ML20098C540

Technical Evaluation Rept of Plant IPE Back-End Submittal, Revised Final Rept

ML20098C540
Person / Time
Site:	Quad Cities
Issue date:	09/30/1994
From:	Vijaykumar R SCIENTECH, INC.
To:	NRC
Shared Package
ML20094L068	List: ML20098C496 ML20098C540 ML20098C560
References
CON-NRC-04-91-068, CON-NRC-4-91-68 ERI-NRC-94-107F, NUDOCS 9510100193
Download: ML20098C540 (42)

Text

_ _. _.

1 i

l l

QUAD CITIES UNITS I & 2 INDIVIDUAL PLANT EXANINATION i

TECHNICAL EVALUATION REPORT (BACK-END) e l

i 4

1 qsioloo ms gy

0 8

ERI/NRC 94-107F 1

TECHNICAL EVALUATION REPORT OF THE QUAD CITIES INDIVIDUAL PLANT EXAMINATION BACK-END SUBMITTAL REVISED FINAL REPORT September 1994 i

R. Vyaykumar and M. Khatib-Rahbar 4

Energy Research, Inc.

P.O Box 2034 Rockville, Maryland 20847-2034 Prepared for:

SCIENTECH, Inc.

11821 Parklawn Drive Rockville, Maryland 20052 Under Contract NRC-04-91-068 With the U.S. Nuclear Regulatory Commission Washlagton, D. C. 20555

s EXECUTIVE

SUMMARY

Tida report presents the.esults of the review of tl.e back-end portion of the Commonwealth Edison Company's Individual Plant Examination (IPE) submittal of the Quad Cities plant. The IPE was a joint utility-contractor effort, with Fauske and Associates, Westinghouse, Inc., and Tenera, L.P., being the contractors responsible for the back-end analyses. The IPE submittal contains a substantial amount of information with regards to the requirements of the Generic letter (GL) 88-20 and NUREG-1335.

)

The submittal reports a Core Damage Frequency (CDF) of 1.2 x 104 per reactor year. The top contributor to core damage frequency is a loss of offsite power sequence (46% of the core damage frequency), followed by medium LOCA sequences and other LOSP sequences. Loss of offsite power sequences contribute to 72% of the CDF, followed by LOCAs (17 % of CDF),

and ATWS sequences (6% of the CDF). Containment bypass sequences were found to be insignificant contributors to the CDF.

A large majority of sequences lead to some form of containment failure, and the probability of containment remaining intact is 2.5 x 104 per reactor year (21% of the total CDF). The principal mode of containment failure appears to be late structural failure (without venting) resulting from high containment temperature (53% of the CDF). Early containment failure due to overpressure occurs for 3.8% of the total CDF, and is primarily found to occur for ATWS sequences where containment failure occurs prior to core damage. Early venting of the containment occurs for 20% of the total CDF.

However, late structural failure of the containment was found to occur for a substantial fraction (18 % of the total CDF) that involved early venting.12te containment venting occurs for sequences that contribute to 2 % of the CDF.

The IPE uses a Plant Response Tree (PRT) methodology developed by CECO, in which, accident sequences are followed from the time of accident initiation until the time of containment failure.

The b=:k-end portion of 4e PRT is abridged, and uncertainty in several phenomena of interest to severe accidents in BWRs are not fully considered. Instead, the CECO position on several energetic phenomena are summarized in Position Evaluation Summary (PES) reports, and based on these reports, several accident phenomena are excluded from further consideration. Examples of such phenomena include steam explosions, direct containment heating and hydrogen combustion. As a response to the NRC review team questions, the licensee provided summaries of the PES reports discussing the exclusion of DCH and EVSE as possible containment failure modes for the Quad Cites plant. It appears that the licensee has performed some calculations to estimate the containment loads due to these phenomena. Other phenomena such as the drywell liner melt-through due to direct contact with molten core debris are treated as part of sensitivity studies. The exclusion ofimportant accident phenomena from the PRT and the severe accident analyses is an important shortcoming of the submittal. In particular, a significant number of sequences (corresponding to 77% of the CDF) invie a dry pedestal floor. It is anticipated that, the conditional probability of liner melt-through will be high for these sequences.

However, since the submittal does not consider this issue in the PRTs, the Quad Cities IPE Back-End Review ii ERI/NRC 94-107F i

t l

conditional probability of liner melt-through is low. Instead, many of the sequences have late containment failure by overtemperature. The results of the IPE are inconsistent with the results of the recent NRC studies and the IPEs for other BWRs with Mark-I containment.

• Ihe submittal reports source terms calculated using the MAAP code, evaluated 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation. Large releases are reported even for sequences involving late containment failure. It appears that the releases are dominated by revaporization of fission products deposited in the RCS and the structures.in the drywell.

More than 66.7% of the CDF leads to i

containment failure with volatile releases greater than 10 %, and another 11.4 % of the CDF leads to releases larger than 0.1% of CsI. In addition, sequences that correspond to 55.3% of the i

CDF entail releases larger than 1% of the core inventory of tellurium.

De principal contributors to these large releases are the loss of offsite power sequences, followed by the A'IWS sequences.

)

The following are the major findings of the Quad Cities IPE submittal:

The Quad Cities plant has reliable safety systems. De overall core damage frequency 1

of 1.2 x 104 per reactor year is dominated by one initiating event, dual unit loss of offsite power. No other particular vulnerability to core damage was found for the Quad Cities plant.

The containment analyses indicate that there is a 78% conditional probability of containment failure involving releases, and 21 % probability of intact containment.

Unique design features such as the shutdown makeup pump system, shared safety water system, and shared condensate storage tanks, help to reduce the core damage frequency.

The licensee claims to have derived several systems and operations-related insights from the performance of the IPE.

'Ihe important points of the submittal-only technical evaluation of the Quad Cities IPE back-end analysis are summarized below:

A PRA methodology involving the use of plant response trees that track the severe accident sequence from the initiation of the accident to containment failure, has been used. The treatment of the containment phenomena is abridged.

Uncertainties in severe accident phenomenology are excluded based on position papers.

All the phenomena are treated within the MAAP modelling framework.

Phenomena that lead to early containment failure (i.e., DCli, steam explosions, liner melt-through) have either been ruled out, or have not been treated as an uncertainty in the quantification of the PRTs (i.e., liner melt-through). The result is that early containment failure for the Quad Cities plant is entirely due steam overpressurization Quad Cities IPE Back-End Review iii ERl/NRC 94-107F

E 0

during ATWS sequences, while late containment failure is expected to occurs for a large-fraction of accident sequences. The results of the IPE are inconsistent with the results of the recent NRC studies and the IPEs for other BWRs with Muk-I containment.

The source terms are reported at a time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation, and appears to be dominated by revaporization for the volatile species.

Quad Cities IPE Back-End Review iv ERI/NRC 94-107F l

I 1

I l

TABLE OF CONTENTS l

1.

INTRODUCTION....................................... 1 i

l 2.

CONTRACTOR REVIEW FINDINGS 2

2.1 Review and Identification of IPE Insights..................... 2 2.1.1 General Review ofIPE Back-End Analytical Process.........

2 2.1.1.1 Completeness 2

2.1.1.2 Description, Justification and Consistency.......

2 2.1.1.3 Relevance to Actual Plant Configuration / Operation.................. 3 2.1.1.4 Peer Review of the IPE.................. 3 2.1.2 Containment Analysis and Characterization............... 3 2.1.2.1 Front-End/Back-End Dependencies...........

4 2.1.2.2 Containment Event Tree Development 7

2.1.2.3 Containment Failure Modes and Timing........

8 2.1.2.4 Containment Isolation Failure

.............10 2.1.2.5 System / Human Response................

10 2.1.2.6 Radionuclide Release Categories and Characterization....................... I 1 2.1.3 Accident Progression and Containment Performance Analysis.... 12 2.1.3.1 Severe Accident Progression..............

12 2.1.3.2 Dominant Contributors: Consistency with IPE Insights...........................

17 2.1.3.3 Characterization of Containment Performance....

19 2.1.3.4 Impact on Equipment Behavior.............

21 2.1.4 Reducing the Probability of Core Damage or Fission Product i

Release....................................

22 2.1.4.1 Definition of Vulnerability...............

22 2.1.4.2 Plant Modifications....................

22 2.1.5 Responses to CPI Program Recommendations.............

22 2.1.6 Other lssues.................................

23 2.2 IPE Strengths and Weaknesses..........................

24 2.2.1 IPE Strengths................................

24 2.2.2 IPE Weaknesses...............................

24 3.

OVERALL EVALUATION AND CONCLUSIONS

.................26 4.

INSIGHTS, IMPROVEMENTS AND COMMITMENTS

..............28 5.

REFERENCES........................................ 30 APPENDIX A............................................. 3 2 Quad Cities IPE Back-End Review y

ERI/NRC 94-107F l

1

t LIST OF FIGURES Figure 1 Frequency of Exceedance per Year of Csl as a Function of Fraction of Inventory Released to the Environment: Comparison to NUREG-1150 and the Pilgrim IPE Results.............

20 l

i l

l i

l 4

Quad Cities IPE Back-End Review vi ERI/NRC 94-107F l

l LIST OF TABLES Table 1 Comparison of Timing of Various Events and Radionuclide Releases to Other Studies (Long Term and Short Term Station Blackout Sequence).

