| |
Search Options | |||
| Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us | |
|||
SECY-96-051
March 8, 1996
| FOR: | The Commissioners |
| FROM: | James M. Taylor /s/ Executive Director for Operations |
| SUBJECT: | STATUS OF THE IPE AND IPEEE PROGRAMS |
PURPOSE:
To discuss the status of the staff's Individual Plant Examination (IPE) and IPE External Events (IPEEE) reviews and associated assessment of generic insights as requested by Staff Requirements Memorandum (SRM) dated April 20, 1989 to provide annual updates. In addition, in response to the Commission's SRM dated April 18, 1995, discussion is provided regarding methods for evaluating the validity of, and guidance for providing consistency to, probabilistic risk analyses (PRAs). Last, in reference to the Commission's SRM dated May 24, 1993, an update is provided regarding staff work to assess the results of IPEs in the context of the Commission's Safety Goals.
SUMMARY:
The IPE submittals and the IPEEE submittals are being reviewed to determine whether the licensees' analyses met the intent of GL 88-20. The staff's conclusions on each IPE and IPEEE are documented in staff evaluation reports (SERs) issued to each licensee. The IPE submittal reviews were scheduled to be complete in June 1996; however, the completion of the review of fewer than 10 of the remaining IPE submittals may be delayed until September 1996. This delay is due to the expansion of the staff review to cover revised IPE submittals and due to the request by several licensees for additional time to respond to the staff's request for additional information. The IPEEE submittal reviews were originally scheduled to be complete in 1998; however, reductions in the FY96 (and subsequent year) budgets have impacted plans in this area.
The IPE submittals are being examined to determine what the collective IPE results imply about the safety of U.S. nuclear power plants. Insights gained from this examination are to be published in a NUREG report for public comment in October 1996. However, since the IPEs only cover internal initiators and internal flooding, a separate NUREG report will examine insights from the IPEEEs, which address external events. The schedule for completing this report has not yet been established.
BACKGROUND:
On August 8, 1985, NRC issued a Policy Statement on Severe Reactor Accidents Regarding Future Designs and Existing Plants (50 FR 32138) that introduced the Commission's plan to address severe accident issues for existing commercial nuclear power plants. In this Policy Statement, the Commission addressed its plan to formulate an approach for a systematic safety examination of existing plants to study particular accident vulnerabilities and desirable cost-effective changes so as to ensure that there is no undue risk to public health and safety. Generic Letter (GL) 88-20, in November 1988, requested all licensees to perform an IPE to identify any plant-specific vulnerabilities to severe accidents, and to report the results to the Commission. Supplement 4 requested licensees to perform an IPE of external events and also report these results to the Commission. There are four main objectives of the IPE/IPEEE program for the licensees, as stated in the Generic Letter:
On April 20, 1989, in an SRM, the Commission requested annual briefings on the Severe Accident Integration Plan. This paper principally addresses the IPE and IPEEE portion; the other elements of the Severe Accident Integration Plan will be provided to the Commission by the end of April 1996.
On May 24, 1993, in an SRM, the Commission requested a paper outlining the major achievements obtained from the IPE and IPEEE programs. It was also requested that the staff include any insights or conclusions on IPE perspectives relative to public risk associated with the operation of existing nuclear power plants with the Commission's Safety Goal Policy. In SECY-94-134, "Status of IPE and IPEEE Insights Programs," dated May 20, 1994, the staff provided the Commission preliminary results from the IPE Insights Program.
On April 18, 1995, in an SRM, the Commission requested that "some thought be applied to methods for evaluating the validity of, and guidance for providing consistency to, PRAs. Similarly, some means for comparing the effects of different PRAs, in order to provide confidence that the PRA methods and models which are being used provide reasonable results, would be useful." This paper discusses staff work in each of these areas.
DISCUSSION:
Status of IPE and IPEEE Submittal Reviews
Each IPE submittal is reviewed with a focus on whether the licensee's method was capable of identifying vulnerabilities. Therefore, the review considers (1) the completeness of the information and (2) the reasonableness of the results given the plant design, operation, and history. The overall structure of the IPE review process involves NRC contractors performing the basic review (provided in a contractor technical evaluation report (TER)) with the staff serving in an auditing and monitoring capacity as part of the NRC quality assurance process. This staff function is accomplished by a Senior Review Board (SRB) comprised of NRC staff and NRC consultants who are PRA experts. The contractors' TERs form the basis of the SER that is prepared by RES and transmitted to NRR for issuance to the licensee. The SER provides a summary of the contractors' findings (the contractor TER is enclosed with the SER) and provides the staff position regarding whether the licensee met the intent of the GL.
