ML20214M803

Draft Addendum to Review of Risk-Based Evaluation of Isap Issues for Connecticut Yankee (Haddam Neck) Plant (Addl Issues)

ML20214M803
Person / Time
Site:	Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png
Issue date:	04/22/1987
From:	Atefi B, Gallagher D, Le P SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML20214M721	List: ML20214M719 ML20214M803
References
CON-NRC-03-82-096, CON-NRC-3-82-96 SAIC-87-3004, SAIC-87-3004-ADD-DRF, NUDOCS 8706010433
Download: ML20214M803 (67)

Text

SAIC-87/3004 ADDENDUM DRAFT DRAFT REVIEW OF RISK-BASED EVALUATION OF INTEGRATED SAFETY ASSESSMENT PROGRAM (ISAP) ISSUES FOR CONNECTICUT YANKEE (HADDAM NECK) PLANT (ADDITIONALISSUES) l i  ;

Bahman Atefi Daniel W. Gallagher Phuoc T. Le and Paul J. Amico

• Ap.-il 22,1987 Prepared for  ;

U.S. Nuclear Regulatory Comission Washington, D.C. 20555  ;

Contract No. NRC-03-82-096 l

• Applied Risk Technology Corporation 8706010433 870527 PLH ADOCK 05000213 P PDR t j Post Of6ce Box 1331,1710 Goodn@e Drhe, McLeen, Wginia 22102, ()C3) 8214300 h

h '

I'

[ilfAfT REVIEW 0F RISK-BASED EVALUATION OF INTEGRATED SAFETY ASSESSMENT PROGRAM (ISAP) ISSUES FORCONNECTICUTYANKEE(HADDAMNECK) PLANT (ADDITIONALISSUES) l i

I

-*7-- -w W--y-- - ,- y-., __ _

. FOREWORD This interim report was prepared under Task Order 24 of Contract NR-82 096, " Technical Assistance in Support of NRC Reactor Licensing Actions:

Program III."

The report provides the results of the review of a series of safety-related topics for the Haddam Neck Plant analyzed by the licensee using Probablistic Risk Assessment (PRA) techniques. An earlier report (SAIC-87/3004 (1))

provided the results of the review of another set of topics. The topics reviewed in this report were received after the earlier report was completed and submitted to the NRC. Once comments from the NRC and the licensee are reviewed, they will be combined into one final report and submitted to the NRC.

P

. TABLE OF CONTENTS-Se'etion 'g LIST OF TABLES . .................... .

vi-EXECUTIVE

SUMMARY

vii

1.0 INTRODUCTION

...................... 1-1 1.1 Background . . . . . . . . . . . . . . . . . . . . . 1-1 1.2 Objective, Scope and Review Procedure . . . . . -. . 1-2 1.3 Organization of the Report . . . . . . . . . . . . . 1-3 2.0 REVIEW 0F THE HADDAM NECK ISAP TOPICS . . . . . . . . . . 2-1 2.1 Comments on the Utility's Method of Public Risk Quantification . . . . . . . . . . . . . . . . . . . 2-2 2.2 Proposed Method for Ranking of the ISAP Topics . . . 2-5 2.3 Topic 1.05: Seismic Structural Modifications . . . 2-8 2.3.1 Background ................. 2-8 2.3.2 Utility Evaluation . . . . . . . . . . . . . 2-8 2.3.3 Review of Utility Evaluation . . . . . . . . 2-9 2.3.4 Conclusion ................. 2-9 2.4 Topic 1.08: Seismic Modifications to Reactor Coolant System (RCS) . . . . . . . . . . . . . . . . 2-10 2.4.1 Background . . . . . . . . . . . . . . . . . 2 .2.4.2 Utility Evaluation . . . . . . . . . . . . . 2-10 i

- - - e.,., ~<- e --, ,--w .

r, e ,,.-s e- , , ,-,-, ,-. ,_ -,-. ,c- --<- , , , - .c. - - - .--

TABLE OF CONTENTS (continued)

Section Pace 2.4.3 Review of Utility Evaluation . . ... . . . . .

2-11 2.4.4 Conclusion.. . . . . . . . . . . .-. . . . .. 2-11 l

2.5 Topic 1.14.2: ' Install New 480V L/C'and Rearrange in Fire Area S-8.(New Switchgear Room).

Topic 1.14.4: Install Remote Instrumentation Panel ....................... 2-12 2.5.1 Background . . . . . . . . . . . . . . . . .- 2 2.5.2 Utility Evaluation . . . . . . . . . . . . . 2-12 2.5.3 Review of Utility Evaluation . . . . . . . . 2-13 2.5.4 Conclusions. . . . . . . . . . . . . . . . . 2-15 2.6 Topic 1.16: Anticipated Transients Without Scram . 2-15 2.6.1 Background ............. .. 2-15 2.6.2 Utility Evaluation ............. 2-16 2.6.3 Review of Utility Evaluation ....... 2-17 2.6.4 Conclusions . . . . . . . . . . . . . . . . 2-19 2.7 Topic 1.17: Replacement of Motor Operated Valves . 2-19 2.7.1 Background ................ 2-19 2.7.2 Utility Evaluation ............ 2-19:

2.7.3 Review of Utility Evaluation ....... 2-19 2.7.4 Conclusion ................ 2-20 2.8 Topic 1.21: Regulatory Guide 1.97 Instrumentation . 2-20 2.8.1 Background ................ 2-20 2.8.2 Utility Evaluation ............ 2-20 2.8.3 Review of Utility Evaluation ....... 2-25 2.8.4 Conclusion ................ 2-26 ii l

TABLE OF CONTENTS (continued)'

Section Pg.qt.

2.9 Topic 1.22: Emergency Response Facilities Instrumentation .................. 2-27 2.9.1 Background ................. 2-27 2.9.2 Utility Evaluation _. . . . . . . . . . . . . .

2-27 2.9.3 Review of Utility Evaluation ........ 2-27 2.9.4 Conclusion ..:............... 2-28~

2.10 Topic 1.28i Reactor Coolant Pump Trip . . . . . . . 2-29 2.10.1 Background . . . . . . . . . . . . . . . . . 2-29 2.10.2 Utility Evaluation . . . . . . . . . . . . . 2-29 2.10.3 Review of Utility Evaluation . . . . . . . . 2-31 2.10.4 Conclusion . . . . . . . . . . . . . . . . . 2-31 2.11 Topic 1.54: Safety Implications of Control Systems ...................... 2-32 2.11.1 Backgrouno . . . . . . . . . . . . . . . . . 2-32 2.11.2 Utility Evaluation . . . . . . . . . . . . . 2-33 2.11.3 Review of Utility Evaluation . . . . . . .-. 2-33 2.11.4 Conclusion . . . . . . . . . . . . . . . . . 2-34 2.12 Topic 1.59: Additional Low Temperature Overpressure Protection . . . . . . . . . . . . . . . . . . . . . 2-34 2.12.1 Background . . . . . . . . . . . . ... . . . 2-34 2.12.2 Utility Evaluation .-. . . . . . . . . . . . 2-34 2.12.3 Review of Utility Evaluation . . . . . . . .- 2-36' 2.12.4 Conclusion . . . . . . . . . . . . . . . . . 2-37 iii l

TABLEOFCONTENTS(continued)

Section Eajt 2.13 Topic 1.60: RCS/RHR Suction Line Valve Interlock on PWRs . . . . . .:. . . . . . . . . . . . . . . . . .

2-37 2.13.1 Background . . . . . . . . . . . . . . . . . 2-37 2.13.2 Utility Evaluation . . . . . . . . . . . . . 2-37 2.13.3 Review of Utility Evaluation . . . . . . . . 2-38 2.13.4 Conclusion . . . . . . . . . . . . . . . . . 2-39 2.14 Topic 1.61: Pressurized Thermal Shock . . . . . . . 2-39 2.14.1 Background . . . . . . . . . . . . . . . . . 2-39 2.14.2 Utility Evaluation . . . . . . . . . . . . . 2-40 2.14.3 Review of Utility Evaluation . . . . . . . . 2-40 2.14.4 Conclusion . . . . . . . . . . . . . . . . . 2-40 2.15 Topic 1.62: Feed and Bleed Modifications ..... 2-41 2.15.1 Background . . . . . . . . . . . . . . . . . 2-41 2.15.2 Utility Evaluation . . . . . . . . . . . . . 2-41 2.15.3 Review of Utility Evaluation . . . . . . . . 2-42 2.15.4 Conclusion . . . . . . . . . . . . . . . . . 2-44 2.16 Topic 1.63: Hydrogen Control ........... 2-44 2.16.1 Background . . . . . . . . . . . . . . . . . 2-44 2.16.2 Utility Evaluation . . . . . . . . . . . . . 2-45 2.16.3 Review of Utility Evaluation . . . . . . . . 2-45 2.16.4 Conclusion . . . . . . . . . . . . . . . . . 2-46 I

iv

~ 9Lg TABLEOFCONTENTS(continued)

Section

.P_9.29.

2.17 Topic 2.05: Process Computer Replacement . .. .. . 2-46 2.17.1 Background . . . . . . . . . . . ... . . . .

. . 2-46' "

2.17.2 Utility Evaluation . . . . . . . . . . . . . 2-47 2.17.3 -Review of_ Utility Evaluation . . . . . . . . 2-47 2.17.4 Conclusion . . . . . . . . . . ... . . . . . 2-48 2.18 Topic 2.10: Administration Building Upgrade . . . . 2-48 2.18.1 Background . . . . . . . . . . . . . . . . . 2-48 2.18.2 Utility Evaluation . .-. . . . . . . . . . . 2-48 2.18.3 Review of Utility Evaluation . . . . . . . . '2-49 2.18.4 Conclusion . . . . . . . . . . . . . . . . . 2-49 2.19 Topic 2.13: Fire Detection System Upgrade . . . . . 2-49 2.19.1 Background . . . . . . . . . . . . . . . . . 2-49 2.19.2 Utility Evaluation . . . . . . . . . . . . . 2-50 2.19.3 Review of Utility Evaluation . . . . . . . . 2-50 2.19.4 Conclusion . . . . . . . . . . . . . . . . . 2-50

3.0 REFERENCES

3-1 t

1 l

i

y 1

4

LIST 0F TABLES Table fi21 1 Proposed Ranking Scheme Based on Change in Core-Melt frequency. ... . . . . . . . . . . . . . . . . . . . . . . viii 2 . Proposed' Supplemental Ranking Scheine Based on Change in Total _ Population Exposure . . . . . . . . . . . . . . . viii

'3' Classification of the Risk Significance of the Additional Haddam Neck ISAP Topics Analyzed Using PRA Techniques . . . . . . . . . ... . . . . . . ... . . .

. ix 2.1 Review of the Haddam Neck Mean Consequences (in man-rem) for Various Plant Damage States . . . . . . . .

2-4 2.2 Proposed Ranking Scheme Based on Change in Core Melt Frequency ......................... 2-6 2.3 Proposed Supplemental Ranking Scheme Based.on Change in Total Population Exposure . . . . . . . . . . . . . . . 2-6 2.4 Summary of the Analysis of Regulatory Guide 1.97 Requirements ..................... .2-21 vi

l i

EXECUTIVE SUMARY Science Applications International Corporation (SAIC), under contract to the U.S. Nuclear Regulatory Commission'(NRC), has conducted a review of a series of safety-related issues or " topics" for the Connecticut Yankee (Haddam Neck) Plant. The topics for this plant consist of (1) topics originated .

because of specific NRC requirements, (2) topics initiated by the licensee because of their safety importance, and (3) topics initiated by SAIC as a result of the review of the Haddam Neck Probabilistic Safety Study (PSS).

All the NRC and utility-initiated topics were analyzed by the Northeast Utilities Services Company (NUSCO), using either deterministic or probabil-istic techniques. An earlier report provided the result of the review of a series of topics analyzed using Probabilistic Risk Assessment (PRA) techniques (1). This report is concerned with review of additional topics analyzed for this plant using PRA techniques. <

Both the licensee's study and SAIC's review are part of the NRC's Integrated Safety Assessment Program (ISAP) for this plant. This program was initiated by the NRC to assess, prioritize, and resolve all outstanding regulatory or safety-related issues for each nuclear power plant. In addition to the regulatory and safety-related topics, each plant is also required to perform a plant-specific Probabilistic Safety Assessment (PSA) to identify any areas

of plant vulnerability and provide a probabilistic basis for resolving those topics amenable to probabilistic analysis. This program was initiated in 1985 on the basis of voluntary participation by licensees. The first plants volunteered by their licensee to participate in this program were Northeast Utilities' Millstone Nuclear Power Station Unit 1 and Haddam Neck Nuclear

, Power Plant.

