February 1992 Distr : Restricted

International Atomic Energy Agency

INTERNATIONAL PEER REVIEW SERVICE

For Probabilistic Safety Assessment of

Kori Unit 3&4

VOLUME I

Final Report for Phase I Review

26 August • 6 September 1991 Seoul, Republic of Korea

Michael P. Bohn (U.SA.) Lennart К E. Carlsson (Sweden) Radulescu Gheorghe (Romania) Stefan Hirschberg (IAEA) Raymond H. Matthews (U.K.)Ali Mosleh (U.SA.)Martin A Stutzke (U.SA.)

PREAMBLE

This report presents the results of the first phase of the IAEA International Peer Review Services (IPERS) mission which reviewed the Kori Unit 3&4 Probabilistic Safety Assessment (PSA). The PSA documentation available for the review corresponds to about 70% completion level of the Level I PSA. In addition to the information supplied in the documentation the IPERS views are based on communications with analysts.

The results presented herein reflect the views of international experts carrying out the review. They are provided for consideration by the responsible organizations in Republic of Korea.

Distribution of the IPERS report is left to the discretion of the Government of R.O.K.; this includes the removal of any initial restriction. The IAEA makes the report available only with the express permission of the Government of R.O.K.

Any use of or reference to the views expressed in this report that may be made by the competent organizations in R.O.K. is solely their responsibility.

3

TABLE OF CONTENTS

1. INTRODUCTION

2. SUMMARY, CONCLUSIONS AND RECOMMENDATIONS

3. GENERAL COMMENTS

4. INITIATING EVENT ANALYSIS

5. ACCIDENT SEQUENCE ANALYSIS

6. SYSTEMS ANALYSIS

7. COMPONENT DATA

8. TREATMENT OF DEPENDENCIES

9. HUMAN INTERACTIONS ANALYSIS

10. EXTERNAL EVENTS ANALYSIS

11. QUANTIFICATION OF ACCIDENT SEQUENCES

12. DOCUMENTATION AND RESULT PRESENTATION

13. QUALITY ASSURANCE

14. LIVING PSA ASPECTS

APPENDIX A : Composition of the review and responding teams APPENDIX В : Agenda for pre-IPERS and IPERS meetings APPENDIX C : Issue lists, PSA team responses, issue resolutions

4

1. INTRODUCTION

1.0. Background

At the request of Republic of Korea (R.O.K.), the International Atomic Energy

Agency (IAEA) has agreed to conduct an International Peer Review Service (IPERS)

mission for the Probabilistic Safety Assessment (PSA) for Kori 3&4 Nuclear Power Plant

(NPP). The review was carried out in two stages. The pre-IPERS meeting took place

in Vienna, Austria from 27-31 May 1991, while the main part of the mission was carried

out in Seoul, R.O.K., from 26 August-6 September 1991. Both missions were undertaken

within the ROK/9/031 project which is a part of the IAEA Regular Programme of

Technical Cooperation.

This report is the conclusion of the two review stages. However, it focuses

primarily on IPERS evaluation of the Kori 3&4 PSA as reflected in the documentation

available for review during the main mission. This documentation corresponds roughly

to 70% completion level of the PSA.

A valid plant-specific PSA is a valuable tool useful for guiding safety decisions

related to design, operation and regulatory activities. Independent peer review of a PSA

constitutes an integral part of any PSA programme. Since 1989 the IAEA has provided

such review services on the request of Member States. The general objectives of the

IPERS programme are :

To bring international experience to improve a PSA study and hence to improve nuclear safety.

To give guidance on what improvements should be made on the analytical

approaches used.

Thus, an IPERS examines a PSA to identify specific areas either planned or

5

performed which are not accurate or in accordance with acceptable practices, and to give

guidance related to recommended revisions. Depending upon the objectives of the PSA

an IPERS can focus on one or more of the following technical areas:

The completeness of the tasks and validity of the technical approaches

proposed for the PSA;

The general validity of assumptions, models, data and analyses used in the

PSA;

The validity of the results obtained;

The validity and applicability of the PSA models as tools to assist operation

and other applications.

An IPERS can be carried out basically at any stage of a PSA, but typically it takes

place at the beginning of the project, half-way through the project or when the project

is about 90% complete. During the early phases, the focus might be as much on the

guidance for improvements as on the review itself. The advantage of an intermediate

review is that the identified deficiencies can be corrected in a timely manner with

minimum impact on the available resources.

1.1. The Plant

Kori Unit 3&4 are Westinghouse Pressurized Water Reactors (PWRs). The two

units are virtually identical with a limited number of shared facilities.

The plant is located at the Kori NPP site which is on the southeastern coast of the

Korean peninsula approximately 26 km south of Ulsan and 32 km northeast of Pusan.

For each unit, the Reactor Coolant System (RCS) is arranged as three reactor

coolant loops connected in parallel to the reactor vessel, each containing a reactor

coolant pump and a steam generator.

The containment for the Nuclear Steam Supply System (NSSS) is dry prestressed

concrete steel-lined structure designed by Bechtel. The turbine generator is supplied by

General Electric Company of England (GEC).

The net electrical output for each unit is 913 MWe. Unit 3 has been in commercial

operation since September 1985 and Unit 4 since April 1986. The plants are operated

by Korea Electric Power Corporation (KEPCO).

6

1.2. The PSA

The study is being performed using primarily domestic manpower. In some

technical areas support has been given by overseas consulting companies. KEPCO is

responsible for project management while Korea Atomic Energy Research Institute

(KAERI) takes responsibility for the review. The analysis is mainly carried out by Korea

Power Engineering Company (KOPEC) with US consulting companies (NUS, EQE and

RISK Engineering) being subcontracted for analysis of specific topics.

The PSA was initiated in September 1989. Draft report covering complete Level

I PSA is planned to be issued in November 1991 and final draft including suggestions of

PSA-based safety improvements in February 1992. Final report will be published in August 1992.

The objectives of Kori Level I PSA are defined in Document KPC-89N-T03, 3rd

interim report in the following way :

"The main objectives of the study are : (1) to evaluate the overall safety of Kori

3&4 by performing integrated safety assessment (2) to identify practically applicable

safety improvement items, and (3) to standardize PSA methodology in Korea.

7

The detail objectives can be summarized as follows :

1) Identify plant-specific vulnerabilities to core damage sequences and to gain

a perspective on severe accidents.

2) Find out the potential weak points in design, operation, and test and

maintenance.

3) Provide the modification scheme of hardware and/or procedures to reduce

the overall frequency of core damage.

4) Provide information and guidance to operators on how to cope with severe

accidents."

The scope of the Kori PSA includes in addition to Loss of Coolant Accidents

(LOCAs) and transients also seismic events, internal fire, internal flooding and typhoon.

The scope of the PSA, which is believed to satisfy the objectives is also summarized

in the above mentioned document :

"1) Preparation of a set of working procedures to perform the PSA. The

procedures identify the major tasks in PSA and provide guideline, objective

and method for implementation of each task.

2) Development of the data base containing generic and plant specific data.

3) Development of event tree and fault tree models of systems. The models

include component failures, human errors, common cause failures, system

dependencies and system interactions.

4) Evaluation of core melt frequency with plant specific data and identification

8

of hardware and procedure modifications to improve plant safety.

5) Analysis of the external events that may bring about a hazard at Kori site.

This analysis includes, where appropriate, (1) hazard analysis, (2) fragility

analysis and (3) accident sequence and system analysis.

6) Preparation of Level II PSA interface requirements.

7) Performance of Independent Peer Review which includes the review of the

appropriateness of methods, information sources, assumptions and

judgement."

1.3. TheJRevjew

The present IPERS of the Kori 3&4 PSA is based on the documents available at

the review time, i.e. Document KPC-89N-T03, 3rd interim report (available during pre-

IPERS meeting), and Document KPC-89N-T03,4th interim report (available during the

main mission to R.O.K.). The latter document is an updated and extended version of

the former. It includes parts of the analysis not available during the pre-IPERS meeting,

such as : frequency of initiating events, human interactions analysis, detailed modelling

of fire, flooding and seismic events (as opposed to just methodology descriptions

available for review in Vienna), and accident sequence quantifications. During the

period between pre-IPERS and IPERS meetings the PSA team also modified parts of

the analysis and documentation ; these changes were in several cases based on the issues

raised during the pre-IPERS meeting.

Due to the availability of quantitative results it has been possible during the main

mission to focus on these aspects of the PSA which, given the numerical perspective,

could have the most significant impact on the results. The scope of the review was still

limited in the sense that the results given, are to be regarded as basically early accident

sequence quantifications. They are based on generic component reliability data, on a

relatively superficial approach to common cause failure (CCF) analysis and on an initial

9

quantification of human errors. No quantification of fire analysis was available for

review.

The Kori IPERS is based on the international PSA experience of the IPERS team

members and on the IPERS Guidelines (IAEA-TECDOC-543 and a draft of the second

version). The IPERS team members were from the IAEA, Sweden, U.K. and U.S.A.

In addition, two observers (from Romania and Yugoslavia) participated in the review.

The composition of the team was slightly different during the pre-IPERS meeting and

the main mission. The experts who participated in the later event are the authors of the

present report. Appendix A contains the curriculum vitae of these experts and a list

of PSA analysts responding to IPERS issues. The agenda for both meetings is attached

in Appendix B.

The IPERS review started with discussions on a number of issues based upon a

review of the available documentation. These issues were then used to generate a set

of questions. This process allowed a check on the review procedure to ensure that there

was sufficient reason for each question to be included in the list. The written answers

to the questions and follow up discussions with the PSA analysts formed the basis for the

resolution of issues and for the conclusions and recommendations contained in this

report.

The complete set of questions, responses and issue resolutions is attached in

Appendix C. This includes issues raised during the pre-IPERS meeting in Vienna.

Although some of these issues are not relevant in view of the new information obtained

in the time between the meetings and during the mission to Seoul, they are kept in

Appendix C for the sake of completeness of IPERS documentation. However, issues

generated during the second stage of IPERS can be distinguished through the numbering

scheme explained in Appendix C. In addition, priorities (A=High, В=Medium, C=Low)

have been assigned to different issues in order to facilitate interpretation of IPERS

recommendations. The priorities are provided together with resolutions of the issues.

KOPEC and NUS PSA analysts were completely cooperative in providing

10

information requested by the IPERS team, and in assisting the team to better understand

the Kori plant. In this context also support of KAERI, KEPCO and KOPEC

management is acknowledged.

1.4. Report Structure

A summary of the main recommendations is given in Chapter 2 of this report.

Detailed review of the most important PSA topics is provided in Chapters 3-14. For

more details and background information the reader should consult Appendix C. In

Appendix C the issues are grouped with respect to the topics covered in Chapters 3-14.

11

2. SUMMARY, CONCLUSIONS AND RECOMMENDATIONS

2.0. Overview

The IPERS review has identified a number of issues to be considered before the

Level I PSA will be completed. The main conclusions and recommendations of the

review are summarized in this chapter. The treatment of specific PSA topics is reviewed

and suggestions are given with regard to improvements of, or supplements to, the current

analyses.

The IPERS team noted with satisfaction the good qualities of the PSA group and

the technical achievements of the project. Having in mind that Kori 3&4 PSA is the first

full scope Level I PSA carried out in R.O.K. and that the project schedule has been

relatively tight, the progress made to date is remarkably good.

The basic tasks of the PSA (i.e. development of logic models), are being performed

in accordance with state-of-the-art approaches. The inconsistencies and incompletenesses

in treatment of these tasks, identified during the IPERS mission, can be fixed quite easily

using relatively small resources. There is clear evidence that during the time between

the pre-IPERS meeting and the main mission some important improvements were

implemented.

Such tasks as human interactions, common cause failure, component data and

external events analyses require more extensive revision/modifications, and in some

cases, extensions. This does not necessarily mean that the volume of work needed to

improve the quality and scope of these analyses is very large or significantly exceeds the

originally allocated resources. In fact, collection and evaluation of plant-specific data is

a part of the current project plan. Given that major IPERS recommendations concerning

these issues will be followed, the PSA for Kori Unit 3&4 will have high quality according

to international standards and will meet the originally defined objectives. The only

concern that the IPERS team has in this context, is that the present time schedule for

12

the project provides too short a time for the necessary fixes.

It should be noted that the scope of the review was limited in the sense that neither

plant-specific component data analysis nor quantification of accident sequences

associated with internal fires were available for review. For other initiating events the

quantifications were based on a set of generic data; all quantifications available at the

time of the review can be regarded as first trials. Also the human reliability analysis in

the present form significantly differs from the expected final product. While there are

clear indications that the PSA has a good potential to point out possible plant

improvements, at this stage the IPERS did not address the question of what safety-

related conclusions the present analysis does support. This could be done at a later

stage, i.e. after completion of the Level I analysis.