At this time, the staff has completed forty-five (out of seventy-five) IPE reviews (SERs sent to NRR) with thirty remaining to be completed (see Attachment 1). The PRA Implementation Plan, SECY-95-079, indicates a June 1996 completion date for the IPE reviews. This date will be slightly impacted in that it is anticipated that fewer than ten of the remaining thirty IPE submittals will be delayed. The causes for this delay are:
| (1) | The staff review has been expanded to cover the revised IPE submittals for those SERs where, initially, the staff was unable to conclude that the licensee
met the intent of GL 88-20. |
| (2) | Several licensees have indicated a delay in their responses to the staff's request for additional information due to increased demands on their PRA staffs. |
It is expected that the SERs on the remaining IPEs will be completed by September 1996. A final paper will be prepared at that time informing the Commission of the completion of the staff review; an insights study in the form of a draft NUREG report (discussed in the next section) will also be included.
In regard to the review of the IPEEE submittals, the staff has received approximately half of the IPEEE submittals; the last IPEEE submittal is scheduled to be received in December 1997. The staff is now completing four reviews and currently has an additional 20 reviews underway. The review process for these submittals is similar to the IPE review process described above. However, due to budget reductions made in FY96 (and anticipated for FY97 and FY98), the IPEEE review plan is being modified. A separate paper is being prepared for the Commission regarding the status and plan for these reviews, including preparation of an insights report; this paper will be part of the Commission paper on the Severe Accident Integration Plan.
Status of IPE Insights Program
The IPE Insights Program is documenting significant insights based on the IPE results for the different reactor and containment types.
As noted in SECY-94-134, the IPE Insights Program is assessing:
This information is being assessed with the objective of gaining insights in three major areas. These areas, and specific insights being examined, are:
These insights are being documented in a NUREG report, to be published for public review and comment in October 1996. This report will be transmitted to the Commission for information prior to publication, in September 1996. A small sample of key insights to be provided in the NUREG report is provided in Attachment 2 to this paper. These insights include those regarding core damage frequency for boiling water reactor (BWR) 3/4s and those regarding containment performance for BWR Mark I containments. This attachment provides some examples of design and operational factors that have the greatest impact on the results for these plant types as well as improvements in these plants that have been made as a result of the IPE process. When published, the NUREG report will provide a more in-depth and comprehensive discussion of the insights gained for these and other plant groups.
A separate report on the insights gained from the IPEEE submittals and reviews will be prepared and published at a later date. As noted above, the staff's reexamination of the IPEEE review process will be the subject of a separate paper. Additional information on the staff's plans for gaining insights from the IPEEE program will be provided in that paper.
Validity and Consistency of PRAs
In its April 18, 1995, Staff Requirements Memorandum, the Commission requested that:
Some thought be applied to methods for evaluating the validity of, and guidance for providing consistency to, PRAs. Similarly, some means of comparing the effects of different PRAs, in order to provide confidence that the PRA methods and models which are being used provide reasonable results, would be useful. ... The Commission should be informed of staff plans to address these concerns either at the IPE briefing [subsequently held on April 19, 1995] or as part of the IPE Insights Report.
The staff's work in developing insights from the IPE submittals, and documenting these in the NUREG report, discussed above, will help to illuminate areas of consistency and inconsistency among IPEs and the reasons for identified inconsistencies. For example, the variability among plants of certain important operator actions is being examined to determine how much of the variability is due to design and operational differences among plants and how much is due to PRA modeling differences.
Insights such as these are being used in parallel staff activities to improve the consistency of PRAs. These activities, described in SECY-95-280 and my January 3, 1996, memorandum to Chairman Jackson, will result in guidance to the industry on acceptable PRAs to be used to support specific regulatory activities (such as modifications to technical specifications) and guidance to the staff on how to review PRAs submitted as part of such activities. The former is expected to be in the form of a series of new or modified regulatory guides; the latter is planned to be in the form of new or modified sections to the Standard Review Plan. The guidance on acceptable PRAs will also be provided to and discussed with industry standards-making organizations for eventual codification as formal standards. It is the staff's judgment that development of such guidance is an important part of the overall effort to ensure that PRAs are adequate for their intended use in regulation.