The objective of this study is a detailed review and validation of the results of each Haddam Neck ISAP topic. In reviewing these topics, an attempt was made to avoid overly conservative assumptions, since overly conservative assumptions in the analysis of some topics could distort the true risk or safety importance of those topics and result in diversion of the utility's resources and implementation schedule toward topics that are not the most risk or safety significant, vil i

4

~y . _ . , _ , - . . _ _ . ~ . , , . - . -_ . . , . .

,-c.

-t Following the review of each topic, the topic is ranked with respect to its risk significance using a set of guidelines shown in Tables 1 and 2 and discussed in this report. Table 3 shows the results of the ranking of the Haddam Neck ISAP topics reviewed in this study.

Table 1 Proposed Ranking Scheme Based on Change in Core-Melt Frequency Change in Core-Melt Frequency as a Result of the Resolution ofanIssue(peryear) Rank aCM > 5x10-5 High 5x10-6 < ACM < 5x10-5 Medium 5x10-7 < aCM < 5x10-6 Low ACM < 5x10-7 Drop Table 2 Proposed Supplemental Ranking Scheme Based on Change in Total Population Exposure Change in Total Population Exposure as a Result of the Resolution of an Issue (man-rem) Rank AE > 5000 High 500 < aE < 5000 Hedfum 50 < AE < 500 Low AE < 50 Drop viii

I Table 3 Classification of the Risk Significance of the Additional Haddam Neck ISAP Topics Analyzed.Using PRA Techniques >

Topic Title Risk Significance 1.05 Seismic Structural Modifications High 1.08 Seismic Modifications to Reactor Coolant Low System (RCS).

1.14.2 Install New 480 V L/C and Rearrange in

• High Fire Area S-8 (New Switchgear Room) 1.14.4 Install Remote Instrumentation Panel

• High 1.16 Anticipated Transients Without Scram Drop 1.17 Replacement of Motor Operated Valves Drop 1.21 Regulatory Guide 1.97 Instrumentation Medium 1.22 Emergency Response Facilities Instrumentation Low 1.28 Reactor Coolant Pump Trip _ Medium 1.54 Safety Implications of Control Systems Drop i 1.59 Additional Low Temperature Overpressure Protection Drop 1.60 RCS/RHR Suction Line Valve Interlock on PWRs Drop 1.61 Pressurized Thermal Shock Low 1,62 Feed and Bleed Modifications Drop 1.63 Hydrogen Control Low 2.05 Process Computer Replacement Medtum 2.10 Administration Building Upgrade Drop 2.13 Fire Detection System Upgrade Low

• Review of Topics 1.14.2 and 1.14.4 was combined.

ix

~

j

1.0 INTRODUCTION

4

,ScienceApplicationsInternationalCorporation(SAIC),undercontracttothe Nuclear Regulatory Commission (NRC), has reviewed a series of safety-related issues or " topics" for the Haddam Neck Plant. The list of topics for Haddam Neck includes (1) topics originated because of specific NRC requirements for ..

this plant, (2) topics initiated by the licensee because of their safety -

importance, and (3) topics initiated by SAIC as a result of the review of

(

the HaddamNeckPSS(2,3). All the NRC and utility-initiated topics were analyzedbytheNortheastUtilitiesServicesCompany(NUSCO), using either deterministic or probabilistic techniques. An earlier report provided the r

results of the review of a series of topics analyzed using Probablistic Risk l Assessment (PRA) techniques (1). This report is concerned with review of some

additional topics for this plant analyzed using PRA techniques. Both the licensee's study and SAIC's review are part of the NRC's Integrated Safety Assessment Program (ISAP) for this plant.

i 1.1 Background ISAP was initiated by the NRC to examine the outstanding regulatory and safety-related requirements or issues pertinent to each nuclear power plant.

The primary objectives of this program are (1) to assess the importance of each requirement or issue with respect to its impact on the risk associated with the operation of the plant, (2) to prioritize the issues, and(3)to develop an appropriate schedule for implementation of changes necessary for I

resolution of these issues. The !$AP pilot program was initiated in 1985 on the basis of voluntary participation by licensees. The first plants volun-teered by their licensee to participate in the pilot program were Northeast Utilities' Millstone Nuclear Power Station Unit 1 and the Haddam Neck Nuc-lear Power Plant.

The issues, or "ISAP topics," that are considered for each plant include:

1. Issues identified in Phase II of the Systematic Evaluation Program (SEP), pending licensing requirements including TMI Action Plan items for the particular facility, pending l

1-1

Unresolved and Generic Safety Issues, and licensee-initiated improvement projects.

j

2. Significant events that have occurred during the operation of the plant.

3. Dominant contributors to plant risk based on a plant-specific ProbabilisticSafetyAnalysis(PSA).

The first plant evaluated under this program was Northeast Utilities.' Mil-Istone Unit 1. The second plant being evaluated under this program is Northeast Utilities' ConnecticutYankee(HaddamNeck) Plant, a 590 MWe pressurized water reactor. The utility recently performed a " level 1" Probabilistic 56fety Study (PSS) that examines internally initiated events attheplant(2). This PSS was reviewed by SAIC and, as a result, three new safety-related topics for this plant were generated that are also discussed in this report.

1.2 Objective, Scope and Review Procedure The objectiv*: of this study is a detailed review and validation of the results of the analysis of each ISAP topic for Haddam Neck. In this regard, the plant model contained in the Haddam Neck PSS and its review is used when appropriate to check the scenarios and sequence of events postulated in the analysis of each topic.

An important consideration in reviewing these topics is to avoid overly conservative assumptions. This is especially important in the analysis of individual ISAP topics since overly conservative assumptions in the analysis of some topics could distort the true risk or safety importance of those topics. This distortion could result in diversion of the utility's resources and implementation schedule toward those topics that are not the most risk or safety significant.

After each topic is reviewed, it is ranked with respect to its risk signifi-cance using a set of guidelines developed during the Millstone Unit-1 ISAP review (4). This ranking scheme is briefly summarized in this report.

1-2

1.3 Organization of the Report Section 2.0 contains the results of the review of additional Haddam Neck ISAP topics analyzed by the licensee using PRA techniques. Also included in this section is a brief review of the utility's method of Public Risk Quantification and a discussion of the ranking scheme used in this review for ranking the risk significance of each ISAP topic. After receiving com-ments from the NRC and the licensee on this report and the earlier report on Haddam Neck ISAP topics, both these reports will be combined into one final report. All references cited in this report are listed in Section 3.0.

1-3

2.0 REVIEW 0F THE HADDAM NECK ISAP TOPICS In this section the Haddam Neck ISAP topics analyzed by the licensee using PRA techniques will be reviewed. As mentioned previously, only a portion of all the ISAP topics for Haddam Neck were analyzed by the licensee using PRA techniques; this report is only concerned with the review of this portion of the topics.

The licensee used three methods to evaluate the impact of resolution of each topic on public risk. In Method A, the change in core-melt frequency and public risk (measuredinman-rem)asaresultoftheresolutionofa topic was evaluated. For those topics where direct quantification of change in core-melt frequency or man-rem exposure was not possible, engineering judgment was used for ranking of the topic. This method is referred to as Method B. Finally, for those topics where the impact on public risk is non-radiological, Method C, consisting of calculation of public risk in terms of early and latent fatalities and conversion of these numbers to equivalent total person-rem exposure was used.

Following the calculation of the change in public risk (measured in man-rem) as a result of modification of each topic, the importance of each topic was scored by the utility on a scale of -10 to +10. The scale used is linear, with each unit corresponding to an expected exposure of 50 man-rem. A zero score implies no change in pub!ic risk. A negative score implies an in-crease in public risk and a positive score implies a decrease in public risk. Thus, a decrease in public risk of 500 man-rem or more as a result of a modification due to an ISAP topic is given the maximum scale of +10.

Alternatively, an increase in public risk of 500 man-rem or more that might occur as a result of a change due to an ISAP topic is given the maximum negative scale of -10.

In evaluating the public risk impacts of those ISAP topics that were ana-lyzed using Method A, the licensee used a man-rem exposure relationship based on the Haddam Neck PSS and the Sandia Siting Study (5), with some modifications. Since this relationship is important in prioritization of the topics, some comments on the validity of the assumptions used in this relationship will be provided in Section 2.1.

2-1

In order to rank the importance of the topics reviewed in this report, a two step ranking scheme was developed during the review of the Millstone Unit 1 ISAP topics (4). A brief summary of this ranking method is presented in Section 2.2. This summary is followed by the results of the review of individual topics.

2.1 Comments on the Utility's Method of Public Risk Quantification As mentioned earlier, public safety impacts of individual ISAP topics were evaluated using either direct quantification, engineering judgment, or quan-tification of equivalent radiological impact. In this section, some com-ments on the assumptions used in the direct quantification method are pro-vided.

In the direct quantification method, change in the core melt frequency and/or offsitepublicconsequences(measuredinman-rem)dueto resolution of each topic is calculated. The change in total public risk (measured in man-rem) is calculated from the following equation:

AR=Tb(PgxCj) i where

AR is the total change in public risk (man-rem)

T istheremaininglifeoftheplant(assumed 20 years)

Pj is the frequency of the ith plant damage state C4 is the offsite public consequence associated with the ith plant damage state Since the Haddam Neck PSS is a level 1 PRA, no plant-specific modeling of the containment response to core melt sequences or offsite public conse-quence was performed for this plant. Instead, based on the Sandia Siting Study (5), industry's 10COR project, and the Millstone Unit 3 PSS, some 4

approximate values for potential cons iences of different plant damage states and containment failure sequences are calculated by the licensee.

The starting point of the licensee's analysis was the three most severe siting source terms (SSTs) for the Haddam Neck site, developed in the Sandia Siting Study for a generic 1120 MWe pressurized water reactor. The  :

2-2 l

consequences (in man-rem) associated with these source terms were estimated by the licensee by converting the corresponding latent cancer fatalities to man-rem exposure. It is not clear why the man-rem exposures associated with these source terms were not directly taken from the Sandia Siting Study.

But in converting the latent cancer fatalities to man-rem exposure, the mean consequence associated with each source term was somewhat underestimated, as shown below. We recommend that the original Sandia Siting Study man-rem values be used.

Assumed Exposure (man-rem)

Source Terra Haddam Neck PSS Sandia Siting Study SST g 2.1E7 3.5E7 SST2 1.0E7 2.9E6 SST3 5.0E3 8.8E3 Next, these offsite consequences were adjusted for three factors, reactor size, population within 50 miles, and source term reduction, based on information generated after the Sandia Siting Study. These calculations were performed for five distinct consequence categories depending on how the containment was breached or bypassed.

Table 2.1 shows the results of the utility's analysis. Also shown are the suggested mean consequences based on our review. In general, we do not have any major problems with the licensee's calculation of mean consequences.

Our suggested mean consequence values are higher for categories 1, 3, 4, and 5 because the licensee incorrectly converted the latent cancer fatalities to equivalent man-rem exposure. For category 2, the mean consequences are based on the calculations in reference 6 for the same event for Byron Station Unit 1, with adjustments to convert the results to Haddem Neck Plant. The calculations for this category seem to be reasonable.

2-3

Table 2.1. Review of the Haddam Neck Mean Consequences (in man-res) for Various Plant Damage States Plant Mean Consequence Damage Description Of Consequence Category States Phenomena (Man-Rem) Suggested PSS 1 V, VI Containment is bypassed 3.8 x 106 6.3 x 106 l due to interfacing sys-temsLOCA(i.e.,LOCA outsidecontainment) 2 V2 Containment is bypassed 1.6 x 106 1.6 x 106 due to steam generator tube rupture induced core melt, with failure of loop isolation valves and like-ly stuck open SRV on the steam generator 3 AE, AL, Containment potentially 2.2 x 106 3.8 x 106 SE, TE fails early due to early core melt and/or rapid containment pressurization 4 SL, TL Containment potentially 8.4 x 104 1.4 x 105 fails late due to late core melt and low pres-surization rate 5 AEC, ALC, Containment heat removal 2.8 x 103 4.9 x 103 SEC, SLC, systems are available to TEC, TLC remove fission products and to prevent contain-ment overpressure and gross failure; some leak-miaht be exoected, i

2-4 l

l

2.2 Proposed Method for Ranking the ISAP Topics 5,everal considerations must be kept in mind when choosing a method for ranking the ISAP topics. The first is that the method should be simple and straightforward and should not require a substantial amount of effort. The variables used to rank each topic should be a good measure of the probabil-ity of occurrence of an accident and release of radioactive material outside the containment, i.e., a good measure of risk associated with the operation of the plant. Even though public health and safety are the primary objec-tives of the NRC regulations, the ranking method should indirectly address the substantial onsite and offsite financial costs associated with a major accident.

