequences results in late containment failure. De contribution from SBO sequences to late i containment failure G% to total late failure CDF and 75 conditional probability) is relatively now in !, ciomparison with that from small LOCA or transient sequences. De low failure probability for SBO is probably due to ac recovery. De time allows for ac recovery is long for late anarninmera faDure. l 3 For Prairie Island, lue containment failure is % wily due to ovartemperature/ overpressure failure caused by i lack of cooling to the debris dispersed to outside of the reactor cavity G8% oflate failure CDF). Because a j significant amount of core debris is dispersed to outside the reactor cavity only in high pressure vessel failure l

cases, the conditional probability oflate mntainment fauure is low h accident classes that involve low pressure  !

j! vessel failure or no vessel failure (e.g., medium /large LOCA and the late core melt accident classes). Besides i s the above late failure mecharusm, another low-i late failure machanism is the loss of decay beat removal

   ;                       ,G2% oflate failure). he contribution from basemat melt-through is smrl! because core debris is assumed to i                             be coolable if RWST water is injected to the aantninmer .                                                        i 2.4.2.3 charneseriansen er the=I===-# hrformance ji                            As shown in Table 10, & Prairie Island Nuclear Generating Station, the core damage frequency (CDF) is lower than that obtained in NUREG-1150 for Zion but comparable to that obtained in NUREG-1150 for Surry.

}! Although the conditional probability of enar= lament bypass obtained in the Prairie Island IPE is significantly j greater than those obtainad in NUREG 1150 for Suny and Zion, k is simBar to that for Surry if the probability ofISGTR is eliminated. For the other failure modes, the conditional probability ofIse aantninmant failure for Prairie Island is similar to that h Zion and the probability of early ~ '. ..ent failure is between those i obtained in NUREG-1150 h Surry and Zion. De cantninment faDure profHe obtained in the Prairie Island 4 IPE is in general conelerant with those obtained in NUREG-1150. I l' -

• He fractional contributions discussed below are obtained from the C-Matrix provkled in the licensee's seapome to RAI (Level 2 Question 7). Dare are minor differences between the some values preamnead in the IPE submittal and those obtained from the C-Matrix (probably due to trunestian or roundoff armes).

t 49

                                                                                                                                    .- . . -- - - . - .l r                                                                                                                  .

l *

    !                         De C Marix, which shows the =driaani probabilities of CET ed mates (or containment failure modes) for f                         the accident classes (orPDSs), is provided in the licensee's response so RAI (Lavel 2 Question 7). De C-l                         Matrix provided in the response does not include ISGIR failure. According to the response, the procedure to i                          vastart the RCPs, which has a significant effect on ISGTR, is changed based on the recommendations of the r                          W=iadm** Owners Group. His change would in ansc1 eliminate the ISGIR challenge.

1 2.4.1.4 kapact en St *, ' Behavior ( s The effects of barsh environmental condition on Ibe operation of meenlarnent sprays and ennemiammt fan i coolers are not discussed in the CET q=r-:A of the IPE submittal but are discussed in the ficaaaaa's

   ;                          respose to RAI (Laval 2 (Miaa 9). In the response, the potential adverse effect of =*=la==t pressure ad temperature, radiation, and aerosol and debris on the opersion of containment spray and fan coolers are discussed. Although the effect of aerosols and debris on the operation of the above containment syntans are 3.

i not considered in CET quantification, the sensidvity studies performed in the FE can be used to address the effect of the loss of these systems on nnnenlamme failure. 2.4.2.5 Uncertainties and Sensitivity Aanlysis

   )

i' Sensitivhy studies are discussed in Section 4.8 of the FE submhtal. Two types of sensitivky studies were performed in the Prairie FE to determine key assumptions on the final results. De first type of senshrvity studies are probabilistic in nature and address uncertainties in the quandfication of the various nameniammt failure modes modeled in the CET. He second type of sensitivity studies involve daerminictic analyses, performed in the IPE to establish the assitivity of the I.mei 2 analysis to uncertainties in abe physical modeling of containment response and the source term.