The IPERS team expressed some concern with regard to certain lack of focus on

important contributors, as they have been emerging in the course of the study.

Hopefully, this will be addressed but will require an extension of the present project

schedule.

There is a strong impression that the participation of the utility (the plant personnel

in particular) in the Kori 3&4 PSA is not as extensive as would be desirable. The project

would certainly benefit from more frequent interactions with the plant operators. The

same applies to KEPCO’s review of work. Without these elements it may not be

credible to claim that the PSA models represent the plant as it is built and operated.

There are some issues which could be easily resolved through a dialogue with plant

personnel. In the long-term perspective KEPCO will have to take full responsibility for

implementation, maintenance and use of the PSA models at the plant. This is absolutely

necessary to assure the benefits of the PSA also in the context of supporting the

operation.

It is left to the consideration of the competent organizations in R.O.K. to decide

if a second phase IPERS for the Kori 3&4 PSA is needed. The review would cover the

13

complete Level I PSA and also address the safety-related conclusions including suggested

PSA-based plant improvements. This might be important since Kori PSA is intended to

serve as a standard example for future PSAs in R.O.K. Furthermore, use of PSA for

backfitting (if any) puts stringent requirements on review of the validity of PSA-findings.

This chapter provides IPERS findings concerning modelling topics (Sections 2.1 -

2.8), documentation and result presentation (Section 2.9) and quality assurance (Section

2.10). For details Chapters 4-13 should be consulted.

2.1. Initiating Event Analysis

The various steps in initiating event analysis involve identification, grouping and

quantification of initiators. The scope of the study is defined by the initiating events

analyzed. The Kori PSA has three classes: LOCAs, transients and external events.

The procedure used to assure completeness is adequate and represents state-of-the-

art. However, the general framework includes more initiators than was originally

considered as the scope of the study. It is important to notice that an integrated

assessment of Kori NPP should involve the present out of scope plant modes such as

shutdown and low power operation.

The review suggests that the identification of Common Cause Initiators (CCIs) be

checked and further refined. Grouping of initiating events follows an appropriate

procedure. The Rationale for grouping should be provided in a number of cases.

Quantification of initiating events derives figures in the order of expected values.

However, the process to derive these estimates needs to be revised. There should be a

consistency in the approach used. Quantification of loss of CCW and NSCW should be

improved using proper fault trees models. Also statistical treatment should be improved

by the PSA team.

14

2.2. Accident Sequence Analysis

The use of (1) the small event tree/large fault tree concept and (2) fault tree

linking to generate accident sequences has been appropriately implemented in the Kori

PSA. In general, the event tree structures are sound; they produce meaningful sequence

cut sets. The Kori PSA team has done a good job in determining success criteria using

MARCH.

To improve readability and promote future use of the study as a living PSA, we

recommend that: (1) summary tables of success criteria, and of function and system

dependencies on common cause initiators be provided, and (2) the event trees pertaining

to loss of offsite power and station blackout be restructured to show a chronological

sequence of events.

Some instances were noted where the preliminary sequence quantification results

were not generated using the stated function equations (top logic); in addition , some

function equations were only documented in the quantification section. The entire logic

model (event trees, function equations, and fault trees) should be documented in the

relevant sections of the report; the quantification section should only demonstrate that

the quantified model agrees with the specified logic model.

2.3. Systems Analysis

The systems analysis follows standard PSA practice. There are several comments

related to completeness of the modelling for some of the systems. Overall, though, the

quantity and type of comments are not more than we would expect from a peer review

of a PSA that has been done by experienced PSA analysts. Our main only concern is

related to the documentation of the fault trees. Basically the text should reflect the work

that was done in order to construct the trees. Any item or issue examined (for example,

failures of passive components) should be documented and either modelled in the fault

15

tree or excluded from the tree and the reasons for exclusion documented in the text

(usually such reasons are placed in the list of assumptions). A number of concerns

related to specific modelling assumptions have been expressed by the IPERS team.

2.4. Component Data

Component reliability data includes estimates of the failure frequencies for various

failure modes and the unavailability due to test and maintenance. Currently Kori PSA

is quantified based on generic data. An effort is underway to collect and analyze plant

specific data to be combined with the generic estimates through Bayesian methods at a

later stage.

Component failure frequencies are obtained mostly from EPRI URD Data Base.

For cases where the EPRI URD data base did not contain the data required or the value

provided was judged to be inapplicable, NUREG/CR-4550 was consulted, and if data

could not be found there either, analyst subjective opinion was used.

In general the generic data base developed for Kori PSA shows careful

consideration of important issues typically encountered in development of generic data

bases. Several suggestions made during the first IPERS review have been considered

and modifications made to the data base. The justification for the judgmental values used

to supplement URD and NUREG/CR-4550 data have not been adequately documented

in the data analysis report. The IPERS team cautions that even with plant specific data

most of the generic distributions will still influence the updated distributions heavily. The

degree of this influence of course depends on the magnitude of the plant specific data.

Therefore care should be exercised in the assessment of all generic distributions.

Finally, given some of the stated objectives of the study the IPERS team believes

that standby failure rate model should be seriously considered as an alternative to

demand failure model currently used in the PSA . This will allow future applications of

16

the PSA models for such activities as TechSpec optimization.

For component maintenance Kori PSA has mainly used the data from

NUREG/CR-4550. No adjustments have been done to account for the effect of

TechSpec limitations on the maintenance unavailability. For cases where NUREG/CR-

4550 does not provide an estimate the unavailability value is assigned by engineering

judgment. Since maintenance unavailability is typically sensitive to the TechSpecs, it is

recommended that for dominant cutsets the data base be reviewed for potential

inconsistencies between the generic maintenance unavailability numbers with TechSpecs.

2.5. Treatment of Dependencies

Dependent failures in a broad sense cover (1) shared equipment dependencies, (2)

functional dependencies, (3) common cause initiators, (4) operator interactions

dependencies, (5) external events, (6) physical interactions, and (7) common cause

failures (CCFs). Kori PSA’s treatment of the first 5 categories are discussed separately

in the report. Physical interactions causing single or multiple component failures other

than those considered in the external events analysis, are not explicitly addressed by the

Kori PSA. Dependent failures arising from these interactions (also called subtle

interactions) are normally treated by plant walk-through and qualitative screening.

For category 7 PSA report refers to the procedures offered in NUREG/CR-4780

as the basis for common cause failure analysis. However, two important steps have not

been followed namely the quantitative screening, and event data classification for

parameter estimation. Instead with few exceptions, the PSA has used generic estimates

from EPRIURD data base. With few exceptions common cause failures in the run mode

are not modelled. Also, only global common cause basic events are used in the systems

models.

Limiting the models to only global common cause failures is often adequate.

17

However without following a systematic approach to evaluating the potential impact of

ignoring the intermediate CCF basic events it is difficult to be confident that potentially

significant contributors to system unavailability have not been left out. It is

recommended that the fault trees be reviewed closely with these concerns in mind.

The decision not to model common cause failures in the run mode is not supported

by operating experience when potential common cause failures are accounted for. It is

recommended that for important components common cause failures during operation

be added to the models.

The IPERS team is of the opinion that the use of EPRI URD generic estimates

may result in misleading conclusions regarding plant vulnerabilities. This is based on the

experience that common cause failures are very plant-specific and that the way to capture

that is to perform a plant-specific screening of the industry data base. This is extremely

important for a PSA that is going to be used for decisions regarding hardware

improvements.

It is suggested that the work on CCF analysis be extended, perhaps in two phases.

In the first phase the present analysis could be supplemented by a limited qualitative

analysis for some critical components. A quick review of the operating experience as

documented in the EPRI URD can supplement this effort. These activities would

hopefully provide concrete arguments qualitatively supporting the generic values used.

In the long run a more comprehensive qualitative and quantitative analysis using data

sources such as NPE, and based on EPRI/IAEA Procedures, should be performed.

2.6. Human Interactions Analysis

The human reliability analysis (HRA) in the Kori PSA follows the Systematic

Human Action Reliability Procedure (SHARP) as the framework. It considers three

18

types of operator actions: Pre Initiating Event Interaction (Type A), Initiating Event

Related Interactions (Type B), and Post Initiating Event Interactions (Type C). The

quantification of Type A and some Type C actions is based on the THERP (Technique

for Human Error Rate Assessment) approach. For most Type C actions the time

reliability curve concept of HCR model is used, requiring estimation of a median, Ti/2

and a logarithmic standard deviation of operator response.

The report indicates that model parameters are estimated using simulator data,

operator interviews, and data reported by others. However, the actual analysis is based

on much less extensive use of data, apparently because simulator data could not be

obtained for many crews. Also for the logarithmic standard deviation "generic" values

were subjectively assigned . The PSA team has agreed to revisit the approach to the

assignment of the sigma values.

In general, dependencies between different operator actions in the same sequence

are not handled nor documented adequately. The IPERS team believes that this is an

important issue and should be given a high priority in the human actions analysis.

The so-called manipulative errors, mostly slips, are quantified using the THERP

approach. In a large number of cases the total probability is dominated by the

manipulative error mode. The report does not however provide the necessary details to

enable an evaluation of the basis and justification for the probabilities.

The IPERS team strongly recommends that the "sanity check" proposed in the

HRA report but not implemented be applied, particularly for low probability cases. This

will provide additional assurance that the values generated in the Kori PSA are

consistent and can be understood and justified relative to the range of the available

estimates. Finally, the PSA should provide adequate documentation of the steps of the

analysis and derivation of the numerical results for all important operator actions.

The work to date shows good understanding of many key issues in analysis of

19

operator actions. IPERS team nevertheless believes that more needs to be done before

the results of the analysis can be used in the KORI PSA with high confidence.

2.7. External Events Analysis

External events are those sources of hazard that originate outside the boundary of

the equipment of interest and which may impact several pieces of equipment

simultaneously. These include earthquakes, flooding, turbine missiles, fires, etc.

Experience has shown that such external events are usually very significant contributors

to plant risk.

In the Kori PSA, detailed analyses of earthquakes, fires, internal floods and

typhoons are being considered. At the time of this review, the models and (preliminary)

quantification of accident sequence frequencies were available for all except fires. For

fires, a methodology description and data tables could be reviewed, although a number

of important aspects of fire methodology associated with quantification were not

described. No sequences or quantification were yet available.

In general, the review found that the external event analyses were being performed

by state-of-the-art methods and at a level of detail to inspire confidence in the results.

Clearly, a very substantial effort has been put into the external event analyses, and it is

reflected in the current report.

Several general observation were made, impacting all events :

1. No systematic identification and screening of all potential external events to which

the plant might be exposed was included in the study. (A full list is. given in the

PRA Procedures Guide (NUREG-2300)).

2. In general, no sensitivity studies (investigating various assumptions, models, level

of discretization, etc) were done for external events. Similarly, no importance

20

studies were done yet. These provide insights and confidence in the final results,

and guidance to potential plant retrofit modifications.

3. There is some inconsistency in structure, nomenclature, gate names, etc. between

the various external events logic models themselves, and with respect to the

internal events logic models. While not wrong, this decreases the transparency of

the final results, and perhaps increases the difficulty of modifying the PSA later.

Comments on the specific external events are given below.

Seismic Risk Analysis

The methodology for the seismic risk assessment is state-of-the-art and in good detail.

The approach used for the hazard curves is good and seems complete. Fragility

development using plant walkdown and the Engineering Factor of Safety method is the

best available. The simplified seismic logic models are acceptable, although somewhat

conservative. The NUS SEISMIC code used for quantification is accurate and

appropriate. Important observations are as follows :

1. A major interface problem exists between the hazard curve development team and

seismic quantification team. The hazard curve input did not match the

requirements of the seismic quantification. This resulted in preliminary estimates

of seismic core damage frequency being a factor of (about) 10 too low. This is

being corrected, and the requantification is being done.

2. Extensive use of fragilities previously developed for the ROC Maanshan plant was

made in developing fragilities for Kori. While this approach is valid, it presumes

the equipment is identical. Anchorages must be verified to be the same.

Nominally identical relays, etc, may have internal changes resulting in different

chatter characteristics, etc. Thus use of fragilities extrapolated from another plant

must be done with caution, and raises some questions. The Kori 4KV switchgear

21

fragility may be affected by this issue.

3. A number of "anomalous" conditions (missing bolts, etc) were observed at the

plant, and identified in the EQE Kori Fragility report as assumed to be fixed (since

these items are simple to repair). A formal means to assure that all such

anomalies have been fixed is needed.

4. Relays were identified from functional electrical line drawings. Protective relays

(on all 4KV switch gear and 480V MCC’s and busses, etc) were not identified. In

the future, identification of relays (for consideration of chatter) should be done by

an electrical engineer using detailed circuit drawings.

