ML20209D870
| ML20209D870 | |
| Person / Time | |
|---|---|
| Site: | Seabrook  |
| Issue date: | 01/30/1985 |
| From: | Speis T Office of Nuclear Reactor Regulation |
| To: | Eisenhut D, Eisenhut P Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML20209C800 | List:
|
| References | |
| FOIA-87-6 NUDOCS 8502070262 | |
| Download: ML20209D870 (23) | |
Text
7. .
k :
JAN 3 0 '1985 1
~
MEMORANDUM FOR: -Darrel G. Eisenhut, Director Division of Licensing FROM: Themis P. Speis, Director Division of Safety Technology
SUBJECT:
INITIAL REVIEW 0F THE SEABROOK STATION PROBABILISTIC SAFETY ASSESSMENT We have completed our initial review of the Seabrook Probabilistic Safety Assessment (PSA). The Seabrook PSA, performed for Public Service of New Hamphsire by Pickard Lowe and Garrick, Inc. (PL&G) was voluntarily _
submitted to NRC for information. The PSA considers both internal and [
external initiating events, containment failure modes, radioactive releases, and associated consequences. The Reliability and Risk Assessment Branch contracted technical assistance from Lawrence Livermore National Laboratories -
(LLNL) in reviewing the internal and external events analyses leading to plant damage states (core damage or core melt). The Reactor Systems Branch (RSB) in the Division of Systems Integration is providing a review of the contairiment failure modes and consequence analysis, with the assistance of Brookhaven National Laboratcry (BNL), and the results of their pre'iminary review will be provided separately.
We and our contractors believe that the Seabrook PSA is an extremely com-prehensive study with advances in the state-of-the-art in terms of identifying initiating events and their groupings, the inclusion of support states in event trees, and quantification of accident sequence frequencies, plant damage state frequencies and resultant overall frequency of core melt. However, some of'these aspects make the PSA less amenable to estimating the effect on the results from changes in models and obtaining qualitative engineering insights into the strengths and weaknesses of plant design and operation.
The Seabrook PSA estimate of overall core melt frequency is about 2x10 4/ reactor year. However, a very large number of sequences contribute to the overall core melt probability with the single most dominant sequence contributing less than 15% to the total and the top 22 sequences contribute fczp- S ?-ccc
Contact:
Sarah Davis, RRAB
^e- m a 660e94thM2- Xk @49) sua .e > .. .. . . . . . . . ..
oan y . . . . . .. . . .
ta: eoau sis ec, eemacu om OFFICIAL RECORD CO'*Y wo *-n
- l
r e
approximately 50% to the total. The Seabrook PSA included consideration and quantification of 58 initiating events. These were collapsed to initiating event groups and the contribution to core melt frequency by these initiator groups are displayed in Tables 1 through 3 in Enclosure 1, Summary Review of the Seabrook PSA, Table 4 in Enclosu,as re 1well displays as delineation the rough of the top 22 of aggregation accident accidentsequences.
sequences with similar characteristics to better identify dominant contributors to core melt frequency. As can be seen, sequences initiated by Loss of Offsite Power overwhelmingly dominate core melt frequency followed by Fire initiated and Small LOCA sequences with significantly smaller contributions. These groups of sequences, along with Seismic Events, Component Cooling Water System Failures and ATWS sequences are discussed in Enclosure 1.
Our review of the Seabrook PSA did not identify any safety issues which merit immediate action. We have enclosed a summary of the salient features of the review, with regard to core melt, of the Seabrook PSA (Enclosure 1) and Enclosure 2, the draft report from LLNL. Overall, the review did not identify a discrepancy or error which is estimated, at this point, to significantly change the quantitative results of the PSA. The areas of disagreement and questions are documented in the review report (Enclosure 2).
The review has been impeded by circumstances and problems in several areas.
This PSA was submitted to the NRC voluntarily by Public Service of
- New Hampshire during a period of severe financial problems surrounding the completion of the Seabrook plants and the stability of the applicant utility.