                             'De senshivhy studies of the first type performed in the FE include:

4

1. Reternion of the debris in the reusar venel by adraarging the lower vessel head (i.e., ex vessel cooling

                            .           for in-vessel recovery),

2. Depressurization of the reactor by bot leg creep rupture,

3. Debris coolability in the reacsor cavhy, and

4. Cooling of the debris relocated to the upper parts of the onntainman following HPME.

1 - Resuhs of the smshivhy audies abow linie effect on -w niam-v failure probabuities by ibe n.=miviaa used for kwassel recovery bl ex vessel cooling and the assumption used for bot leg creep rupture (Etems 1 and 2 l above). On the other band, the asumption on 6e coolabilky of the debris in the seamor cavky has a 4,.T.,.- l effett on late containmert failure. Asanning abat the debris is not coolabuity and long-term en=ralan=* failure

  ;                             occurs one the debris is dish v4 from the reassor vessel (i.e., the vessel falls), the conditional probability of late containment failure would increase thxn 21% for Ibe base case to 63%. Consspondingly, the l

wwdeinna! probabuity of so aveniamant thilure is dennesed from 65% to 235. Since in Ibis asesitivity case l matalamme fauvre is assured if the vessel falls,6e cases for no mnenlan=* fauurs (23%) are largely made 4

  ;                             up of sequences in which the event is terminsad by ex vessel cooling (i.e., with the lower vessel bead submerged).                                                                                                            ,

f* For the remaining senskivky case,9weala==* fauure by the relocated debris is amanned to occur men whb 6e operation of containtnent sprays. Results obtained for this sensitivity case are simHar to those obtained for . the senshivity case on debris cootabHity in the tenmor envky (pensitivky case 3 above) - De conditional probabusy for ime failure incneses from 215 for the base case to 63% for the senskivky case. De simHarity 50 I i e-me .- --..o ...ww.- - - 18""' ~'N'*w - , -

j - i ) l i

    )                of thase two sensitivhy cases reflects abe fact that the sukrky of cost damage everts occur at high pressure            i i: !,     -

with a significant amount of debris relocmad to the upper comparanent. I[ Deterministic analyses of the following categories are performed in the FE to evaluate the uncertainties in physical modeling of cornminmant response and the source tenn: j 4 I

1. Core melt progression and inessel hydmgen generation,

   .                 2.         Natural circulation, induced ruptures of the primary system, and RCS prissure at vessel failure,

3. Fission product release and rwipu.' . .k,s, ,

j 4. En-vessel debris coolability, . 1

5. Energetic events in =alam and

6. Containment failure modes. .

4 1 l ] MAAP code is med for the sanskivity studies of the above issues, which are identified in the Prairie Island IPE 4! by the recommerwbrinnt made in the EPRI Guidance Document for performing sensitivity studies with MAAP i' 3.0B, the augmernations to these r-maMations provided in the NRC sponsored MAAP 3.0B code evaluation, and specific areas deemed kr.pura for Prairie Island. t

                      %e sensitivity studies provided in the Prairie Island IPE maams to'have addressed the issues of significant ancertainties in the IPE analysis.

2.5 Evaluation of Decay Heat Removal and CPI i ! 2.5.1 Evaluation of Decay Heat Raunoval 2.5.1.1 Examination of DHR 1 l2 %e IPE addresses decay heat removal (DHR). Several nuehnh of DHR are discussed, including secoulary cooldown and depnssurization (using either AFW or main feedwater providing the steam generator makeup), i feed and bleed (i.e., utilizing the Si pumps and p.- /- PORV), safety %W and recirculalon cooling y '(as provided by the SI and RHR systems), and sinadown cooling (by the RHR opersion) . -In addition _ enarninment cooling is mentioned. -

   )                  'De CDF contributions from endi of the individual DHR nuehna were not anti == tad either in the manW

- or in the RAI response. { i 2.5.1.2 Diverse Means of DHR I

                       'Ibe submhta! provides a faidy detaBed descripdon of endi of the diverse DHR capabilities at the Prairie Island

{ plant. De description includes a reheration of several specific ( maybe " unique") features of the systems involved in DHR and major modeling assumptions, a discussion of the effects of initiating events on the I , symms' unavansbuides, and a pnaarsmion of the : yuc i hardware failures and opersor enors contributing to these unavailabuities. f . The specific features that directly impace ibe abnity of the systems to provide DHR are described in Section 1.2 (" Key Features"). Therefore, they will not be discussed here again.

   ,                                                                                      51 f

i p= -..,iwy.-.md- . . . . . . , , ,-w., . . ,. . . _ _ .

     ._...- -                  - - .             -    ----.-- - -..-....                               -.-. . - - . . - - ~ _ .

iI lf t k b noteworthy that the seats relief part of the samadary side bem removal was ex modeled for the Prairie Island IPE. De licens6e's reason for k is the large divershy of means of meam removal. ("Following a l g rumaar trip, steam is relieved to the condenser through a single air opersed rnief valve or to the amosphere !l through four air operated valves. If the MSIVs should fall closed, steam rdief is possible through ar. air' '[' opersed PORV for each steam generator or throust five safay relief valva on and steam generamr,il of which are upstream of the MSIVs. In the event ofloss of air, DC control power or instmment power, stamm i . relief is assured through the five safety valves for and steam generator as they are not dependent on any support systems.") %erefore, k was assumed, tha the unavailabuhy of secondary cooling is primarily determined through the probability for a loss of makeup capability to the SGs.