14 Table 2 Containment Failure as a Percentage ofInternal Events CDF: Comparison to Other BWR Mark I IPEs and Peach Bottom NUREG-1150 Results..

18 Quad Cities IPE Back-End Review vii ERI/NRC 94-107F

1 2

i l

NOMENCLATURE I

ADS Automatic Depressurization System ATWS Anticipated Transient Without Scram l

BOC Break Outside Containment BWR Boiling Water Reactor j

BWROG Boilig Water Reactor Owners Group j

CDF Core Damage Frequency CDES Core Damage End-State CECO Commonwealth Edison Company j

CET Containmem Event Tree CPI Contairroat Pe:formance Improvement DCH Direct Conaivent Heating DF Decontamination Factor DW Drywell ECCS Emergency Core Cooling Systems EOP Emergency Operating Procedure 3

j EPG Emergency Procedure Guidelines EPA Electncal Penetration Assembly EPRI Electric Power Research Institute EVSE Ex-Vessel Steam Explosion l

GL Generic letter IPE Individual Plant Examination l

IPEP Individual Plant Examination Partnership i

IVSE In-Vessel 5? cam Explosion LOCA Imss of Coolant Accident l

LPCI Iow Pressure Coolant Injection i

M A,tP Modular Accident Analysis Program

1. 4CI Molten Core-Concrete Interactions MSIV Main Steam Isolation Valve I

NRC Nuclear Regulatory Commission PDS Plant Damage State j

l PRA Probabilistic Risk Assessment PRT Plant Response Tree

{

RCS Reactor Coolant System RHR Residual Heat Rej;.ction RPV Reactor Pressure Vessel SIL Stan6y Liquid Control System l

SRV Safety Relief Valve SSMP Safe Shutdown Makeup Pump i

TER Technical Evaluation Report WW Wetwell I

Quad Cities IPE Back-End Review viii ERI/NRC 94-107F

~ _... _

1.

INTRODUCTION This Technical Evaluation Report (TER) documents the results of the review of the Quad Cities Nuclear Power Station Individual Plant Examination (IPE) Back-End submittal [1], based on the following review objectives set forth by the NRC:

To determine if the IPE submittal essentially provides the level of detail requested in the l

l

" Submittal Guidance Document," NUREG-1335, 1

To assess the strengths and weaknesses of the IPE submittal, l

To complete the IPE Evaluation Data Summary Sheet.

l Section 2 summanizes the review findings and briefly describes the submittal as it pertains to the work requirement. Each portion of Section 2.1 corresponds to a specific work requirement as outlined in the NRC contractor task order. Identified IPE submittal strengths and weaknesses are summanzed in Section 2.2. Section 3 contains a summary of the overall IPE evaluation and the review conclusions. Appendix A of this report contains the IPE evaluation summary sheets.

A number of questions were transmitted to the licensee based on the submittal review [2] and l

the licensee responses [3] have been considered in the present document.

I l

l 1

l l

l l

l Quad Cities IPE Back-End Review I

ERI/NRC 94-107F l

\\

2 2.

CONTRACTOR REVIEW FINDINGS De present review compared the Quad Cities IPE submittal to the reouirements of Generic Letter (GL) 88-20, according to guidance provided in NUREG-1335. De findings of the review are reported in Section 2.1.. The review findings reported in Section 2.1 follow the structure of Task Order Subtask 1. The key points of the GL (and its Supplements) have been addressed in the IPE submittal report. Overall evaluations and conclusions are presented in Section 3.

2.1 Review and Identification of IPE Insights 2.1.1 General Review of IPE hek Fnd AnmIvtical Praceae 2.1.1.1 Completeness ne IPE submittal contains a substantial amount of information with regards to the requirements of the Generic Imtser (GL) 88-20 and NUREG-1335. Hov ever, several shortcomings exist with regards to the guidelines of the generic letter, particularly in the treatment of phenomenological uncertainties, and they will be discussed later in this report.

2.1.1.2 IL dption, Justification and Consistency His submittal uses an integrated approach where Plant Response Trees (PRTs) model the plant j

response from the initiation of the accident through the entire accident progression to j

i containment response. The PRTs are event trees which are supported by system fault trees.

Each PRT has an initiating event, nodes, various paths and an endstate for each path. The outcome of the PRT is a probability for each endstate. Containment end-states are defined to evaluate the outcome of each initiating event. For those paths that end in a long-term stable staae, the end-state is called SCS (success). Those sequences that end in core damage are represented by a 5-character identifier to characterize fission product release. An additional end-state called Success with Accident Management (SAM) was also identified. The final step of i

the PRT is stated to be the development of an accident management program that can mitigate the outcome of accidents. The other advantage claimed for this method is that "there exists a j

direct causal relationship between operator actions (based on EOPs) and accident progression."

He PRT approach can result in a large number of core damage sequences and containment end-states. In the PRT, the core damage bins, containment status and source term bins are combined togelher, which makes it difficult to understand the progression of the accident sequences. The

~

back-end phase of the Quad Cities PRT does not consider the uncertainty in severe accident phenomenology. 'The back-end portion of the Quad Cities PRT is very abridged, and considers the availability of the containment systems. Issues of importance to severe accident progression to BWRs are treated only within the framework of the MAAP inodels and the uncertainty in these phenomena are not treated in the Quad Cities PRT. Some of the issues are treated as sensitivity studies on the base case MAAP simulations. However, no use is made of the results of the sensitivity studies in the results for the containment analyses or source terms.

Quad Cities IPE Back-End Review 2

ERI/NRC 94-107F

i i

2.1.1.3 Relevance to Actual Plant Configuration / Operation

\\

Plant walkdowns were conducted by members of the IPE team who were responsible for the evaluation of specific plant systems or areas of special support. Checklists were developed to collect the information needed for the IPE analysis. In addition, a comparison was also made between the two units to identify any differences in the plant and containment design. Itis concluded in Section 2.3 of the submittal that the IPE model reflects the Quad Cities as-built condition as it cxisted in July 1991 with one exception, the hardened con:ainment vent installation was included in the plant model because the modification was imminent at the start of the IPE :nalysis.

2.1.1.4 Peer Review of the IPE A list of the CECO staff who participated in the performance of the Quad Cities IPE is presented in Figure 1.2-1 of the submittal.

Commonwealth Edison engaged the Individual Plant Examination Partnership (IPEP), a group of companies composed of Westinghouse, Fauske Associates, Inc. and TENERA to support the IPE analyses. It is stated in the submittal that IPEP personnel performed the basic modelling and analyses while CECO personnel performed success criteria analysis using MAAP and conducted detailed reviews of the models, assumptions, and results.

Key insights and resuas were reviewed by experienced CECO personnel and by senior management staff not involved in the IPE process. Though not requested by GL 88-20,.no independent peer review of this unique PRA methodology was performed by an outside party independent of the licensee and the IPEP.

2.1.2 Containment Analysis and Characterintion The Quad Cities plant is a BWR-3 design with a Mark I containment, which is described in Sections 4.3.1 and 4.3.3 of the submittal, and shown in Figure 4.3-1. The drywell, a steel pressure vessel enclosed in reinforced concrete, is shown in Figures 4.3-2 and 4.3-3. As stated in the submittal, the drywell has a removable head which is secured to the drywell shell by a bolted flange. The internal design pressure of the drywell is 56 psig (at a temperature of 281'F). The pedestal in the drywell supports the RPV. Two sumps are provided in the drywell floor for drainage purposes.

The suppression chamber is a torus-shaped steel pressure vessel and is supported by a concrete foundation slab. Eight vent pipes connect the drywell to the suppression chamber vent header and its 96 downcomer pipes which discharge well below the water level in the torus.

Several containment cooling systems are available in the Quad Cities plant. The RHR pumps can take suction from the suppression pool and discharge it through the spray headers in the drywell or wetwell air space. The EOPs instruct the operator to initiate wetwell sprays if the torus pressure cannot be controlled, but only if the wetwell water level is below 27.5 feet, and the wetwell pressure is less than 6 psig. Otherwise, the EOPs instruct the operator to initiate Quad Cities IPE Back-End Review 3

ERI/NRC 94-107F

,e.-.m..

s

.J drywell sprays. The drywell sprays are important for both drywell pressure control and also for possible quenching of debris on the drywell floor.

Sven fan coolers with capacity of 1.14 MW total are available tc' cool the drywell. Five of the fans are located on the drywell floor. Two fan coolers are located in a compartment adjacent to the pedestal below the RPV. The fans discharge at various locations in the drywell. The fans i

and the associated cooling water pump can all be loaded on to the emergency bus in the event of loss of offsite AC power and drywell cooling can be maintained even during a transient

]

involving a loss of AC power. Operators are directed by 'he EOPs to initiate drywell coolers when drywell gas temperature exceeds 180"F.

1 The torus /drywell vent in the Quad Cities plant consists of 18" vent pipes from both the drywell and the torus gas space, discharged through either the Standby Gas Treatment System (SGTS) or an Augmented Primary Containment Venting System (APCV) which is the " Hardened" vent system. The augmented primary containment vent is an alternative 8" flow path connecting the normal 18" vent to the radwaste vent duct discharging directly into the main chimney. The Quad Cities EOPs instruct the operator to vent the containment when the torus gas space pressure exceeds 46 psig or when the primary containment water level exceeds 93 feet. This vent threshold pressure is considerably lower than other BWRs such as Peach Bottom (100 psig),

and Pilgrim (56 psig).