Since the PSA has not been tied to a specific licensing action, the applicant made the decision that they were not able to allot resources for
! .the support- of the review of this document. They did provide personnel to conduct a plant visit in late August, but did not provide any further support in terms of supplying documentation requested, answers to l questions from the Lab and the staff, and, having severed their contract
! with their consultant who performed the PSA, could not provide an avenue for answers or documentation from the authors of the PSA. We acknowledge that
'these decisions were not made in a spirit of non-cooperation but rather l
financial circumstances which outweighed a decision to provide support.
However, this support is important in conducting a PSA review in order to arrive at meaningful conclusions regarding the validity of the results and the insights gained during the performance of the PSA.
l l
l .
l l
Opf ect ) . . . . a 5
Sumassast ) ... -. .. ..
oan y m: sondm oc ecmacw om OFFICIAL RECORD COPY uscw =-m l .
e 3-With this evaluation, the Phase I (preliminary review) work, as identified in the FY84 Operating Plan (Item V.B.1.a.iv), on the Seabrook PSA is complete.
Original Signed By Themis P. Speis, Director Division of Safety Technology
Enclosures:
- 1. Staff Summary Review of the Seabrook PSA
- 2. A Review of the Seabrook Station PSA cc: H. Denton E. Case R. Vollmer R. Bernero Distribution H. Thompson
- G. Knighton w/o Enclosure a 2a Central file V. Nerses
" RRAB Rdg
" a a SDavis B. Sheron a W. Lyon' " " Davis CHRON a a RFrahm D. Silver ". a S. Brocoum
. a AThadani
" a a FRowsome P. Sobel AD/TRg TSpeis DST CHRON l
l RRAB: DST RRAB: DST RRAB:D AD T DST l onicep . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .................... .
AThadani owsome TS is sune nan > S.Da v. .i...... RFra..hm
,,]/ .$,..,,/ 85 .,]/,M.f85 ]f,g1]85,, .;7,,j /,85, we > ..l./.M.../ 85 OFFICIAL RECORD -COPY acc --sw o.ac eoaw sis oc ac, acu c2.o
ENCLOSURE 1 Staff Summary. Review of the Seabrook PSA BACKGROUND Lawrence Livermore National Laboratory (LLNL) conducted a review of the Seabrook Station Probabilistic Safety Assessment for the Reliability and Risk Assessment Branch (RRAB), Division of Safety Technology. This probabilistic safety assessment (PSA) was performed by Pickard, Lowe, and Garrick Inc. for Public Service of New Hampshire (PSNH) and Yankee Atomic Electric Company (YAEC). The PSA was also provided to the NRC for its information. The review of the Seabrook PSA was performed by a project g team composed of personnel from NRC staff, LLNL staff, subcontractors and consultants.
OVERALL EVALUATION OF THE SEABROOK PSA An examination and review of the dominant sequences identified in the PSA was performed in light of the various concerns that have been identified in Chapters 3 and 4 of Enc'losure 2 for the internal and external events. This examination was necessarily limited by the inability to reconstruct and reevaluate the event trees with consideration of these concerns, and to then compare the new results to the PSA results. It was not possible to perform
- this evaluation and comparison because of the lack of information and answers to technical questions.
Nevertheless, the overall findings of the LLNL review resulted in the judgment that the dominant sequences presented in thi PSA generally appear to be i
l L
o reasonable (although conservative) in a quantitative sense. That is to say that one could expect to find that the quantitative results of a new evaluation would n,ot find the probability of core melt to be significantly larger than described in the PSA, because of the generally conservative quantitative approaches and assumptions incorporated in many places in the PSA. A summary of the sequences and review findings is provided in the following section. No significant omissions were found in terms of an overall contribution to the frequency of core melt. Several modeling errors were found that indicate an incomplete or different understanding of interactions between plant sytems or human beings (operators) and plant systems; these are described in the internal events section of Enclosure 2.
While LLNL considered it likely that a reevaluation of the sequences where these differences were identified would not significantly affect the overall core melt frequency, it may provide different qualitative results regarding
.the understanding of dominant contributors and therefore different insights. However, the significance of these differences could not be completely assessed.
SUMMARY
The PSA results for core melt probabilities were 1.6E-4 per reactor year (RY) for internal events and 6.2E-5/RY for external events, for a total of 2.3E-4/RY.
External events were dominated by contributions of 2.9E-5/RY from seismic events and 2.6E-5/RY for fires. The scope of the review did not include a review of containment response or offsite consequences nor extensive requantification.