  \                                                 .

Table 11 aummarizes the unavailability values of the systems involved in the, DHR for selected initiating events or initiating event groups. De data markedly damaamste the strong dependency of the systems' unavailabilities on the type and nature of the lahia: events. His dependency is lilustrated by the following mamples: I De ansvallabuity of feed & bleed is relatively low for normal transients, since its operation is principally i akpenders on opersor maion to inhine the process. For initiatons, like loss of DC train A or B, the instrument air containment isolation valves fail closed cutting oNIA to the pressurizer PORVs, failing feed & bleed. The unavailability of the AFW system can vary for the spectrum ofinkistors. It has a ruher low value for

 +

transients (other than LOOPS) because the AFW support systems include only AC and DC power with cooling waar providing a redundant suction sourm in the event the condensate storage tanks are depleted. The increase of unavailability for LOOP events and for SBO reflects the additional dependence on the DGs. In the event of an SBO, the TDAFW pump is the only means for feedwater addition to the SGs. His pump is not dependent on AC or DC power, as the steam admission valve to the pump fails open on loss of DC power. He submittal expliEitly provides the h u6.iu i hardware and makr human error contrD=miant to the unavailability of the various DHR systems (expressed in %, but understood as "impurtance"). These offer j valuable insights about the relisbuity of the symems, therefore they are repmduced below. Aindlary Feedwater System: Random faDure of Unk 11DAFW pump to run 09%), similar fuhre for Unit 1 MDAFW pump G7%), misalignment of the MDAFW pump train aAer test & maintemnce G4%), and MDAFW pump motors fail to start due to ==maa cause G2%). The ww error "FaDure to crosstle the MDAPW pump tom Unk 2" contributes 515 to the symem's unavauabuity. I ne prest data on the unavailability of the APW symem reflect the recent improvements implemented on the symem (see the report, NSPNAD 8606P Rev.0). I t i . 0 4 e b l 52 f I 7-.-.----. - . . . .-

i- )i' i f !! Table 11 Effects of blartad Initianng Events en the Unsvallabluty of Systems Involved in DHR i .

                                                        " 'y Side

!l. ie Hast Raamval* St RHR 1r Intiaang Ewas/ Feed & i . Event *0roup - Stat. ' Bleed

APW new** Ini. macire. aqi. Racine. down

,;                                                                                                                                  Coolmg h                  1.arge IDCA                                                                             1.3E 04 1.2E@

1 Medium 14CA 1.9E 03 5.9E43 1.3E 04 1.2EG ! Small1DCA 1.9543 J.9E43 1.7E 02 SOTR ' 1.9543 5.95 03 1.75G I 1DOP 8.1E 04 1.0 1.6E42 - J.1542* (SBO) (3.6E 02) f less of CC 5.8E41' 5.2E Ol* i i j Imss of CL 1.0 5.8E 01* 5.2E 01* !I Ames ofIA 5.8E Ol* 5.8E 01 I? Imes of DC Tranment A 1.0 1.0 l .Imss of DC Transient B 1.0 !! Transisets 8.3E 05 6.5E43 Transienes with "s" signal '3.9E 02 4.7E 02* Transients w/o "s" signal 6.6E43 4.1E42'

• steam rshef was not modeled because of the seveal diverse means of steam removal.

**MFW is not a safeguards syssent 1 *laciudes recovery of initiating event.

l +value dnpends on the operator aceme to snart FAB and she ansvailability of Dos. j l .. j Main Feedwater System: Bus 110 unit cooler unavailable due to malreanance (15%), control room chillers 1

fail to'run due to common cause (4%), control room ch111ed water pumps fail to run due to enmnvws cause l (4%). All of these hardware failuns cause eventual loss Of DC power via loss of scom cooling to the l i amfuguards 480 V bus rooms. Namely, if room cooling is lost the transformers in the rooms will best up and l eventually fail causing loss of all loads supplied by the affected buses. In ibis way the bettery shargers will be lost causing DC power to fall aAer the batteries have depleted. (This condition has been changed, as l

i ===vbaai previously in this TER.) Mi.i operstos action is the restoration of MFW for events in which

   .                  It lost as a result of the initiating event but is otherwise available (60%).