The various containment systems considered in the submittal are described in Section 4.3.1 of the submittal.

2.1.2.1 Front-End/Back-End Dependencies The IPE used PRTs to model both the front-end and back-end aspects of a severe accident, and as such, no Plant Damage State was defined. Instead, the submittal defined Core Damage Sequences (CDSs).

The core damage sequences have both PDS and source term bin ci:are::teristics. The flin fxr letters are similar to a PDS bin and the fifth letter defines the source term characteristic. The five separate binning characteristics as described below:

1.

Initiatine Event Tvne: This indicator identifies the accident initiator. Eight types of accident initiators were considered:

Transients T

Large Break LOCAs A

Medium Break LOCAs M

S Small Break LOCAs Interfacing Systems LOCA V

Loss of Offsite Power

.L Stuck-Open Relief Valve I

All types of accident initiators appear to have been included in this definition.

Quad Cities IPE Back-End Review '

4 ERI/NRC 94-107F e +

T 2.

Core Damnoe Timine: This indicator differentiates accident sequences based on the time of core damage initiation relative to accident inception, namely:

Early Core Damage (core damage occurs within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the initiation E

of the accident)

Intermediate Core Damage (core damage occurs within 2 - 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after I

l the initiation of the accident) late Core Damage (core damage occurs within 6 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the L

initiation of the accident) 3.

Functional Failure I =Ane to Core Melt: This indicator differentiates accident sequences based on functional availability of core cooling and reactivity control systems. Seven different categories are identified:

Failure of HPCS and ADS A

Failure of all coolant systems B

Failure of containment heat removal C

Failure to scram, but power level reduced to CHR capability D

Failure to scram or failure to reduce power level to CHR capability E

Insufficient coolant makeup with failure to depressurize F

Insufficient coolant makeup at low pressure G

All types of ECCS (and reactivity control) functional failures appear to have been included in this definition.

4.

Cantninment Svetem Statne: This indicator is a descriptor of containment failure time, mode of vessel breach, and water supply to the debris bed (if vessel breach does occur).

j A total of 24 different combinations are found to occur, and they are discussed in detail i

i in Table 4.3.2 (Page 4-24) of the submittal. To summarize, the following characteristics of severe accident progression are described by this designator:

Vessel Breach (yes or no)

Vessel pressure at the time of vessel breach Water supplied to the debris beds (from drywell sprays, LPCI, or SSMP)

Suppression pool cooling available j

Quad Cities IPE Back-End Review 5

ERI/NRC 94-107F

i i

1-Containment vented (wetwell or drywell) l Timing of containment failure (measured from the time of accident initiation) 1 5.

Containment Pananse and Source Term: In the event of containment failure, the releases l

are further classified based on the magnitude of the released source terms as follows:

l A

Greater than 50% noble gases, less than 0.1% CsI, less than 1%

l tellurium, and less than 0.1 % Strontium Greater than 50% noble gases, less than 1 % CsI, less than 1 % tellurium, j

B and less than 0.1 % Strontium Greater than 50 % noble gases, less than 10% CsI, less than 1 % tellurium, C

and less than 0.1 % Strontium Greater than 50% noble gases, less than 10% CsI, greater than 1%

D tellurium, and less than 0.1 % Strontium Greater than 50% noble gases, greater than 10% CsI, greater than 1%

E tellurium, and less than 0.1 % Strontium Greater than 50% noble gases, greater than 10% CsI, greater than 1%

F tellurium, and less than 0.1% Strontium G'reater than 50% noble gases, greater than 10% Csl, greater than 1%

G tellurium, and greater than 0.1% Strontium Less than 50% noble gases, less than 0.1 % Csl, less than 1 % tellurium, S

and less than 0.1 % Strontium (Containment not failed, leakage only)

The source term release definitions cover the expected magnitude of fission product releases in BWRs. However, one shortcoming of the above classification of the release bins is that the definitions do not account for the time of release; therefore, quantitatively similar releases are assigned to early and late release modes. In reality, the early large releases are entirely due to i

different processes (pool bypass, lack of retention, etc.) as compared to late large releases which can be due to revaporization from surfaces, and possibly water pools.

The definition of the CDSs can be found in Table 4.1.3-2 (page 4-23) of the submittal. There are 32,256 possible core damage sequences. To a first order, the first three letters in the core i

damage sequence designation corresponds to the usual plant damage state definition. The fourth letter is equivalent to a traditional definition of a Containment Event Tree (CET) endstate and the last letter is equivalent to a source term bin. The lack of a traditional plant damage state definition makes it difficult to get an understanding of the IPE since each accident sequence las to be followed all the way to containment failure.

Quad Cities IPE Back-End Review 6

ERI/NRC 94-107F l

I 2.1.2.2 Containment Event Tree Development Probabilistic quantification of severe accident progression is performed using a " Plant Response

(

Tree" (PRT) approach. Plant response trees are based on event tree / fault tree methodology.

PRTs start with an accident initiating event and nodal branch points are developed all the way

]

to various end-states that result in radiological teleases. In effect, the PRTs are combinations 1

of 1.evel 1 frontline system event trees and Level 2 accident progression / containment event trees.

The nodes represent success or failure of plant systems or operator actions and are developed further by fault trees, particularly for the plant systems. For development of plant response trees, a set of " critical safety functions" is developed. The critical safety functions pertinent to containment integrity (i. c. the only node on the PRT applicable to the back-end analysis) are:

(1)

RHR functions in suppression pool cooling mode, (2)

RHR functions in spray mode, and (3)

Containment venting successful.

If the accident eventually leads to an environmental release, the end-states are characterized by various release bin attributes. Otherwise, (c. g., no core damage, or core damage without radiological releases) the end-state is classified into either the success category, or the Success with Accident Management (SAM) category.

De SAM end-states refer to those sequences which require accident management actions in order to achieve a stable (plant) state beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after accident initiation. For those accident sequences that entail fission product release, the time period of interest for characterization of the releases is taken to be 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation. De definition of end-states is provided on page 4.23 of the submittal. The portion of the PRT applicable to the back-end analyses is very simple. The only nodes that appear to be considered for the containment analyses are (for a full list, see Table 4.1.3-4, Page 4-32 of the submittal):

o ISLOCA e

Containment Sprays (Operational) e 8 inch drywell vent (functional) e 8 inch wetwell vent (functional) e Operator action to initiate containment sprays e

Operator action to inhibit ADS e

Operator action to vent containment e

1.ocation of containment failure (wetwell or drywell)

It should be noted that the PRTs do not have any nodes that treat the uncertainty in severe accident phenomenology, and issues of uncertainty to containment failure. All the phenomena of irnportance are treated within the MAAP framework, and if the MAAP code calculations show that vessel breach does not occur and containment does not fail, then the sequence is binned as a success end-state. A few sensitivities are performed, but the sensitivity studies alone cannot replace the lack of treatment of phenomenological issues. From the list of event tree Quad Cities IPE Back-End Review 7

ERI/NRC 94-107F

nodes above, it can be seen that the uncertainty in all the phenomena of interest in BWR severe accident phenomenology have been omitted from the CET analyses.

As an example, consider the question of liner melt-through. This mode of containment failure was identified as the principal mechanism of early containment failure for the Peach Bottom plant by the NUREG-1150 analyses. In the NUREG-1150 analyses, liner melt-through was always considered probable, with probabilities varying from 0.38 to 1 depending on the availability of water. Recent NRC-sponsored research is summarized in NUREG/CR-5423 [4]

and it is concludes that the probabihty of drywell melt-through is 10d in the presence of water and 0.63 - 1 in the absence of water. The submittal does identify that liner melt-through is a significant concern for severe accidents that involve a dry pedestal floor, but, since the MAAP code does not have a method of treating the melt spreading and liner attack issue and since the PRTs do not have any node that addresses the probability of direct liner attack by melt, the issue is not considered. Instead a few sensitivity studies have been performed using the MAAP code by causing drywell failure to occur in the accident progression and the resulting source terms are summarized.

The submittal lists the following phenomena as unlikely to lead to containment failure (See Section 4.3.3.2, page 4-136 of the submittal):

Hydrogen Combustion Direct Containment Heating (DCH)

Steam Explosions Molten Core-Concrete Attack (MCCI)

High Temperature Effects on Penetrations Position Evaluation Summaries (PESs) are referenced to in the submittal that justify the licensee position explaining why the above phenomena are considered to be unlikely to lead to containment failure. The licensee provided a summary of a few PES reports as a part of the response to the review team questions [3]. Almost all of the important phenomenological issues that can impact containment integrity have been either neglected or ruled out as improbable.