Comparing IPE Results with Safety Goals
Licensees were not requested to calculate offsite health effects in Generic Letter 88-20, and therefore, most of the IPE results cannot be used directly to compare with the quantitative health objectives of the Commission's Safety Goals (i.e., early and latent cancer fatalities). However, all licensees did estimate two related risk measures: containment failure frequencies and radionuclide release frequencies. These results can be examined in light of other studies of similar scope where explicit comparisons of plant risks with safety goals were performed, specifically NUREG-1150. In this (indirect) way, insights can be provided on the IPE results and the current level of risk of U.S. plants, and comparisons made with the Commission's Safety Goals. Consistent with the scope of GL 88-20, these insights only cover accidents initiated by internal events (including internal flooding) at full power; accidents initiated by external events or during other operating modes (such as shutdown) will not be explicitly included. Results of this comparison with NUREG-1150 and the Commission's Safety Goals will be included in the staff NUREG report described above.
In summary, over the next seven months, the staff will complete its reviews of the IPEs and a draft NUREG report (for public comment) on the insights gained from these reviews, including (indirect) comparisons of IPEs with the Commission's Safety Goals. At that time, the Commission will be provided a final report on the IPE review results and a copy of the draft NUREG report. In parallel with this work, the staff's insights and experiences in IPE reviews are being used to help develop guidance on acceptable PRAs for use in regulation.
| James M. Taylor Executive Director for Operations |
| Contact: | Mary Drouin, RES 301-415-6675 |
| DISTRIBUTION: | PRAB Sub/File Central File |
Beaver Valley 2
Catawba
Diablo Canyon
Fermi 2
Haddam Neck
Indian Point 3
Maine Yankee
Millstone 3
Nine Mile Point 2
Oyster Creek
Peach Bottom 2&3
Robinson 2
Sequoyah 2
Turkey Point 3&4
Browns Ferry 2*
DC Cook 1&2
Duane Arnold
Fitzpatrick
Harris 1
LaSalle 1&2
McGuire 1&2
Monticello
North Anna 1&2
Palisades
Perry
Seabrook 1
South Texas 1&2
Vermont Yankee
Brunswick
Cooper
Farley 1&2
Grand Gulf
Hatch 1&2
Limerick 1&2
Millstone 1
Nine Mile Point 1
Oconee 1,2&3
Palo Verde 1,2&3
Point Beach
Sequoyah 1
Surry 1&2
Watts Bar 1&2
SERs Issued to Licensee -- NOT Conclude Met Intent of Generic Letter
Dresden 2&3
Quad Cities 1&2
Zion 1&2
Review Complete -- SERs In Progress
Arkansas 2
Calvert Cliffs
Davis Besse
Kewaunee
Pilgrim
Susquehanna 1&2
WNP 2
RAIs Issued To Licensee -- Responses From Licensees Not Received
Arkansas 1 (2-15-96/5-1-96)
Braidwood 1&2 (2-15-96/3-31-96)
Comanche Peak 1&2 (3-15-96/3-28-96)
Prairie Island 1&2 (2-15-96/2-21-96**)
Summer (2-15-96/3-11-96)
* No IPE submittal for Browns Ferry Units 1&3.
** Prairie Island has indicated a potential delay past the 2-21-96.
*** RAIs just issued (2-7-96) to licensees for Ginna and St. Lucie.
Twenty-one units (15 IPE submittals) make up the BWR 3/4 group of plants with reactor core isolation cooling (RCIC) systems(1). All of the units are housed in Mark I containments except for Limerick 1 and 2 and Susquehanna 1 and 2 which are in Mark II containments. The importance of specific accident classes to core damage frequency (CDF) vary from plant to plant; however, three accident classes are dominant CDF contributors for many of these plants:
These three accident classes are important contributors to CDF and containment failure frequency since they involve initiating events and/or subsequent system failures that defeat the redundancy in systems available to mitigate potential accidents. On average, accident classes involving low frequency initiating events such as anticipated transients without scram, loss of coolant accidents (LOCAs), and internal floods contribute less to the CDF for the BWR 3/4 group. However, some of these accident classes are important for a few IPEs. The variation in what accidents dominate the CDF is attributed to many factors including plant-specific design features, modeling assumptions, and variation in data including the probability of operator errors. These factors are being documented in further detail for each important accident class in the NUREG report. Some of the more key insights are discussed below, but only for the SBO and transient accidents with loss of DHR.
Station blackout accidents involve an initial loss of offsite power followed by failure of the emergency onsite AC power sources. The failure of AC power sources results in failure of multiple mitigating systems, leaving only steam-driven systems such as RCIC and the high pressure coolant injection (HPCI) system available for coolant injection.
For station blackout accidents, containment systems will not be functional and the drywell floor will often be dry, leaving the plant susceptible to drywell shell melt-through. In addition, the reactor vessel will normally be at elevated pressure, which increases the containment loads at vessel breach. This means that station blackout accidents pose a severe challenge to Mark I and Mark II containments, and therefore, these accidents are often important contributors to the frequency of containment failure.