I Feed & Bleed: Hardware failuns are insignificana contributors to the unavaBability of feed and bleed. Almost i ; 95% of the unavaBability is from l== nan enor to initiate the proces. (the process inMatha is different in the

   ,                  preurre or absece of an S signal: if there is na S signal, the operator must mamany start the SI pumps and

'[* epen the pressurizar PORV, while if an S signal has been generated, the operator has to verify only whether j , the SI pump is running and then open the pressurizar PORV.) i St Irdecdon: Boric Acid Supply'Ihnk (BAST) auction valves fab to open due to common cause (25%), RWST auction valves fail to open due to common cause (25%), control room chilled water pumps fail to start due to J. 53 4

f common cause (19%), both SI pumps fail to start due to common cause (9%). De SI pumps draw aucsion

.!        off the BASTS during the fint few minuts of the iq}ection phase of an wh. and then switch to the RWST when the 14-1A level alarm is reached on the BASTS. Onlled water failure would cause overheating of the l4         Unit I safeguards 480 V bus rooms and failing c(all loads supplied by the safeguards buses. His would mean

b

! for the SI system, that the suction valves imm the BAST and the RWST would fall as they are the only valves . _ __ 'f required to change state for successful system operation. De unavailability calmtarian included recovery actions, such as: local recovery of abe auction valves, recovery of 480 V room cooling. De submittal, bowever did not pmvide any quantitative infonnation about their total unavailability contribution. {l SI Recirculation: Both CC supply valves to the RHR best exchangers fail to open due to common cause jl G%), both RHR to Si crossover supply valves fail to open due to common cause G%), control room chilled

' water pumps fail to start due to common cause (45), and both control room chillers fail to start due to common cause (4%). De . tingle dominant operator failure for SI recirculation is to initiate the recirculation lI

)i (41%), since the lineup for the SI recirculation rannot be performed from the control room (the breakers for the RHR to SI crossover valves are locked in tha off posiuon and they have to be unlocked locally).

'j RHR In}ection: Both RHR pumps fail to start Q 7%) and fail to run Q95) due to common cause. RWST rupture (5%). i 'RHR Racirtunation: Both CC supply valves to the RHR best exchangers fail to open due to common cause (4%), both control room chilled water pumps fail to start Q%) and chillers fall to run G%) due to common cause. 'Ihe dominant operator failure U2 %) is to initiate the low head recirculation. (Switchover to low head recirculation can be performed from the control room; the limiting factor is the time available to perform the action before the RWST would deplete. During large LOCA the RWST level is eW to fall rapidly.) RHR Shutdown Cooling (RHR SDC): RHR Loop B return valve fails to open G8%), failure of Train A contml room chilled water pump to start (19%) and to run (13%), and failure of the chiller in the same train to run (13%). Failures n'sociated with the chilled water system cause the known bestup of the 480 V safeguards bus rooms, resulting in the loss of the motor control cater that powers the single Imop B return

  )         valve, failing RHR SDC.                                                        ,

Finally a remark has to be made on the role of the corsainment fan cooler units (FCUs) and spray (CS) systems

  ;          in the process of DHR: In the Prairie Island Event Trees success or failure of recirculation is asked before               .
  ;          asking the status of the top event " containment " (l.e., the FCU and CS). If recirculation fails, k is assumed
           . that core damage occurs. Credit is not given for the FCUs to remove decay best from enarninment and condense the ward to return k to the aantniammar sump. Ghus, according to this assumption, failure of the

RHR best exchanger nsults in failure of the recirculation even though the RHR pumps could recirculate the water through containment where the best could be removed by the FCUs.) l i 2.g.1.3 Conduelon On the Analysis of DER 5 %e NRC defines two requiremeras in NUREG-1289 tut have to be met by any systen which performs DHR. j g

Deseare: ,

                                                                                                                                  .       j i           1.       Maintain sumcient water inventory in the RCS to ensure adequate cooling of the fuel.

i 2. Provide the means for ET fmWg best from the RCS to an ultimate best sink. - I l' I

 .I                                                                                                                                       :
  '                                                                 54                                                                     !

i t i

  !                                                                                                                                        i t                                                                                                                                        ;
  . ~ _ ,                                                    -                 -     _ _.-._..__,_          _ _ _ . .

i . u .,

i. .

t.. In the FE there are no core damage sequence d at do not involve loss of ekher one or both of the two g+ requirements. His fqct lead the licensee to consider the loss of DHR to be synonymous with mre damage. Since the overall CDF was found to be acceptably low (5 E 05/yr) and k was abown, the there are several redundant and diverse means for DHR, (i.e., several of the DHR systans and operator actions would have to L fail in combination to have a serious neguive impaa on the DHR apabDity), the licensee considered that k

!             has fulfilled the " Shutdown Decay Heat Removal Requirements" of " Unresolved Safety issue A45," (USI A-l             45).