Q A ve,ry large number of sequences contribute to the overall core melt frequency The Seabrook PSA included' consideration and quantification of 58 events.
Tables 1, 2, and 3 display the accident sequence contributions to core melt frequency grouped by initiating event categories and provide a summary of the top 22 sequences.
However, by collapsing these sequences to categories of sequences with
~
similar characteristics, the resultant sequence frequencies and contributions to overall core melt frequency are presented in Table 4.
5 I
TABLE 1 CONTRiBUTIONSdFACCIDENTSEQUENCES GROUPED BY INITIATING EVENT TO CORE KELT FREQUENCY'
. . . a-Initiator, Group Percent Percent Contribution Contributors Contribution Loss of Coolant 11 s Small LOCA- 8
.I.nventory . .
,,e Others -
3 Transient Events e Reactor trip 6 (excluding e Turbine trip 4 support system o Partial loss of feedwater 4 faults) 31 e Steamline break 4 e Excessive feedwater 3 e MISV closure 2 e Others 8 Common Cause e Loss of offsite power 29 Initiating 58 o Seismic events 12 Events e Fires 11 e Other support system faults 3 e Other external events 3 Total 100 100
, , Core Melt Frequency: Mean 2.3 x 10-4 per reactor year -
O 9
--e -
-e _
w_- .--
,wn,_ , . . . - _ , ,m,,_.-,__ -_m, m_y_ - - , - - - . - - - . ,,.__,.,,,_,_,_.,,_,.,,,-,,,-..-,--___-.,._m , , _ - - -__e,-_ , _ . .. . -
c TABLE 2 CONTRIBUTIONS OF SEQUENCES GROUPED BY INITIATING EVENT TO FREQUENCY Of RISK :
SIGNIFICANT RELEASE CATEGORIES AND CORE met.T
- 1 Release Category Frequency Contributions If (events per reactor yearl
~
g t,,, ,,, y t Initiating Event (,g, Ir quency Initiating Event Large Small Group 8asemat overpressure l'I' Contributions
- Containment Containment verpressure - Contalament (events p r By ss Melt-Through with g,geCg .
Bygs 8 MV Vaportaation "* **'*#I8'II*"
15 reactor yearl n e lease T3, selease 53 ;
Loss of Large LOCA * * * * **
Coolant Small LOCA * * *
- 1.5-6 1.4 6 Inventory Interf acing Systems LOCA 2.5 6 1.7 5 2.0-5 1.8-6 0 0 0 0 0 Steam Generator Tube Rupture *
- 1.8 6 1.0-7 8.2 7
- 6.5-7 1.7-6 General Reactor Trip * * *
- 6.3-6 Transients Turbine Trip * * *
- 6.7 6 1.3 5 3.9-6 3.9 6 1.0-5 Loss of Main Fee &ater *
- 1.0-6 8,3-6 *
- 1,g.5
.. Partial Feedwater Loss a s *
.*. 5.0-6 2.5 6
[acessive Fee &ater * * *
- 7.8-6 2.8-6 2.7-6 5.7-6 Loss of Condenser Vacuus * * * *
- MSIV Closure * * *
- 8.9-7 1.1-6 Loss of Primary Flow a * *
- 4.9 6 5.0-6 Steam Line 8reak * * *
- 1. 2.- 6 1.t-6 2.4 6 Mala 5teae 8ellef Opens * *
- 6.9 6 7.3 6 5.0-7 1.4-7 7.8 7 Coanon Cause Loss of Offsite Power *
- 6.8-6 5.5-5 4.9-6 1.5 6 Initiating. . Loss of One OC Sus * * * *
- 6.9-5 Events Loss of Service water * * *
- 1.1-6 2.3-6
- Support Loss.of Component Coollag * *
- 2.5-6 0 2.5-6 System 1. 4 -6' 0'- 1.4-6 Faults
- Enternal Selsatc [ vents (totall 5.8-7 1.7-5 5.3-7 4.0-6 2.9 6 2.8-6 2.8-5 Events Fires (totall *
- 6.6-7 5.3-6 2.0-5.