With all these factors in mind, a two-step ranking scheme consisting of consideration of change in core-melt frequency and total populatien exposure is proposed. The first step consists of evaluating the change in core-melt frequency as a result of the resolution of the topic. Change in core-melt frequency is proposed as the primary measure of importance of the issues for several reasons. First, it provides a direct measure of the importance of any proposed hardware er procedural change as implemented to resolve an issue. The only exception would be a change that affects containment or accident mitigation performance. Also, change in core-melt frequency is relatively straightforward and the level of confidence in the final numeri-cal results is higher than in numerical results for risk measures that must include containment and consequence analyses. Finally, there is an inherent measure of financial risk associated with core-melt frequency. If the primary measure of importance were the population exposure and not core melt frequency, in cases where there is core damage but minor or no release of radioactivity, the importance of the issue would be ranked low unjusti-fiably.

Table 2.2 shows the proposed ranking based on change in core-melt frequency.

As can be seen in this table, the numerical criteria used for ranking of the issues are fixed, and not based on a percentage of core-melt frequency for the plant under study. This is a more rational method because it will not penalize plants with low core-melt frequency and help plants with high core-melt frequency.

2-5

Table 2.2 Proposed Ranking Scheme Based on Change in Core-Melt Frequency Change in Core-Melt Frequency as a Result of the Resolution ofanIssue(peryear) Rank t.,CM > 5x10-5 High 5x10-6 < aCM < 5x10-5 Medium 5x10-7 < ACM < 5x10-6 Low ACM < 5x10-7 Drop Table 2.3 Proposed Supplemental Ranking Scheme Based on Change in Total Population Exposure Change in Total Population Exposure as a Result of the Resolution of an Issue (man-rem) Rank aE > 5000 High 500 < AE < 5000 Medium 50 < A E < 500 Low l l

AE < 50 I Drop  !

2-6

The cutoff core-melt frequency of 5x10-5 per year for ranking an issue high was chosen based on consideration of the Commission's proposed safety goal core-melt frequency of 10-4 per year and on our previous experience with the SEP Phase II, which showed that issues resulting in changes in core-melt frequency of about 5x10-5 per year and higher are important contributors to the dominant core-melt sequences (7). The other cutoff points are one and two orders of magnitude lower than the high cutoff rate.

The second step in this ranking process is to estimate the total population exposure as a result of resolution of the issue. The purpose of this second step is to upgrade the ranking that was based on change in core-melt frequency so that low frequency events that could lead to large consequences are ranked higher than they would have been if ranking were based on the change in core-melt frequency alone. In addition, this second step allows ranking of those issues that only affect containment performance and would not be ranked in step 1 above. Table 2.3 shows the proposed supplemental ranking scheme using change in total population exposure.

For example, based on the results of the Sandia Siting Study, the total population exposure as a result of an SST2 relecse is on the order of 2x106 man-rem (8). The SST2 corresponds to accidents involving loss of core cooling with containment emergency safety functions available. For this type of release category the 5000 man-rem criteria approximately corresponds to the 5x10-5/ year core-melt frequency which is the lower end of high ranking based on change in core-melt frequency. The total population exposure for an 55T1 release is on the order of 2x107 man-rem (8). The SST1 corresponds to the most severe radioactive release following a core-melt accident. It involves failure of core cooling and containment emergency safety functions with severe breach of containment. For this type of release category the 5000 man-rem criteria corresponds to 5x10-6/ year core melt frequency, which is the lower end of medium ranking based on change in core-melt frequency.

Thus, for the case where the change in core-melt frequency is on the order of 5x10-6 and involves a severe containment failure and radioactive release, the issue would be ranked medium using the change in core-melt frequency criteria. But the total exposure criteria of Table 2.3 will upgrade this 2-7

ranking to high, ensuring that low probability events with large conse- t l quences are ranked appropriately.

Finally, it should be emphasized that for most plants a simple containment and consequence analysis using existing information and surrogate source terms would be sufficient for developing the total population exposures for this ranking scheme. Thus, there should not be a need for a large effort in performing a sophisticated containment and consequence analysis.

2.3 Topic 1.05: Seismic Structural Modifications 2.3.1 Background  :

i

! The occurrence of a series of unexpected seismic events in the Eastern l; United States has caused a great deal of concern regarding the ability of nuclear plants to withstand earthquakes. The NRC is particularly concerned

] with older plants (such as Haddam Neck) which were built prior to the i implementation of the strict seismic design criteria used today. Sir.ce

] failure oflargestructures(e.g., buildings)canrenderlargeamoun'ts'of i equipment inoperable, this is an obvious area for consideration.

i j

In this project, the utility proposes to perform a seismic analysis 'f o a number of structures at the Haddam Neck plant and determine whether they can

, beexpectedtowithstandtheSafeShutdownEarthquake(SSE). If the deter-2 mination is that upgrading is required to meet this requirement, then the

appropriate structural modifications will be proposed and implemented. The i selected structures are

the auxiliary feedwater building, service build-

ing, tornado wall, shield wall, turbine building, and primary auxiliary building.

, 2.3.2 Utility Evaluation

, /,

4 Since a seismic PRA was not performed, the utility. used engineering judgment '

and information from the Millstone Unit 3 seismic PRA to evaluate this issue. The evaluation clearly states that the utility is aware that the Millstone 3 analysis is not directly applicable to the Haddam Neck plant.

, As far as can be determined, the evaluation was performed in the following a

{ manner. First, it was assumed that the contribution to core damage from t

i 2-8 i

l

.i j

4 4

seismically induced structural failure is presently the same percentage of 1

/ total core damage frequency at both Haddam Neck and Millstone 3. Since the Haddam Neck PSS had a higher core damage frequency than the Millstone 3 PSS, this yielded a proportionately higher core damage frequency from these events at Haddam Neck. Next, it was assumed that the proposed study and modifications would increase the strength of the Haddam Neck structures to that comparable with Millstone 3, so that the new Haddam Neck core damage frequency from these seismic failures would be the same frequency as that for Millstone 3 (as opposed to the same percentage of total frequency). The difference between these two frequencies was considered to be the. core damage reduction assigned to this project (IE-5/yr), which was assumed to occu'r in Consequence Category 3 (2.2E+6 man-rem). This results in a public consequence reduction of 440 man-rem and a score of 10 on the utility's rankihg scale.

2.3.3 Review of Utility Evaluation The utility has attempted to put a number on the benefit of this project by i the use of the results of a single seismic PRA. This is very difficult.

For the purpose of understanding the importance of this project, it is preferable to review the results of a number of seismic PRAs and to con-sider the importance of this project in a more qualitative manner. We re-viewed the results of seven seismic PRAs covering six PWRs for this topic.

These seismic PRAs included Indian Point 2, Indian Point 3, Oconee, Mill-stone 3, Seabrook, Zion PSS, and Zion SSMRP. The results of these PRAs are

]

summarized in NUREG/CR-4334 (9). Structural failures were dominant con-l tributors to seismic core damage for Indian Point 2, Oconee, Millstone 3, l

Zion PSS, and Zion SSMRP. Core damage frequencies due to these structural failures were generally on the order of IE-6 through 1E-4 (before structural 1

modification). Because of the age of the Haddam Neck plant (or rather, the time duringwhichitwasbuilt)thecontributionfrom structural failures due to seismic events to this plant's risk is expected to be quite signifi-cant.

2.3.4 Conclusion

] The discussion above indicates that seismically induced structural failure at Haddam Neck should be of concern. Theprojectasproposedbytheutility l l

l 2-9 4

5 I

4

6 t

l 1

may not be sufficient to address the issue. In our opinion, the proposed seismic analysis should include the development of seismic fragility curves for the structures identified, and the containment building should be added to the list. These curves should be integrated with the site hazard curve to produce a " mini seismic PRA" for the contribution of structural failure to core damage frequency. Structural modifications should be- implemented a based on these results. Although a risk reduction cannot be quantified for -

this issue, the potential contribution (as illustrated by the results of other seismic PPAs) causes us to rank this issue as high on the ISAP ranking scale. ,

2.4 Topic 1.08: Seismic Modifications to Reactor Coolant System 2.4.1 Esckground As indicated in the review of Topic 1.05, NRC is quite concerned about the ability of the older plants (such as Haddam Neck) to withstand earthquakes.

4 In ttis project, the utility proposes to implement a series of modifications to the RCS to improve its seismic capacity. The modifications are based on the results of a seismic re-evaluation program performed at the plant. The selected modifications are: replace 8 of 16 steam generator upper hold-down bolts (2 per S/G), install a leaa/oeflection limiting device on 1 of 3 spring cans on each reactor coolant pump, replace a spring hanger on the s surge line support, and re-install wall anchor plates and provide cover plates to the pressurizer earthquake truss.

2.4.2 Utility Evaluation Similar to the analysis of Topic 1.05, the utility used engineering judgment and information from the Millstone Unit 3 seismic PRA to evaluate this issue. Again, the evaluation clearly states that the utility is aware that the Millstone 3 analysis is not directly applicable to the Haddam Neck plant. As far as can be determined, the evaluation was performed in the following manner. First, it was assumed that the contribution to core damage from seismic induced large LOCA/ vessel rupture is presently the same percentage of total core damage frequency at both Haddam Neck and Millstone

3. Since the Haddam Neck PSS had a higher core damage frequency than the Millstone 3 PSS, this yielded a proportionately higher core damage frequency 2-10

from these events at Haddam Neck. Next, it was assumed that the proposed study and modifications would increase the strength of the Haddam Neck RCS to that comparable with Millstone 3, so that the new Haddam Neck core damage frequency from. these seismic failures would be the same frequency as that for Millstone 3 (as opposed to the same percentage of total frequency). The difference between these two frequencies was considered to be the core damage reduction assigned to this project (6E-6/yr), which was assumed to occur in consequence Category 3 (2.2E+6 man-rem). This results in a public consequence reduction of 264 man-rem and a score of 5.9 on the utility's ranking scale.

2.4.3 Review of Utility Evaluation The attempt by the utility to put a number on the benefits of this project by the use of the results of a single seismic PRA are very questionable. It is preferable to look at the results of a number of seismic PRAs and to consider the importance of this project in a more qualitative manner. Seven seismic PRAs covering six PWRs were reviewed for these topics. These seis-mic PRAs included Indian Point 2, Indian Point 3, Oconee, Millstone 3, Seabrook, Zion DSS, and Zion SSMRP. The results of these PRAs are summa-rized in NUREG/CR-4334 (9). Large LOCA/ vessel rupture was a dominant con-tributor to seismic core damage for only three of the seven PRAs (0conee, Millstone 3, and Zion SSMRP). In all three cases, these failures were at the lower end of the dominant contributor list, with core damage frequencies due to these RCS failures on the order of IE-7/yr to 4E-6/yr. Because of the age of the Haddam Neck plant (or rather, the time during which it was built) it would be expected that there would be a contribution from RCS failure due to seismic events.

2.4.4 Conclusion Seismic induced large LOCA/ vessel rupture was a dominant contributor in only three of the seven seismic PRAs reviewed. In only one of those three cases was the contribution close to the frequency which would be categorized as medium in our ranking scheme (4E-6/yr for Oconee). While the age of the Haddam Neck plant would suggest that the contribution for these events would lean toward the upper end of the observed range, it is not likely (in our judgment) that it would exceed that range significantly. Therefore, 2-11

i although a risk reduction cannot be quantified for this issue, the poi:eatial contribution (as illustrated by the results of other seismic PRAs) causes us to rank this issue as low on the ISAP ranking scale.

2.5 Topic 1.14.2: Install New 480V L/C and Rearrange in Fire /.rea S-8 (New Switchgear Room)

Topic 1.14.4: Install Remote Instrumentation Panel 2.5.1 Background The switchgear room of the Haddam Neck plant containc the 4160V buses, the 480V buses, both batteries, both DC buses, the vital AC inverters, and MCC- l

5. A fire in the switchgear room could cause the loss of some or all of this critical equipment and prevent the safe shutdown of the plant. The Haddam Neck probabilistic fire study found that switchgear room fires ac-count for 71 percent of the core melt frequency due to fire. {

{

the utility intends to construct a new switchgear room that is redundant to  ;

the existing room. The new room will contain a load center, a safety-related 480V MCC, batter ies, static inverters, and a remote instrument panel. Construction is planned for 1989.

1 Additionally, the utility proposes irstalling a series of interim instrumen- i l

tation including pressurizer pressure / level, steam generator level / pressure j and RCS loop temperature indicators. This instrumentation is portable and I was slated to be used until the new switchgear room is installed. I 2.5.2 Utility Evaluation i

The utility analysis examined the interim installation of portable instru-mentation and concluded that the benefits would be negligible because:

a.

The affected core melt sequences are dominated by human error probabilities for maintaining steam generator cooling.

2-12 1

b. It would be difficult to hook up all of the interim instrumenta-tion (i.e., generator, indicators) in the containment vault while fighting a fire and trying to control the plant transient.

The new switchgear room will contain all of the instrumentation suggested for the interim instrument panel on its remote shutdown instrument panel.