2.5.2 Other GSIs/USIs Addnesed in the Enhmkf at No GSIs or USIs, other than USl A45 are addressed in the submhtal. 2.5.3 Response to CPI Program Reen==aadatianc I The CPI mmendation for PWRs with a dry marninmant is the evaluation of meenlan=* and equipment i vulnerabDities to localized hydrogen combustion and the need for is rewiments. Although the effects of h)drogen combustion on containment integrity and equipment are dimited in Ibe submittal, the CPI issue is  !

not specificauy addrused in the submittal. More daalled information on this issue is provided in the licensee's

!              response to the RAI (i.evel 2 Question 10). Hydrogen sources, the condition for hydrogen dwanarian, and the         l load for hydrogen deflagration are dimmM in the response. According to the response, hydrogen detonation

, is highly unlikely to occur with the Prairie Island containment geometry and hydrogen concentration. De

!              loadug maman generated by hydrogen deflagration has been pessimlatie=Hy treated in the FE and found not likely to cause containment fanure.

2.6 Vulnerabilities and Plant Imprwements De criteria used in the Prairie Island FE to determine whether any vulnerability *11erM at abe plant were:

                !.                Are there any new or unusual means by dich core damage or containment failure occur as usini W to those identified in other PRAs?
                                                                                                             ~    ~

2. Is there adequate assurance of no undue risk to public health and safety?

i De licermee suses that nehher of the above criteria lead to the identifiestion of potential vulnerabilities for the plant. De FE process demonstrated that; the accident classes contributing to the CDF are .ee+.41e with I those calculsed in PRAs of similar nuclear plants (indeed the cosci,.deas made in Table 2.4-1 of the =M*=1 . with Surry, Kewaunee, Point Beach supports this viewpoint), and the overall CDF kself is at an acceptably low  ! hwel of SE 05/yr. Therefore the licensee believes that there is adequate assurance of no undue risk to public ! health and safay. I r The licensee staes that dile no vulnerabllhy stists, as a result of the IPE, mmmistiane have been l , genermed for plant improvernents. These mmendations are pardy implemented and partly only under 1 m=Wration but by no means represent any definitive "NRC mmmir==r=". De rewnmendations focus on

.            ' plant improvements in three areas: procedural /administruive, structural and training anhaa=nants.

t . T 55 i h k ow . . - _ - , _ , - . , _ - - , - - . - -- . . - - - .

   )                                                                                               .
                                                                                                                                                 ~

! Depending on further evalunion of poternial howets and practicality, the lheue expects a signWaae decrease i in the overall CDF (a decrease of IE 05/yr or granter). In particular, the risk contribution from internal i Sooding is anticipated to be reduced from 1E 05/yr to approximately 1E-08/yr.

l1p 1 ,

[ A aununary of the1.avel 1 related rwamm=wielaat is provided below

_

!i !1 Procedurnl/ Administrative Enhancements ) i .  ; 1. De plant strendy proceduralized the process esublishing crosstie from aestion air to istrument air in l

1 CM AOP1, Rev.0. i

. i' j a) If the crosstie could be established wkhin one bour aRer a CL Loop A break, feed & bleed ) j or main feedwater cooling could be restored and core melt could be pid.(Ibe station j i , air compnsaors are cooled from loop B cooling water and are not affected by a break in the l i ether loop.) s .  !

! b) "Ihe new procedure prucribes also abat the station air crosstie should be used when an IA )

1! compressor is in mahanara l l Present (November 28,1995) disposhion of the tscoenmendation: a.) CH AO? 1, Rev. 4 incorporates this action (Step 2.4.6); b) CM, Rev 12 incorporates this recommanwiniaa

2. De procedure C35 AOP1, Rev.2, " Lass of CL Water Header A or B" should be revised such that the crosstie between CL Loop A and B could be used. Two valves, one manual and an AOV.have to be opened during 20 minutes to supply cooling water to the MFW pumps' lube oil coolers. De  ;

MFW pumps can conservatively operate w/o cooling water for about 20 minutes before possible pump damage. ,

    ?                      Present disposhion of the rea==aad*iaa- See the next disposhion.

Structural Enhancements

    ;                      1.        Constrain the impact of AFW pump toom Sooding by some simple measures. -Evaluations are                       !

[ moderway to determine the best long term solution. In the interim the following measures are , i auggested; modify the side doors to pmmate water Sow out of the room, or close the Are door

    '                                between the two halves of the room and render the door to be " water. tight".