5. Although seismic/fire interactions are out-of-scope for the Kori PSA it was found

that weak battery racks would likely cause loss of the Kori plant fire water

protection system during an earthquake. Since this is the main FPS for Kori, and

since the upgrade is simple, this should be done.

6. The structure of the seismic primary event tree (involving only seismic failures) is

not optimal. Some sequences must be viewed pairwise to be logical. The order

of the top events is bit confusing. The trees are not wrong, and will give

numerically correct results, but they appear a bit illogical. (They are currently

being revised.) In addition, some consideration should be given to SLOCA

sequences, both as transfer sequences from transient trees and due to a seismic

initiator (pipe break).

In spite of the above criticisms, when the identified issues are addressed, this will

constitute a state-of-the-art seismic PRA inspiring high confidence in the results.

Fire Analysis

As mentioned, this analysis was not complete, either in documentation or

22

quantification. However, the general approach (as far as it was described) seemed

typical of a state of the art fire PRA. Data bases for fire initiating events are the best

available. Fault trees particularized to fire had good detail. A detailed table of fire

zones and all equipment in each zone had been prepared, and the level of detail was

excellent.

Many questions about details of the quantification remain to be answered when

documentation is complete. Clearly, quantification will have to include partitioning and

consideration of fire growth and suppression, as a rough estimate made by this reviewer

showed that a simplified analysis would give quite high fire core damage frequencies.

Control room fires should be included, since (evidently) cabling for the remote shutdown

panel can be affected by control room fires.

Flood Analysis

This analysis was complete, and very well done. It represents the state-of-the art.

Three levels of screening and a fourth level of analysis considering flood propagation

were performed. Other than some specific documentation recommendations (to allow

a reader to reproduce the results), few criticisms could be made. An excellent job.

Typhoon Analysis

The typhoon analysis considered three aspects of typhoon : winds, floods and

blockage of intake structure. Wind analysis included development of a wind velocity

hazard curve, and fragility calculations for yard tanks (CST and RWST) and transmission

towers. In general, state-of-the-art methodology was used. Observations were as follows:

1. Possibility of steel siding blowing off turbine building and causing LOSP should be

considered.

2. The screening of possible floods which could affect NSCW pumps was not

23

convincing. Maximum deterministic surge level is within 2 1/2 feet of a critical

level. More documentation is required, at least.

3. The scenario involving blockage of screens due to debris associated with typhoon

needs better explanation. Some consideration of LOSP in conjunction with this

event is needed.

2.8. Quantification of Accident Sequences

At the time of the IPERS (26 Aug-6 Sept) the risk model had been quantified and

we were able to review the results. The core melt frequency is dominated by core melt

following a station blackout (loss of all on-site A.C. power). Our judgement on the risk

dominant sequences is that they seem to represent the likely course of events.

We have some concerns with the quantification process:

1. Lack of documentation describing the quantification process. This includes

the recovery factors which have been added to many of the core melt

sequences during the quantification. Probabilities of failure for these factors

appeared in the minimal cut set lists for the sequences without explanation.

2. No evidence has been presented to the IPERS team that the recovery factors

are reasonable and that the credited recoveries are justified. This is of

particular concern with the claimed recovery of failed motorized valves in the

lines from the containment pump to the high/low pressure pumps. It is not

usual in PWR PSAs to claim such recovery. We accept, though that it has

been standard practice in BWR PSAs. In view of thé fact that this recovery

factor makes very little difference to the overall reliability of recirculation, we

suggest that no credit is taken for recovery in such circumstances.

24

3. The transfer frequencies calculated by the event trees are not currently added

to the relevant initiating event frequencies, this needs to be done. Further,

care should be taken that undue optimism is not introduced in this transfer

process. For example, transfers from the loss of grid tree to the small LOCA

tree involve the non-conservatism that in the small LOCA tree grid is

assumed to be available. Such transfers need to be considered on individual

basis and special trees constructed if necessary.

2.9. Documentation and Result Presentation

The documentation available for IPERS review was a draft report. The overall

plan for documenting the PSA as evidenced by review of the Table of Contents, is

adequate to explain the PSA results and to provide the capability for a living PSA.

However, the current documentation falls short of what is needed or planned.

It is essential that the documentation accurately reflects the work that has been

performed; many instances were noted where the described methodology was not used

to generate the PSA results. In order to support the living PSA effort, it is necessary to

establish and maintain a complete list of all references (such as WCAPs, KOPEC- and

KAERI-generated MARCH input, drawings, procedures, etc.); to date, this list has not

been started.

Preliminary core damage quantification results have been given in terms of

sequence cut sets; this is good practice and should be continued. We would expect that

the final report will also list dominant contributors to risk, as determined in the

importance analysis.

2.10. Quality Assurance

Our review of the QA program for the Kori PSA has been limited to the review

25

of the draft final report and discussions with KOPEC and NUS personnel. The overall

inadequacy of the current documentation (see Section 2.9) demonstrates that, in many

cases, the PSA team is not following good QA practice. It is our understanding that the

PSA project team follows à set of project/task plans; we have not specifically reviewed

these plans. Nevertheless, the concerns we have with the current documentation suggest

that either the project and/or task plans are not fully adequate, or that they are not

consistently used during the development, review, and approval of work products.

We understand that plant personnel have been involved to some extent in the Kori

PSA; this involvement requires documentation. Extension of plant involvement would

also be desirable.

26

3. GENERAL COMMENTS

3.0. Introduction

This chapter provides an evaluation of team quality and technical achievements,

and comments on organization of the PSA work. In addition, progress of the PSA

towards the stated objectives is addressed.

3.1. Evaluation of Team Quality and Technical Achievements

During the review the IPERS team interacted with all team members on a regular

basis. These interactions and the study documentation form an adequate input for

evaluation of the capabilities of the PSA group and of the technical achievements.

The overall impression is positive. Technical competence of the Kori PSA team

members is good, especially in view of the relatively short experience of this type of

project work which involves many complex tasks. The team members have suitable

educational background for performing PSA work. The IPERS team also notes with

satisfaction that the project is well coordinated, and that KOPEC management shows

interest and actively supports the work.

From the technical point of view the work performed to date is of good quality,

taking into account that the project is roughly at 70% level of completion and represents

the first PSA in R.O.K. The fact that a well functioning PSA group has been established

in a relatively short time, that this group has in most cases good grasp of state-of-the-art

PSA approaches, and that a powerful computer code for Level I PSA has been

implemented and is being used, demonstrates that the PSA programme is successful.

The degree of detail in the developed plant models is high. Generally, good quality

has been achieved in the basic parts of PSA, i.e. initiating event, event tree and fault tree

analyses. Valid approaches have been used in most cases although there is a need to

27

further improve treatment of specific topics such as human interactions, common cause

failures, data and external events analyses. Specific recommendations on the

improvements and need of supplementary analyses are given in the following chapters.

3.2. PSA Work Organization

As stated above the PSA work is well coordinated. Involvement of experienced

consultants supporting the project has been an important factor. In particular access to

state-of-the-art procedures for different PSA tasks, has significantly facilitated the work.

Some matters of concern have been identified by the IPERS team. One is

insufficient focus of the work on dominant contributors emerging in the course of the

study [Issue no. GC-SH-01]. It is expected that the contributors will be prioritized and

this will lead to more resources being allocated to extended analysis of some of the

topics superficially treated at this stage. This problem is relatively simple to address

given a certain focused support of experienced PSA analysts. It is noted, however, that

it will be very difficult to achieve proper treatment under the present tight time schedule

for the project. Consequently, some modifications of this schedule should be considered.

At present the involvement of the utility in the project does not seem sufficient,

although KEPCO supports the work actively [GC-SH-02]. Extension of this involvement

is desirable in the context of:

1. Support/input to analysis of specific topics (this applies in particular to

interaction with plant operators as a part of human reliability analysis).

2. Internal review (this task has been mainly delegated to KAERI)

3. Implementation of the PSA at the site, its maintenance and uses (even though

this goal can be seen as an objective in long-term perspective, it is

recommended that a plan should be developed as soon as possible by

KEPCO with active assistance from KOPEC and KAERI).

28

3.3. Fulfilment of Project Objectives

This review has demonstrated that some central tasks within the project should be

subject to modifications and/or extensions. There are some clear indications that the

Kori PSA has the capability to identify potential weaknesses in plant design and

procedures and also suggest/evaluate alternatives for improvements. Specific conclusions

would be premature at this stage and can only be drawn after the implementation of the

recommended changes/extensions of parts of the present analysis. As outlined in the

following chapters of this report there are important and extensive modifications, which

will be necessary in order to support specific recommendations on plant improvements.

Of particular importance for Kori PSA is revision of the human reliability, common

cause failure (for some components), component reliability data (use of plant-specific

data) and external events tasks.

Some of the IPERS recommendations are related to one of the main objectives of

the Kori PSA being defined as standardization of PSA methodology in R.O.K. This

implies that the level of ambition in treatment of such topics as e.g. common cause

failures should be high as opposed to the present superficial approach.

Given implementation of the major IPERS recommendations the Kori PSA

objectives will be met. Further comments on the potential for future Kori PSA

applications in the spirit of the Living PSA concept are given in Chapter 14 of this report.

29

4. INITIATING EVENT ANALYSIS

4.0. PSA Task Description

A very important task in the PSA is to assure completeness. The identification of

initiating events defines the scope of study and gives boundaries for interpretation of

results and conclusions. The number of possible initiators resulting from human actions,

system/component failures and externally induced events is very large. In order to

identify and group the initiators to a manageable size a systematic approach is necessary.

Many of the initiators can be treated identically since the plant response will be the

same. It is then also important that this is consistent with the event and fault tree

development for accident evaluation. The steps to identify and group the initiators are

followed by the estimation of the frequencies of grouped events.

4.1. Treatment of Initiating Events

In the PSA three basic classes of initiating events are defined:

Loss of RCS integrity (LOCA’s, SGTR)

Transients

External events

External events are described in Chapter 10 of this report. This section describes

the treatment of various LOCA’s and transients.

A three stage approach to the identification of initiating events has been adopted

and is as complete as one would expect from any PSA. The steps are:

1. Comprehensive engineering evaluation

30

2. Logical evaluation

3. Plant specific evaluation

The comprehensive engineering evaluation gives a good description of possible

paths for loss of RCS integrity. Special attention is paid to elements such as safety relief

valve failures (stuck-open) induced by transients. The transients refer to the EPRI-NP-

2230 document and the plant FSAR. The two sources were merged.

The logical evaluation, sometimes named master logic diagram was used to

generate a list of initiating events that were compared with the initiators of the EPRI-

NP-2230. The approach is a top-down approach.

The third step to evaluate plant specific initiators was done for plant trips and

support system failures. The plant trips were classified in accordance with EPRI

classification. A failure mode and effects analysis approach was used to focus on support

system contributions to initiating events. This is a bottom-up approach.

Some specific observations will be addressed below.

4.2. Completeness of the Initiating Events

The approach used to assure completeness is adequate and corresponds to state-of-

the-art. The developed methodology, however, gives initiators resulting from full power

operation only. Other operating modes have been excluded but should be considered

in the future planning [IEA-MPB-01, IEA-LC-03, IEA-SH-02, IEA-SH-04]. This should

include startup, shutdown and other low power conditions.

The identification of CCIs contributing to standard transient categories should be

checked [IEA-LC-02, IEA-SH-03]. A similar check on how to treat the loss of HVAC

in switchgear room is necessary [IEA-MAS-02]. Apart from the above mentioned

reservations which need to be addressed the internal initiating events are complete.

31

4.3. Initiating Event Grouping

The grouping of initiating events follows an appropriate procedure. However, the

rational for excluding or including should be provided in a number of cases [IEA-SH-01,

IEA-WEV-03].

The documentation is good and the basis for grouping of initiating events, including

success criteria definition, is adequate.

4.4. Initiating Event Quantification

The initiating event quantification is supposed to give frequencies in a consistent

manner for the quantification of accident sequences. The figures derived are with some

exceptions in the order of what one would expect for initiating event frequencies. The

process of quantification of initiating event frequencies needs to be revised and updated.

There are some inconsistencies in the quantification. The loss of CCW and NSCW

should be requantified including operating experience, fault tree development and

appropriate recovery analysis [IEA-SH-07(ii), lEA-AM-ll(ii)].

The IPERS team recommends that the error factors used in the first iteration be

modified [IEA-AM-04(ii), IEA-AM-05(ii)].

Also the use of operating experience should be supported by a rational explanation

of the selection of data [IEA-AM-06(ii)]. The modelling of some of the initiators is not

consistent. The PSA team has already adopted the recommendations made in several

issues [IEA-AM-07(ii) ... 12(ii)].