Thus, the utility has rejected the proposed project to install remote instruments and the benefits of permanent installation of instruments were evaluated along with ISAP topic 1.14.2, the new switchgear room.

The utility estimates that installing redundant switchgear in a separate room so that a single fire will not prevent reactor safety shutdown, will reduce core melt frequency by 3.9E-4/yr, a 58 percent decrease. The new room will also decrease the risk of a cable spreading area fire since the rewly routed cables will not pass through the existing cable spreading area.

2.5.3 Review of Utility Evaluation The utility's qualitative decision not to install the portable instrumenta-tion is based on sound judgment, but cannot be analytically evaluated with-out the fire sequences. In any case, the risk change should be siight, since the maximum period that the installation could have an effect on risk is about 2 years (until 1989, when the switchgear room is to be construc-ted).

The fire analysis performed by the utility is not available for review, so we can only speculate about the accuracy of the results. The utility indi-cates that the Haddam Neck core melt frequency due to fire is 6.8E-4/yr.

Rensselaer Polytechnic Institute examined for the U.S. Nuclear Regulatory Commission various aspects of fire risk for light-water reactors. The results reported in the PRA Procedures Guide concluded.that the frequency of core damage due to fires was 2E-4/yr, with an upper bound of IE-3/yr (10).

The result of the Haddam Neck fire analysis is well within this range.

The fire analysis calculated a 58 percent decrease in core melt frequency upon installation of a second switchgear room. The large reduction is 2-13

expected, since the probability of core damage following a major fire in the switchgear room without recovery is near unity. Thus, . reduction in core melt frequency of 3.9E-4/yr seems reasonable.

Based. on the importance of fire to the probability of core melt even after construction of a new switchgear room, we recommend that the_ utility' submit a detailed fire analysis for review. The remaining core melt frequency of

~

2.9E-4/yr suggests there are other important fire-related issues that might need closer attention.

The public consequences are. recalculated based on the revised Haddam Neck mean consequences model, as follows:

Man-Rem Plant Reduction By Damage Consequence Decrease in Core State Cateaory Melt Freauency SLC 4.9E+3 2.11E-4 SL 1.4E+5 2.76E-6 TEC 4.9E+3 1.15E-4 TE 3.8E+6 6.45E-5 3.93E-4 R = (20 years) x [(2.11E-4 yr-1)(4.9E+3) +

(2.76E-6yr-1)(1.4E+5)+

(1.15E-4yr-1)(4.9E+3)+

(6.45E-5yr-1)(3.8E+6)]

= 4940 Man-Rem.

2-14

2.5.4 Conclusion T.he above changes in core melt frequency and public risk can lead to a ranking of high in both categories. It should be noted that the major contributor to public risk is from TE sequences that lead to early core melt. This is further evidence that the portable instrumentation package, which must be connected after the accident is initiated, does not reduce risk significantly.

2.6 Topic 1.16: Anticipated Transients Without Scram-2.6.1 Background Anticipated transients without scram (ATWS) contribute significantly to the risk involved in the operation of nuclear power plants. Certain transients followed by failure of the control rods to insert could result in rapid pressurization, challenging the primary safety relief valver. If the relief capacity is not sufficient, the reactorcoolantsystem(RCS)could over-pressurize, threatening primary integrity. Also, failure of the relief valve (s) to reseat could result in a consequential loss of coolant accident (LOCA). Certain features in the design of nuclear plants can help to miti-gate the consequences of an ATWS. Among these are automatic initiation of AuxiliaryFeedwater(AFW), automatic turbine trip, (unblocked) opening of the PORVs, and more negative moderator temperature coefficient of reactivity.

At the Haddam Neck Plant, the AFW start is initiated by low level in two out of four steam generators or by tripping of both main feedwater (MFW) pumps.

Low steam generator level is one of the conditions that indicates an ATWS.

This initiation circuitry is diverse and independent of a Reactor Protection System (RPS), and therefore meets the ATWS rule requirement. However, the existing turbine trip does not meet the requirement of the ATWS rule since there is no turbine trip signal that is indicative of ATWS and independent from the RPS. It has been suggested that the automatic AFW initiation circuitry be modified to include a trip circuit that would trip the turbine on steam generator low level with a two out of four taken twice logic. This modification would entail the installation of two additional trip relays in the AFW initiation circuitry, as well as the addition of another steam 2-15

generator level channel per steam generator. The modification would bring Haddam Neck into conformance with regulations (11).

~2.6.2 Utility Evaluation Two types of ATWS events were explicitly considered. One combines several ,

transients that are followed by failure of the automatic scram into one ATWS.

event tree. Another considers the loss of offsite power followed by failure of the automatic scram. The two most important ATWS sequences identified in the Haddam Neck PS are:

o Sequence 1 - path number 32 of event tree 22:

A transient followed by failure to scram (automatic and manual), failure of MFW, failure of turbine to trip, and failure of the pressurizer safety valves to reseat.

Auxiliary Feedwater is available, o Sequence 2 - path number 32 of event tree 25:

This is identical to Sequence 1, with the exception that it is initiated by loss of offsite power.

The potential decrease in the core melt frequency as a result of the proposed ecdifications was estimated by assuming that the probability of a safety valve opening decreases by a factor of 10.

melt The decrease in the core frequency for Sequence I was calculated as 1.7E-7/yr. The decrease for Sequence 2 was calculated as 7.2E-8/yr, for a total reduction of 2.4E-7/yr.

The utility neglected the increase in public risk caused by the increased number of turbine trips due to the new instrumentation. ~These risk increases were determined to be several orders of magnitude lower than the decreases from Sequence 1 and 2.

2-16

2.6.3 Review of Utility Evaluation The utility correctly chose the only important accident sequences in which turbine trip is important. However, the logic used in quantifying the effect is incorrect. The utility assigned a factor to the pressure relief (PR) event tree node on the branch that follows failure of the turbine trip.

The basis for the factor is the correct assumption that the relief valves are less likely to lift if the turbine successfully trips. However, since the proposed modification affects the turbine trip circuitry, the factor should have been applied at the turbine trip (TT) node. For many sequences, the point at which a node probability is multiplied by a given factor does not matter, but for the logic in this particular case, it does make a difference. The ATWS sequence assumes that pressure relief will be required whether the turbine trips or not. The probabilities at the PR node may be different as a result of the turbine trip, but the changes in each sequence frequency must be taken into account. Although the PSS does not give the probabilities used at the PR nodes of the affected sequences, they should not be significantly different. The major risks are a result of stuck open relief valves (PORVs and SRVs) or relief valves failing to open, leading to small LOCAs.

Since the PSS does not give the probabilities for the PR node with and without turbine trip a thorough analysis of the sequences is difficult, but a bounding-type analysis can be performed on the TT failure sequences.

The sequences identified in the utility evaluation can be quantified using data from reference 2. For Sequence 1:

F1 = E22 RT1 RTM

• MF3 TT XN

• PR Where:

F1 is the core melt frequency due to ATWS sequences initiated by a transient including turbine trip E22 is the total transient event frequency = 3.68/yr RTI is the probability of failure of automatic scram = 3.8E-5 RTM is the probability of failure of manual scram = 0.506 MF3 is the unavailability of MFW = 0.11 2-17

TT is the probability of failure of turbine trip = 0.15 given failure of scram

. A M is the success of AFW = 0.14 PR is the probability of stuck open safeties = 0.2 given two lift F1 = (3.68/yr) (3.8E-5) (.506) (.11) (.15) (1 .14) (.2)

= 2.0E-7/yr For Sequence 2, the frequency is given by:

F2 = ET12 RTS MFW TT AFW PR where:

F2 is the core melt frequency due to ATWS sequences initiated by a loss of offsite power including turbine trip E12 is the loss of offsite power frequency = 0.17/yr RT3 is the probability of failure of control rods = 1.9E-5 to drop MFW is the unavailability of MFW = 1.0 TT is the probability of failure of turbine trip = 0.15 N is the success of AFW = 0.14 PR is the probability of stuck open safeties = 0.2 given two lift F2 = (0.17/yr) (1.9E-5) (1.0) (0.15) (1 .14) (.2)

= 8.3E-8/yr The total decrease in core melt frequency of the important ATWS sequences with turbine trip is 2.8E-7/yr. However, this figure is far higher than the upper bound for risk reduction that can be achieved by the proposed turbine trip modifications. Even if turbine trip failures could be eliminated, this reduction would not be achieved because there is a significant chance of core melt with a successful turbine trip. Qualitatively, the risk of ATWS sequences is driven by the availability of feedwater, emergency boratation, and relief valves, and is not-significantly affected by turbine trip.

2-18

Detailed thermal hydraulic analysis and relief. valve reliability analysis of various overpressure transients is needed to more accurately quantify these sequences.

.The public risk reduction associated with these sequences is:

tR = (20 yr) x (2.8E-7/yr) x (4.9E+3) = 2.7E-2 Man-rem 2.6.4 Conclusions Although a detailed analysis was not performed, the maximum benefit from any turbine trip modification appears to be small. The risk significance of this topic is ranked drop.

2.7 Topic 1.17: Replacement of Motor Operated Values 2.7.1 Background This project was performed to satisfy the requirements to brtng certain motor operated valves (MOVs) into ompliance with Equipment Environmental Qualification (EEQ) requirements.

2.7.2 Utility Evaluation The utility indicated that all MOVs within containment that had to be envi-ronmentally qualified with EEQ were replaced with upgraded valves during the 1986 refueling outage. The utility indicates that no other MOVs need to be upgraded.

2.7.3 Review of Utility Evaluation Since all modifications have been completed in accordance with EEQ require-ments, and these modifications do not have any detrimental effect on plant safety, there is no need for an analysis of this issue.

2-19

2.7.4 Conclusion The modifications have been iuplemented and have no detrimental effect on p'lant safety. Thus, this topic is not analyzed any further. However, it is recommended that the reliability characteristics of these safety-related MOVs be monitored over the next several years and the failure rates compared to the generic failure rates used in the PSS and the results of the study of MOVs in containment performed in conjunction with the PSS. Credit should be taken for any changes in MOV performance when and if the PSS is requanti-fied. Since this modification was performed in order to meet published standards, which are an upgrade from the initial installation, this topic is ranked as drop.

2.8 Topic 1.21: Regulatory Guide 1.97 Instrumentation 2.8.1 Background As part of the post-TMI accident initiatives, Regulatory Guide (R.G.) 1.97 was developed to help the utilities determine the instrumentation that is deemed necessary for use by the operators during and after an accident. The evaluation criteria for each type of instrumentation required by R.G. 1.97 address one or more of the following: installation, equipment range, envi-ronmental qualification, seismic qualification, and redundancy. A list of instrumentation required and evaluated in this utility analysis is presented in Table 2.4.

The proposed project is to install or modify instrumentation as required by R.G. 1.97.

2.8.2 Utility Evaluation The utility performed an analysis of the instrumentation required by R.G.

1.97 to determine the impact of each type of instrumentation on the safety. plant Table 2.4 presents a summary of the results of the utility evaluation.

2-20

Table 2.4. Summary of the Analysis of Regulatory Guide 1.97 Instrumentation Requirements CY Analysis SAIC Review Results Regulatory Guide 1.97 Risk Reduction CHF Safety Risk Reduction CHF Instrumentation (man-rem) (yr-l) Score man-rem (yr-I) Ranking

1. HPSI System flow 0.007 1.3E-7 0 Negligible Negligible Drop indication

2. Safety Relief Value (SRV) 0.34 Negligible 0 0.34 Negligible Low Status

3. SRV Radiation Monitor 0.34 Negligible 0 0.34 Negligible Low 7

m

4. Steam Generator (SG) Implemented -- -- -- -- --

Level Indication

5. RCS Tcold Indication Implemented -- -- -- -- --

6. Subcooled Margin Implemented (See ISAP issue No. 1.13) -- -- --

Monitor

7. Core Exit Temperature Implemented (See ISAP lssue No. 1.13) -- -- --

Indication

8. Containment Hydrogen See ISAP Issue No. 1.23 -- -- --

Monitor

9. Reactor Vessel level Implemented. (See ISAP issue.No. 1.13) -- -- --

Monitoring System

10. SG Pressure Indication 0.64 1.2E-5 1.2 0.56 S.7E-6 Medium

Table 2.4. Summary of th! Analysis of Regulatory Guide 1.97 Instrumentation Requirements (Continued)

CY Analysis SAIC Review Results Regulatory Guide 1.97 Risk Reduction Safety CHF Risk Reduction CMF Instrumentation (man-rem) (yr-l) Score man-rem (yr-l) Ranking

11. RCS Hakeup Flow Negligible Negligible Indication O Negligible Negligible Low

12. Containment Pressure Negligible Negligible 0 Negligible Negligible Indication Low

13. Neutron Flux Indication Negligible Negligible 0 Negligible Negligible Low

';3 14. Containment Isolation Negligible y Negligible 0 Negligible Negligible Low Valve Position Indication

15. Low Pressure Safety Negligible Negligible Negligible Injection Flow 0 Negligible Low Indication

16. Containment Atmosphere Negligible Negligible Negligible Temperature Indication 0 Negligible Low

17. Emergency Ventilation Negligible Negligible Negligible Damper Position Indication 0 Negligible Low

18. Containment Fan-Cooler Negligible Negligible- 0- Negligible Negligible Low fleat Removal Monitor System

The required R.G.1.97 instrumentation could be categorized as:

(a) Instrumentation that' is installed:

~

indication for Steam Generator (SG) Level, RCS Tcold, Subcooled Margin Monitor, Core Exit Temperature, and Reactor Vessel Level Monitoring System.