Pnsent dispa=hina of the recommendation: De CL bender piping was completely replaced wkh a piping of 33% tincker wall dring the Mwember,1992 dual unit outage. De internal surface of the new pipe is coated with an epoxy costing to inhibh microhiologically induced corrosion (MIC). Also piping failure would be 4 motiosd by any WW who periodically walk through these rooms.

    ;                      Rahane====8 of Training                                                                                        ,
                                               -                                                                                                   l
     }

5 1. Esplain the importance of the feeid & bleed process. Put an amph=le on the operator actions that are f - necessary for success. it is expected that the training wul result in ar.arked reduction of the - l contribution of accident class *nIE to the overall CDF. 1 i l 56 I l i l t l l

                                                                                                                                                   )

       . u    .

lI~

i e z i

,4 2. Explain the importance of a crosstle between the MDAFW pumps. Emphasize the opersor actions l l that are required for success. k is expected that due to the training a significant reducsion will occur ij also in the THE's contribution to the overall CDF. , 1 ,t e 3. Explain the importance of switchover to high and low head recirculsion. Emphasize the wen- , i activides tha are required to success. he training may reduce significantly the CDF cos=dtion of i the accident class SLL. ,i

4 Explain the importance of RCS cooldown and depressurization to terminate SI behbre ruptured SG , j j overfill. Emphasize the operator actions that are required for success. It is =W that the training l will result in reduction of the CDF contribution of accident class GLH.

i Disposhion of the above i- es==%iaae: ) i 4( i a) I.atier 2.21.94, M. Wadley to D. Reynolds, sking to take the necessary actions to ensure the 1 opersors receive periodic training on the FE recommended training actions. he letter identifies the  ! acsions and a suggested frequency for giving training on them. ) !. l i b) Request for Training 94-25 from J. Sorensen. RequaldNLO training on FE and bass. Training l completed during cycle 94-09. i ! c) Course Outline for Simulator %dag Training: P9160S, Rev.4. Records of the FE recommended ! training items at the frequency requested in the Wadley letter. ) I d) ' NLO training Program P8400, Rev.9: Outplant actions required to successfully establish low head recirculation and to cross connect the MDAFWP to the opposke unit are JPMs (SI-3 and AF-7), required biennially. . l' e) Lasson Plan P81611A03, Rev.1, Intmducxion to Accider Analysis for isc;:nse candidates: In addition to USAR accident analysis topics, students are trained in how PRA techniques are used to determine risk, and on the results and uses of the PI FE in the operation and maintaanwe of the plant. De following two recommendations are misted to the back end: .

1. Revise the EOP that requires the restart of the RCPs under ICC condition. k is mmended in the j FE subminal that the operator checks for adequate steam generator level before setempting to start the i RCP. His recommendation is intended to reduce the probability ofISGTR. l

2. Secure open the in-mre instrument tube batches for both units to aBow water to flow into the reactor 4 cavity to provide cooling to the lower vessel head 0.e., ex vessel coolleg) and improve debris I I

coolability in the reactor cavity. i 1

• l 57 n se^ + ~.w' a-w __pg., ...p, ,. ., ,,

hur46--m*=1

                                                                                           , a r- g h

9 4 I

        'f 1

P k 4 . e f i 4 t h. I i . s k t 0 W 4 D t

;f                                                      '

h+

1 N N

't 6

4

 . ,i
 .T 4

i f i 58 r a s

           ***-c- 9 w-mse c o-  . .iemme.www         __             ., _

u .. > e e g .s { 3 COMRACTOR OBSERVATIONS AND CONCLUSIONS 1 I !h Strengths of the level 1 analysis of the FE are a fouows: Thorough analysis of W*ia events and !I ibeir hapact for both units of the plant, descriptions of the plant responses, pr==aatmion of the results of j; yyvning MAAF cal =1=riaan (herian 7 of the anbmittal), seasonable failure data and cannaan cause f factors, usage of plant specific data whenever possible to support the ~~~**laa of Waia: events i4 and system ansvallabuities, and an ;-yvn s analysis on major variables ' ;=% core damage. 'Ibe 1 1, effort seems to have been evenly distributed across the various areas of the analysis. jl The FE Imvel I analysis has no thad===wat weakansses, les " leading" uninor weakness is the lack of (i detail in the individual accident sequence deswiyibas. The text of the submittal everywhere indicated

l that a detailed analysis was done but only highlights were reported.