32

5. ACCIDENT SEQUENCE ANALYSIS

5.0. PSA Task Description

The objective of the accident sequence analysis is to identify combinations of

failures following the occurrence of initiating events that can result in core damage.

These combinations of failures are identified using event tree analysis; each combination

that results in core damage is termed an "accident sequence". The process of accident

sequence identification consists of three broad steps:

1. Identification of initiating events that cause a similar plant response,

2. Determination of success criteria, and

3. Construction of event trees.

It is possible to use one event tree to identify accident sequences for several

initiating events; this possibility is considered, in part, in the initiating events

identification task. For each group of initiating events, the plant response has to be

similar in order to make one event tree applicable.

The term "success criteria" refers to the combination of system equipment and/or

operator actions which must occur to prevent core damage. Success criteria are usually

developed by relating system response to broad post-accident safety functions (such as

reactivity control, RCS inventory control, and decay heat removal); this approach ensures

completeness. Success criteria are developed for each group of initiating events based

on the results of thermal-hydraulic analysis using either computer codes such as

MARCH, published reports such as WCAPs, or hand calculations. In general, best-

estimate calculations are used (as opposed to design-basis or licensing basis calculations, which tend to be overly conservative).

33

The headings of the event trees directly relate to the identified safety functions.

Combinations of systems and/or operator actions that lead to the failure of each safety

function are specified with small fault trees (sometimes called "top logic"); top logic

provides the linking mechanism to the system analysis fault trees.

Accident sequence analysis provides the basic framework for calculating plant risk;

it provides the focus for the remaining PSA tasks. Consequently, completeness of this

effort is essential to ensure that all contributors to risk have been identified. It is also

important to adequately document all steps in the accident sequence identification

process (particularly, the interfaces with other PSA tasks) to promote the validity and

acceptance of the PSA results, provide the capability for PSA maintenance and update,

and allow for future PSA applications.

5.1. Methodology for Event Tree Construction

In the Kori PSA project, the general approach chosen has been to model accident

sequences with small event trees and large fault trees. This is, in principle, a valid

approach which can provide a good resolution of the accident phenomena. Six event

trees have been developed for the transient initiators: (1) general transients, (2) loss of

offsite power, (3) main streamline break upstream of the MSIVs, (4) main streamline

break downstream of the MSIVs, (5) loss of CCW or NSCW, and (6) loss of power to

NSSS control group cabinets. LOCAs are described in four event trees: (1) small

LOCAs (less than 2-inch), (2) medium LOCAs (2- to 6-inches), (3) large LOCAS

(greater than 6-inch), and (4) steam generator tube ruptures. ATWS and interfacing

system LOCA sequences are developed in separate analyses.

The impact of common cause initiators (CCIs) is handled through the inclusion of

logic flags in the system-level fault trees. This approach is generally acceptable and has

been implemented in the Kori PSA; however, it has not been adequately documented

[ASA-MAS-12(ii)]. We recommend that a table which relates system dependencies upon

CCIs be included in the final documentation.

34

Event tree development should consider the role of the plant operators during

accidents; consequently, it is important to review plant operating procedures during

accident sequence analysis. While the Kori PSA team has reviewed the Emergency

Operating Procedures, no documentation was supplied to the IPERS team that supports

this effort [ASA-LC-03]. We encourage plant staff involvement throughout the PSA

[QA-SH-03, QA-WEV-01], particularly in the use and interpretation of procedures.

With one exception, the event tree structures provide a clear development of

accident sequences. The loss of offsite power (LOP) event tree currently contains some

extraneous sequences [ASA-MAS-13(ii)]; these should be eliminated to facilitate

understanding. While the existing LOP and station blackout (SBO) event trees seem to

produce meaningful accident sequences, we believe that they could be better understood

if they were rearranged so that the event tree headings appear in approximate

chronological order. Since preliminary results indicate that LOP-related sequences are

dominant contributors to plant risk, it is essential that LOP and SBO sequences be

clearly displayed.

5.2. Identification of Core Damage States

Core damage is assumed to occur when the core is uncovered; this practice is

acceptable, being generally consistent with previous PSAs. It should be noted this

definition of core damage may be somewhat conservative since the time when fuel

cladding damage occurs is later than the time of core uncovery in most accident

sequences.

Core damage states (CDS) for the purposes of supporting a Level II PSA have not

yet been defined; rather, each Level I PSA sequence is labelled "OK" or "CD". Current

treatment of CDSs does not fulfil one of the stated objectives of the PSA, namely

preparation of Level II PSA interface requirements. The PSA team has acknowledged

that the definition of CDSs during future Level II PSA work may necessitate some

modification of the existing Level I PSA event trees [ASA-MAS-Ol(ii)]. We encourage

35

the Kori PSA team to develop preliminary CDSs during the Level I PSA to avoid future

rework of the Level I event tree [ASA-SH-01, ASA-MAS-Ol(ii)].

5.3. Success Criteria

Success criteria for the Kori PSA have been determined using a combination of

Kori-specific MARCH analyses and relevant WCAP reports. The PSA team is to be

commended for performing plant-specific analyses of accident sequence behavior using

MARCH.

Documentation of this effort is generally inadequate, which lead to many issues

concerning the origin and validity of the success criteria and sequence timing [ASA-RG-

02(ii), ASA-RM-Ol(ii), ASA-MAS-04(ii), ASA-MAS-OS(ii), ASA-MAS-07(ii), ASA-MK-

01, ASA-WEV-01, ASA-WEV-03, ASA-WEV-07, ASA-WEV-13]. Success criteria are

discussed in the documentation of each event tree; this practice makes the PSA difficult

to review. We would prefer to see a master list of success criteria and other important

sequence information such as timing [ASA-WEV-02].

5.4. Completeness and Consistency

The accident sequence analysis provides a complete delineation of accident

sequences with one exception. It has not been demonstrated in the available

documentation that reactivity accidents are addressed by any other transient categories

[ASA-SH-04]. While such events are probably insignificant plant risk contributors at

Kori, the PSA team should be aware that French PSA results have raised new concerns

about boron dilution accidents.

The IPERS team identified several areas that require improvement in either

analysis or documentation:

36

1. The RCP seal LOCA model [ASA-WEV-03, ASA-MAS-09(ii)].

2. Injection line check valve testing [ASA-LC-04, ASA-WEV-14] and its impact

on interfacing system LOCA frequencies.

3. The treatment of battery depletion in the logic model (currently considered

in the electric power fault tree; need to reference in the discussion of LOP

and SBO event trees) [ASA-WEV-04].

4. Interfacing system LOCAs completeness and consistency [ASA-LC-05, ASA-

WEV-05].

5. Failure of the turbine-drive auxiliary feedwater pump steam supply following

stuck-open S/G relief valves and MSIV closure failures [ASA-WEV-06].

5.5. Coordination of Input into the Event Trees

In the Kori PSA, failures of functions are considered using top logic (function

equations), which provide the connection between the event tree headings and the

system-level fault tree models. In general, the top logic reflects the stated success

criteria; no discrepancies were noted. Certain issues concerning event tree input raised

during the pre-IPERS were addressed [ASA-WEV-10, ASA-SH-03].

In some instances, the development of certain functions could not be determined

by review of Section 5 of the PSA report [ASA-MAS-02(ii), ASA-MAS-03(ii), ASA-MAS-

06(ii), ASA-MAS-lO(ii)]; however, the documentation of sequence quantification did

identify the set of function equations used to generate the results. We prefer that the

accident sequence development process be completely documented in Section 5;

particular emphasis should be given to the interfaces between the safety functions and

the system-level fault trees.

37

6. SYSTEMS ANALYSIS

6.0. Task Description

The objectives of the systems analysis is to perform a detailed analysis for those

nodes in the event trees which represent failure modes of systems. The fault trees and

associated base event failure data are linked to the event trees within the NUPRA code.

6.1. Interface with Event Trees

The event tree analysis (and associated thermal-hydraulic assessment) gives the

success criteria for the demanded systems. The system fault trees are constructed to

correspond to the defined success criteria. This is done well by the Kori team. There

were however some problems in assuring that this was so (see Section 5.3 for details).

A further problem arises from the way in which NUPRA can handle several success

criteria within the one system tree by using house events to selectively switch in (and out)

sections of the tree [SA-RM-Ol(ii)]. The problem is easily resolved by providing an

explanation of the way in which NUPRA is used in the Kori PSA.

It is difficult to ensure that a consistent set of assumptions are used throughout the

PSA. The use of standard logic modules in the fault tree construction for the Kori PSA

has gone a long way to ensure that there is consistency within the fault tree analysis.

However, there is evidence that similar level of consistency has not been achieved

between the fault trees and event trees [see SA-MAS-02(ii)].

6.2. Fault Tree Structure

The fault trees are well structured with an easy to follow logic. There are well

defined links to support system trees. The component failure segments are structured

using standard component logic modules, which are then tailored as required for

individual components. There are no significant concerns with the tree structure.

The interface with support systems is treated well. A specific problem was

identified with the LPSI fault tree [SA-WEV-28]. We suggest that a fault tree interface

diagram should be produced. This diagram would provide greater assurance that all the

interfaces have been found.

The fault trees are based on the provided plant documentation. The Kori PSA

team should be aware that discrepancies can exist between the actual design and that

indicated by the documentation. Plant walkthroughs should be used to confirm the

design of important systems [SA-WEV-30].

38

6.3. Modelling of Common Cause Failures

Common cause failures are identified as multiple failures of similar components.

These are then modelled as base events within the fault trees, alongside the independent

failure base events of the affected components. There are no concerns with this

approach, at least in the context of implementation of CCF contributions within the logic

model. Other concerns with respect to CCF modelling exist and are addressed in Chapter

8.

6.4. Modelling of Test and Maintenance

The unavailability of components due to test and maintenance is treated in the system fault trees as follows :

1. Component unavailability during test and maintenance is modelled at the

segment level in the fault trees. Generic outage data is currently used in the

PSA.

39

2. The potential of components to be placed in a failed condition following a

test or maintenance is modelled as a base event in the fault trees. A human

error analysis is provided to estimate the probability of such events occurring.

The above approach is reasonable and for single component failures is

comprehensive. Systematic test/maintenance error on similar components is only

considered in the Kori PSA if the maintenance is scheduled back-to-back. While back-

to-back maintenance is more likely to produce higher correlations between maintenance

errors, systematic errors arising from staggered maintenance should also be considered

(see [SA-WEV-04]).

6.5. Modelling of Passive Failure

Passive component failures (failure of pipework, tanks, etc.) are not considered in

the Kori PSA systems analysis. It is generally accepted that passive component failures

are not significant contributors to the unreliability of active systems. It is, however,

general practice to state in the documentation that the passive failure modes have been

considered and not modelled on the basis of low probability or of insignificant

contribution to system unreliability [SA-WEV-03, SA-WEV-21, and SA-RG-01].

6.6. Modelling of Miscalibration

Failures due to miscalibration are, in general, not currently considered in the Kori

PSA [SA-WEV-04, SA-WEV-19]. This is a deficiency and leads to concerns over the

completeness of the fault trees. The Kori PSA team has agreed to consider

miscalibration errors on a more systematic basis and either model the miscalibration

failure in the fault trees or exclude it on the basis of low contribution to unreliability

(and include such statements in the fault tree documentation).

40

6.7. Specific Detailed Concerns

There are several concerns related to specific modelling assumptions in the systems

analysis. These are:

1. Modelling of failure of steam supply to the turbine driven auxiliary feedwater

pump [SA-RM-03(ii)]. One concern here is that a fuller consideration of this

issue may reveal dependencies between the auxiliary feedwater and

requirements to depressurize and cool down. Another concern is a possible

dependency between events which lead to a demand on the SG relief valves

and the auxiliary feedwater system.

2. Modelling the possibility of unborated water being injected into the core.

This issue is a concern in several countries and should be addressed by the

Kori PSA team [SA-RM-05(ii)]. It may be resolved either by a physics

analysis demonstrating that a defined source of unborated water will not lead

to a core melt or a combined human factors, fault tree, and event tree

assessment to estimate the contribution to risk of such sequences.

3. Pressurizer PORV Unavailability; several US plants run at power with one

or more block valves closed on the PORV lines. This operating practice

would also be allowed at Kori. The calculated PORV unavailability should

reflect this possibility [SA-MAS-Ol(ii)].

4. Nitrogen pressure out of acceptable range is not considered in the

accumulator system fault tree [SA-LC-03]. The effects and likelihood of the

over-pressure and under-pressure should be considered.

5. Control circuit failures in the feedwater system [SA-WEV-25]. The

probability of occurrence and effect on motive plant of control circuit failures

should be confirmed.