(b) Instrumentation that was evaluated in another ISAP Topic 1.23, containment hydrogen monitor.

(c) Instrumentation that was of negligible impact on plant safety:

indication for RCS Makeup, Containment Pressure, Neutron Flux, Containment Isolation Valve Position,- Low Pressure Safety Injection (LPSI) Flow, Containment Atmosphere Temperature, Emergency Ventilation Damper Position, and Containment' Fan-Cooler Heat Removal Monitoring System.

(d) Instrumentation- that would have an impact on plant safety:

Indication for High Pressure Safety Injection (HPSI) Flow,. Safety Relief Valve (SRV) Status, SRV Radiation Monitor, and SG Pressure.

The R.G. 1.97 requirements for the SG Pressure indicators are: .(1) they '

should be environmentally and seismically qualified, (2) the instrument range should be expanded, and (3) they should have redundancy. From its analysis, the utility indicated that the current range of the SG Pressure indicators (50-1050 psig)issufficientfor plant operation, since the ,

operator would have taken corrective action before the SG Pressure reaches the lower range, and the upper range surpasses the highest setpoint of the SRVs. However, the utility would examine the possibility of expanding the current range if the instrument was required to be environmentally quali-fied.

The utility states that the SG pressure instrument does not require redun-dantchannelsbecause(1)thefailureprobabilityoftheequipmentisinsig-nificant compared to the operator error that is associated with its usage; and (2) the most likely cause for the instrument failure would be due to exposure to adverse environment or a seismic event. In the latter case, all monitoring channels are assumed to be disabled. Thus there is little bene-fit in providing redundant channels for the instrument, 2-23

With regard to the environmental qualification of the SG Pressure indicators, the utility indicated that the benefit of such a modification would result in a core melt reduction of 1.2E-5/yr and also equate to a 0.64 Man-Rem reduction in public consequence. The utility indicated that the instrument not need be seismically qualified, since there exists other indication for identifying the faulted steam generator.

As indicated by the licensee, the requirement for installing flow indication for the HPSI system would not result in a significant impact on plant safety because (1) the HPSI system is designed to operate at maximum flow on demand, and (2) there is no flow " throttling" capability except for opening and closing MOVs that are not designed for such operation. The utility further indicates that there are two scenarios in which there is a potential need for regulating the HPSI flow. The first is the use of HPSI following bleed and feed operation when the charging system is unavailable. The second is the use of HPSI for RCS make-up following seal failure and, again, the charging system is unavailable. Under these cases, the HPSI system operation can be verified using pump current and discharge valve position.

For the RCS make-up scenario, system volume can be determined via pressurizer level indication and Reactor Vessel Level Monitoring System.

Thus the addition of a HPSI flow indicator would not result in any real benefit. However, to quantify the maximum potential benefit for this instrument requirement, the utility assumes that the operator error probability associated with the HPSI system operation could be reduced from 3E-3 to 1E-3. This results in an estimated reduction of 1.3E-7/yr in core melt frequency and 0.007 Man-Rem in public risk.

With regard to the requirement for SRV status indication, the licensee indicates that such instrumentation would not be of any benefit to the operator in identifying a stuck open SRV because, when the SRV opens, it makes a tremendous noise that should alert the operators and other plant personnel of its status. Thus, the required additional indication would have no impact on the operator performance nor on plant safety. However, the utility has performed an evaluation of the potential impact on public risk since a stuck open SRV incident would lead to a direct radiological release to the environment. The analysis indicates that the potential benefit for having a SRV status indication could be estimated as a public  ;

risk reduction of 0.34 man-rem.

l 2-24

In summary, for all instrumentation expected to have an impact on plant safety (all of the instrumentation listed in item (d) above), the utility es.timated a total core melt reduction of 1.2E-5/yr and about 1 man-rem in public risk reduction for this issue. This is dominated by the benefit derived from the SG Pressure indicator modification. As a result, this ISAP

, topic was assigned a score of 1.2 on a scale of -10 to 10.

2.8.3 Review of the Utility Evaluation Upon reviewing the utility analysis, it appears that the licensee evaluation is generally adequate. For all of the required instrumentation that has already been implemented by the licensee, we have no comments with regard to their probabilistic safety implications (instrumentation listed in Section 2.8.2 (a)). The recommended instrumentation that was evaluated under other ISAP issues will not be reviewed in this issue (Section 2.8.2.(b)). In-stead, it is referred to the review of the appropriate ISAP topic. We also agree that the instrumentation identified as having negligible impact on the plant or public safety (Section 2.8.2 (c)) is indeed of low safety signifi-cance.

For instrumentation that is listed in Section 2.8.2 (d), the following observations are applicable. As indicated by the utility, the HPSI system is designed to perform at maximum flow rate, with no throttling capability.

Thus, the need for reading HPSI flow is not critical for the plant opera-tion, as long as there is indication that the pump is working (i.e. pump current), and positive valve position indication. As for the SG SRV status indication, it appears that the licensee analysis is adequate.

With regard to the SG pressure indication, it appears that the analysis performed by the utility addresses all of the R.G. 1.97 requirements. In all aspects except one, their arguments are appropriate. However, in its analysis for the environmental qualification for the SG Pressure indication, the utility did not provide any information associated with the estimated benefit of 1.2E-5 yr-1 in core melt frequency reduction. From our review, of this issue it appears that the loss of the SG Pressure indication, which is one of the primary indications of a faulted SG, will affect the cognitive operator action of identifying and initiating isolation of the faulted SG (0A7). Conservatively, we consider that the loss of the SG Pressure 2-25 i

indication has an equivalent impact on the operator's ability to success-fully perform on a loss of one DC train. Therefore, a stress modifying factor of two (2) is applied to the current operator -error probability.

In'stallation of equipment meeting R.G. 1.97 equipment qualifications would eliminate this stress modification of the human error probability and will result in-a core melt reduction of 5.7E-6/yr, and a public consequence of 2

0.56 man-rem.

A review of the seismic qualification of the equipment indicates that the consequences of losing the SG Pressure indicators due to a seismic event are the same as those caused by adverse environment.- However, the frequency of a seismically induced steam line break is very low compared to the normal steam line break event. Therefore, the benefit of having this indicator seismically qualified is insignificant.

In summary, in converting the SG Pressure indication to an environmentally qualified instrument, and the range expanded, the utility would realize a benefit in plant safety of 5.7E-6/yr core melt reduction. Adding redundancy and seismic qualification to the instrument would appear to have little impact on the plant safety.

2.8.4 Conclusion A review of the issue report indicates that the utility analysis is general-ly adequate. SAIC concurs with most of the results presented in the utility report. However, with regard to the modification of the SG Pressure indica-tien, we estimate a potential benefit of 5.7E-6/yr core melt reduction.

1 Cummulatively, the benefit for implementing this issue would be about 5.7E-6/yr in core melt reduction, and about 1 man-rem in public consequence.

Since this benefit stems solely from the modification of the SG Pressure indication, we would rank this item as medium in our ranking process and others as low.

2-26

. .~ - . - - - - . .- .. . - . .

L 2.9 Topic 1.22: Emergency Response Facilities Instrumentation 2.9.1 Background 4

In the Ha'ddam Neck PSS, potential operator errors such as cognitive or manipulative errors were identified as significant contributors to the plant.

-risk.

The potential for occurance of these errors could conceivably be i-reduced by providing operational aids to the operators. As part of the post TMI . accident initiatives, various programs such as Detailed Control Room 2

DesignReview(DCRDR), Safety Parameters Display System (SPOS), Emergency OperatingProcedures(EOPs) upgrade, Regulatory Guide 1.97 Instrumentation, and Emergency Response Faciiities (ERF) development were required by.the NRC to enhance operator performance and to reduce the potential for operator errors.

I The proposed project is to install an Offsite Based Information System (0FIS) for the plant. This information system is based on an IBM computer system,- which accesses data from the plant process computer, and transfers j them totheEmergencyOperationsFacility(EOF), the Corporate' Emergency Operations Center (E0C), the Technical Support. Center (TSC), and back to the control room.

2.9.2 Utility Evaluation

The utility indicated that the installation of an 0FIS would help reduce the

, potential for operator errors during and after.an accident at the plant. As described in the submittal for this ISAP issue, it appeared that the poten-3 tial benefit of having this information system could be equated to a total core melt- reduction of 2E-5/yr. This result was based on the assumption that - the addition of an 0FIS to the plant would help reduce the cognitive ,

and manipulative operator error probabilities by about 10 percent. Using i the method described in Reference 12, the licensee estimated a total core melt' reduction of about 3.7 percent (or 2E-5/yr).

2.9.3 Review of the Utility Evaluation i Based on the- information provided by the utility on other related ISAP issues (Topics 1.20, and2.05), itappearsthattheproposedproject(i.e.

3 2-27

1

installation of an 0FIS) is independent of-the Safety . Parameter Display System (SPDS) described in Topic 1.20. As a result, .the review of this

~

issue is limited to the evaluation of the potential-benefit of installing an OFIS as a separate souce of plant information independent of the SPDS.

I A review of the utility analysis indicated that the information provided on  ;

j this issue is insufficient for a thorough evaluation of the potential impact l- of the~0FIS on plant and public safety. Additionally the utility maie l an i i assumption that the installation of the OFIS would reduce ~the operator error t probability by 10 percent without providing the basis for this assumption.'

Due to this lack of information, instead of providing detailed comments on 4 the utility evaluation of this topic, we will qualitatively review the potential benefit of this proposed project. .

1 1

likelihood, the operator will follow the procedures closely in -

In all mitigating the accident, and will accept changes in the procedures only when

there are authorized directives. The probabilities that an operator would not be able to follow the procedures were quantif_ied in the PSS with asso-ciated uncertainty bounds. Possible solutions for reducing the potential for operator errors include regular training programs (such as simulator training), better and clearer emergency operating procedures, and appro-i priate displays of information. These enhancements are currently being

} performed under various post-TMI acciaent initiatives. ,

l In summary, it is difficult to compare the benefit of installing an .0FIS y at the plant compared to the benefits from the post-TMI accident actions.

l It is particularly difficult to envision,- without a description of the

) functions of the proposed 0FIS, what the system can do.to. enhance operator

! performance beyond the improvements gained through instructions presented in the existing procedures and through training sessions.. Unless the system l can provide additional information beside that already available to the operators, the reviewer does not perceive any real impact on the risk of the plant from having such a system.

i  ;

2.9.4 Conclusion t

j As stated previously, the reviewer has some concerns about the assumptions l used by the licensee in the analysis of this issue.- It appears that the-l I.

I 2-28

-. . - .. - . .. .- - - - .. ._ . . .-)

. ~ . . - - . . .- - .. . - -. --

5 assumption

~ '

of a 10. percent reduction.in the' operator error probabilities'was made withoutLb' asis and is_ unrealistically high. .It is more likely that the proposed project would have little_ impact;on plant risk given-implementation i

of- other post'-TMI initiatives, and therefore, this issue is ranked low in our evaluation process.

= ,

2.10 Topic 1.28: Reactor _ Coolant Pump Trip 2.10.1 Background i'

Small break loss ofcoolantaccidents(LOCAs)fallinto one of several.

categories of events that, if not~successfully mitigated, will lead to. core.

melt.

Generic evaluations made by the PWR vendors have shown that either i- delayed trip or_ continuous operation of the reactor coolant pumps--(RCPs)

~

during a small break LOCA may result in insufficient core cooling-(13). The.

[ RCPs at the Haddam Neck Plant do not automatically trip on a LOCA; however,

~

the Haddam Neck Emergency Operating Procedures direct the operator-to trip-

! all of the -RCPs when the reactor coolant system pressure ' drops to 1700 psig. The addition of automatic circuitry to trip the pumps'could ~ reduce ,

! the frequency of those core melt sequences . initiated by small ' breaks by l increasing reliability of tripping the pumps and reducing the dependence on operator action. -The proposed project is the design and installation of-

[ circuitry that would automatically trip all four reactor coolant pumps on detection of a small break LOCA.

j- 2.10.2 Utility Evaluation L Reference 14 shows that if the RCPs are tripped in a small_.LOCA, . a slightly-1 higher peak clad temperature (although well below the limit of_2300 0F) is produced than if the RCPs are running. Some of the reasons for this. in-crease are the high capacity of the high-pressure safetyfinjection (HPSI) pumps, the forced convection cooling provided by the RCPs (which. reduces-the magnitude of the clad temperature rise), and.the elimination of--the_-loop seal effect characteristic of cold leg breaks with the RCPs tripped. The

} conclusion of the analysis, however, was that the HPSI pumps are capable of-providing sufficient injection flow to cool the core forLall' small break LOCAs with or without the RCPs running. This analysis did .not evaluate the charging pumps.