2.1.2.3 Containment Failure Modes and Timing An evaluation of the containment capacity was performed as a part of the IPE and is discussed in Section 4.3. The following potential failure locations were considered, and failure pressures were evaluated from the structural analyses:

Drywell 125 psig Drywell Shell

> 165 psig Equipment Hatch 150 psig Personnel Airlock 140 psig Mechanical Penetrations Quad Cities IPE Back-End Review g

ERI/NRC 94-107F

l

> 150 psig Electrical Penetrations 125 psig j

Drywell Head Closure H

l Wetwell Vent Line Bellows 93 - 200 psig (118 psig mean) l Wetwell Shell 125 psig l

Uncertainties in the failure pressures for the four dominant failure locations (i.e., drywell head, drywell shell, wetwell shell, and vent line bellows) were considered. Fragility curves for each of these failure modes were constructed and combined into a composite containment fragility I

curve (Figure 4.3-7 of the submittal). The median containment failure pressure was calculated to be 105 psig (at design temperature). I.ow pressure failures are dominated by the drywell head closure. This estimate of containment capacity is considerably lower than typical estimates of the more modern BWRs with Mark-I containtnent (~ 140 psig for Fermi 2, and 148 psig for Peach Bottom) and appears to be similar to estimates for the older designs such as the Pilgrim plant. The failure locations are estimated to be the drywell head and the vent line bellows.

At temperatures above 281*F, significant degradation of material strength and seal properties is anticipated in BWRs with a Mark-I containment. The submittal treats the ovenemperature effect on containment fragility in a simplistic fashion. It is assumed that silicone seals will fail at 500*F. A capacity of 62 psig is indicated at this temperature. A straight line is fitted i

between 105 psig (at 281*F) and 62 psig (at 500'F), and this line is extended to higher temperatures. The results are shown in Figure 4.3-8 of the submittal. Although this method i

is conservative, it tends to underestimate the capacity of the containmedt. As an example, the drywell seals may not fail up to a temperature of 700*F under dry conditions. Given the assumption of seal failure at 500'F, it is to be expected that the drywell head will be the dominant failure mechanism for all overtemperature conditions. (Note that tests performed by Sandia National Laboratories indicate that the BWR Mark I containment electrical penetration assemblies will not degrade at temperatures below 700*F). As such, the drywell closure head seal is judged to be the controlling failure location for containment overtemperature failure.

According to the submittal (Section 4.3.3-1), the MAAP analyses performed for the Quad Cities IPE considered the four overpressure failure locations as well as drywell head failure due to overtemperature.

A discussion of the IPE treatment of temperature-induced failure of containment penetrations is provided in page 4-138 (Section 4.3.3-2) of the submittal. The submittal states that a detailed analysis of the thermal attack of penetrations (by overtemperature) was performed. First, the temperature profile of the drywell for various sequences was obtained.

Next, an aging calculation was performed for the temperature range under consideration. A failure mode and effects analysis of each penetration was performed. It was concluded that, for sequences involving a humid containment atmosphere, the failure of the aging nonmetallic seals was not a concern. For dry conditions, the drywell head seal was found to fail earlier, and hence the Quad Cities IPE Back-End Review 9

ERI/NRC 94-107F

failure of Electrical Penetration Assemblies (EPAs) was irrelevant. These conclusions are a direct result of the assumed form of the containment overtemperature fragility curve.

In summary, the submittal appears to identify and analyze all relevant potential containment failure modes. All applicable containment failure modes from Table 2.2 of NUREG-1335 have been considered. In addition, the issue of containment overtemperature on penetration seals has been addressed. It is to be anticipated that the electrical and mechanical penetrations will not be the dominant failure locations at high containment temperatures. The procedure for obtaining the overall containment fragility curve as shown in Figure 4.3-7 is reasonable. However, the treatment of overtemperature failure is considerably simplified, but appears to be conservative.

2.1.2.4 Containment Isolation Failure in the Quad Cities IPE submittal, containment isolation failure has been considered and ruled out as a contributor to containment failure. The analysts considered several conditions under which isolation can possibly fail in the Quad Cities plant. However, isolation failures are ruled out with the reasoning that "the containment, in normal operation, is nitrogen inerted, and in order for the containment to remain inert, it must also remain isolated". Hence, it is concluded that there are no systems which need to be isolated upon initiation of a severe accident.

Containment bypass was also analyzed as a part of the IPE and the likely mechanisms and locations were identified as being an ISLOCA in the RHR and containment spray piping.

However, the frequency of ISLOCA was calculated to be of the order of 5.7 x 1040 per year, and was considered to be too small to be included in the back-end analyses.

2.1.2.5 System / Human Response Several operator actions were treated in the IPE, and a complete list is provided in Table 4.4.2-1 of the submittal. The most important operator actions with regards to the containment analyses appear to be the 611owing:

Operator action to initiate containment sprays OCNTS Operator action to initiate service water and reactor building OSS cooling water Operator action to initiate containment venting OVNT A detailed discussion of the evaluation of the split fractions for all the operator actions is not provided in the submittal [1] A detailed discussion of the HRA and examples of evaluation of the probabilities of operator actions is provided in attachment 22-1 of the licensee response to the review team questions [3].

Quad Cities IPE Back-End Review 10 ERI/NRC 94-107F

2.1.2.6 Radionuclide Release Categories and Characterization In the Quad Cities IPE submittal, each individual accident sequence is traced from the initiation of the accident until containment failure (if it does occur). One hundred such sequences were identified to be the dominant contributors to core damage; however, the one hundred sequences were further grouped into 24 PDSs, and were further classified into 14 PDS groups based on similarities in accident progression.

As was already discussed in Section 2.1.2.1, the last letter of the core damage sequence descriptor defines the release characteristics and the fourth letter provides information on the containment systems such as the availability of injection systems, ESFs, venting, etc.

Generic letter 88-20 states that "any functional sequence that has a core damage frequency greater than or equal to 104 per reactor year and that leads to containment failure which can result in a radioactive release magnitude greater than or equal to the BWR-3 or PWR-4 release categories of WASH-1400," or "any functional sequences that contribute to a containment bypass frequency of 10-7 per reactor year," should be reported. The following screening criteria are i

used in the IPE submittal to determine the important accident sequences to be reported to NRC:

Any sequence that contributes to more than 10 or more per reactor year to core damage.

All sequences that contribute to the top 95 % of the total core damage frequency All sequences within the top 95 % contribution of the total containment failure probability l

Sequences that contribute to the containment bypass frequency in excess of 104 per reactor year Any other sequence that CECO determines to be of interest from a review of past PRAs Table 4.5.3-1 of the IPE submittal provides a listing of the sequences reported as per the criteria discussed above. The first two sequences in that table (i.e., a loss of offsite power sequence with station batteries available, and a medium LOCA sequence) fall under the first category of having a CDF greater than 10-7 Of course, note that in Table 4.5.3-1 of the submittal, there are no sequences that have a CDF greater than 104 per reactor year, and lead to releases similar

~ to BWR-3 category of WASH-1400 [11]. The sequence that comes closest to the WASH-1400 BWR-3 releases is the first sequence, a dual unit loss of offsite power sequence, which has volatile release of close to 40%. There are no bypass sequences that have a CDF greater then 10* per reactor year. In addition, the reported sequences in Table 4.5.3-1 of the submittal meet the following criteria:

The reported sequences contribute to 87.4 % of the total core damage frequency The reported sequences contribute to 86.2% of the total containment failure probability Quad Cities IPE Back-End Review 11 ERI/NRC 94-107F 1

Hence, it appears that the reporting requirements of GL 88-20 have been met or exceeded by -

the submittal. In addition, the magnitude of the reported source terms are, for the most part, larger than similar results reported in the literature and this will be discussed further later.

2.1.3 Accident Proeression and Containment Performance Analysis 2.1.3.1 Severe Accident Progression A plant-specific version of the MAAP-BWR 3.0B Revision. 7.03 called the CECO-MAAP code was the principal tool used to analyze postulated severe accidents at Quad Cities. As stated in the submittal, a few modifications were incorporated into the code version for the analysis. The top 100 sequences, which contribute to 95% of the total CDF were classified into 24 similar groups (called PDSs in the submittal) for analyses. Rawd on similarities between some of the PDS groupings, it was decided to lump some of the PDS groups together with other PDSs and finally a set of 14 PDS groupings were considered to be sufficient for severe accident and source term analyses. The groupings of similar PDSs is identified in Table 4.5.5-1 of the submittal.

The specific event progression of the highest frequency sequence in the highest frequency PDS in each of the PDS grouping was chosen for source term analysis. The containment analyses were carried out for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation, and not after the time of core damage.

However, none of the analyzed sequences had late (i.e., beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of accident initiation) core damage and it appears that a mission time of close to two days is used in the evaluation of source terms. As a part of this review, a comparison of the results form the IPE with results available in the literature was made, since, the submittal is almost entirely based on these deterministic calculations, and does not consider any phenomenological uncertainties as apart of the PRT analyses.

The following paragraphs provide a summary of sequences analyzed together with a comparison with results available in the literature.

o loss of ofsite power and diesel generators, DC power ami HPCI available 1tus is the dominant core damage sequence accounting for more than 46% of the total CDF of the Quad Cities plant. Core damage starts after the station batteries are depleted. Vessel failure occurs 3.65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> after core damage. Drywell shell failure occurs 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> after core uncovery.