41

6. Post-initiator plugging of service water strainers [SA-WEV-29]. This has been

found to be a contributor in other PSAs. The issue should be discussed, and

its omission from the PSA justified.

7. Modelling of failure of the DG load sequences [SA-MAS-03(ii)]. The

possibility of failure to shed loads leading to failure of the load sequencer

should also be considered. It is not sufficient to only consider the CCF event.

8. The depressurization modes in the event tree (nodes X and Y) should be

modelled in full with system trees for failure of the hardware (pressurizer

PORVs etc.) [QAS-RM-7(ii)]. This would allow consideration of

dependencies between these and other functions in the event trees.

42

7. COMPONENT DATA ANALYSIS

7.0. Introduction

Component reliability data includes estimates of the failure frequencies for various

failure modes, unavailability due to test and maintenance, and common cause failure

rates. The first two categories are discussed in this section. Issues regarding common

cause failure rate estimates are discussed in Section 8.

Data analysis task involves identification of the data needs in coordination with the

systems and plant analysis activities, determination of component boundaries, collection

of the relevant information including generic and plant specific data, and parameter

estimation. Depending on the specific needs of the PSA and the form of the available

data the various steps of data analysis task may vary in complexity and resource

requirements.

7.1. Kori PSA Approach

Currently Kori PSA is quantified based on generic data. An effort is underway to

collect and analyze plant specific data to be combined with the generic estimates through

Bayesian methods at a later stage. The major categories of component failure

frequencies and component maintenance unavailabilities are the subject of discussion

in this section. Kori PSA approach to these data categories is summarized in the

following.

7.1.1. Component failure frequencies

Component failure frequencies are obtained mostly from EPRI URD Data Base.

This data base is developed by combining data from various PSA studies, and component

reliability data compilations. The values obtained from this source are treated as mean

estimates. Since EPRI URD does not provide uncertainty ranges, lognormal distributions

43

have been used and error factors assigned according to a set of criteria that accounts for

the observed variability of these estimates. In some cases since the component boundary

in the EPRI URD was believed to be different than that assumed in the Kori PSA

models, the URD value was modified by adding or subtracting values for different

components as appropriate. For cases where the EPRI URD data base did not contain

the data required or the value provided was judged to be inapplicable, NUREG/CR-

4550 was consulted, and if data could not be found there either, analyst subjective

opinion was used.

7.1.2. Component test and maintenance unavailability

The EPRI URD data base provides maintenance data at the train level whereas

Kori PSA requires component-level data. Therefore for component maintenance Kori

PSA has mainly used the data from NUREG/CR-4550. No adjustments have been done

to account for the effect of TechSpec limitations on the maintenance unavailability. For

cases where NUREG/CR-4550 does not provide an estimate the unavailability value is

assigned by engineering judgment. Values listed in the report are treated as mean values

but uncertainty distributions have not been provided.

7.2. Comments and Observations

7.2.1. Component failure frequencies

In general the generic data base developed for Kori PSA shows careful

consideration of important issues typically encountered in development of generic data

bases. Several suggestions made during the first IPERS review have been considered

and modifications made to the data base (see for example [CDA-AM-02]). The

justifications for the judgmental values used to supplement URD and NUREG/CR-4550

data are not adequately documented in the data analysis report. The report as well as

PSA team response to several IPERS review issues indicate that since plant specific data

will be collected and combined with the generic data for many components, the

44

judgmental values would not have a major impact on the final estimate. The IPERS team

cautions that even with plant specific data most of the generic distributions will still

influence the updated distributions heavily. The degree of this influence, of course,

depends on the magnitude of the plant specific data. Therefore care should be exercised

in the assessment of all generic distributions.

Finally, given some of the stated objectives of the study the IPERS team believes

that standby failure rate model should be seriously considered as the alternative to

demand failure model currently used in the PSA [CDA-SH-02]. This will allow future

applications of the PSA models for such activities as TechSpec optimization.

7.2.2. Component maintenance unavailability

Maintenance unavailability is typically sensitive to the TechSpecs. This is one of the

major reasons why most PSAs are reluctant to use generic maintenance unavailability

numbers. Recognizing this, in few cases Kori PSA has used a more realistic value

compared with the generic estimate. It is recommended that for dominant cut sets the

data base be reviewed for potential inconsistencies between the generic maintenance

unavailability numbers and TechSpecs [CDA-SH-04].

45

8. TREATMENT OF DEPENDENCIES

8.0. Introduction

The validity of a PSA depends to a large extent on the treatment of dependencies.

These dependencies are of several types:

i) Shared equipment dependencies where one system is a support system for others

or a component is shared by several systems/subsystems. Failure of the support

system leads directly to complete or partial failure of all of the supported systems.

ii) Functional dependencies where the operation or non operation of a system affects

the ability of another system to be operated (e.g., where a low pressure injection

system cannot be used unless the reactor is depressurized first).

hi) Common cause initiators where the availability of support or mitigating systems is

affected by an initiating event.

iv) Human interaction dependencies where an operator error or action affects other

operator action errors, or the operation of more than one system or component.

v) Physical interaction failures where the environmental effects caused by a failure

(e.g. after a pipe break) cause other systems to fail.

vi) Common cause failures where two or more identical or similar components fail at

the same time because of some common cause not covered by explicit modelling

of the types of dependencies given above. Common cause failures may, for

example, be due to design errors or deficiencies, lack of quality control in

manufacturing or installation, procedural errors during operation or maintenance,

or environmental effects such as excessive temperature.

46

vii) Major energetic external events which have the capability of causing damage to a

wide range of equipment, cutting across system boundaries.

The first five types of dependency are generally treated during event tree and fault

tree construction, or when event tree sequences are quantified.

The sixth type is most important when analyzing redundant systems where each

channel or train has identical components. Common cause failures can lead to loss of

more than one channel or train. Common cause failures can also be due to a subtle

dependence where identical or similar components fail due to the same cause in different

systems causing failure of both, otherwise independent, systems. They are addressed by

adding common cause failure events to the logic model.

The external events are usually addressed by performing specialized studies using

an already existing PSA model.

This chapter documents the result of the review of the treatment of dependencies

as performed in the Kori PSA. However, the review of the detailed treatment of all but

the common cause failures is more completely documented in the sections of the report

dealing with initiating events, accident sequence analysis, systems analysis, human

interactions analysis and external events analysis as appropriate. In this chapter the

comments are therefore either of a very general nature, or address the remaining class

of dependencies, namely the common cause failures.

8.1. The Treatment of Dependencies in the Kori PSA

The approach taken in the Kori PSA regarding shared equipment dependencies,

functional dependencies, and common cause initiators follows standard PSA practice.

These dependencies are accounted for in developing fault tree and event tree models

and in defining the success criteria and functional requirements for systems within

individual accident sequences. Specific comments regarding the breadth and depth of

47

modelling these dependencies in Kori PSA are provided elsewhere in this report.

Dependencies arising from interactions of operators with systems for both pre­

initiating events (e.g., errors due to test and maintenance) as well as post-initiator

interactions (e.g., operator action to initiate feed and bleed are also treated explicitly in

the system models (by adding basic events) and in the plant model (by adding top events

in the event trees). Dependencies of operator actions and errors are usually treated in

estimation of human reliability. However, the results of this analysis for Kori PSA was

not available at the time of IPERS review. Specific comments regarding the treatment

of human interaction dependencies are discussed in Section 9 of this report.

Physical interactions causing single or multiple component failures other than those

considered in the external events analysis , are only to a limited extent explicitly

addressed by the Kori PSA [DFA-SH-01]. Dependent failures arising from these

interactions (also called subtle interactions), are normally treated by plant walk-through

and qualitative screening. Some generically developed estimates for common cause

failure rates also include certain subcategories of subtle interactions. This to some extent

applies to Kori PSA since common cause failure rates used in the analysis are generic.

It should be noted, however, that subtle interactions have not been shown to be visible

contributors to the risk in the past PSAs.

The treatment of dependencies due to external events is extremely important and

often the most critical issue in identifying the impact of external events on the plant.

External events analysis and issues concerning the adequacy of the treatment of

dependencies are discussed in Section 10 of this report.

The remaining discussions in this section deal with the subject of common cause

failure analysis.

48

8.2. Common Cause Failure Analysis

The PSA report refers to the procedures offered in NUREG/CR-4780 as the basis

for common cause failure analysis in Kori PSA. Indeed many of the steps of the

procedure have been followed to various degrees. However, two important steps have

not have been followed, namely the quantitative screening, and event data classification

for parameter estimation. Instead, with few exceptions, the PSA has used generic

estimates from EPRI URD data base. This reference uses the data classification and

parameter estimation approach of NUREG/CR-4780 but only for a "generic" plant and

according to general PSA considerations.

With few exceptions common cause failures in the run mode and between standby

and running equipment are not modelled [DFA-SH-03, DFA-AM-02].

In modelling common cause failure events in systems, only global common cause

basic events are used. The report, however, indicates that this has been done after a case

by case qualitative evaluation that the combination of intermediate common cause basic

events would not be significant.

8.2.1. Comments and observations

Issues concerning the treatment of common cause failures in Kori PSA are

organized under two general topics; one dealing with modelling CCF events in the fault

trees, and one on the subject of quantification.

8.2.1.1. Common cause modelling in systems

Limiting the models to only global common cause failures is often adequate.

However, without following a systematic approach to evaluating the potential impact of

ignoring the intermediate CCF basic events, it is difficult to be confident that other

significant contributors to system unavailability have not been left out. For example there

are cases where a common cause fails two of three redundant components while the

third component (not subject to the same Tech. Specs), is in maintenance. Also care

must be exercised not to undercount the number of intermediate common cause basic

events. Since the PSA has not followed a systematic approach to this issue the impact of

these factors cannot be evaluated. It is recommended that the system fault trees be

reviewed closely with these concerns in mind [DFA-SH-03]. Also note that these issues

are relevant regardless of whether generic or plant specific CCF frequencies are used.

The decision not to model common cause failures in the nin mode is not supported

by operating experience when potential common cause failures are accounted for. The

IPERS team agrees, however, that for the continuously operating components run mode

failures are not typically dominant. The situation is different for standby components in

the run mode. It is recommended that for important components common cause failures

during operation be added to the models.

Finally the review identified cases where common cause failures were not

considered in the system model (see for example [DFA-SH-02], and [DFA-SH-07(ii)].

49

8.2.1.2. CCF parameter estimation

Many issues raised during this and the previous IPERS review deal with the use of

EPRIURD generic estimates. The essence of these concerns is rooted in the belief that

common cause failures are very plant-specific and that the way to capture that is to

perform a plant-specific screening of the industry data base. It is true that with plant-

specific screening the magnitudes of the common cause parameters change in a relatively

tight range compared with generically screened data. However, it should be recognized

that (1) the relative values for different components can change and (2) cut set

probability orders can be quite sensitive to the variations in the common cause

parameters. Combination of these two factors can lead to a very different conclusion to

be drawn from the PSA results regarding the risk contributors. This is extremely

50

important for a PSA that is going to be used for decisions regarding hardware

improvements.

8.2.2. General recommendations

Common cause failures for some components are among the main contributors to

the dominant accident sequences (e.g., station blackout). In light of their significance

more attention should be paid to modelling and quantification of common cause failures.

It is suggested that the work on CCF analysis be extended, perhaps in two phases [DFA-

SH-05].

In the first phase the present analysis could be supplemented by a limited

qualitative analysis for some critical components (DGs in the first place followed by

some of the valves and pumps in the dominant scenarios). This analysis would address

existing defenses (e.g., separation, staggered testing, maintenance procedures; as

applicable). A quick review of the operating experience as documented in the EPRI

URD can supplement this effort. These activities would hopefully provide concrete

arguments qualitatively supporting the generic values used.

In the long run a more comprehensive qualitative and quantitative analysis using

data sources such as NPE and based on EPRI/IAEA Procedures, should be performed.

51

9. HUMAN INTERACTIONS ANALYSIS

9.0. Introduction

The modelling of human interactions is an extremely important part of the PSA.

For the purposes of modelling, human interactions, and errors resulting from them, can

be separated by time phase into the pre-initiating event, the initiating event, and post-

initiating event phases. The pre-initiating event human errors typically relate to

miscalibration, or leaving equipment in an incorrect configuration. These are usually

incorporated in the PSA model by including representative events in the fault trees.

The impact of errors that result in initiating events are usually argued to be

implicitly incorporated in the initiating event frequencies.

The post-initiating event human errors relate to actions taken by plant staff to

mitigate the impact of initiating event. The human interactions may be required by the

emergency operating procedures. These can generally be modelled at a relatively high

level in the models (e.g., as event tree top events). Others, which represent component

specific responses, can be modelled at a lower (cut set) level. These include the so-called

recovery actions.