2-29 I

L _ . _ _ . __ _ . _ _

The Haddam Neck PSS credited the charging pumps with being an alternate means of injection (in lieu of use of the HPSI pumps) and the only method of I 1

establishing high pressure recirculation after a small break LOCA. The Best  !

Estimate LOCA Analysis for (2) shows that the charging pumps are adequate for all small break LOCAs, except for a small spectrum of break sizes in the loop 2 cold leg. Alternative measures that mitigate the consequences of breaks in the range of concern were implemented during the 1986 refueling i outage and were subsequently approved by the NRC. However, this analysis !

was performed under the assumption that all four RCPs are tripped. On a reactor scram (with or without a safety injection signal), RCPs 1 and 3 trip automatically, but RCPs 2 and 4 will continue to run.

Although the best estimate analysis was performed assuming that the RCPs are tripped as required by the current Emergency Operating Procedures, it was expected that the charging pumps with two RCPs running would be able to mitigate all small break LOCAs in all locations. To give an upper-bound '

estimate of the reduction in core melt frequency, a postulated automatic trip was assumed as a backup to the operator manually tripping the pumps. l The estimated unavailability of this automatic trip was combined with the {

human error probability associated with the operator failing to trip the I RCPs. This combined unavailability was then used to calculate a new core j melt frequency. l The upper-bound change in core melt frequency as a result of the postulated automatic RCP trip is a decrease of 2.6 x 10-5/yr. All of the core melt sequences affected by this change are in consequence category 5 with mean I consequence of 2.8 x 103 man-rem. The resulting public risk was calculated I as one man-rem.

In this analysis, however, it was assumed that all small break sizes and j locations cannot be mitigated by the charging pumps with the RCPs running.

It is unlikely that further LOCA analyses will show this to be so for more than a small fraction of the cases. Also, as noted previously, when the HPSI pumps are used to mitigate small-break LOCAs, having the RCPs running has been shown to be beneficial in certain cases.

2-30 l

l I

2.10.3 ~ Review of Utility Evaluation  !

The utility has not performed a formal LOCA analysis for the exact scenarios needed to evaluate this topic. A LOCA analysis has been performed for small break LOCAs with the RCPs tripped but is needed for small break LOCAs- with two RCPs running. LOCA analysis has been completed for RCPs tripped and RCPs running for Incore Instrument Tube Rupture and for Steam Generator Tube Rupture. Both of these'LOCAs fill into the small break LOCA category (3). Since the analysis showed no difference for cases with and without RCPs running, further analysis of small small break LOCA-initiated sequences is not required. .

An upper bound estimate of the effect of RCP trip on core melt can be obtained by assuming that charging fails if RCPs 2 and 4 are running. The failure of charging is not a failure to provide water inventory; the problem is the inability to provide high pressure recirculation. Assuming that the failure to trip the RCPs results in failure of the charging pumps and the recirculation, the upper bound reduction in core melt frequency if RCPs trip would be about 4.9E-5/yr. This figure is comparable with the utility's analysis. However, we agree with the utility's conclusion that this calculated upper bound core melt change is probably much higher than the actual change in core melt.

We expect that thermal-hydraulic analysis will prove this estimate of core melt change to be several orders of magnitude high. Running RCP's (if they are not cavitating) may actually improve core cooling and reduce the rise in fuel temperatures, much like in a small-small LOCA.

2.10.4 Conclusion Without thermal hydraulic analysis, we are forced to make very conservative assumptions in reviewing this issue. Thermal hydraulic assumptions deal with system (in this case high pressure recirculation) success criteria, not system success probabilities, so they cannot be adjusted or modified by factors like system success probabilities. Although further thermal hydraulic analysis may justify lowering the ranking of this issue to low or drop, we must stick with the assumptions and rank this issue medium.

2-31

. . i E

2.11 Topic 1.54: Safety Implications of Control Systems l 2.11.1 Background Instrumentation and control systems utilized by nuclear plants are composed of safety grade protection systems and nonsafety grade . control systems.

Safety grade systems are used to trip the reactor when specified parameters exceed allowable limits _and, protect the core from overheating by initiating ECCS systems. Nonsafety grade control systems are used to maintain the plant within prescribed parameters during shutdown, startup and normal load

varying power operation. Nonsafety grade systems are not relied on to perform any safety functions during or following postulated accidents, but are used to control plant processss. Although nonsafety grade control system failures are not likely to result in accidents or transients that could lead to serious events or in conditions that safety systems are not able to cope with, indepth studies of these issues have not been performed to date. Concerns have been identified in which a failure or malfunction of 4

the nonsafety grade control system can (1) potentially cause steam generator or reactor vessel overfill or (2) lead to a transient th'at could cause severe vessel overcooling.

l The purposeofUnresolvedSafety' Issue (USI)A-47(Safety Implications of

Control Systems) is to perform a systematic evaluation of nonsafety grade j control systems that are typically used during nermal plant operations and ~

to identify control systems whose failure could (1) cause transients or accidents identified in the FSAR analysis to be more severe.than previously.

} analyzed, (2)adverselyaffectanyassumedoranticipated~ operator action during the course of an event, (3) cause technical specification safety

) .

l limits 'to be exceeded, or (4) cause transients or accidents to occur at a frequency in excess of that established for abnormal operational. transients and design basis accidents. Specific analyses of this issue are needed to -

, study steam generator / reactor vessel overfill and.overcool transients to determine the need for preventive and/or mitigating design measures. The NRC's objective in this USI is to evaluate the need for requiring control >

system changes in operating reactors,- to verify the adequacy of licensing requirements, and to propose, if needed, additional criteria and guidelines.

k l 2-32 i

i L

2.11.2 Utility Evaluation The licensee concluded that the Haddam Neck PSS contained'an indepth evalua-t' ion of the~ issue by developing detailed models of plant systems. Potential control' system failures or malfunctions were addressed by detailed fault-tree development, consideration of event initiators, and consideration of control power sources, both in terms of a support state system model and in; terms of special initiators. System fault tree models included unavailabil-ity contributions from instrumentation and controls down to the contact pair and relay level. These instrument failures were also considered potential accident initiators, and the loss of instruments following various loss of.

power events appeared in many sequences. Additionally, the human reliabil-ity analysis reflects the effect of plant instrumentation on operetor per-formance.

2.11.3 Review of Utility Evaluation The purpose of the USI is to evaluate the risk contributions of .nonsafety

~

grade control systems. A thorough PSS, such as the one performed at Haddam Neck, examir.es the risk of control systems in each of the areas described in the utility evaluation (above). However, a PSS makes no distinction.between safety and nonsafety grade equipment when creating system unavailability models.

Several insights about the Haddam Neck Plant design were gained from the review, but none specific to instruments and controls.(I&C). Control system failures contribute to many of the dominant sequences, but they are almost entirely caused by loss of power to these instruments.

izes the risk attributed to loss of power due to limited equipment The licensee. real-

{ redun-

{ dancy and lack of separation, and corrective actions are in progress.

Ex-j cluding loss of power, no dominant sequences are initiated .by instrument

! failure. The failure rates of nonsafety grade instruments and controls are i

generally overwhelmed in the model by the failure rates of associated pumps,

valves, and breakers.

' Although nonsafety grade ISC faults appear-in -the dominantcutsetsofthecomponentcoolingwater(CCW) system,andpotential-lynonsafetygradeIACfaultsappearinresidentheatremoval(RHR) dominant cutsets, the effect is small at the system level and negligible at the core melt level.

5 4

2-33 i

i h

- - - - - . - . - . . - -. __.-_ ~.- . - - - _ - . . -

2.11.4 Conclusion The stated purpose of USI A-47 is to " perform a systematic evaluation of o

n'n-safety grade control systems ." The methodology used in the Haddam Neck PSS, when properly applied, supplies an effective and systematic approach to identifying risks associated with I&C systems. The concerns of USI A-47 have been evaluated and the core melt risk associated with non-safety grade..

I&C is less than IE-7/yr. The benefit of any change would be less than this amount. We assign an ISAP rank of drop and consider this issue resolved.

2.12 Topic 1.59: Additional Low Temperature Overpressure Protection 2.12.1 Background Major overpressurization of the Reactor Coolant System (RCS), if combined with a pre-existing critical size crack, could result in a brittle fracture of the reactor vessel. Vessel failure is likely to make it impossible to provide adequate coolant to the reactor, so that ma jor core damage would result.

2.12.2 Utility Evaluation The utility evaluated the chain of events needed for core damage due to an overpressurization transient and concluded that all of the following would i have to occur:

1. An initiating event resulting in excessive flow into the RCS or excessive heatup,

2. The LTOP system becoming inoperable or failing to adequately relieve system pressurization,

3. Other relief paths also becoming inoperable, 4.

Given the pressurization, a breach occurring in the system boundary, and the breach being either excessively large so that core cooling is inadequate (e.g., reactor vessel rupture) or small but the core cooling systems are for some reason unavailable.

2-34

. ~ _ _ __ _ ___. ._

A cold pressurization transient (occurrence 1) can be initiated-by a number of. incidents, .the most_likely being inadvertent safety injection ( S I ) ,-

excessive charging without a functioning letdown system, or misoperation of

~

_pr'essurizer heaters.

No analysis was performed to estimate the frequency _

with which events occur.

The second occurrence, failure of the LTOP system, can be caused by human error in placing- LTOP in service, MOV fa-ilure, safety relief valve (SRV).

failure or human error while the system is operating. The utility dismisses the human error as being unlikely and claims the system will have a high success rate due to the inherent reliability of SRVs.

After failure of the LTOP system, all installed overpressure protection methods must fail for occurrence 3 to happen. Additional overpressure 1

protection is provided by the spring-loaded RHR relief valve (500 psi), the operation of the PORVs, and the pressurizer code safety' valves. Haddam Neck l

considers the failure of all the above equipment unlikely.

Occurrence 4, reactor vessel failure, was probabilistically evaluated using the vessel Integrity Simulation Analysis (VISA) code results for an Oconee-type vessel. Assuming a starting tempi:rature of 110 0 F, the probabilities of reactor vessel failure were calculated and are as follows:

Peak Pressure (osia) Probability of- Failure per Event 2485 1.5E-3 1200 7E-7 950

<1E-9 i

The Oconee analysis is considered to be very conservative because the Haddam Neck vessel.RT NDT temperatures are much lower throughout vessel lifetime.

The utility assumes that a small LOCA due to a piping rupture is far more likely than a vessel rupture. Because this event could be mitigated by core cooling, and because of lower decay heat and fuel temperature, the proba-bility of core damage is very low and is bounded by vessel rupture concerns.

2-35 I

i

. - - - . - _ , , , . - . .. ~ . _ _ , .- -

The utility estimated the likelihood of the above four occurrence sequences to be about 3E-7/yr, and since there is virtually no potential for improve-ment, this issue was assigned an ISAP ranking of zero.

2.12.3 Review of the Utility Evaluation The sequence described in the Haddam Neck evaluation accurately depicts the chain of events that could lead to an overpressure condition, but a step-by-step quantitative analysis is warranted.

Occurrence 1 is defined as the occurrence of one of the following: inadver-tent SI, excessive charging with a letdown system failure, or misoperation of pressurizer heaters. Haddam Neck has experienced one inadvertent SI in the study period, which equates to a rate of 7.7E-2/yr. This is a very conservative value since the chances for inadvertent SI are much lower for a shutdown and cooled down reactor. An extensive HRA analysis would be re-quired to quantify the other two events, but errors that would lead to the severe overpressure transient are certainly bounded by IE-2/yr. The total initiating frequency would conservatively be IE-1/yr.

Occurrences 2 and 3 are equipment failures of the LTOP system and of other pressure relief means. The probability of failure of the simple, two train LTOP system, including human error, is estimated to be SE-2 per demand (2).

The PSS calcualtes the probability of the PORVs failing to relieve to be 2.5E-3 per demand. The likelihood of the spring-loaded RHR relief valve failing is low (1.25E-5), and would be negligible compared to the-possibility that RHR is not aligned to.the primary. Without analysis or data collection on the frequency of RHR being isolated during a ' rupture reactor shutdown, we will assign a very conservative unavailability of IE-1 per demand.