A comparison of the timing of various events between the results of the MAAP calculations and similar calculations performed for the Peach Bottom plant using the MELCOR code at BNL [5]

and ORNL [6] is shown in Table 1. The table also makes a comparison of fission product release fractions to the environment. The MELCOR.timulations performed at BNL were performed for a high pressure station blackout sequence, whereas, the ORNL results reported in the table are for a depressurized station blackout sequence with a late failure of the containment. Even though the MELCOR calculations were performed for different station blackout accident sequences, the results can still be used for comparison purposes.

To a large extent, it can be seen that the results for timings of key events are comparable for the MAAP and MELCOR simulations. The time of containment failure is fairly similar between the various calculations. Even the differences in the time-to-containment failure (from the time Quad Cities IPE Back-End Review 12 ERI/NRC 94-107F

-~

of vessel breach) can be attributed to differences in treatment of the core-concrete interactions between the two codes. A sensitivity study performed with increased core concrete interactions for the MAAP code showed earlier drywell failure, increased release of non-volatile fission products, and more pedestal erosion and ex-vessel hydrogen generation.

A comparison of fission product release fractions shown in Table 1 indicate that the calculated volatiles release fractions are much larger for the MAAP simulations. However, the MELCOR calculations predict much higher releases of refractory species such as strontium. The above-mentioned sensitivity study (performed by reducing the heat transfer from the molten debris in the pedestal to the overlying water) showed that effect of increasing the intensity of the MCCI processes was to increase the release fraction of the SrO species. However, the reporting of releases only at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation, makes the comparison and understanding of release fractions difficult. It appears that the release fractions reported in the submittal are dominated by revaporization of fission products deposited in the RCS and retained on drywell structures.

Medum LOCA with suppression pool cooling, feedwater, and drywell sprays available o

No containment failure, and small releases due to leakage only, o

Loss of ofsite pour, HPCI antilable for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Vessel failure occurs 3.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after core damage (12.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after accident initiation).

Operator initiates wetwell vent, yet, drywell failure occurs 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> after core damage. Fission piu? ct release to the environment is substantial, with 28% of the volatiles, and 44% of the tellurium being released to the environment. Although no similar results are available for

. comparison, the results appear to be conservative.

o Loss of ofsite power, no injection available This sequence is similar to the other loss of offsite power sequences, however lack of vessel injection leads to faster core melt progression. A comparison with the MELCOR-calculated results is provided in Table 1. The results are fairly similar, and they indicate that the MAAP code predicts faster core melt progression. The difference in in-vessel hydrogen generation between the MAAP results and the MELCOR results is due to the modelling of the core blockage in the MAAP code, which leads to local steam starvation.

Sensitivity studies performed for the first sequence (loss of offsite power) indicates increased in-vessel oxidation when the core blockage model is made inactive. The other difference is in the time of containment failure, which is calculated by MAAP to occur at 9.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. However, this can be attributed to the modelling of core concrete interactions in the MAAP code. A comparison of release fractions indicate that the MAAP-calculated release fractions are up to a factor of eight larger than the MELCOR results for the volatile species, and for tellurium. However, the releases calculated for the no-volatiles are lower, and can be attributed to the modelling of the fission product releases during MCCI in the MAAP code.

Quad Cities IPE Back-End Review 13 ERI/NRC 94-107F

O s

t j

Table 1 Comparison of Timing of Various Events and Radionuclide Releases to.

Other Studies (Long Term and Short Term Station Blackout Sequence)

Key Event Quad Cities Quad Cities Peach Peach (Short Term (Long Term Bottom Bottom Station Station (MELCOR, (MELCOR, l

Blackout)

Blackout)

ORNL)

_ BNL)

Core Debris 0.78 1.45 NA+

' 2.0 Relocation *, Hours Vessel Failure *,

2.03 3.65 4.77 4.55 Hours In-Vessel 9

10 35 34 Zirconium Oxidation *, %

l Containment 9.73 8.95 10.3 7.1 Failure *, Hours Release Fraction Group Noble Gases 0.865 0.997 0.889 0.99 Csl 0.54 0.41 0.0013 0.09 Te 0.16 0.128 0.0004 0.02 Sr 3.5E-5 1.5E-4 2.0E-6 0.04 Ru NA+

NA+

6E-7 8E-4

• Not Available

• After Core Uncovery o

Turbine trip ATWS Wetwell failure occurs prior to core damage. Although no comparison is available in the literature for this ATWS sequence, the release magnitudes (2.3% of the volatile species) appear to be reasonable, given that wetwell scrubbing is available. This sequence contributes 2.8% of the CDF and 3.7% of the frequency of the releases.

Quad Cities IPE Back-End Review 14 ERI/NRC 94-107F

s 1krbine trip, HPI unavailable, AC power available a

Vessel breach occurs at high pressure due to unavailability ofinjection sources at 2.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after.

core damage. Operator vents the containment after vessel breach, but owing to the lack of containment cooling, drywell failure occurs 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> after core damage.

However, the magnitude of the fission product releases for this sequence are low because of wetwell scrubbing.

o Ikibine trip ATWS This sequence is similar to the other ATWS sequence discussed earlier, and drywell failure occurs prior to core damage. 58% of the volatile species and 14% of tellurium is released.

These releases are considerably larger than STCP-calculated releases reported for Peach Bottom plant in Reference [7].

In addition to the above-mentioned sequences, seven additional base case sequences were simulated; however, they are qualitatively similar to the seven sequences described above, and i

differ only in the location of containment failure, availability of ECCS. etc. Also, the magnitude of the fission product releases calculated for these sequences appear to be conservative in comparison with results reported in the literature. Furthermore, a number of phenomenological uncertainties of importance to both containment performance and source term analyses are treated indirectly through sensitivity analyses performed using the MAAP code.

Section 4.5.6 of the submittal summarizes the sensitivity analyses performed as a part of the IPE. The choice of the sensitivity analyses are based on Table A.5 of NUREG-1335, the recommendations of the EPRI

• Guidance Document" for using MAAP [8], and insights of the IPE analysts. The following uncertainty issues were investigated through performance of sensitivity analyses with the MAAP code:

Core Melt Progression /In-Vessel Hydrogen Generation Core Relocation Characteristics Containment Pressure load due to RPV Failure (including the effect of hydrogen combustion)

Shell Failure by Liner Melt Through Ex-Vessel Debris Coolability Containment Failure I.ocation cantainment Failure Area A brief description of each sensitivity case is provided in Table 4.5.6-3 of the submittal, and a results for the timing of key events, typical figures-of-merit such as containment pressures, temperatures, etc, and fission product release fractions are summarized for all the sensitivity analyses in Table 4.5.6-4 of the submittal. A summary ofinsights and conclusions from these analyses is presented in Table 4.5.6-5.

Quad Cities IPE Back-End Review 15 ERI/NRC 94-107F

E W

The phenomenon that has the most significant impact on the results is drywell melt-through due to direct contact of core debris. Two different drywell shell failure sizes (1 inch and 20 inch diameter holes), at two different times after vessel breach were investigated. Large increases

. in the release of iodine, cesium and tellurium are reported.

The effect of disabling the " core blockage" model on in-vessel hydrogen generation was investigated for a loss of offsite power sequence; a large increase in in-vessel oxidation was noted.

The effect of additional hydrogen generation upon containment failure was also investigated. Two sensitivity cases m the submittal investigate the effect of accelerated MCCI; this was made possible by reducing the heat transfer to overlying water. Slightly earlier drywell failure was noted to occur. A significant increase in nonvolatile fission product releases, and slightly increased pedestal erosion depth was noted to occur in these calculations.

A number of the base case simulations had assumcd operator action to open the wetwell vent after the drywell pressure exceeds 46 psig. Several sensitivity studies were performed by assuming that no wetwell venting was performed. Instead wetwell and drywell failure (upon reaching the failure pressures) were assumed to occur. In sequences where wetwell failure was calculated to occur, the magnitude of the fission product releases was smaller. However, failure of the drywell (in the absence of wetwell venting) was found to lead to a large increase in volatile and nonvolatile species.

In summary, the performed sensitivity calculations are extensive, and to a large extent, lead to results that are physically plausible. However, a number of other parameters recommended for sensitivity study by NUREG-1335 are not considered in the submittal, and dismissed using other analyses which form part of Position Evaluation Summaries (PESs). They include the following:

Hydrogen combustion Mode of Vessel Breach (Penetration failure vs. creep rupture)

Steam Explosions Direct Containment Heating Early Containment Failure by Pressure load Liner Melt-through by Contact with Debris Long Term MCCI PESs are referenced in the submittal, but not provided. These PESs form the bases of the dismissal of severalimportant phenomena such as direct containment heating. Of the neglected phenomena, the most important appears to be liner melt-through, and the CECO PES (summarized in page 4-240 of the submittal) indicates that drywell melt-through in the presence of water is unlikely. Hydrogen combustion is not expected to be a threat to containment failure in the inerted BWR Mark-I containment, but combustion can occur in the reactor building, following containment failure. In the IPE analyses, if water is present and a water supply (through drywell sprays or through ECCS) is available to cool the debris, drywell shell melt-through is considered implausible. The submittal states that drywell melt-through is more likely when the drywell floor is dry, and the sensitivity studies performed indicate that increased Quad Cities IPE Back-End Review 16 ERI/NRC 94-107F

releases are possible. However, this possibility is not considered in the event tree analyses, and the baseline analyses are completely deterministic, and no node has been included in the PRT to treat the potential of containment failure due to liner melt-through issue.