Human actions are often characterized as errors of omission or errors of

commission. Generally, errors are modelled as if they were errors of omission, although

it has been argued that some types of commission errors are also modelled as part of the

errors of omission. Current PSAs do not address errors of commission explicitly.

The estimation of post-initiating event human error probabilities is a subject of

much discussion. Many methods have been proposed and used, and while none is

universally accepted, each has the merits of establishing a relative ranking of importance.

The objective of human reliability analysis (HRA) task in the PSA is to identify the

most important human interactions and estimate the probability of errors associated with

them. This section describes the results of the review of the HRA performed in the Kori

PSA.

9.1. Approach to Human Reliability Analysis in the Kori PSA

The human reliability analysis report indicates that the HRA analysis in the Kori

PSA follows the Systematic Human Action Reliability Procedure (SHARP) as the

framework. It considers three types of operator actions:

Type A: Pre-Initiating Event Interaction

Type B: Initiating Event Related Interactions

Type C: Post-Initiating Event Interactions.

Type A includes errors during routine interactions of the plant personnel with

components and systems, e.g., miscalibration and misconfíguration errors. These errors

are either modelled explicitly by inclusion of basic events representing the error into the

fault trees, or implicitly via the failure probabilities used.

Type В interaction include those errors that cause initiating events, e.g., plant trips

caused by mistakes during testing. These errors are commonly assumed to be accounted for by the initiating event frequencies.

Type C actions are divided into three categories: (1) manual backup on failure of

automatic initiation, (2) actions performed in response to an Emergency Operating

Procedure (EOP), and (3) recovery actions to restore a safety function that is lost due

to equipment malfunction. Types Cl and C2 are either modelled in the functional fault

trees or in the event trees. Type C3 actions are addressed at the sequence cut set level

after initial quantification.

52

53

The quantification of Type A and Type Cl actions is based on the THERP

(Technique for Human Error Rate Assessment) approach. For Types C2 and C3 the time

reliability curve concept of HCR model is used. This requires estimation of a median

response time Tl/2 and a logarithmic standard deviation of operator response times.

These are used to determine a lognormal time reliability curve. The report (Section

8.3.2.1) provides estimators for TV2 and Sigma based on observed simulator data.

Errors of commission are considered out of scope. However, it can be argued that

certain categories of errors of commission are included in the errors currently modelled.

9.2. Key Findings

Based on the review of the documents and discussion with the HRA analysts the

IPERS team is of the opinion that significant progress has been made in the area of

human reliability analysis since the pre-IPERS meeting. The work to date shows good

understanding of many key issues in analysis of operator actions. IPERS team

nevertheless believes that more needs to be done before the results of the analysis can

be used in the Kori PSA with high confidence. The key findings and recommendations

of the IPERS review are summarized in the following.

9.2.1. Treatment of pre-initiating event human errors

The methodology adapted is commonly used in PSAs. It appears that the approach

has been used systematically in the Kori PSA. In several cases IPERS team identified

potential problems in assignment of numerical values [HIA-WEV-01 and HIA-WEV-05]

which were subsequently corrected in the analysis. The review team believes that

dependencies may have been underestimated in some cases (see for example [HIA-RM-

2(ii)]), however the impact on the overall results seems to be insignificant.

Documentation of the analysis in all cases should be improved. The current version of

the Human Reliability Analysis Report (Section 8) and the Systems Analysis Reports

(Section 6) do not include any case by case discussion of the estimation of Type A errors.

9.2.2. Treatment of post-initiating event human errors

The issues regarding the treatment of Type C operator errors fall into several major

categories of Estimation of Model Parameters, Dependencies, and Treatment of

Uncertainties. These issues are discussed separately.

54

Estimation of Model Parameters. The report indicates that model parameters are

estimated using simulator data, operator interviews, and data reported by others.

However the actual analysis is based on much less extensive use of data apparently

because simulator data could not be obtained for many crews. The data were only

available for some selected events and even in those case only limited to one data point

which was used as the value of Ti/2 (See [HIA-AM-07(ii)], Issue and Response.) For the

same reason the estimates of the logarithmic standard deviation could not be developed

based on data. Instead, "generic" values were subjectively assigned for different cases

based on the complexity of the situation, clarity of the procedures, etc. In response to the

IPERS comment [HIA-AM-06(ii)] the PSA team agrees to revisit the approach to the

assignment of the sigma values. This is particularly important since the behavior of the

time reliability curve is quite sensitive to the value of sigma. Regarding the value of the

median response time T1/2 it is recommended that other PSAs be also consulted to

assure that the assigned values conform with the range of values estimated or observed

by others.

Accounting for Dependencies. In general, dependencies between different operator

actions in the same sequence are not handled nor documented adequately (see for

example [HIA-SH-03(ii) and HIA-RM-03(ii)]). The methodology discussed in Section 8

does not provide a systematic approach to this issue and no examples could be found in

the actual analysis to enable evaluation of the approach adapted in the PSA. The IPERS

team believes that this is an important issue and should be given a high priority in the

human actions analysis.

55

Estimated Error Probabilities. The estimated probabilities of operators failing to

perform the actions required in response to an initiating event are composed of

"cognitive" failure probability and "manipulative" error probability. As mentioned earlier

the cognitive errors are modelled using the HCR model. The manipulative errors, mostly

slips, are quantified using the THERP approach. In a large number of cases the total

probability is dominated by the manipulative error mode. The report does not however

provide the necessary details to enable an evaluation of the basis and justification for the

probabilities assigned [HIA-AM-lO(ii)]. In those cases where the total probability is

dominated by the cognitive component, the validity of the numbers can be questioned

mostly because of the sensitivity of the numbers generated to the values used for T1/2 and

sigma and the fact that no strong basis has been provided for the assigned values.

However, it is noted that the majority of the probabilities generated are within the range

of typical values seen in HRA analyses. The IPERS team strongly recommends that the

"sanity check" proposed in the HRA report but not implemented be applied, particularly

for low probability cases [HIA-AM-08(ii)]. This will provide additional assurance that the

values generated in the Kori PSA are consistent and can be understood and justified

relative to the range of the available estimates.

Treatment of Uncertainties. The HRA report describes a methodology and a set

of criteria for the assessment of uncertainties about the estimated human error rates. The

method is adequate and the IPERS review has only suggested a minor modification (see

[HIA-AM-09(ii)]). The actual implementation of methodology could not, however, be

evaluated since at the time of the IPERS review none of the error probabilities was

accompanied by an uncertainty distribution. This is usually not a problem during the first

round of point quantification of the PSA if the analysts are careful with respect to the

use of mean values in the analysis. A case in point is the use of values from the HRA

Handbook which are normally interpreted as median but are used in the Kori PSA as

mean.

56

9.3. Summary of Recommendations

Based on the observations discussed above the following recommendations are

made:

1. Develop and implement an approach to handling dependencies among operator

errors in post-initiating event actions.

2. Extend the simulator data base or use other sources of information such as the

EPRI data base and other PSAs, to develop more reliable estimates for T1/2 and

sigma.

3. Compare the numerical results obtained for operator error rates with similar ones

in other PSAs.

4. Provide adequate documentation of the steps of the analysis and derivation of the

numerical results for all important operator actions.

57

10. EXTERNAL EVENTS ANALYSIS

10.0. PSA Task Description

External events are those sources of hazard that originate outside the boundaries

of the equipment of interest and impact several pieces of equipment simultaneously. For

example, a fire inside the plant is considered as an external event, since it can impact

several cables and several pieces of equipment at the same time. The list of external

events for a plant may include earthquakes, floods (from internal or external sources),

turbine missiles, etc. In the PRA Procedures Guide (NUREG/CR-2300) an extensive list

of external events is suggested for PSA studies. Almost all PSAs completed to date that

have included external events have concluded that such events are important contributors

to the overall plant risk. Often earthquakes and fire events are the most important

external events.

10.1. Treatment of External Events in the Kori PSA

In the Kori PSA, the following external events were considered:

Seismic

Fire

Internal Flooding

Typhoon (Wind, Waves, Intake Blockage)

At the time of this review, detailed (sometimes preliminary) sequences, cutsets and

quantification were available for all except the fire analysis.

In each case, the analysis consisted of an evaluation of the annual frequency of

different levels of the hazard (e.g., levels of earthquake ground motion, random pipe

breaks of different sizes, typhoon wind speeds or fires), an analysis of susceptibility of the

components to the event (e.g., failure acceleration of components, critical wind levels for

58

component collapse, flood level causing damage to each component, etc.) and finally a

quantification of accident sequences specialized to the external event under

consideration. In each case, the appropriate random and test/maintenance component

unavailabilities and human error probabilities (HEPs) were coupled into the analysis of

the accident sequence associated with the external event-induced initiators.

10.2. General Results of the Review

In general, it was found that the external events analyses were performed by state-

of-the-art methods and at a level of detail to provide confidence in the completeness of

the final results. A very substantial effort has gone into the external event analyses, and

it is reflected in the current report.

Hazard analysis for typhoon and earthquake hazards used Kori site-specific data.

Hazard analysis for internal flooding and fires used available generic data on pipe break

and in-plant fires from other countries, which represents the best generic data currently

available.

The vulnerability of components to each external event was analyzed in detail, in

some cases using outside consultant expertise (winds and earthquakes) and for flooding,

a detailed compilation of critical water levels for each component plus an identification

of each component’s susceptibility to spraying.

Logic models for the sequences used for each type of initiator were derived in close

cooperation with the development of the internal events logic models (fault trees and

event trees) and good consistency between the internal and external events logic seems

to have been maintained.

Finally, numerical quantification of the various sequences seems to have been done

in an appropriate (if sometimes conservative) fashion. The documentation contained

sufficient data and information to allow the reviewer to reproduce the numerical values

59

of the dominant wind, flood and earthquake sequences (although assistance from the

analysts was sometimes required in locating the pertinent data within the PSA report and

its appendices).

In general, the external event documentation was good. Large tables presenting

basic data, failure levels, plant layout and component locations, etc., were included. All

of this helped in giving confidence in the final results, as well as allowing the reader to

reproduce all important results. (Specific areas where additional information should to

be added, or additional explanation is required is identified in the attached issues, or in

the discussion of each specific external event analysis below. PSA personnel have

committed to making these additions.)

A number of general criticisms are discussed below. Most of them apply to all the

external event analyses.

1. No systematic screening of all potential external events was performed to assure

completeness of the study [EEA-AM-04 and ЕЕА-МРВ-01]. A fairly complete list

of such events is presented in the PRA Procedures Guide (NUREG/CR-2300)

along with appropriate screening criteria. A table addressing each event, along with

a qualitative argument as to why an event can be screened out should be a part of

any PSA report which includes external events. For those events which cannot be

qualitatively screened out, a simple quantitative screening analysis (often solely

based on the initiator frequency) should be made. For the Kori PSA, this should

be done. (In particular, aircraft crashes and perhaps barge or ship chemical releases

should be examined.

2. In general, none of the external events included sensitivity studies assessing the

impact of different assumptions, models, ranges of integration or levels of

discretization. Similarly, there were no importance studies performed on the results

to date. These are important to identify critical components, vital areas, etc. and

they provide guidance to potential retrofits aimed at reducing plant risk.

60

3. There is some inconsistency between the fault trees used for fire, flood and internal

events, and the event trees used for internal events and seismic events. Evidently

different analysts constructed the different fault trees, simplifying them for the

particular event in question. The various fault trees are not wrong, but the lack of

consistency in structure, nomenclature and gate numbering makes the results less

transparent and will cause more difficulty in updating the PSA. These

inconsistencies could be eliminated in future ROK PSAs by completing

development of the internal events logic models before considering external events,

and then making use of these internal logic models directly to particularize them

to the different external events. Then only one set of nomenclature, gate names,

random failure rates, etc. would have to be referenced. (Of course, additional basic

events for the hazard in question would have to be added.)

Comments and review conclusions for each of the four external events analyzed in

detail for the Kori PSA are presented below.

10.3. Seismic Risk Analysis Review

At the time of the review, the seismic risk analysis had completed seismic hazard

curves (development and report), a completed fragility analysis of components and

structures (analysis and report) and a nearly complete quantification section in the PSA

report. This included event trees and a description of the impact of seismic component

failures on mitigating systems, and a preliminary quantification of the seismic accident

sequences. The review comments below are based on this information.