Generally, plant design and operational features have a larger impact on the station blackout CDF than modeling characteristics, but no single factor dominates. Combinations of contributors are important, and those combinations vary from plant to plant. The most influential plant features and modeling characteristics include the following:
Nearly all the plants in this group have planned or made plant improvements (both procedural and hardware modifications or additions) to address the factors influencing station blackout scenarios. These improvements include efforts to increase AC system reliability by establishing dedicated lines to alternate offsite power sources, implementing bus cross-tie procedures, or installation of additional diesel generators. DC power improvements such as establishing load shedding procedures and aligning small diesel generators to supply AC power to the station battery chargers are also identified. Increasing the reliability of providing coolant injection during a station blackout is also a major area for suggested plant improvements which included the addition of procedures and hardware to allow for firewater injection into the vessel, re-configuring RCIC pump room enclosure fans from AC to DC power sources, and establishing loss of ventilation procedures for RCIC and HPCI pump rooms. The IPE results generally do not reflect these plant improvements and very few evaluated the quantitative impact on the CDF. However, a few licensees performed sensitivity studies on some of these improvements. For example, increasing the battery depletion time from four to six hours reduces the station blackout CDF by 28% at Monticello and a 38% reduction is obtained for Cooper when the battery depletion time is increased from four to eight hours. The impact of having a gas turbine generator is evaluated in the Fermi 2 IPE. Without the gas turbine generator, the station blackout CDF increases by over an order of magnitude. Addition of an auxiliary diesel generator to supply power to the station battery chargers reduces the station blackout CDF by 68% in the Monticello IPE.
Loss of DHR transient sequences involve accidents where coolant injection succeeds, but containment heat removal fails. In this situation the suppression pool heats up, leading to containment pressurization, and if the containment is not vented, it will eventually fail. Coolant injection eventually fails, either as a result of a hot suppression pool, or the adverse conditions created in containment or the reactor building when the containment is vented or fails. These adverse conditions include loss of net positive suction head in the suppression pool or steam in the reactor building.
This accident class involves events that develop over a number of hours, allowing time for mitigative actions, including evacuation of the public. However, many of these sequences involve containment failure prior to core damage, so that the mitigative effects of containment are minimized.
The key factors affecting the CDF from loss of DHR sequences involve plant-specific design and operating conditions as well as the assumptions made in the IPEs. These modeling assumptions are important to the results and represent an important area of uncertainty. The key factors include the following:
Because adverse containment conditions can impact continued coolant injection during a loss of DHR accident, many licensees suggested plant improvements that help ensure continued coolant injection. Some examples of plant improvements are procedures for replenishing the condensate storage tank to prevent switching the HPCI suction source to the suppression pool, increasing the RCIC turbine exhaust pressure trip setpoint, modification of the HPCI logic to prevent auto-switchover of suction on high torus level, and procedural changes directing the operator to use alternate systems for injecting water into the vessel and for cooling the residual heat removal system heat exchangers. Most plants credit installation of a hardened vent as a plant improvement in the IPE. The Fermi IPE reports that without containment venting, the total plant CDF increases by an order of magnitude.
Twenty-four BWR units (17 IPE submittals) are housed in Mark I containments. All of the plants in the BWR 2/3 group and most of the plants in the BWR 3/4 group have Mark I containments. These containments have relatively high strength but small volumes and rely on pressure suppression pools to condense steam released from the reactor coolant system during an accident.
The importance of individual containment failure mechanisms depends on plant-specific features and in some cases on modeling assumptions. For example, the relative contribution of shell melt-through is dependent on the assumptions (and, of course design features). Recent research information indicates that there is a very small likelihood of shell melt-through if water is available on the drywell floor. Previous understandings assumed a high probability of shell melt-through for both a wet and dry cavity. Most licensees considered this newer information in their analyses as seen in the IPE results.
The following mechanisms are found to be important for many Mark I containments:
In general terms, these failure mechanisms are important because of the relatively short time available for radioactivity decay, natural deposition processes, and for emergency response actions. In addition, drywell failure means radionuclides released from the damaged core bypass the suppression pool (significant retention can occur if aerosol radionuclides pass through a suppression pool). The relatively short time to radionuclide release and the magnitude of the release means these failure mechanisms have been found important to early and latent health effect risk measures (including land contamination) in past studies that included estimates of offsite consequences. These failure mechanisms can also occur for any accident class in a Mark I containment that involves release of a significant amount of core debris from the reactor vessel. In addition, other failure mechanisms are important for a few plants. Drywell failure caused by gradual pressure (and temperature) buildup due to gases and steam released during core/concrete interactions leads to containment failure in some IPEs. In other IPEs, containment venting is an important release mechanism. However, accidents that bypass containment (such as interfacing systems LOCA) or involve containment isolation failure are not important contributors to the CDF in any of the IPEs for Mark I plants. These accidents are also not important to the likelihood of either early or late containment failure because their frequencies of occurrence are so much lower than the frequencies of early structural failure caused by other accidents that dominate the CDF.