2.1.3.2 Dominant Contributors: Consistency with IPE Insights Table 2 shows a comparison of the conditional probabilities of the contair. ment failure modes provided in the Quad Cities IPE submittal, together with the results of the IPE submittals for the Fitzpatrick, Oyster Creek and Pilgrim plants, as well as the NUREG-1150 study for Peach Bottom [10]. Note, that the results reported for Peach Bottom do not include internal flood events.

Table 2 shows that, in comparison with the other plants, Quad Cities has a significantly lower l

conditional probability of early containment failure, and accordingly, a much higher probability of late containment failure. The conditional probability of early containment structural failure l

is 3.8%. The only contributors to early containment failure in the Quad Cities plant are the ATWS sequences. In the ATWS sequences, containment failure (or venting) often occur prior to core damage. There are no other sequences with early containment failure (i.e., at or around vessel breach).

All the important phenomena that can lesd to overpressurization of the containment and cause early containment failure are excluded in the submittal. Hence, it appears that the Quad Cities IPE submittal may have understated the contribution from early drywell failure due to overpressurization.

For BWRs with Mark I containments, a dominant cause of early containment failure is drywell liner melt through. The submittal states in Table 4.5.6-1 that drywell liner melt-through is likely 1

if the floor is dry. Approximately 77.1 % of the CDF [3] involve sequences with a dry pedestal floor. It is anticipated that liner melt-through should result with a high conditional probability for these sequences. Indeed, for these sequences, the conditional probability of containment failure (structural) is 68.4%. However, the containment failure is by late, overtemperature mode, and not the liner melt-through mode. This is a significant difference between the submittal and other PRAs which have considered the liner melt-through issue in detail. The IPE submittal makes use of the MAAP code (which is incapable of treating this issue) and makes use of the MAAP results, and thus has not fully addressed this failure mode.

It should be noted that many of the sequences that are associated with ' late" containment failure entail large releases of fission products. For instance, the loss of offsite power sequence (contributing to 46.2 % of the total core damage frequency) is seen to lead to containment failure 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br /> after accident initiation. However, for this " late" containment failure sequence, the release fraction of volatiles is more than 40% of the inventory.

The relatively high probability of late containment failure reported in the submittal is the result of the understatement of the probability of early containment failure. The principal failure mechanism in the Quad Cities IPE is drywell failure by overtemperature a few hours after vessel breach, and wetwell venting. Many sequences that entail wetwell venting also involve late Quad Cities IPE Back-End Review 17 ERI/NRC 94-107F

F O

E Table 2 i!!.

O Containment Failure as a Percentage of Internal Events CDP g

Comparison to Other BWR Mark I IPEs and Peach Bottom NUREG-ll50 Results R-in 8.

Containment Fitzpatrick Oyster Creek Peach Bottom Pilgrim Quad Cities

c Failure IPE IPE NUREG-1150 IPE IPE Q

[

CDF (per year) 1.9 x 104 3.2 x 10 4.3 x 104 5.8 x 104 1.2 x 104 4

Early Failure 60.4 16.4 46 21.6 24*

l Bypass NA 7.3 NA 0.4 SE-04 g

Late Failure 26.0 26.4 26 61.0 55" Intact 2.5 0.0 3

1.2 21.0 +

No Vessel 11.1 50.4 25 15.8 NA Breach NA Not Available j

Including no vessel breach

+

Out of which,4 % is due to containment structural, overpressure failure and 20 % is due to venting. However, m

90% of the early venting sequences (i.e.,18% of the CDF) also have late containment failure due to g

overtemperature.

O T

Out of which,53% is containment structural, overtemperature failure, and 2% is due to venting.

4.

O m

l i

}

drywell shell failure. The significantly increased conditional probability of late drywell failure.

is the principal difference between the Quad Cities IPE submittal, and other PRAs reported in i

the literature. A similar conclusion was reached by the NUREG-1150 analysts, who performed i

a sensitivity analysis in which liner melt-through was suppressed; it was found that although the i

probability of early containment failure was reduced for station blackout sequences, the probability of late containment failure was increased.

Approximately 20% of the CDF corresponds to sequences that have early venting. The high conditional probability of early venting is probably due to the low venting threshold (46 psig).

However, more than 90% of these sequences (18% of the CDF) are associated with late containment structural failure.

Figure I shows a comparison cf the frequency of cumulative exc-hmce of Cs1 plotted as a function of the fraction of inventory released to the environment, as obtained from the results of the Quad Cities IPE submittal. The figure also shows a comparison of releases with the Peach Bottom NUREG-1150 analyses [11], and results from the Pilgrim IPE. The results show that there is a qualitative similarity between the Peach Bottom releases and the releases calculated by the IPE. However, nne important difference is to be noted: the reported releases in the Quad Cities IPE submittal are cumulative releases at a time period of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. As such, a large component of the releases should be due to revaporization of fission products. In contrast, for Peach Bottom, a large fraction of the Csl releases are associated with liner melt-through at vessel breach (early containment failure).

2.1.3.3 Characterization of Containment Performance The CECO version of the MAAP code was used to calculate all accident progression parameters.

The submittal rules out phenomena not treated by the MAAP code, or those that have considerable uncertainties associated with them. The submittal lists the following phenomena as unlikely to lead to containment failure (See Section 4.3.3.2, page 4-136 of the submittal):

Hydrogen Combustion Direct Containment Heating (DCH)

Steam Explosions Molten Core-Concrete Attack (MCCI)

High Temperature Effects on Penetrations All energetic phenomena are exchuled, and with the neglect of the uncertainty in the containment fragility, it is not surprising to see that the submittal calculates a zero probability of containment failure due to energetic events. The only contributors to early containment failure are the ATWS sequences.

The licensee appears to have performed additional analyses (not reported in the submittal) for the DCH and EVSE issues. As a response to review team questions, the licensee provided a brief summary of the PES on the Quad Cities DCH issue. The conclusion of this PES is that Quad Cities IPE Back-End Review 19 ERI/NRC 94-107F

0 l

Frequency of Exceedance per Year of Csl Release to Environment l

l Frequency of Exceedance(per Year) om001 0.a0001 c

0.000001 e

1E 07 -

o

b ' '

' ' ' ' '.'00001

' ' ' ' ' '.0001 1Em 0

0 0.001 0.01 0.1 1

O.000001 Fraction of Inventory Released to Environment

-Peach Bottom NUREG-1150

+ Quad Cities Figure 1 Frequency of Exceedance per Year of Csl as a Function of Fraction of Inventory Released to the Environment; Comparison to NUREG-1150 Results Quad Cities IPE Back-End Review 20 ERI/NRC 94-107F i

the DCH pressurization in the drywell in the Quad Cities plant can be effectively mitigated'by.

the suppression pool.

The licensee also summarized the results of the PES for the EVSE issue as a response to the review team questions [3]. The licensee stated that simplified EVSE calculations for the Quad Cities plant showed that the increase in containment pressure due to the explosions was estimated to be 4.5 psi. The pressure load on the pedestal wall was 6 psid (best estimate) and 100 psid (worst-case estimate). The pressure loads on the containment and shock loads on the pedestal walls resulted in stresses and strains well below the failure criteria assumed for the analyses.

1 It appears that the analyses are simplistic, and the impulse on the pedestal wall and the containment structural response have not been considered in detail for these calculations.

It also appears that the submittal may not have correctly characterized containment performance for early drywell failure due to overpressurization. The method of evaluation of the conditional probability of ectly drywell failure is very simple. In the PRTs, failure of containment integrity is defined as "when the containment pressure exceeds 105 psig, the containment fails" (page 4-

' 34 of the IPE submittal). This treatment is incorrect, and understates the potential for early drywell failures due to overpressurization, since it does not account for the uncertainty in the structural fragility and pressure loading associated with severe accident progression. Even at j

peak pressures well below the mean failure pressure, there may be a reasonable probability of drywell failure.

Table 2.5-11 of Peach Bottom NUREG/CR-4551 shows early drywell overpressure conditional failure probabilities of between 2 and 19 percent for different PDSs (as opposed to zero for Quad Cities). Owing to the smaller containment capacity for the Quad Cities plant, the probability of early drywell overpressure failure should be even larger.

i

• Iherefore, the Quad Cities treatment of drywell overpressure failure appears to be incorrect.

]

The other significant shortcoming of the submittal relates to the treatment of liner melt-through.

The submittal correctly recognizes the fact that for accident sequence,s involving a dry pedestal, the probability of liner melt-through is not negligible, and cannot be determined using a code such as MAAP. However, in the PRT quantification, the submittal does not provide the 4

probability of drywell shell melt-through for sequences involving a dry pedestal floor. Note that 77% of the CDF involves sequences with a dry pedestal floor [3]. Liner melt-through is not considered probable for these sequences.

Even though sensitivity calculations have been performed and documented in the submittal for various failure sizes in the liner at or around the time of vessel breach to simulate liner melt-through, no use was made of these results for the PRT quantification. The exclusion of liner melt-through as a possible containment failure mode in the PRT analyses is thus a significant shortcoming of the IPE.