!i )i *Ihe FE determined that an internal flooding sequence is the primary contributor to core damage. Its i initiator is a cooling water line break inside alther the Unh I or Unit 2 side of the Turbine Budding jf AFW/IA compressor room, which causes failure of these two systems fbr both units. There is a low ,. potential for this pipe rupture (only a small section of piping is involved); however, sbis initiating event !!i represents a potentially important location d--ad-aey for several systems at the plant, since abe AFW pumps (secondary best removal) and the IA compressors (in feed & bleed support for the pressurizer l, PORV) are located in the same room.

i

! As was noted previously, several recommendations for plant improvements have been made as a result 4 of insights obtained from the FE, particularly to reduce the CDF contribution of the above mentioned flood accident. The CDF knpact of these improvements is expected to be a CDF decrease on the order j of IE-05/yr or greater. I 1he HRA miew of the FE submittal did not idaatify any alp ~ = problems or errors. A viable I approach was used in performing the HRA and nothing in the licensee's submittal indicated that k faued

 .            to meet the intent of Generic Letter 88-20 in regards to the HRA. 46 moi elements pertinent to this
 ;            determination include the following:

F -1) - The submittal indicated that utility personnel were involved in the HRA and the procedure svviews, discussions with operations and training staff, and walkdowns of operator acsions

 !                       represent a viable process for confirming that the HRA portions of the FE represent the as buDt-
 ;                     .as operated plant.

2) The analysis of pre-laitistar human actions focused on restoration faults. The HEPs assigned to a the modeled restoration faults and the approach for -+;- Ag the component unavaDabilities

 !                       appeared reasonable. D5=adaneles between restoration errors were not addressed because h was I                     - argued that plant practices regarding nialatan=ae* of separate trains assured the independence of restoration faults. Miscalibration errors were " treated through the inclusion of common cause          .

failure modeling for the season or instruments dwanalves." 1he licensee's treatment of t sniscalibration events may have precluded identification of 46 moi pre-initiator events and is I therefore a weakness of the HRA. - i e I e _, _.m_ ....m.m._ _ ._ - . , , .- --

_ . ~ _ _ - . _ _ _ _ - - - - - - - . . -- - o a 3

3) Post-initiator hunan actions modeled included both --- .ir. and recovery 4ype actions.

       ;                                         Although the damnantalan for the screening analysis perrormed on post-initiators was minim =1, f'

k appeared that the screening analysis was relatively more " plant 4pecific" and detailed aban many of those performed for other pes. In addition, the licensee stated that if more than one r operator action occurred in the same cutset, *either independence of the human actions was

                                               - confirmed, or a change was made to correctly model darandane* between bensa errors." The l[
                                 ~

11amana*'s response to an additional RAI regarding trastment of dapandaarisa confirmed that they ( were appropriately addressed. Moreover, the detaDed quantifcation ofimportant post-initiator

     ,                                          operator actions and the -~* d- of recovery actions appeared sound.

1 . l 4) Plantepecific perinamence absping factors (PSFs) and event timlag, were appropriately n Considered. F l 5) A list of hnportant human actions based on their contribution to core damage frequency was provided in the subminal.

 -I                                                                                                    ..

De FE uses five small eaatainmaar phanamanalogical event tree (CET) with from 5 to 8 top events for Isvol 2 analysis. De quantificaGn of the CET in the Prairie Island PE is based on plant-specific y phenomenological evaluations, which include anodeling and haaadia= calculations (based upon emperimental data), cons 8derstbn of phenomenological uncertainties, and MAAP calculations. g I De interface between the Level I and level 2 analyses is accomplished by the development of a set of l 14 accident classes. The Level I core damage sequences are grouped in the accident classes based on ,  ! accident initiators, the time of core damage, and the RCS pressure at the time of cc:e damage. De availability of containment systems is not included in the definition of accidant classes. Conestament j system fault trees (for -. * . " - spray iqjection, containmaat spray recirculation, and - ' .... - fan 1 coU units) were quantified in the Prairie Island PE using linked fault tres models. De containment systems fault tree cutsets were input to the CET branches as necessary to support the CET quantification. t De definition of the ACs for Level I and Level 2 interface seems adequate. The CETs used in the FE

    !                                  provide a reasonable coverage of the kupertant backed 7 == De gnantinenttaa of the CETs i                                . also seems adequate.
                                                                                                                                                               ~

De following are the nudor findings of the back end analysis described in the submittal: .

• De back end portion of the IPE supplies a anh==atial amount of infonnation wkb regards % the subject areas identified in Generic Lauer 88-20. . ._.

l t

• De Prairie 1aland Nuclear Generating Station IPE provides an evaluation of all phenomena of

    !                                       importance to avere acendent progression in accordance whb Appendix I of the Generic IAuer.

t - l

• The IPE has identified a plant specific reactor cavity configuration feature that may affect accident

     ,                                      progression. Based on the PE, it is recommendad that the in core instrument tube hatches for both anits be secured open to allow water to flow into the reactor cavhy to provide cooling to the lower vessel head (l.s., sawassel cooling) and improve debris coolabHiry in the reactor cavtry.