The utility correctly interpreted NUREG-0933 (15) in extracting the vessel rupture probability. We will assume that this sequence leads to a peak pressure of 2485 psi, and will use the Oconee vessel rupture probability of 1.5E-3. The conservative calculation of sequence frequency is:

(IE-1)(5E-2)(2.5E-3)(1E-1)(1.5E-3)=1.9E-9yr-1 2-36

2.12.4 Conclusion i

The. utility's conclusion that the frequency of core damage resulting from cold overpressure transients is low is correct. Additionally, the consequ-ences of such an accident for the public would be extremely low, since even in an overpressure condition, there is inadequate energy in the primary to breech containment. The risk significance of this topic is ranked drop.

2.13 Topic 1.60 RCS/RHR Suction Line Valve Interlock on PWRs 2.13.1 Background At Haddam Neck, there are two isolat. ion valves (M0Vs-780, -781) between theReacterCoolantSystem(RCS)andtheResidualHeatRemoval(RHR) system.

These valves are normally closed during plant operation and are equipped with pressure interlocks to prevent the RHR from being inadvertently exposed to the high pressure condition of the RCS. Separate interlock channels control.the operation of each valve. In the normal shutdown and long term cooling mode, the RHR takes suction from the RCS, and therefore,

' requires these isolation valves to be opened. Inadvertent or spurious closure of either one of these valves during the cooling operation could lead to damage to the RHR pumps.

Presently, the pressure interlock logic of the isolation valves is in a one-of-one configuration. Unlike typical Westinghouse plants, these interlocks control only the valve opening operation, and therefore, will not cause spurious closure of the valve. During normal operation, the pressure interlocks stay de-energized to keep the valve from opening.

The proposed project is to modify the MOV pressure interlock logic from a one-of-one to a two-of-two configuration, i.e. valves cannot be opened if both logic channels indicate a high RCS pressure condition exists.

2.13.2 Utility Evaluation As described above, the pressure interlocks of the isolation valves only control the valve opening circuitry. Therefore, failure of the interlocks will not result in spurious closure of the valves. The safety issue is that 2-37

t failure of the interlocks will lead to the inability to open the valves on demand. As proposed by the utility, the isolation valve pressure interlock wi,ll be modified to a two-of-two logic configuration. As a result, this  ;

' project .will increase the reliability.of the valve opening on demand. _

l l

1 Based on the PSS, the utility estimated a 1.64E-6/yr total core melt reduc-tion, assuming a' 1-of-2 success logic for the pressure interlocks'of the

isolation valves. The resulting public safety impact was estimated at 9E-4 man-rem. The utility also indicated that while the proposed modification will increase the reliability of the valve opening logic, it would -also-increase the probability of spurious opening of-the isolation valve. .How-ever, in order to create.an RHR/RCS interfacing LOCA, both valves.would have to fail open. Considering that the power supply for each valve is key-

~ locked in.the control room, that the contact pairs or the control switch for-each valve would have to be in the wrong position, and that at least one of 4

the two pressure interlock contact pairs on each valve fails closed, the j . probability of such an incident'is very low.

2.13.3 Review of the Utility Evaluation 4

A review of this ISAP topic indicates that the proposed modification .would j have little or no impact on the plant safety. Although we generally concur with the utility on the safety implication of-the proposed project, there is

, a comment that needs some clarification. Based on the information provided in the issue report, it is difficult to determine how the utility arrived at

the core melt frequency reduction of 1.64E-6/yr.

! From 'our review of the RHR system fault tree presented in the PSS, it

, appeared that the failure of the pressure interlocks on the isolation valves did not contribute to system unavailability, since it appears that the 'PSS assumed that the operator would always be able to override the pressure interlocks when they failed on demand. Thus, the addition of another '

pressure -interlock on the valve would not have any impact on the system unavailability. -

i We agree with the utility that the proposed modification would also lead to a potential increase in interfacing system LOCAs due to spurious opening of i

2-38 h

w - m -, ,,4- .- , , , , . . _ _ . . . . , , _ . . , _..m , , . , ,p .,

4 ,#,,, - ,,. y . ., w e

the valve, but it appears that the probability of such an incident is very low. Thus, the impact on plant safety would be negligible.

2'.13.4 Conclusion As described above, it appears that there would be little or no impact on plant safety. As a result, this ISAP topic is ranked drop in our ranking process, 2.14 Topic 1.61: Pressurized Thermal Shock 2.14.1 Background Pressurized thermal shock (PTS) refers to the effect on the reactor vessel of a severe reactor system overcooling event accompanied by pressurization or repressurization of the vessel. Neutron irradiation of reactor pressure vessel weld and plate materials decreases the fracture toughness of the materials. The fracture toughness sensitivity to radiation-induced change is increased by the presence of certain materials such as copper. If a severe overcooling event followed by or concurrent with high vessel pressure occurs, and if a small crack is present on the vessel's inner surface, decreased fracture toughness woul.1 increase the likelihood that the crack will grow to a size that might threaten vessel integrity.

Severe pressurized overcooling events are improbable since they are caused by multiple failures and improper operator performance. However, cet tain precursor events have occurred that could have potentially threatened vessel integrity if additional failures had occurred and/or if the vessel had been more highly irradiated. Therefore, the possibility of vessel failure due to a severe pressurized overcooling event cannot be ruled out.

Haddam Neck will submit projected values of the reference temperature for PTS ( RTPTS) of the the reactor vessel beltline materials from the time of the submittal until the expiration date of the plant's license. This infor-mation will be updated whenever core loadings, surveillance requirements, or_ ,

other information indicate a significant change in the projected values. If the value of RT PTS is projected to exceed the screening criteria, the utili-ty will develop and implement a flux reduction program if practical, or will l

2-39 i

n. g

modify equipment to prevent potential reactor vessel failure as a result of pressurized thermal shock events.

2.14.2 Utility Evaluation The utility calculated that the highest RTPTS value of the Haddam Neck

, pressure vessel, assuming the plant's operating license is extended to 40 ,

! years, is 1690F. From Figure 8-3 of reference 1, the frequency of a PTS-induced vessel rupture is 1E-6/yr for a reactor with an RTPTS of 177 F. The utility assumed vessel rupture would lead to core melt, and conservatively used IE-6/yr as the vessel rupture frequency, and thus core melt frequency.

Assuming 20 years remaining in plant life, the maximum possible benefit from complete elimination of all PTS-induced core melt accidents is 0.06 Man-Rem.

2.14.3 Review of Utility Evaluation The RTPTS calculations were not reviewed. As the state-of-the-art advances in materials engineering, the calculated value of RTPTS may change. Figure 8-3 of reference 1 was correctly interpreted, and the use of IE-6 as the frequency per year is conservative. Using the revised consequence model, the public risk is recalculated as follows:

AR = (20 years) (1.0E-6/ year) (4.9E+3 Man-Rem) = 0.1 Man-Rem 2.14.4 Conclusion A great deal of work on the likelihood and results of PTS, especially on older, highly irradiated reactor vessels, is being preformed by the NRC (under Unresolved Safety Issue A-49) and by various industry groups. Haddam Neck's probabilistic treatment of the issue is satisfactory, but future analytical work may significantly change the PTS assumptions, so this prob-lem should be continually reevaluated. Even using the conservative bounding approach, the issue only achieves a low ranking based on the maximum possib-le change in core melt frequency, and a drop ranking, based on changes in total population exposure. Slight modifications in assumptions (e.g., only 50 percent reduction in core melt frequency) or extrapolation of the refer-

{

enced table rather than the conservative bounding analysis used would 2-40 I

justify dropping the issue. However, since the study of PTS is an evolving field, it is recommended that the very conservative assumption be used, and th,e issue be ranked low pending further major advances in the PTS field.

2.15 Topic 1.62: Feed and Bleed Modifications 2.15.1 - Background The low temperature overpressure protection (LTOP) system had been proposed to be used to extend bleed and feed cooling when the pressurizer power operated relief valves (PORVs) became inoperable. The proposed project is to analyze, and if necessary modify, the LTOP piping and valves so that the system will be qualified for the temperature, pressure, and flow conditions that would exist late in a bleed and feed scenario at the Haddam Neck Plant.

Bleed and feed operations, used for decay heat removal when' the steam generator cooling 'is unavailable, involves the operation of air operated PORVs. The LTOP system is simply another pressurizer relief system which drains to the containment sump. The important differences between LTOP and the PORV system are that LTOP uses motor operated valves and is only qualified for very low-pressure operation. The PORV system relies on air operated valves and is useful throughout the complete range of plant operat-ing pressures. If the LTOP system meets residual heat removal (RHR) system pressure, temperature and flow requirements, it could be used as a bleed path upon failure of the PORVs at moderate reactor pressures. The specific concern about PORV failure is that the air compressors that supply operating air for the PORVs are located in containment and their operation cannot be guaranteed in the harsh environment created by bleed and feed.

2.15.2 Utility Evaluation The licensee calculates that, given compressor failure, the PORVs have adequate air to maintain bleed and feed operations for about 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> by using system reserve air. Once the PORVs become inoperable, the RHR pumps and heat exchangers are needed to provide long-term cooling. The preferred method of long-term cooling involves opening the RCS/RHR isolation valves so that the RHR pumps can take suction from the loop 1 hot leg and discharge into the loop 2 cold leg. Alternatively, the RHR pumps can take suction 2-41

from the containment sump, if a supply of water is provided by way of the LTOP relief valves.

For the purpose of performing an upper-bound calculation, the utility assumed that if they were not further qualified, the LTOP relief paths would fail with a probability of 1.0 when demanded to serve the long-term cooling function. Using the Haddam Neck PSS to calculate the effect of qualifying the LTOP system, it was determined that a total core melt frequency reduc-tion of 1.05E-04 per year can be obtained. Since all of the affected sequences fall into Release Category 5, as specified in the Public Safety Impact Model, the maximum expected safety benefit is:

AR = (20 years) (1.05E-04/yr)(2.8E+03 Man-Rem)

= 5.9 man-rem.

2.15.3 Review of Utility Evaluation The RHR system is designed to provide long term plant cooling by using a suction from the loop I hot leg, RHR pumps, and heat exchangers, and a discnarge into the loop 2 cold leg or through the core deluge valves.

Alternatively, the system can be lined up in a bleed and feed taking suction from the containment sump. If the sump is used for suction, one of two bleed paths from the pressurizer must supply water to the sump. The preferred bleed path is through the PORVs, since they can be used throughout the plant pressure range. (RHR can only be used for long-term cooling at reactor pressures of less than 400 psi). However, the PORVs are subject to failure, especially during bleed and feed, since the containment air compressors may not be able to stand the adverse environment, and compressed air storage tanks will only last about 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The second bleed path is through the LTOP system, which does not require air to operate. However, this system is currently not designed for the RHR operating pressures of up to about 400 psi. Thus, the system can only be used after a steam generator tube rupture when the procedures call for complete depressurization of the plant. The proposed project is to analyze, and modify if necessary, the LTOP system for operation at RHR temperatures and pressures, and to ensure that there is adequate flow for late cooling in bleed and feed scenarios.

2-42

The Haddam Neck PSS could only consider the option to use LTOP for a bleed and feed in the event of a steam generator tube rupture (SGTR). If the proposed change allows the use of LTOP at up to RHR operational pressure 4

('00 psi), the system unavailability for long-term cooling following an SGTR rather than the system unavailability for long-term cooling after bleed and feed should be used in all event tree models. The only difference between the fault trees for post-SGTR long-term cooling and for the typical post-bleed and feed long-term cooling is the inclus. ion of the option of using the sump for RHR pump suction. The system unavailabilities, as calculated in reference 3, are:

System Failed Operation Support Mode Systems Unavailabilities Long-term cooling None 5.8E-3 after bleed and Offsite power and 9.7E-3 feed one DC Bus Long-term cooling None 5.4E-3 after SGTR Offsite power and 9.5E-3 one DC Bus In order to evaluate the change in core melt frequency as a result of the upgrading of LTOP, the sequences, other than SGTR-initiated sequences, requiring long-term cooling after bleed and feed are credited for the im-proved system availability. Sequences with no failed support system are multiplied by the factor:

5.4E-3 = .931 5.8E-3 The factor for sequences with offsite power and a DC bus failed is:

4.5E-3 = .979

• 9.7E-3 2-43 l

Application of these factors to the affected sequences yields a reduction in.

core melt frequency of 1.75E-7/yr. There are two reasons why the effect-of this modification is so much smaller than the upper bound calculated by the licensee:

1

1. Most of the core melt likelihood in the Haddam Neck PSS occurs before getting to the need for long term cooling.

2. Both with and without the LTOP, the failure of_long-term cooling is overwhelmingly dominated by a)FCV-796 failure to open, FCV-602 failure to close, and RV-175 spuriously opening in the. no support system failures case, and b)-pump train failures and PAB ventilation failures in the LOSP and loss of a DC bus case. Thus, the system unavailabilities do not change much.