2.1.3.4 Impact on Equipment Behavior Section 4.4.5 of the submittal provides a discussion of the analyses performed to study equipment survival under various accident conditions. The process was divided into three phases. In the first phase, equipment survival for support state and fault tree models was reviewed. The CECO version of the MAAP code was used to evaluate equipment survival. In Quad Cities IPE Back-End Review 21 ERI/NRC 94-107F

Phase II, all the PRTs were reviewed to determine which initiators and events can produce a harsh environment. The limiting conditions were identified for the PRTs for each equipment, and survivability conditions were identified. Tables 4.4.5-1 and 4.4.5-2 of the submittal provide a list of equipment that are needed to mitigate severe accidents. It was determined that all these equipment will survive, and will be available in a severe accident. In addition, a list of equipment that is necessary for accident management, and for post core-damage purposes is listed in Table 4.4.5-3 of the submittal. This table includes equipment important to the back-end severe accident analyses, such as RHR pumps, core spray pumps, ADS valves, vent valves, drywell fan coolers. The identification and evaluation of the survivability of this equipment was determined to be beyond the scope of the IPE submittal. As a response to the Irview team question, the licensee stated that [3] performance and survival of the remaining equipment will be treated as a part of the accident management activities to be undertaken by the licensee.

2.1.4 Rad u ine the Prahnhility of Core Damnoe or Fission Product Palan=a t

2.1.4.1 Definition of Vulnerability The submittal concludes that the core damage frequency evaluated for the Quad Cities plant is low, and that there are no " vulnerabilities" which require attention to improve the plant risk profile. The submittal does not provide any definition of " vulnerability".

It should be noted that a few initiators, particularly the dual unit loss of offsite power initiator dominate the CDF profile and releases. Although this is not unique to the Quad Cities plant, and has been noted in other IPEs, the submittal does not consider the importance of emergency AC power sources; instead, the submittal concludes that, based on the low CDF, the loss of offsite power and loss of onsite AC sources do not constitute a vulnerability.

i 2.1.4.2 Plant Modifications As stated in Section 4 of the submittal, during the course of the conduct of the IPE study, the licensee was in the process of making a number of plant modifications, including the following:

Installation of a hardened vent path Implementation of Revision 4 of the Emergency Procedure Guidelines The two modifications have already been credited by the licensee in the IPE, although the installation of the hardened vent was not complete at the time the IPE study was completed.

4 l

2.1.5 Responses to CPI Program Recommendations Generic Letter 88-20 supplement numbers 1 [12] and 3 [13] identified specific Containment Performance Improvements (CPIs) to reduce the vulnerability of containments to severe accident challenges. For BWRs with Mark I containments, the following improvements were identified:

Quad Cities IPE Back-End Review 22 ERI/NRC 94-107F

.--n

-c.---

- ~,

,. + -

Hardened vent, Alternative water supply for drywell spray / vessel injection, Enhanced reactor pressure vessel depressurization system reliability, and Implementation of Revision 4 of the BWR Owners Group EPGs.

Although the submittal does not specifically address the CPI issues, specific recommendations have been addressed in the submittal. As already mentioned, the licensee is in the process of adding a hardened vent system, and the submittal includes this feature in evaluation of the containment response. Alternate water supply (i.e., from the fire protection system) has been identified for RPV injection through the SSMP. The licensee also identified alternate injection sources (i.e., the fire protection system and the unit 2 RHR system) for drywell sprays. The licensee stated in response to a review team question [3] that procedures are in place for using the interconnection to inject water from the fire protection system to the RPV using the RHR

)

system piping. The submittal has not addressed the reliability of the ADS system. In response R

to review team questions, the licensee stated that ADS hardware failures are not significant contributors to the CDF, and the potential benefits of enhanced depressurization capability are i

not significaat. However, the licensee is committed to replacement of the electromatic relief valves used in the ADS by power-operated relief valves. The submittal has credited the implementation of revision 4 of the BWROG EPGs in the submittal.

2.1.6 Other Issues Other outstanding issues identified as a part of the draft review [2] and the licensee responses to these issues [3] are summarized in this section. The issues include:

1.

Lack of treatment of post-core damage recovery actions:- The licensee responded that probabilistic credit was not taken in the IPE analyses for human intervention unless the pertinent actions are included in plant procedures. The only exception was the treatment of recovery of offsite power, which was included in the PRT analyses.

' 2.

The decision of CECO to forego the external vessel cooling strategy based on the risk model developed by the licensee (Section 5.3.2, page 5-11 of the submittal). The licensee stated that [3] the licensee will pursue strategies to prevent RPV breach by dryweD flooding using sprays following the recommendations of the BWR owners group.

3.

The licensee did not evaluate the probability of the SRV tailpipe being stuck open during the course of a high pressure accident sequence. However, since, for a large fraction of high pressure sequences, containment failure occurs with suppression pool bypass, the neglect of the SRV failure is probably conservative.

Quad Cities IPE Back-End Review 23 ERI/NRC 94-107F

2.2 IPE Strengths and Weaknesses 2.2.1 IPE Strengths 1.

The Back-End portion of the IPE is complete with regard to the information provided in the subject areas identified in the Generic letter 88-20.

j 2.

The Quad Cities IPE employed an innovative PRA methodology, where the level 1 and level 2 ponions of the study are fully integrated with an Accident Management (AM) program. This is stated to allow synergistic modelling of the plant with important safety i

insights.

3.

The Accident Management program was integrated in the Quad Cities IPE. It introduces Success with Accident Management (SAM) sequence end-states to track sequences that would lead to core damage after the traditional 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> evaluation time of PRAs.

4.

The source term analysis in the Quad Cities IPE submittal has been performed with a state-of-the-art tool and considerable source terms have been calculated.

5.

The submittal claims to have acquired new insights about the operational safety of the plant from the IPE, though none of the reported insights are applicable to the back-end analyses.

2.2.2 IPE Wanhaecae 1.

The issues considered as a part of the PRTs in the submittal do not include all phenomena of interest to severe accidents in BWRs. Uncenainties in severe accident phenomenology are ecluded based on position papers prepaned by CECO. The severe,

accidents have been assessed only within the deterministic framework of the MAAP computer code.

2.

Involvement of CECO personnel in the IPE appears to have been limited to analysis of.

success criteria and review of the IPE models, assumptions and results. The major modelling and analyses were performed by IPEP (Westinghouse, Fauske and Associates, Inc. and TENERA) contractors.

3.

The licensee has used analyses to argue that all the phenomena that typically lead to early containment failure in BWRs with Mark I containments can be excluded as possible threats to containment integrity. Examples of such phenomena include liner melt-through by direct contact with core debris, direct containment heating and steam explosions. The licensee refers to Position Evaluation Summaries (PESs) to justify its position on these issues. The only contributor (s) to early containment failure are ATWS sequences, which lead to containment failure prior to core damage. The probability of early containment failure is found to be zero in this submittal for non-ATWS sequences. This result is Quad Cities IPE Back-End Review 24 ERI/NRC 94-107F

markedly different from all previous PRAs/IPEs that have been performed for other f

BWRs with Mark I containments.

4.

The radionuclide releases calculated for the Quad Cities IPE submittal are based on integral values corresponding to a time period 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after the initiation of the accident. In the late phase of a severe accident, revaporization of fission products is i

expected to dominate the releases of volatile species. The early large release components (occurring at the time of early containment failure) have not been reported separately.

l Quad Cities IPE Back-End Review 25 ERI/NRC 94-107F

_._ ~..

i a

3.

OVERALL EVALUATION AND CONCLUSIONS The back-end portion of the Quad Cities IPE submittal provides a substantial amount of information in regard to the subject areas identified in Generic Letter 88-20 and NUREG-1335.

This IPE uses the IPEP-developed PRA methodology, the results of MAAP computer code, and results from experiments to essentially exclude any early challenges to the containment integrity.

The IPE methodology uses a Plant Response Tree (PRT) approach developed by CECO, in which, accident sequences are followed from the time of accident initiation until the time of containment failure. The back-end portion of the PRT is abridged, and uncertainty in several phenomena ofinterest to severe accidents in BWRs are not fully considered. The CECO position on several energetic phenomena are summanzed in Position Evaluation Summary (PES) reports, and based on these reports, several accident phenomena are excluded from further consideration.

Examples of such phenomena include steam explosions, direct containment heating and hydrogen combustion. As a response to the NRC review team questions, The licensee provided summaries of the PESs discussing the exclusion of DCH and EVSE as possible containment failure modes for the Quad Cites plant. It appears that the license 6. has performed some calculations to estimate the containment loads due to these phenomena.

Other phenomena such as the drywell liner melt-through due to direct contact with molten core debris are treated as part of sensitivity studies. The exclusion of important accident phenomena from the PRT and the severe accident analyses is an important shortcoming of the submittal.

In particular, a significant number of sequences (corresponding to 77% of the CDF) involve a dry pedestal floor. It is anticipated that the conditional probability ofliner melt-through will be high for these sequences. However, since the submittal does not consider this issue in the PRTs, the conditional probability of liner melt-through is low. Many of these sequences have late containment failure by overtemperature.

The following are the major findings of the Quad Cities IPE submittal:

The Quad Cities plant has reliable safety systems. The overall core damage frequency 1

of 1.2 x 104 per year is dominated by one initiating event, dual unit loss of offsite power. No other particular vulnerability to core damage was found for the Quad Cities plant.