- Flood (totall *
- 2.3-7 2.5-5 Truck Crash *
- 1.9-6 1.8-6
- 3.9-6 1.8-7 1.4-6 1.4-7
- 1.8 6 Total 2.4-6 1.8-5 1.0-5 8.0-5 5.8 5 6.0-5 2.3-4
- Less than It contribution to release category freq uency.
NOTE: Esponential notation is Indicated in abbreviated fonal f.e. 1.1-6 i 1.1 a 10-0 ee.... . eg
. O
-. . .c a TABLE 3
SUMMARY
OF ACCIDENT SEQUENCES WITH SIGNIFICANT RISK AND CORE MELT FREQUENCY
' ___ sheet I ofC0tlIRibuT10r 2
sequence Ranking Additto Sy Failures / Resulting Dependent Fallures r acy g,,,
4Nat %
la 16ating f per reactor year) gy g 4tealth lie s t t h Risk Risk Component cooling, high pressure makeup 3.3-5 1 1 Loss of Offsite Onsite AC Power, No Recovery of AC Power 8efore Core Damage ((CCS), reactor coolant pump seal LOCA, Power containment flitration and heat removal.
t 9.2-6 2 2 Service Water, No Recovery of offsite Onsite AC power, component cooling, high Loss of Offstte and low pressure makeup (ECCS) reactor Power Power coolant pump seal t0CA, containment flitration and heat removal.
Mone.
8.9-6 3 Small LOCA Residual Heat Removal *
- 8.7 -6 4 3 None Component Cooling, high and low pressure Control Room makeup (ECCS). reactor coolant pump seal Fire LOCA, containment filtration and heat l
removal. 1 Reactor trip, emergency feedwater. high 8.)-6 5 4 toss of Main Solid State Protection System and low pressure makeup (ECCS), contain.
Feedwater ment flitration and heat removal.
5.6-6 6
! Steam Line Operator Failure to Estabitsh Long Tere i Break Inside Containment fleet Removal
- High and low pressure makeup (ECCS). 4.6-6 7 5 Reactor trip Component Cooling I
! reactor coolant pump seal LOCA, contain-ment flitration and heat removal.
I
- 4.4-6 6 6 Train A Onsite Power Train B Service Train 8 onsite power, component cooling.
toss of Offsite high and low pressure makeup (fCC5).
Power Water, llo Recovery of AC Power Before Core Damage reactor coolant pump seal LOCA, contain-t ment flitration and heat removal, Train A onsite power, component cooling. 4.4-6 9 7 Loss of offsite Train 8 Onsite Power. Train A Service high and low pressure makeup (ECCS).
Power Water,'No Recovery of AC Power Before j
Core Damage reactor coolant pump seal LOCA, Contaln-
, ment flitration and heat removal.
i -
4.1-6 10 8
- PCC Area Fire None ' Component cooling, high and low pressure 1
' makeup ([CCS), reactor coolant pump seal t0CA, containment flitration, and heat removal.
- Ncqllglble Contribution to risk. ,
N0l[: Esponential notation is indicated in abbreviated form; l.e., 3.3-5
- 3.3 m 10-5, ,
j 09u9P12228) 1
~
i t
1 l TABLE 3 (continued)
- Sheet 2 of 2 l Sequence Ranking tattlating Additional System Fallures/
Lwat Resulting Dependent Failures requ ncy Latent Early j
Human Actions tper reactor yearl Health Health i Risk Risk l.
{ Partial Loss of Component Cooling High and low pressure makeup (ECCS), reactor 3,8-6 11 9
- Main feeduater coolant pump seal LOCA, containment filtra-tion, and heat removal. .
l Cable Spreading mone Component cooling, high and low pressure 3.5-6 12 10
- Room Fire makeup (ECCS), reactor Coolant pump seal
. LOCA, containment filtration, and heat i removal.
Loss of One DC Emergency Feedwater, No Recovery of Sleed and feed cooling, Train A 3.2-6 13 *
- Dus Emergency or Startup feeduater containment filtration and heat removal.
