Insights for PWR plants

1. Dilution accidents should be investigated in all POSs. Boron dilution during midloop operation and 'fast dilution' accidents at hot standby are important risk contributors.

2. Isolation of RCS loops should be avoided during midloop operation as it could be an important contributor to risk.

3. Core damage frequency (CDF) during midloop operations is comparable to power operation CDF.

4. Loss of residual heat removal (RHR) with the RCS in reduced inventory conditions is also a dominant contributor to risk.

5. Once boiling has occurred, the containment may become uninhabitable and the equipment hatch may become difficult to close.

5.3.2. Specific insights for PWR plants Surry

The study is a Level 3 PS A including internal events, internal fires and floods, and seismic hazards. Currently the Level 1 internal event study is almost complete. Only detailed analysis of midloop operation POS is missing. Point estimates of core damage frequency will soon be available.

An uncertainty analysis will follow.

The plant configuration changes continuously in any outage. There are four different types of outages (refuelling, drained maintenance, non-drained maintenance with use of the RHR system, and non-drained maintenance without the RHR system). A shutdown PSA requires the definition of at least three midloop POSs. In these POSs the RCS level is lowered to the mid-plane of the hot leg. The three POSs used in the analysis are:

midloop operation that takes place early in the refuelling outage (allows fast draining of the RCS loops to permit eddy current testing of the SG tubes);

midloop operation after refuelling is completed to allow additional maintenance of equipment in the RCS loops;

midloop operation in which maintenance activity requires midloop conditions. This POS is characterized by the highest decay heat level among the 3 POSs analysed.

The last POS was found to be the most important risk contributor. The characteristics of this POS are high decay heat removal and the relatively short time available for operator action. This result shows that it is preferable to enter midloop conditions when decay heat is relatively low (entering midloop as early as one day after shutdown should be avoided). Before this study was completed, the utility changed its previous outage practice which is expected drastically to reduce the time in midloop configuration.

The MELCOR computer code was used to assess whether or not gravity feed from the RWST could be used to provide longterm cooling (i.e. 24 hr decay heat removal). It was found to be sufficient only when the decay heat is relatively low. However, it can provide a margin of a few hours for restoring other means of decay heat removal when the decay heat is high.

It was found that the use of checklists reduces the impact of component maintenance unavailability. The technical specifications should take account of what happens across different systems in addition to within the systems.

The water level instrumentation used during midloop operation, i.e. standpipe level instrumentation and ultrasonic level instrumentation, have limited applicability during an accident. The standpipe system provides a correct level indication only when there is no pressure buildup in the

system. The ultrasonic level instrumentation only provides a level indication when the level is within the reactor coolant pumps; therefore this level of instrumentation may not be useful during feed-and-bleed operation.

Isolation of the RCS loops contributes to core damage frequency during the midloop operation.

This practice makes the SGs unavailable for decay heat removal upon loss of RHR. In a cold shutdown condition the SGs are usually maintained in the wet lay-up condition with the secondary side filled with water. During midloop operation, the availability of the SGs makes reflux cooling a possible method of mitigating a loss of RHR. This may be the only mitigating function available in a station blackout.

The RHR system at Surry has many 'single' failure potentials. This is due to the fact that it is not a safety system (i.e. it does not perform a safety injection function).

The following factors influencing human performance were identified for low power and shutdown operation:

administrative controls;

human factors engineering;

measures to ensure plant staff awareness, e.g. alarms, laggings, etc.;

operator training;

workload and stress;

procedures;

task verification measures.

The following requirements were identified for an HRA methodology applicable to low power states and shutdown:

to quantify the frequency of human errors as initiating events;

to quantify the impact of influencing factors on an error frequency and recovery actions;

to construct models for an analysis and quantification of diagnostics and knowledge based tasks.

The preliminary results indicate that the off-site releases from core damage during shutdown are comparable to full power release. The risk associated with a specific outage is highly dependent on the outage schedule.

Studies in France

Several topics found to be important have already been manifested in the generic findings in France. There are several insights in the enclosed Electricite de France paper concerning total loss of the RHRs, loss of primary coolant accident and dilution by a plug of water.

There are two cases where a boron dilution can take place: RHR connected and RHR not connected. There is a real contribution to risk while RHR is connected, especially during midloop operation and only in the case of the 'plant dilution accident' if not connected.

As a result of the study concerning the loss of RHRs instrumentation improvements (Vortex detection, US level measurements) were carried out. A safety engineer should be present in the control room during water level changes.

Studies in Belgium

The studies in Belgium manifest the role of bunkered systems. The CDF in shutdown is significant when compared to power operation. The methodology used in the studies in Belgium was quite similar to that of the study in France due to the similarity of the reactor type.

6. APPLICATION OF LPS PSA RESULTS