The contcinment analyses indicate that there is a 78 % conditional probability of releases, and 22% probability ofintact containment.

Unique design features in the plant, such as the shutdown makeup pump system, shared safety water system, and shared condensate storage tanks, help so reduce the core damage frequency.

The important points of the technical evaluation of the Quad Cities IPE back-end analysis are summarized below:

Quad Cities IPE Back-End Review 26 ERI/NRC 94-107F e

r

i A PRA methodology involving the use of plant response trees that track the severe acrident sequence from the initiation of the accident to containment failure, has been used. The treatment of the containment phenomena is abridged.

Uncertainties in severe accident phenomenology are excluded based on position papers i

prepared by CECO.

All the phenomena are treated within the MAAP modelling framework.

4 Phenomena that lead to early containment failure (i.e., DCH, steam explosions, liner i

melt-through) have either been ruled out, or have not been treated as an uncertainty in the quantification of the PRTs (i.e.. liner melt through). The result is that early containment failure for the Quad Cities plant is entirely due steam overpressurization during ATWS sequences, while late containment failure is expected to occur for a large fraction of accident sequences. The results of the IPE are inconsistent with the results of the recent NRC studies and the IPEs for other BWRs with Mark-I containment.

The source terms are reported at a time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation. Large, risk-dominant releases that occur around the time of vessel breach have not been reported separately in the submittal.

I Quad Cities IPE Back-End Review 27 ERI/NRC 94-107F

4.

INSIGHTS, IMPROVEMENTS AND COMMITMENTS It is stated in Section 4.7 of the submittal that 81 insights were obtained from the IPE, which were classified into groupings based on the following subject areas, namely, loss of offsite power / station blackout, drywell flooding, ISLOCA, NRC strategies, and containment performance. The obtained insights are not provided in the submittal. However the licensee provided a complete list of the obtained insights in the form of tables in attachment 42-1 to the licensee response to review team questions [3]. Most of the insights are related to the front-end analyses, but a number of these insigms are related to drywell and RPV flooding are also provided. It appears that the implementation of some of these insights (possibly in EOPs) will be a part of the CECO accident management program.

In addition, Section 5.3.2 of the submittal provides a description of two Accident Management insights.

Pkmion of RPV Failure by Drvwell Floodine. The CECO experiments and analyses had indicated that drywell flooding (and submergence of the lower vessel head) can prevent vessel breach. A large volume of water is required to flood the containment and subraerge the RPV in the Quad Cities plant. The pedestal would require structural modifications so that the RPV lower head can be submerged without flooding the torus and the drywell, or without requiring a substantial quantity of water. CECO investigated the possibility of addition of an external spray that can flood the pedestal region and submerge the lower vessel head. The benefits of adding the external spray were compared against the additional risk avoided, using the " CECO societal risk model". It was concluded that the level of avoided risk did not justify implementation of such modifications.

Alternate Sources for Containment Splay Loss of offsite power sequences and ATWS sequences have a pc:ential for.large releases. The releases for all accident sequences can be mitigated by the use of drywell sprays. Water supply for drywell sprays can be from the RHR system of the othec unit or the fire protection system of the first unit. It is also stated that "t'ne sprays can alsc orevent containment failure and prevent MCCI". This insight was not evaluated further, and no discussion can be found in the submittal or the liccasee response s on the imp;ementation of this modification.

In rxidition, a number of plant-specific features were also identified as insights by the IPE analysts, and they include the following:

F Shared Service Water System The service water system in the Quad Cities plant is shared between both units, thus reducing the probability of loss of service water.

Shpred Condensate Storage Tank The two CSTs in the two units are cross connected, thus extending the availability of water inventory to CRD, SSMP, and HPCI pumps.

Quad Cities IPE Back-End Review 28 ERl/NRC 94-107F

=

i i

Safe Shutdown Makeuo Pumo CECO has installed an electric motor-driven pump system to inject water into the vessel during fire-initiated accidents. The pump can take suction from the CST and the fire protection system, and inject water into the RPV.

i The licensee has not committed to any hardware modifications based on the results of the IPE submittal.

The containment performance for the Quad Cities plant as portrayed by the IPE submittal, is largely driven by the assumptions of the submittal. The licensee has ruled out a number of important severe accident phenomena that can impact containment pressurization. The issue of liner melt-through has only been considered through a MAAP sensitivity study and not included as a part of the PRT structure. In addition, the reported radiological releases do not distinguish the timing aspects of all source terms, and only report the integral 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> source term estimates. The IPE process can be substantially improved by adequately considering the likelihood of containment failure due to important severe accident issues.

l i

i i

Quad Cities IPE Back-End Review 29 ERI/NRC 94-107F O

5.

REFERENCES 1.

" Quad Cities Nuclear Power Station Individual Plant Examination for Internal Events per GL-88-20," Commonwealth Edison Company, September 1992.

I 2.

R. Vijaykumar and M. Khatib-Rahbar, " Submittal Only Technical Evaluation Report on the Quad Cities Individual Plant Examination (IPE) Back-End Submittal," ERI/NRC 94-107 (Draft), March 1994.

3.

Respose to RAI on Quad Cities IPE Submittal, Commonwealth Edison Company August 1994.

4.

T. G. 'Iheofanous, et al., "The Probability of Liner Failure in a Mark-I Containment,"

NUREG/CR-5423, August 1991.

5.

I.K. Madni, "MELCOR Simulation of Iong Term Station Blackout at Peach Bottom",

Proceedings of the Eighteenth Water Reactor Safety Information Meeting, NUREG/CP-0014, Vol. 2, October 1990.

6.

J. J. Carbajo, " Severe Accident Source Term Characteristics for Selected Peach Bottom Sequences Predicted by the MELCOR Code," NUREG/CR-5942, ORNL/TM-12229, September 1993.

7.

R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios, BWR, Mark I Design," NUREG/CR-4624, BMI-2139, Vol.1, July 1986.

8.

Gabor, Kenton & Associates, Inc., " Recommended Sensitivity Analyses for an Individual Plant Examination Using MAAP 3.0B," EPRI TR-100167,1991.

9.

USNRC, " Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH 1400 (NUREG-75/014), October 1975.

10.

USNRC, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants,"

NUREG-1150, Vols. I and 2, December 1990.

11.

" Evaluation of Severe Accident Risks: Peach Bottom, Unit 2," NUREG/CR-4551, Vol.

4, Rev.1, December 1990.

12.

NRC Ietter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, " Initiation of the Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 550.54(f)," Generic Letter 88-20, Supplement No.1, dated August 29,1989.

j Quad Cities IPE Back-End Review 30 ERI/NRC 94-107F

13.

NRC Letter to All Licensees Holding Operating Licenses and Construction Permits for.

Nuclear Power Reactor Facilities, " Completion of Containment Performance Improvement Program and Forwarding of Insights for Use in the Individual Plant Examination for Severe Accident Vulnerabilities - Generic Letter No. 88-20 Supplement No. 3 - 10 CFR 650.54(f)," Generic Letter 88-20, Supplement No. 3, July 6,1990.

Quad Cities IPE Back-End Review 31 ERI/NRC 94-107F

t i

i i

)

APPENDIX A l

IPE EVALUATION AND DATA

SUMMARY

SHEET I

BWR Back-End Fads Plant Name Quad Cities Nuclear Power Station, Units 1 and 2.

l Containment Type i

Mark I.

Unique Containment Features j

None found.

Unique Vessel Features I

l None found.

i l

Number of Plant Damage States 24 Containment Fallust Pressure 105 psig (mean)

Additional Radionuclide Transport and Retention Structures No credit taken for retention in the Reactor Building or other structures.

Conditional ProbabHity That the Containment is Not Isolated 0.0 Important Insights, Including Unique Safety Features Shared Service Water System: The service water system in the Quad Cities plant is shared between both units, thus reducing the probability of loss of service water.

Quad Cities IPE Back-End Review 32 ERl/NRC 94-107F

Shared Condensate Storage Tank: The two CSTs in the two units are cross connected, thus extending the availability of water inventory to CRD, SSMP, and HPCI pumps. '

l l

Safe Shutdown Makeup Pump CECO has installed an electric motor-driven pump system l

which can be used as a backup the RCIC pumps in fire scenarios, and can also be used l

' to inject into the RPV, taking suction from either the CST, or the fire water system.

Implemented Plant Improvements l

Hardened vent system in the process of being installed.

C-Matrix Cannot be extracted from the results of the Quad Cities IPE.

l I

l l

Quad Cities IPE Back-End Review 33 ERI/NRC 94-107F

A.

Al--4d-M4A+-a-a-*

.+eJ---

4-.

4 4

---4

,--aAAAa--h---A--

L R

AL.

-a4--mu.A---

--a.J.-

'--.e a

p

=*aee S a-at

-+m,-m--4=emM-haA._--%.a,-a.,s.me.-

...u--

l l

l

\\

I l

l QUAD CITIES UNITS 1 & 2 INDIVIDUAL PLANT EXAMINATION TECHNICAL EVALUATION REPORT (HUMAN RELIABILITY ANALYSIS) l l

l l

ENCLOSURE 4

_