1 Reactor Irtp Operator Fallure to Establish Long Tern None. 3.0-6 14 *
- Heat Removal. ,
Turbine Trip Component Cooling High and low pressure makeup (ECCS), 2.0-6 15 11
- reactor coolant pump seal LOCA, contain-ment filtration, and heat removal.
l
- toss of Service Mone Component cooling, high and low pressure 2.3-6 16 12 Water makeup, reactor coolant pump seal LOCA, containment filtration, and heat removal.
Operator Failure to Establish Long Term 2.3-6 *
- Partial Loss of Mone. 17
- Fecevater Heat Removal l Turbine Building onsite AC power, No Recovery of AC Power Of fsite pouer, component cooling, high 2.3-6 18 13
- 4 Fire Before Core Damage and low pressure makeup (ECCS), reactor
, coolant pump seal LOCA, containment filtra-tion, and heat removal.
]
Snall LOCA Train 8 Safety Features Actuation. Train A high and low pressure makeup and 2.2-6 19 *
- Train A Residual Heat Removal residual heat removal; trata B Containment filtration and heat removal.
Smal1 LOCA Train A Safety features Actuation. Train B high and low pressure makeup and 2.2-6 20 *
'I Train 8 Residual Heat Removal residual heat removal; train B containement i filtration and heat removal.
- Reactor Trip, f ailure to Hanually Scram Functional Inability to provide adequate 1.g-6 25 Reactor and to Ef fect Emergency Boration high pressure makeup.
Interfacing None Low pressure makeup, residual heat 1.8-6 27 14 1 Systems LOCA .
removal, containment isolation and
. filtration.
- h gilglble contribution to risk. '
hult: Laponential notation is indicated in abbreviated fons; 8.e., 3.8-6 = 3.8 x 10*0 4
i
I TABLE 4 Number of Aggregate Contribution Sequen'ces Total Frequency /RY Initiating in Top 22 Frequency /RY to Overall CMF in Top 22 Event Group
+2x10 5 9% 3 +1x10 5 Small LOCA
~7x10 5 4 +5x10 5 Loss of Offsite 30%
Power
~3x10 5 13% 0 Seismic
+3x10 5 13% 4 *2x10 5 Fire Component Cool- $1x10 5 4% 3 *1x10 5 ing Water System Failure
~1x10 5 4% 2 +1x10 5 ATWS
- 1x10 5 4% 3 ~1x10 5 Transient (other than LOOP)-followed by Failure of Long Term Heat Removal Interfacing Systems *2x10 6 ~1% 1 +2x10 8
.LOCA
$4x10 5 19% 2 +5x10 6 Other Transients Other External Flood, Truck Crash ~6x10 8 +3% 0 e
f l
i i
1 5-SEQUENCES INITIATED BY INTERNAL EVENTS The extent and type, of internal event initiators and their treatment is generally reasonable and consistent with those considered in other PRAs.
1 The event tree models in most esses correctly represented the accident sequence phenomenology assumed in the PSA; however, several areas of disagreement with the assumed phenomenology were identified. There is also a concern that the requirement to have each event on an event tree independent of the others has resulted in large and very complex trees which are difficult to follow and analyze. In addition, the large number of sequences, on the order of 100 times as many as in previous PSAs, effectively fragmented many accident scenarios which could be simply described as single sequences into a large number of sequences, so that the usefulness of the i
event tree sequences as a means to obtain engineering insights was lost.
Although many deficiencies in these trees are described in the text of Enclosure 2, it was not possible to provide a preliminary assessment of the quantitative effect on the PSA results, primarily because of the complexity of the trees in the PSA and their use of proprietary codes'to perform the quantitative evaluations.
i LOSS OF 0FFSITE POWER Sequences initiated by a loss of offsite power, taken collectively, dominate the overall core melt frequency. 0f the sequences comprising 30% of core melt frequency, 4 sequences are in the top 22 sequences with a 22%
1
6-contribution to CMF, the highest of which, contributes 15%. In this sequence, loss of offsite power is followed by failure of onsite AC power (2 of 2 diesel generators failing) with a resultant Reactor Coolant Pump Seal failure (RCP Seal LOCA) due to loss of Component Cooling Water'and High Pressure Makeup. The other three sequences initiated by loss of offsite power involve total.kervice Water System failure and combinations of one train of Service Water failure with failure of the opposite train of onsite AC power. These sequences also lead to a RCP seal LOCA, though the individual sequences have lower frequencies dee to the differing system failures in the accident progression. The frequency assumed for loss of offsite power is generally consistent with those in other PSAs, but two assumptions in these sequences cause concern. The first is that the RCP seal LOCA will occur immediately upon loss of all AC power and that the leak rate is 20 gpm per pump. Based on previous analyses (Millstone 3 PRA, for
. example) it is not reasonable to assume that a leak will occur immediately.