An important finding of the review was that hazard curve input prepared by the

hazard analysis team did not match the input requirements of the seismic quantification

analysis code (SEISMIC code) and that the preliminary seismic accident sequence

frequencies were about a factor of 10 too small [EEA-MPB-06, EEA-MPB-33(ii)]. In

addition, NUS consultants are currently recommending a restructuring of the seismic

event trees to make the event tree logic clearer, to include relay chatter if it turns out

61

to be needed [EEA-MPB-17 and EEA-MPB-42(ii)] and to provide a better interface with

the Level II analysis. Thus the final Kori PSA seismic risk analysis will look somewhat

different than the one reviewed, and will have substantially higher seismic sequence

frequencies.

10.3.1. General PSA approach

The seismic risk assessment methodology is based on the following four steps:

a) Develop seismic hazard curves

b) Determine probabilistic failure criteria for components and structures (fragilities)

c) Develop seismic logic models (event trees)

d) Quantify accident sequence frequencies, including integration over the seismic

hazard curves.

The seismic hazard curves were developed using the methodology and computer

code of Risk Engineering, Inc and using input of experts familiar with the geological and

seismological characteristics of the Kori site region. A logic tree format (with

judgementally assigned split fractions for each branch) was used to propagate uncertainty

in the hazard curve development process. The procedure used represents the state-of-the-

art in hazard curve development. The result was a family of 158 hazard curves derived

from five experts, each of whom used a variety of different (alternative) hypotheses.

These (weighted) 158 individual hazard curves were used to construct a mean hazard

curve and percentiles of the seismic hazard distribution. In addition, the family of hazard

curves for each expert was aggregated so as to obtain 5 discrete hazard curves for input

to the SEISMIC code.

The component and structure fragilities were developed by EQE, Inc. Development

included a detailed walkdown of the Kori plant. Development of individual fragilities

utilized the "Engineering Factor of Safety" approach in which the (usually conservative)

design calculations or seismic equipment qualification test results are scaled by factors

62

of safety to determine a best estimate measure of the peak ground acceleration causing

component failure. A variety of factors of safety are estimated and (log normal) random

and modelling uncertainties are propagated through each analysis. Non-linear energy

absorption capabilities of components (whose failure mode is ductile structural failure)

is included by incorporating a "ductility factor" as developed by N.M. Newmark. In

general, this "Engineering Factor of Safety" approach represents the current state-of-the-

art. Indeed, there has recently been a comparison of this method versus the more exact -

but very costly and time-consuming use of multiple time history non-linear analyses - for

failure of a turbine building shear wall. This was done as part of the (soon to be

published) Diablo Canyon PSA in the U.S. Good agreement was found.

A single "primary seismic event tree" was developed whose initiating event is the

earthquake. This tree involves only seismic failures. If the end state of one of the

sequences on this tree does not lead (in and of itself) to core damage, an event tree

involving only random (i.e., non-seismic) failures is linked to the sequence. This "non-

seismic" tree was taken from the internal events logic models. In the preliminary

quantification for the Kori PSA, only the LOSP tree was used in the "non-seismic" role.

Provided the logic and implications of the various component and structural failures are

carefully thought out, this approach to developing seismic accident sequences is correct

and appropriate (although conservative assumptions usually used in developing these

simplified trees often lead to conservatism in the final core damage frequencies).

Finally, quantification was performed using the NUS Corp. computer code

SEISMIC. This code uses system accident sequences, component and structure fragilities

(including both random and modelling uncertainties) and a discrete family of hazard

curves to quantify the annual frequency of each seismic accident sequence. The result

is percentiles of the uncertainty distribution of each accident sequence as well as the

mean accident sequence frequency. This code has previously been evaluated by the

reviewer (as part of a review of the ROC Maanshan PSA) and found to be an

appropriate and accurate tool for the quantification of seismic risk.

63

10.3.2. Results and observations of review

In the following, review results and specific observations are presented for each of

the four steps of the seismic risk analysis process used in the Kori PSA.

10.3.2.1. Hazard analysis review

As mentioned earlier, a significant interface problem between the hazard curve

development team and the seismic quantification team occurred. This occurred to some

extent due to the fact that the hazard development team developed 158 hazard curves

for the Kori site, but the SEISMIC quantification code is set up to use a much smaller

number of (weighted) point estimate curves. Thus aggregation into a smaller set of

curves had to be performed. (In this case, the 158 hazard curves were aggregated down

to 5 curves). Initially, 5 median hazard curves were constructed. But use of such median

curves does not properly characterize the uncertainty distribution in the hazard curve

family as characterized by the complete set of 158 curves. In particular, the five median

curves do not characterize the overall mean hazard curve of the 158 curves. This overall

mean curve must be preserved in any small set of (aggregated) curves used for

quantification. The net effect of using 5 median hazard curves was an underestimation

of the seismic core damage frequency by a factor of about 10 [EEA-MPB-06, EEA-MPB-

33(ii)], according to calculations made by the reviewer.

The seismic accident sequences are being requantified (as this is being written) using

a set of 5 mean (aggregated) hazard curves, and final results are not yet available.

However, some questions still remain as to the proper choice of a small set of hazard

curves to characterize the uncertainty distribution implied by the full set of 158 hazard

curves. (Note that the use of 5 mean curves by definition preserves the overall mean, and

thus the final mean seismic core damage frequency will be correct). These questions

[EEA-MPB-36(ii)] should be resolved with the NUS Corp. consultants, and clearer

guidance on the aggregation process should be developed.

64

Another seismic hazard-quantification interface issue involved the recommendations

by the hazard development team that the maximum acceleration to be considered is l.Og

(based on expert judgement). By contrast, the seismic quantification team considered

earthquake accelerations up to 2.0 g in the quantification process [EEA-MPB-49(ii)]. The

Kori seismic hazard curves are relatively "flat" for high peak ground accelerations (which

may be caused by large uncertainties in the current state-of-the-art development process

and also due to lack of extensive seismological data in southern ROK). Because of this

"flatness" in the hazard curves, significant contributions to total seismic core damage

frequency in the 1.0 to 1.5 g range will result. Thus the seismic quantification team must

consider peak ground acceleration levels above 1.0 g if the results are to converge. The

discrepancy between the hazard team recommendation and the quantification team needs

for convergence should be resolved. (In some past PSAs, upper limits to peak ground

acceleration have been argued based on rock strain limits, but this has been difficult to

defend).

As mentioned above, the "flatness" in the hazard curves for high peak ground

accelerations is likely to be due to uncertainties in the hazard curve development process

and lack of data for the site region. A similar situation occurs with the sets of Eastern

US hazard curves developed by Lawrence Livermore national Laboratory for the US

Nuclear Regulatory Commission (NUREG/CR-5250). A joint program (among the US

NRC, US DOE, and the Electric Power Research Institute) is currently being set up to

develop an improved, stable, and consensus methodology and models for hazard curve

development, which should reduce uncertainty in the hazard curve development process.

The results of this program should be available in about 18 months. If the results of this

program are combined with gathering of strong motion earthquake data in the ROK, it

would be possible to significantly reduce the uncertainty driving the hazard curves (and

causing the "flatness"). Perhaps a government program could be set up to develop hazard

curves for all ROK sites using the new methods and new data.

65

10.3.2.2. Seismic fragility review

The review consisted of a brief review of the engineering calculations for selected

components and structures, plus a one day plant walkdown. The review of the fragility

calculations was not an audit, but rather a review of methods, assumptions, failure modes

considered and data used in the fragility calculations. The set öf components for which

the engineering calculation sheets were reviewed is given in Table 10-1. The review

walkdown provided the means of verifying certain assumptions as to anchorage, presence

of relays, etc., and an independent check for seismic interactions [ЕЕА-МРВ-20].

Table 10-1

Components Selected for Detailed Review

Aux/Control Bldg

Steam Generator

Pressurizer

RHR Heat

Exchanger

RWST

CST

NSCW Pumps

CCW Pumps

AFW-MD Pumps

4.16 KV Switchgear

480 MCC’s

125 V Batteries &

Racks

Battery Charger

Electrical

Penetration Room

AHU

ECH Chillers

CCW Surge Tank

As discussed in Section 10.2, the development of seismic fragilities for the Kori PSA

was based on the Engineering Factor of Safety approach, and this is felt to be the

current state of the art. The method does, however, require familiarity with the

methodology, analyst experience and it does rely heavily on analyst judgement.

Perhaps the most general observation on the seismic fragility development for Kori

is that it is heavily dependent on the fragilities developed for the ROC Maanshan plant.

That is, the Maanshan fragility "factors of safety" were used for many Kori components,

by scaling them according to the differences between the Maanshan site ground motion

spectra and the Kori ground motion spectra. (This is done because many of the factors

of safety depend on the spectral acceleration at one or more natural frequencies of the

component in question). This approach of scaling the Maanshan fragilities to apply to

Kori is completely valid if the components and their anchorage at Kori and Maanshan

are identical. There are, however, pitfalls.

a) Obviously, this approach presumes that the Maanshan fragilities

themselves are correct.

b) There may be differences in anchorage of cabinets, etc, which are to

some extent "field erected". Actual anchorage capacities should always be

checked, even when EQ test data are the basis for the fragility

development. (Anchorage in EQ tests is often not the same as in the

field). This issue may affect the 4 KV switchgear fragility at Kori [EEA-

MPB-41(ii)].

c) Relays on nominally "identical" pieces of equipment (purchased in

different timeframes) may have different chatter characteristics due to

small design changes in the relays themselves. (Examples of this are

found in the US Nuclear Industry’s Seismic Qualification Utilities Group

relay data base.)

These pitfalls should be kept in mind when making use of fragilities developed from

another plant.

A second general observation is that the presence or absence of relays on electrical

cabinets was determined by use of electrical line drawings. Evidently the protective relays

(over-voltage, over-current and frequency shift) were not on these functional line

drawings. But they are present on almost all electrical cabinets, switchgear and buses.

66

67

In the future, it is recommended that relays be identified by electrical engineers using

detailed circuit drawings [EEA-MPB-42(ii), ЕЕА-МРВ-17].

A final general concern has to do with "anomalies" identified during the plant

walkdown, but which are so simple to correct that it was assumed that they will be

corrected prior to completion of the PSA (and hence no specific fragilities were

developed for these anomalous conditions). A list of these is presented in the EQE Kori

Fragility Report. These include missing bolts, broken welds, etc. Other examples were

observed by this reviewer during his walkdown, including

- missing bolt on safety-related invertor

- unanchored pressurized gas cylinders

- portable tool boxes free to move in an earthquake

A formal process needs to exist to assure that these identified anomalies are fixed,

and to assure that the plant is physically the same as the plant analyzed in the PSA

[ЕЕА-МРВ-30].

A last observation on fragilities has to do with the Kori fire protection system.

During the review walkdown, it was noted that the DC battery racks (which evidently

provide control to the fire pumps if LOSP occurs) lack lateral support in one direction.

Thus, in an earthquake in which LOSP is highly likely, the plant’s fire water protection

system is likely to be lost. Such seismic/fire interaction issues are not in the scope of the

Kori PSA, but the battery racks can be easily upgraded and the remainder of the fire

protection system (pumps, pipes, etc) is intrinsically seismically rugged. Hence the plant

should consider upgrading these racks [EEA-MPB-44(ii)].

10.3.2.3. Seismic system models review

As discussed in the beginning of Section 10.3, the seismic logic models consisted of

a seismic "primary" tree (involving only seismically-induced component and structural

68

failures) and a LOSP tree (containing only random, T&M and HEP’s) which is linked

to certain branches of the primary seismic tree as needed. As mentioned earlier, this

approach is valid and appropriate, provided the logic is carefully thought out.

Note that - as the Kori primary seismic tree is currently structured - certain branches

seem illogical at first glance. For example, there is a sequence

EQ * DG * CST * RWST

which leads to core damage. This sequence looks illogical, because failure of the DG is

not required for core damage (if loss of MFW is presumed). But there is also the

sequence

EQ * CST * RWST

with implied success of DG. Hence the sum of the two sequences is logically correct. The

same situation occurs with the station blackout sequences

EQ * DG * LOSP * RWST

EQ * DG * LOSP

since the RWST is not required for core damage. The numerical results will be correct, but the sequences look wrong. A simple re-ordering of the top events can clean this up.

(This is evidently being done.)

A dominant sequence is EQ*CM, where CM is the union of single events presumed

to lead directly to core damage. This includes a number of single events which actually

model joint failure of multiple components, and thus considerable conservatism is

introduced. For example, failure of one 480 MCC implies failure of ah 480 MCCs and

hence core damage. The same assumption of full correlation applies to the NSCW Pump,

125 DC Bus and 120 AC Panel seismic basic events. This is a valid assumption, and not

69

inappropriate if the failure probabilities are not unacceptably high. But it does lead to

significant conservatism. More complicated systems fault trees and consideration of

partial correlation can remove this conservatism if needed.