Each of these containment failure mechanisms will be discussed in further detail in the NUREG report. Some of the more key insights on shell melt-through and containment venting are discussed below.
This failure mechanism has a relatively high likelihood of occurring in Mark I containments, because for most Mark I containments, the reactor pedestal and the drywell floor are at the same level and openings exist between the pedestal region and the floor. In the absence of water, this design allows the core debris to flow across the drywell floor and fail the steel drywell shell either by direct melt-through or via creep rupture.
The capability to flood the drywell floor, the design configuration of the drywell, and assumptions regarding core debris dispersal on the drywell floor determine, on a plant-specific basis, whether shell melt-through is a significant containment failure mechanism. The most important plant features and modeling characteristics include the following:
A number of utilities identified hardware modifications and changes in procedures to ensure a flooded drywell floor prior to reactor vessel melt-through for those situations where vessel injection is not possible. The availability of alternate water sources to the drywell spray header, such as water from a diesel driven fire pump during a station blackout, reduces the likelihood of early failure in the Browns Ferry IPE. The Nine Mile Point 1 submittal mentions the potential benefit of supplying the drywell sprays from external sources such as the containment spray raw water pumps. Peach Bottom has the capability of supplying the sprays with water from an external pond or the Emergency Cooling Tower. Several IPEs, such as Duane Arnold and Monticello, also discuss the possibility of relaxing the restrictions on drywell spray initiation in the current emergency operating procedures (EOPs), thus providing greater assurance that there would be water on the drywell floor.
The IPEs reflect the use of containment venting to reduce radioactive releases and the likelihood of containment failure and an uncontrolled release, and it is an important element of the containment performance improvement program. Containment venting is used to prevent core damage in accidents involving loss of decay heat removal. It is also used to prevent long-term containment structural failure for those accidents in which the core melts through the reactor vessel.
In response to the recommendations in Generic Letter 89-16, most utilities with Mark I containments committed to install a hardened wetwell vent system (in some cases a hardened vent was already in place). A hardened vent leading from the wetwell to outside the containment building provides an independent means for containment pressure relief and heat removal while maintaining a habitable environment in the reactor building. Utilities intend to use these venting systems to prevent core damage for some accidents involving loss of decay heat removal. Under these circumstances venting is "clean" because it occurs prior to core damage and involves minimal release of radioactive material. However, a few utilities stated in their IPEs that their analyses indicate that the installation of a hardened vent does not significantly impact risk, and therefore, is only of marginal benefit. In one case the utility stated that they would not install a hardened vent.
Venting, after core damage has occurred, as a way of preventing structure failure of the containment is considered to be a last resort by most utilities because it can involve significant release of radioactive material. The advantage of venting from the wetwell (benefit of pool scrubbing) is emphasized in most IPE strategies. The pressure at which venting should be started is also examined in detail by several utilities. The impact of high temperatures on the structural capability of the drywell is also noted. For example, the Nine Mile Point Unit 1 IPE reports that at 400F the containment could fail at pressures below the current venting pressure in the EOPs and is considering further analysis to refine the vent actuation pressure.
Containment venting is important to risk in some Mark I containments. If venting occurs shortly after core meltdown and the flow path is directly from the drywell or from the reactor coolant system to the environment, then the suppression pool will be bypassed. Under these circumstances, venting would cause a significant release of radioactive material to the environment. In this context a number of utilities express concern about the current BWR Owners Group guidelines for containment flooding (filling the containment solid with water to a level equal with the top of fuel in the reactor pressure vessel) and the venting necessary to carry it out. Since drywell (i.e. unscrubbed) venting is needed to relieve the pressure buildup resulting from the compression of the gas space during containment flooding, there is the potential of an early release of significant magnitude associated with the flooding strategy. A number of utilities speculate that other actions, or even no action, is preferable to carrying out the containment flooding strategy. This issue is an area for further study.
1. The BWR 3 plants in this group have RCIC systems; the BWR 3 plants without a RCIC (with isolation condensers) are considered in a different plant group.
2. Licensees were specifically requested to address Unresolved Safety Issue (USI) A-45, "Shutdown Decay Heat Removal Requirements," in their IPEs.