A more realistic time frame is on the order of 30 to 60 minutes before the seals fail. At that time, previous analyses assume that the leak rate will rapidly accelerate to a much higher rate (s300 gpm) and subsequent total failure since the seals will be in a degraded condition under high mechanical and thermal stress. The extremely low flow rate assumed in the Seabrook PSA extends the occurrence of core uncovery and damage to a much later time than is considered realistic. Under the assumption of a higher flow rate, core damage is more realistically expected to occur about two hours after power is lost and unrestored. Justification for the assumptions ir. the PSA was not provided and the overall effect of the concerns regarding e
- - - e ------___
them have not yet been quantitatively assessed. LLNL considered it likely that a reevaluation of these sequences where differences were identified would not significantly a'ffect overall core melt frequency, however, it may result in a different understanding of the timing of core melt and the resultant distribution of sequences over plant damage states.
SHALL LOCA Of the sequences initiated by a small LOCA comprising 9% of overall core melt frequency, 3 sequences appear in the top 22 with a contribution of about 4% to CMF. The highest frequency sequence involves failure of Residual Heat Removal (RHR) as a source.of low pressure infection following manual depressurization with the other two involving combinations of a Safety Features Actuation (SFA) Signal train failure and failure of an RHR train. The SFA failure affects containment filtration and heat removal. Of concern are the two separate values assumed for a small LOCA, representing ,
breaks that can be isolated and those which are nonisolable. It has been generally recognized in previous PSA analyses that isolable breaks do not significantly contribute to overall small LOCA frequency due to the amount of time available for the operator to isolate them prior to the need for emegency core cooling. Therefore, the concern is with the nonisolable break frequency assumed in the S'eabrook PSA which is lower than those found in various other PSAs and PSA reviews. This frequency is based on the ability to isolate a random RCP seal LOCA at a given plant. The Seabrook plant does not have primary loop isolation valves, thus an RCP seal LOCA would be i
considered nonisolable. Since this was not considered in the PSA frequency on nonisolable small LOCAs, it appears that this initiating event has been underestimated by ,as much as a factor of four when compared to other data sources (e.g., ANO-1 IREP analyses).
Component Cooling Water System Failure (CCW)
The other category of sequen es of interest involve failure of the CCW System. These three sequences, which involve resultant RCP seal failure, have an aggregate frequency of *1x10 8/RY and contribute 5% to overall CMF.
This value of 1x10 5/RY is somewhat lower than those determined for other PRAs for similar plants (e.g., Zion, Indian Point). It has not yet been determined whether the particular configuration of the CCW system at Seabrook has design features which would explain this difference, one aspect of the PSA worth noting is that while the study considers a total loss of
.the CCW System as an initiating event, it does not consider loss of a single train. The basis provided is that if a single train is lost, the reactor will not immediately trip and the operator can proceed with an orderly l
shutdown, thus it is not an initiating event.
l Anticipated Transients Without Scram ATWS sequences contribute ~4% to overall core melt frequency. Two sequences, with collective frequency of $1x10 5/RY, were among the top 22 sequences.
One sequence is initiated by a loss of main feedwater with subsequent mechanical failure of the Solid State Protection System (8.3x10 S/RY) and i
e
the other is initiated by a Turbine Trip followed by failure of automatic and manual scramming of the reactor (1.9x10 s/gy),
Using the new ATWS rule to provide guidance and information, some problems with the ATWS event tree were identified, in areas such as operator recovery and credit for bleed and feed.
The PSA gives credit to the poscibility of operator action to effect manual reactor scram following automatic scram failure. This action, however, is not modeled explicitly en the tree; it is applied directly to the failure of RPS leading to ATWS. It is valid to consider this type of recovery, but an action of this import should have been included explicitly on the tree.