• De aseel abell maatain===t of Prairie lated may be vulnerable to direct anack by dispersed core debris. De access hatches to the instrument tunnel are in an open area on the basement leivel of the

    !                                       eamainmant, and for both of the Prairie Island units one of the two hatches faces toward the steel dio-i L

r' ._ ..

g. _ . _ _

I l- containment, about 30 ft away, with a largely unobstructed path in between. Although a scoping

      ;               study performed in the FE shows that the temperature generated by the debris adhering to the steel wall is insufficient to melt the steel and breach the contalamant, details of the scoping study are not                      ,

I provided in the submittal and the potential effect of corium attack on reducing coa'atamam pressure

   )                  capability is not discussed.

i e De FE identified the potential of ISGTR due to the restart the RCPs upon an inadequate core cooling (ICC) condition. Based on the FE results, it is recommanded in the IPE submittal that the

,i EOP that requires the restart of the RCPs under 1CC condition be modified. It is recommended in i the IPE submittal that the operator checks for %=+ steam generator level before attempting to

   ,                  start the RCP. His recommendation is intended to reduce or eliminate the probability of ISGTR.

• De containment analyses indicate that there is a 68% conditional probability of comalan=nt failure ifISGTR due to restart of the RCP is included. De conditional probability of enntainmant bypass is about 45% of which 30% is from ISCTTR, the conditional probability of early containmant failure i is 0.8% , the conditional probability of isolation failure is about 0.02 % , and the conditional probability of late containment failure is 23%. He conditional probability of containment bypass decreases by 30% ifISGTR is assumed not to occur.

i ne licensee has addressed the recommendations of the CPI program.

6 l j I l 4 i 'i - t ]-

a =s x . f . i -

       +

3 4.. 1, i. w 3 This page blank. 6 e i t 0 l i 1 1 2 e i

                                                                                                                                                                               .a f

l t i e i i i y 1

s>= s i l i 1 l !l 4 REFERENCES l

                                                                                                                                                                \

i - l l (GL S8-20) Crutchfield, D.M., indMdual Plant Esanination Jbr Sewe Accident l Vulnerabilities, U.S. Nuclear Regulatory C== inion Generic Latter 88-20,

   .                                                                      November 23,1988.

[NUREG-1335) Individual Plant Framlnwinn* hhmhtml Guidance, U.S. Nuclear Regulatory

                                                                          a==1=taa Report NUREG-1335, August 1989.

l l' [IPE Submittal) Prairie Island, Individual Plang Framinminn GPE) NSPLM144001, Revision 0, the Northern States Power t'-amay, February,1994. l

(RAI Responses) Response so Requesjbr Additional hformationfor she IPE Progren, Prairie

i j

, Idand Mdear Genenming Plant, the Nonborn States Power Company, February lt 1996.

(NUREG-1150) Sewe Acddent Risk

An Assemnent ofFhe U. S. Nudear Ptmer Plants, U. S.

. Nuclear Regulatory Commission, December 1990. [NUREG/CR-1278) A.D. Swain and H.E. Guttman, Handbook ofHwnan Reliability Ana.) sis with l Enphasis on Nudear Power Applications : TedmiqueJbe Hanan Error Rate l Prediction, NUREG/CR-1278, U.S. Nuclear Regulatory Cn== inion,

Washington D.C.,1983.

2 i

, INUREG-751014) Wash-1400, Reaaor Sqfiny Sady - An Assennent of Accident Riskt in U.S. 1

Csisi,scial Nudear Pkmer Plants, USNRC, October,1975.

.i , [!DCOR) IDOOR BWR Individual Plant Evaluation Methodology, Rev 1, December 1986.

   ;                           (NUREGICR-4772)                             A.D. Swala, Acddent &~*=~ Emluation Progren Human Reliability Analysis
.[                                                                         Procedune, NUREG/CR-4772, U.S. Nuclear Regulatory Commission, l'i:                                                                        Washington, D.C., Febmary,1987.

ll [NSAC - 161] Nuclear Safety Analysis f' enter (NSAC), Faulted Systems Remmy Eiperience, 1 !t ih ji i t 4 b

\'

1! 63 i! i j# ~.-..---+-.....w. _ _ . - - . . . . . - - . - - . - - - . . . . _ . . - - , - . - -}}