2.15.4 Conclusion Based on the above analysis, upgrading the LTOP system reduces the core melt frequency by only 1.7E-7/yr. Other equipment in the RHR system dominate the systems' contribution to risk. However, if analysis is performed and it indicates that LTOP can be used under RHR's operating conditions, the use of LTOP after PORV failure, in a bleed and feed scenario, should be incorpo-rated into operating procedures. Based on the above results this topic should be dropped.

2.16 Topic 1.63: Hydrogen Control 2.16.1 Background This ISAP issue addresses the potential for breach of containment due to the hydrogen burn phenomenon, which would lead to a release of a large quantity of radioactive materials to the environment. Such an accident could occurfollowingalossofcoolantaccident-(LOCA) and generation of a large amount of hydrogen in the containment due to radiolysis. When the hydrogen level reaches its flammable concentration, it could ignite and create a so-called hydrogen burn phenomenon. In its latest estimate, the utility indicates that such a condition could occur within 8.5 to 13 months after a mitigated large LOCA that results in partial core damage. The 2-44 l

)

proposed project is to determine whether or not Haddam Neck has the capability to remove the accumulated hydrogen from the containment within 8.5 months using hydrogen recombiners to prevent a potential hydrogen burn.

2.16.2 Utility Analysis In its analysis, the utility indicated that the use of hydrogen recombiners after a core melt accident to prevent hydrogen build-up in the containment would not be applicable, since the rate of hydrogen generation during this type of accident is on the order of hundreds of pounds per hour, while the removal rate of the recombiner is on the order of pounds per hour. However, for the type of LOCA that does not lead to core melt and that produces relatively low amount of hydrogen during the accident, it appears that the use of recombiners would be adequate to prevent hydrogen burn in the long run.

Based on the latest analysis performed by the utility, it is believed that without hydrogen ccicentration control inside containment, a hydrogen burn could occur about 8.5 months after a LOCA without core melt. The licensee considered this type of accident a Category 4 release (in the utility's public safety impact model), with a modified source term to reflect the condition of the accident. As a result, the source term was reduced by a factor of 160 from that of a typical Category 4 release, and subsequently reduced by another factor of 10 due to natural and engineered fission product removal processes over the 8.5 month period. The result was about 50 man-rem as a consequence of the hydrogen-burn induced containment breach 8.5 months after a LOCA. Given a frequency for a large or medium LOCA of approximately 1E-3/yr, the potential risk reduction was estimated at about 1 man-rem.

2.16.3 Review of the Utility Analysis Thelicenseecategorizedthepostulatedaccident(LOCAwithoutcoremelt)as a Category 4 release. By definition, Category 4 is the consequence category for Plant Damage States with late core melt and a relatively slow rate of containment pressurization. This definition does not suit the condition of the postulated accident. The licensee should have classified this type of accident as a Category 5 release, since there is little core damage (about 2-45 s

l 10% fuel damage, as assumed by the utility), and containment. heat:remo' val is available to maintain containment integrity until the hydrogen burn at 8.5 mo.nths . Using the revised source term for a Category 5 release of 4.9E3 man-rem, reduced by a factor of 10 in the source term due to natural and engineering removal processes, and combined with an assumed LOCA (large and-medium) frequency of'about IE-3/yr,- the risk reduction -for implementing hydrogen recombiners is estimated at about 10 -man-rem. This -issue is- "

therefore ranked' low in our ranking process.

2.16.4 Conclusion Under the postulated accident (LOCAwithout core melt, .and. long term hydrogen build-up), the risk is estimated at about.10 man-rem.- The utility estimates .a public risk of 1 man-rem. In both cases this issue is ranked low and the addition of hydrogen recombiners would have little impact on public risk.

2.17 Topic 2.05 Process Computer Replacement 2.17.1 Background The process computer at Haddam Neck provides useful plant data to the plant operators. .However, this system is being utilized at its design capacity and, in some cases, it cannot handle and process the amount of data collected for further analysis. For instance, during a plant trip, some of the data related to post trip analysis (such as sequence of. events information andequipmentstatuschanges)-typicallywouldnot be recorded because the system was overloaded. Additionally, the present system configuration cannot support the addition of a Safety Parameter Display (SPDS). These shortcomings have prompted the utility to propose replacing the present system with a new process computer (hardware and -software included). This system will have the same capability as the current system-with additional enhancements, such as the capability for post trip data handling and support for the SPDS.

i 2-46 i

l

- ._ _.. ._ _., - - , _ _ _-- . . ~ _ - . _ - _ . _ . _ . -- . _ . , _ - , . - _ . , _ _ , ...

2.17.2 Utility Evaluation In its analysis, the utility indicated that the installation of a new process computer would result in benefits to the plant from having an SPDS (as analyzed in ISAP topic 1.20) and other. reasons independent of SPDS. The utility analysis indicated that the installation of the new process computer would have neglible impact on plant safety since, during an emergency condi-tion, the operators would rely (exclusive of the benefit of an SPDS) on primary information available on control boards to operate the plant rather than on outputs from the computer. As a result, the benefit from the new equipment alone was estimated at only 10 percent of that from the SPDS.

Thus, the ultimate benefit to plant safety would be from the functions of the SPDS.

In ISAP Topic 1.20, the utility indicated that the use of an SPDS at Haddam Neck would result in a core melt reduction of 3.7E-5/yr. This value was based on the assumption that use of the SPDS would reduce the cognitive operator errors identified in the PSS by a factor of 1.5. The benefit derived from the new equipment alone (10 percent of the benefit arrived from the SPDS), results in a core melt reduction of about 4E-6/yr from this proposed project.

2.17.3 Review of Utility Evaluation SAIC concurs with the licensee on the issue of the limited impact the new process computer would have on plant safety independent of the SPDS.

The reviewer also concurs with the utility that the addition of the SPDS to the plant information equipment would help the operator decision-making process during an emergency condition, and thus would help reduce the cognitive error probabilities identified in the PSS.

However.

based on little information provided by the utility, it is diffi-cult to provide comments on the potential benefit of the new equipment (4E-6/yr core melt reduction) on plant safety.

It appears that the new process computer does not provide additional information to the operator except for the SPDS. Thus, from it is believed that no benefit can be derived this proposed project except those resulting from the installation of the SPOS.

2-47

, 2.17.4 Conclusion The replacement of the current process computer with a new system would >

e undoubtedly provide additional capabilities for handling plant information,

{ such as data for post trip evaluation and SPDS. The addition of a new-plant process computer- by itself is not expected to provide any significant quantifiable improvement to public safety.

However, this issue must be considered in conjunction with ISAP. topic 1.20.

The improvements to be gained,-.in public safety, from the implementation of an SPDS are in part dependent on the installation of a new process computer.

Therefore, with the ranking of topic 1.20 as medium, this issue must.also be ranked medium,' although'on its own merits it would be ranked low.

2.18 Topic 2.10: Administrative Building Upgrade

2.18.1 Background This topic addresses the potential safety implications of construction

$ work at' the plant site. The proposed project is to expand the' present Administrative Building to accommodate additional storage and staff working space.

2.18.2 Utility Evaluation The utility was concerned about the possibility of damage. to critical underground piping of the fire protection and the service water systems i

being caused by the excavation activities involved in the proposed project.

l The piping for both of these water systems is currently located approximately 40 to 50 feet from the proposed excavation area.

4

, In its evaluation, the utility indicated that the possibility of hitting these pipes during construction is extremely low because' the pipes are located far from the proposed excavation. Even if the damage did occur, it ,

would have negligible impact on plant safety for the following reasons:

} (1) if the fire protection piping system were damaged, there would be no i ' direct impact on plant safety unless a concurrent fire occurred at the

plant that could not be controlled by other fire protection systems, (2)if

2-48 4

N i

-,-----g .-e..- ,w -n, y -,---.>.-,y-.,,m.--, ~re_ .,-,,,.n.,. ,-.-..,,,,-.,,-_,,vn_,--_,,m-vn,w,,,-,,,.a-

+.v~r. -m mgv.,,, ,y-n.e,,g-n-,w

one of the service water lines were damaged, it would be isolated,. and the parallel line located about 60 feet away would still be in service. .Thus, th.e impact of any accident related to the construction project on plant safety would be negligible.

2.18.3 Review of the Utility Evaluation As indicated in this analysis, the probability of damaging critical underground plant system piping should be low since the piping layout is well documented and should be taken into cons _ideration during the planning of the construction project. . In addition, if these systems were . damaged during the excavation, the consequences would be minimal, and corrective actions are possible. Thus, the proposed project would have little impact on plant safety.

2.18.4 Conclusion As indicated above, we concur that the proposed project would have negligi-ble impact on plant safety, and this issue is ranked drop in our ranking process.

2.19 Topic 2.13: Fire Detection System Upgrade 2.19.1 Background At Haddam Neck, a fire detection system was installed to provide early warning of a fire and to locate its source in order to prevent it from spreading to other areas of the plant. Depending on the location ana the time required to mitigate the fire accident, the consequences could range from a "no damage" state with continued operation of the plant to a " major damage" state that could be termed an induced transient. As a result, earlier detection and shorter response time would help to minimize the damage of the fire.

The proposed project is to replace the existing "Pyrotronics" fire detection system with a " Simplex" smoke detection system. This project would impact the following areas: diesel generator rooms, containment outer annulus and cable vault, and cable spreading areas. Additionally, the fire detection 2-49

system'in the switchgear area is currently being replaced by an ' independent detection /Halon suppression system.

2.19.2 Utility Analysis In its analysis, the utility-indicated that the existing "Pyrotronics" fire detection systems in the affected areas have been credited in the Haddam Neck fire analysis, and the proposed project did not include monitoring additional areas. Thus, if there was any benefit to the' risk of the plant, it would have been because of a slight increase in the reliability of the new system. Based on these assumptions, the utility assigned a subjective score of 1 to this issuec i

2.19.3 Review of the Utility Analysis Since the proposed system does not involve monitoring of additional areas of the plant, we agree with the utility that there is no significant impact to i

the plant risk due to the proposed project.

2.19.4 Conclusion As indicated above, the proposed project has no significant impact on the l plant safety. Thus, this issue is ranked low in our ranking process.

l 4

i ,

4 2-50 l

)

i- 1 i

3.0 REFERENCES

1. Atefi, B., et al., " Review of Risk-Based Evaluation of Integrated SafetyAssessmentProgram(ISAP)IssuesforConnecticut. Yankee (Haddam Neck) Plant," SAIC-87/3004, Draft, February 15, 1987.

2. " Connecticut Yankee Probabilistic Safety Study," Northeast Utilities Service Company, NUSC0149, February 1986.

3. Atefi, B., et al., "A Review of the Connecticut Yankee Power Plant Probabilistic Safety Study," SAIC-86/3088, Oraft, November 15, 1986.

4. Atefi, B., et al., " Review of Risk Based Evaluation of Integrated Safety Assessment Program (ISAP)IssuesforMillstoneUnit1," Final Report, SAIC-87/1013, December 31, 1985.

5. Aldrich, D.C., et al., " Technical Guidance for Siting Criteria Develop-ment," NUREG/CR-2239, SAND 81-1549, December 1982.

6. "NRC Integrated Program for the Resolution of Unresolved Safety Issues A-3, A-4, and A-5 Regarding Steam Generator Tube Integrity," NUREG-0844, April 1985.

7. " Safety Goals for Nuclear Power Plant Operation," NUREG-0990, May 1983.

8. Strip, D.R., " Estimates of the Financial Consequences of Nuclear Power Reactor Accidents," NUREG/CR-2733, SAND 82-110, September 1982.

9. Budnitz, R.J., et al., "An Approach to the Quantification of Seismic Margins," NUREG/CR-4334, August 1985.

10. "PRA Procedures Guide, A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants," NUREG/CR-2300, January 1983.

3-1 i

11. 49 federal Recister 26044, June 26, 1984; 49 Federal Recister 27736, July 6, 1984.

12. Schmidt, E.R., K.M. Jamali, G.W. Parry, S.H. Gibbon, "Importance Measures for Use in PRA's and Risk Management," Proceedinos: ANS/ ENS Probabilistic Safety Methods, EPRI-NP-3912-SR, February 1985.

13. " Generic Assessment of Delayed Reactor Coolant Pump Trip During Small Break Loss of Coolant Accidents in Pressurized Water Reactors," NUREG-0623, November 1979.

14. Letter from W.G. Counsil, iJSCO, to W.A. Paulson, NRC, "Haddam Neck Plant - Small Break LOCA Topi:al Reports," August 23, 1984.

15. "A Prioritization of Generic Safety Issues," NUREG-0933, Supplement 4, December 31, 1985.

3-2

- - _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ - - _ - _ _ _ _ _ _ - _ _ _ _ _ _ - ___ _ __ _ -