It is also important to note that this recovery action can only be applied to electrical failures of the RPS, so that RPS failures should have been divided into electrical and mechanical failures as stated in the ATWS rule.
The assumption that it is necessary for the operator to shut down the l
l reactor after the initial phase of the ATWS is reasonable and consistent with the ATWS Rule. However, the Seabrook PSA assumes that this action must be taken within ten minutes, which appears to be conservative. Once the initial phase of the ATWS 'is over, the power equilibrates at the secondary heat demand and the plant will operate safely for extended periods of time.
~
This was supported by many analyses and a simulator run performed on the Seabrook simulator during the plant visit of August 29-31, 1984. It appears
[
l
that the time frame is more on the order of 60 minutes or more, except when a primary safety valve sticks open or the ATWS tree is entered from a LOCA initiator. In this case, a 20 minute time frame is more appropriate than the 10 minute operator action time assumed in the Seabrook PSA.
The PSA also assumed that it is possible to mitigate an ATWS by using bleed-and-feed with HPI alone if emergency feedwater fails. This would theoretically provide boration to shut down the reaction simultaneously with bleed-and-feed cooling. This method has not been considered in most other PSAs, and takes an inordinately large amount of credit for the ability of HPI to provide flow at operating pressure. Also, there would be much greater ,
amounts of heat to be removed through the PORVs with makeup flow than 'for a normal bleed-and-feed scenario. It is not clear that heat removal and reactor shut down could be accomplished under these conditions without
'the emergency feedwater system. Therefore, it is more appropriate to conclude that all sequences with failure of emergency feedwater would lead to core melt and may increase the ATWS sequence frequency. This may be offset by the other can'servatisms assumed in evaluating ATWS events. The overall quantitative effect on ATWS and overall core melt frequency has not yet been evaluated.
l Transients with Failure of Lona Term Heat Removal The contribution to overall core melt frequency from this category of sequences comes from a large number of sequences, only three of which appear 9
e
9
- 11 in the top 22 sequences. Failure of long term heat removal (high and low pressure makeup in the RHR mode configuration) is dominated by common cause failures (e.g. maintenance unavailabilities) and independent hardware failures. These failures involve failure of pumps to start and valves in RHR trains and heat exhanger valves failing to open.
The category of "other transients" is comprised of an extremely large number of sequences of the remaining sequences analyzed as contributors to overall core melt frequency. This category has not been decomposed to obtain insights in this initial review.
The functional success criteria used in the PSA were generally found to be reasonable, with some exceptions. These criteria, however not clearly stated in many cases, included both conservative and optimistic examples and in general appeared to be inadequately documented.
The review of the failure rate data used in the PSA consisted of a comparison of the individual component failure rates with other sources and a review of system failure probabilities and unavailabilities. The data values presented were found to be reasonably consistent with other data sources available to the review. A comparison of system failure probabilities with other sources of similar data revealed that these values were reasonably consistent with the other sources.
Consideration and treatment of dependencies and common cause failures in the PSA were evaluated in the review in three categories: common cause initiating events,.intersystem dependencies, and intercomponent dependencies.
The methodology used in the analysis appears reasonable and appropriate. No important omissions in the treatment of dependencies were identified by the review. The treatment of common cause data was of some concern because of the exclusion of passive components and the use of very low beta factors (i.e.,
factors to account for commor, c?.use failures) for some components although no instance was identified that would significantly change the results.
EXTERNAL EVENTS The external events considered in the PSA are earthquakes, fires, aircraft accidents, internal and external flooding, extreme winds, and turbine missiles.
It is important to note that sequences initiated by the various external events
-(not including LOOP) were not significant contributors and that only fire initiated sequences appeaied in the top 22 sequences. This is not entirely consistent with other PSA findings (such as those for Zion, Indian Point, and Millstone 3).
i The methodologies used in the detailed assessments are generally reasonable I
and consistent with the state-of-the-art; however, there were notable disagreements in several areas.
e e
EARTHQUAKES SEISMIC HAZARD AND SEISMIC FRAGILITY.
Though sequences initiated by seismic events contribute +13% to overall core melt frequency, none of these' sequences appear in the top 22 and the highest individual sequence frequency is $4x10 8/RY. The occurrence of a seismic event could initiate a sequence at the Seabrook plant in any of several ways. Failure of the offsite power transformers (Reserve Auxiliary Transformers and Unit Auxiliary Transformers), or switchyard equipment, would result in offsite power to the plant being lost. Also, at higher accelarations, a failure of the reactor, internals could cause the control rods to jam and not position for reactor shutdown. It is also possible that an earthquake could cause the anchor bolts tying down the steam generators or reactor coolant pumps to fail, thereby permitting the equipment to tilt, possibly resulting in a break at the primary cooling system piping. Other failures such as instrument buses, that would cause a transient type event, would occur at accelerations higher than those that would already have caused a loss of offsite power and would result in the same sequences.
The methodology used in the evaluation of the frequency of the seismic l
hazard at Seabrook is cons'istent with the state-of-the-art of commercial PSAs. However, there is disagreement with numerous applications of the methodology in the PSA. In particular, the procedure used to perform the uncertainty analysis failed to document the choices made and the uncertainty
assigned to key parameters in the analysis. A review of individual ,
parameters in the analysis and a comparison with the interim Seismic -
^
Hazard Ctiaracteriz,ation Program lead to the qualitative conclusion that the hazard analysis results may be optimistic and the uncertainty underestimated.
The methodology used in the PSA for determining the seismic fragilities is <-
appropriate and adequate to obtain a rational measure of the capacity of the structures and equipment. Based on a preliminary review of the results of the PSA, the mean frequency of core melt value of 2.89E-5 per <
year appears to be high relative to the optimistic hazard curves used in the analysis. Calculations indicate that the capacities of the key components at the SSE value are low and generally less than values determined for other PSAs such as Limerick and Millstone. In addition, comparing fragility' parameter values of Seabrook and other PWRs (new and old), the capacity values of equip-
. ment considered also appeared to be low for Seabrook. Based on experience with-past PSA reviews and information gained during the site inspection, the capacities of the dominant contributors, though they have not been quantita-tively reevaluated, are likely not to be as low as indicated.
FIRES Fire induced sequences contribute ~13% to overall core melt frequency with 4 sequences appearing in the top 22 sequences contributing $2x10 5/RY (9%) to CMF. These sequence initiators are Control Room fire (8.7x15 8/RY), Primary l
Component Cooling Area Fire (4.1x10 8/RY), Cable Spreading Room Fire 9
- . . - . - . . - . - , . . - - - . . - . . . - , ,-.---.--._,,,__..,------w,
. ., ! .:I'
_L [ - .
(3.5x10 8/RY), and Turbine Building Fire followed by loss of all AC power
- ' (2.3x10 8/Ry). All of these sequences result in loss of component cooling, RCP seal LOCA, loss of ECCS, and failure of containment filtration and heat removal. The fire analysis performed for the PSA, based on current fire
$, protection guidance, appears accurate and valid and the frequencies of the fire induced initiating event which include system failure appear reasonable.
The contribution to core damage due to fires at the various locations analyzed falls withir. the renge of those calculated from other fire assessments at nuclear power plants (IE-4/RY to 1E-7/RY).
The analysis of fire propagatien for determining the loss of safety related functions is rigorous and explicit and the considerations of fire phenomena, material properties, fire detection and suppression, operator action, and modeling uncertainty at each fire location were reasonable.
There is a concern, however, about the manner in which the fire induced initiating events are processed through the plant matrix. It appears that these initiating events, which already include component or system failures, are being incorrectly combined with auxiliary and front-line event trees I that have not explicitly considered these same failures. This concern has yet to be verified and eva'luated.
l INTERNAL FLOODING The PSA treats internal flooding primarily qualitatively, with a l
d l
quantitative analysis performed for a turbine building and switchgear room flood. The qualitative analyses consider all internal flood sources for each. defined lockt.f on, including floods caused by fire protection equipment and sources > from adjacent locations. In all these locations it was concluded that the risk due to flooding was insignificant. The quantification
. of the turbine building flood appears to be reasonable and adequate as was
'4 -
the qualitative treatment of flooding in other locations.
l l
l l
-- ~ - - , . . _ . . _ _ _ _ . _ _ , _ _ . _ _ . . . _ _ _ , . _ , _ _ _, , _ _ _ _