Strictly speaking, the primary seismic event tree sequence No 1, involving the

occurrence of the earthquake and no seismic failures does not lead to an "OK" end state,

but rather to a general transient, since the operators are expected to shut the plant down

for inspection following an earthquake above the OBE. Thus, this sequence should

transfer to the general transient tree. Using the CMF of 1.7e-6 from the general transient

tree involving only random events (Fig.III 1.3.1-4) and the Kori mean hazard, this

sequence would have an annual frequency of only 1.5e-8/year. So this is negligible for

the Kori PSA (given the seismic fragilities as currently identified). For future PSA’s,

however, there may be components which are seismically-vulnerable, and which do not

have global impact (and hence are not included explicitly on the seismic primary event

tree) which should be quantified as part of the general transient tree. This could increase

the CMF of the general transient, and make the contribution of such sequences non-

negligible (as has been found in some other PSAs).

Finally, there are no explicit accident sequences identified which must transfer to

a small LOCA tree (say, stuck open safety relief valves in the LOSP tree appended to

the primary seismic tree, etc). These transfer sequences have been contributors to some

other seismic PRAs. Similarly, there are no seismically-induced small LOCA initiators,

although the PSA analysts have indicated that they may be included in the future. Again,

SLOCA sequences have been found to be contributors in some other seismic PSAs.

10.3.2.4. Seismic quantification review

As described early in Section 10.3, the numerical quantification was performed using

the NUS corp. SEISMIC code. This code is an appropriate and state-of-the-art tool for

seismic quantification, and has been reviewed in the past by this reviewer (MPB).

70

As input to the SEISMIC code, the user must provide coding which defines the

seismic accident sequences. Two observations are made.

1. One of the two dominant sequences (EQ*CM) used the small probability

approximation in obtaining an algebraic expression for the union of events

considered. This is not appropriate, because for high peak ground accelerations, the

resulting conditional accident sequence probabilities will be computed to be greater

than 1.0, and hence the core damage frequency of that sequence will be

overestimated (often significantly). Instead, the algebraic expression should be based

on the full expression for the union of independent cut sets,

Prob(ACC) = 1 - Product [1 - Prob (cutset)]

which, by definition, cannot yield probability values greater than unity. This has now

been corrected [EEA-MPB-35(ii)].

2. Concern was initially expressed at the preliminary review (in Vienna) that the

complemented events must be properly included and incorporated in the

quantification. This was reviewed in Korea, and it was found that the complements

were correctly incorporated and quantified. This is very important in seismic PSA,

as complement events can be much less than unity at high acceleration levels, and

if neglected, can result in significant over-estimates of the seismic frequencies [EEA-

МРВ-21].

10.3.3. Summary of seismic review

Although the seismic accident sequence frequencies are being requantified (and

hence not yet available for final review), the review found that the overall methodology

is appropriate and state-of-the-art. With revision of the hazard curve input to the seismic

quantification, the final seismic accident sequence frequencies should be accurate, and

constitute a seismic risk assessment in which KEPCO can have high confidence.

71

10.4. Internal Flooding Risk Analysis Review

10.4.1. General PSA approach

The analysis of internal flooding was performed by an appropriate and detailed

methodology. Three levels of screening of floods without interzone flood propagation

plus a fourth stage analysis specifically considering flood propagation were performed.

Documentation was essentially complete, and (draft) quantification results were

available.

Flood initiating frequencies for level 1 screening (entire buildings) and for level 2

screening (independent flood areas within buildings) were performed using generic data

based on Nuclear Power Experience reports. For Level 3 screening analysis (same flood

zones as level 2) plant-specific calculations of flood frequency were made, taking into

account actual equipment in each flood zone. Sources considered were:

Pipe Break

Tank Failure

Valve Rupture/Leakage

Expansion Joint Failure

Maintenance Activities

Industry data were used to quantify these frequencies.

Component failure was based on flood level. Input flowrates, drainage and sump

capacities, free volume in each zone and the likelihood of isolating the flood source were

considered.

The level 4 analysis of flood propagation between zones considered doorways, drains

and penetrations. Check valve failure rates and hydraulic calculations were used to

determine interzone flood rates.

72

In general, the flood analysis was felt to be a very good, state-of-the-art analysis with

detailed attention paid to all potential components, flood sources and propagation paths.

10.4.2. Review observations

Very few criticisms can be leveled against the flood risk analysis. The following

observations were made.

1. Floods were broken into three discrete sizes called Categories I, II and III,

coinciding to severe break, small break and leakage. Flow reduction factors of 1,3,6

and associated split fraction likelihoods of 0.1, 0.3, and 0.6 were assigned to these

categories. No basis for the choice of these values was given. No sensitivity studies

on these choices were performed. Yet these values can have a very important effect

on the final CMF[EEA-MPB-47(ii)].

2. Operator recovery actions to isolate floods were based on time available. No basis

was presented for values chosen. (Time available depends on the discretization

scheme as described above). The basis for the non-recovery probabilities should be

included, and the same methodology as used for internal events HEP’s should be

used [EEA-MPB-47(ii)].

3. Further explanation of results and tables is needed so the reader can numerically

reproduce the results. Discussion on flow reduction factors for different flood

categories and associated split fraction likelihoods now treated in separate sections

in an appendix) should be described together in the main report. More detail is

advised. Similarly, some tables in the appendix need explanations of where entries

come from. An example using a dominant sequence should be provided to illustrate

the entire quantification process [EEA-MPB-48(ii)].

4. Two dominant sequences were found, a flood in zone CB-1 and a flood propagating

from AB-12 to AB-13. The second sequence (of lesser importance) involves loss

of all CCW due to loss of NSCW, and has the same inherent conservatisms (and

potential recovery actions) as in the internal events analysis for the corresponding

scenario. This sequence may be quite conservative.

The dominant sequence (CB-1) involves flooding due to breaking one train of

NSCW piping in a corridor outside the 4KV switchgear rooms, and seems realistic

as currently analyzed.

10.5. Fire Risk Analysis Review

The fire risk analysis quantification and documentation were not complete or

available at the time of this review. Hence the comments made below are based on

incomplete data. However, much of the basic component and cable routing data were

available.

10.5.1. General PSA approach

The general approach seems to be reasonable and typical of state-of-the-art

commercial Are PSAs. Initiating events (fires in different fire zones) are determined from

events at US commercial nuclear power plants (given in NUREG/CR-4586). Fire

occurrence frequencies for different types of components are determined from the same

data base. Simplified fault trees - with the addition of fire damage events for 50 different

components - are developed using the internal events fault trees for LOSP and general

transients. Quantification (evidently) will include probability of non-detection and non-

suppression of fires. As far as this goes, this approach is reasonable and acceptable.

10.5.2. Review observations

Again, it must be reiterated that final results, sequences, cutsets and sequence

frequencies (as well as the supporting appendix) were not available.

73

74

1. Although fire damage component basic events were added to the simplified fault

trees, it is not clear how various cable segments in different fire zones will be

treated in the logic format - yet they must be included [EEA-MPB-51(ii)].

2. It was mentioned that 50 components were considered vulnerable to fire - but no

list of these was in the documentation. Are cable segments included?

3. Certain fire frequencies for different general types of areas (control room, battery

room) are lower than other analysts have found from the same data. This should be

resolved [EEA-MPB-50(ii)].

4. No Bayseian updating of fire frequencies using Kori-specific data or partitioning of

fire areas (and thus fire frequencies) was described. This can substantially lower the CMF.

5. No description of any uncertainty analysis was presented, and no uncertainties for

any parameters. An uncertainty analysis and sensitivity studies should be included.

In summary, it is felt that the general approach to fire analysis presented in the available

documentation is typical and adequate, but many questions remain to be answered until

final documentation is available.

10.6. Typhoon Risk Analysis Review

The analysis of typhoon risk was complete at the time of the review, including

documentation, wind fragilities and numerical accident sequence results.

10.6.1. General PSA approach

Three aspects of a typhoon event were analyzed:

75

Typhoon winds

Flooding due to typhoon

Debris blockage of NSCW intake structure

A wind hazard curve for the Kori site (giving the annual probability of exceeding

different wind speeds) was developed. This was based on fitting several different

probabilistic models to local data, and determining a mean wind speed hazard curve.

The effects of high winds on structures, transmission line towers and exposed tanks

in the yard (RWST and CST) were examined. Wind-blown missiles were considered as

potential damaging mechanisms for the yard tanks. Only failure of transmission towers

was found to be significant. This was used as LOSP initiator. A small contribution to

CMF was found.

High water level effects were considered. Only the NSCW pumps in the intake

structure were found to be vulnerable, based on deterministic FSAR flood levels. This

was screened out.

Finally, a scenario involving heavy debris due to typhoon and failure of the intake

structure travelling screens (resulting in intake structure blockage and failure of all

NSCW) was examined. A small CMF contribution was found.

10.6.2. Review observations

In general, the approach to analyzing the typhoon-induced risk was found to be

appropriate. Appropriate statistical models were used to develop the wind fragility curve.

Detailed calculations of transmission tower failure and missile penetration of yard tanks

were made.

The following observations and criticisms were found:

76

1. The wind analysis did not address the possibility of steel siding on the turbine

building above the station transformers blowing loose and causing LOSP. This

should at least be examined and screened out if appropriate [ЕЕА-МРВ-15].

2. The screening out of typhoon-induced flooding of the intake structure was not

convincing and not well documented. Some probabilistic estimate of maximum flood

surge level will have to be made (perhaps including forebay oscillations) as the

deterministic surge level in the FSAR is within 2.5 feet of a level which could flood

all four NSCW pumps (if doors not sealed). [EEA-MPB-46(ii)].

3. The analysis of NSCW blockage due to typhoon was not clearly described. The

sequence considered did not include LOSP. An additional sequence involving both

LOSP and loss of NSCW could be envisioned. PSA responses indicated they felt

such a sequence would not be a large contributor - and could be recovered.

However, item (1) above could affect this conclusion [EEA-MPB-45(ii)J.

77

11. QUANTIFICATION OF ACCIDENT SEQUENCES

11.0. PSA Task Description

The quantification of accident sequences includes:

1. The integration of fault trees for front line and support systems into fault trees

on a sequence basis.

2. The algebraic solution and quantification of the fault trees and event trees.

3. The evaluation of event or system importances, sensitivities, and uncertainties.

11.1. Methodology

The quantification is performed by NUPRA code. NUPRA works as follows :

1. The fault trees are solved to produce minimal cut sets. Truncation values are

needed to keep the solution manageable.

2. Minimal cut sets are obtained for the core melt sequences. The method takes

account of the success terms in each sequence.

3. Each sequence (or each minimal cut set within each sequence) may have a

recovery factor associated with it. The recovery factor represents the

probability that the operator can find some means to prevent the onset of core

damage.

Overall this approach works well; we have several minor concerns relating to its

implementation and one major concern relating to the use of recovery factors.

78

Truncation Errors

In performing the sequence analysis a truncation value has been used to keep to

a manageable level the number of sequences calculated and carried forward in the

quantification. The sequence truncation values are set at either 10'7 or 3 orders of

magnitude lower than the associated function values (whichever is lower). We

recommend (in the resolution to [QAS-MAS-02(ii)]) that the truncation value used for

the sequences should not be set lower than the highest truncation value of the associated

functions. (As any MCS list generated with a probability lower than the highest function

truncation may be incomplete and hence the results would be misleading.)

Transfer between Event Trees

Several of the end points in the transient event trees are sequences in which the

intact circuit has become breached (either by failure of the RCP seals or by a pressurizer

relief valve sticking open). These sequences are transferred to the appropriate event

trees. The contribution of these transferred points has not been added to the initiating

event frequencies though it is the stated intention of the Kori PSA team to do so. If the

additional contributions are significant then new event trees should be constructed (The

Kori PSA team already proposed to do this, see [QAS-SH-05(ii)]). Of particular concern

are the transfers from the loss of offsite power [ASA-LC-01], that is sequences TPB30Q1

and TPB30Q, into the small LOCA trees. We believe these should be handled

separately from the general small LOCA tree as for these two sequences the safety

injection pumps are relying on the diesels alone for power.

Screening Analysis

No screening analysis was performed for the Kori PSA. This would have been

useful in the initial stages of the event and fault tree development. Screening analysis

should be considered for any future PSAs [QAS-WEV-01].

79

Maintenance

Unavailability of components due to maintenance is modelled in the fault trees.

The quantification of the accident sequences will produce minimal cut sets that contain

two or more such maintenance unavailabilities. The maintenance implied by such

minimal cut sets may be outside the operational constraints of the plant. In such

circumstances the minimal cut set should be deleted as it is not a valid combination of

events. NUPRA can recognise combinations. This has not currently been implemented

in the Kori PSA [QAS-MAS-Ol(ii)], though it is their stated intention to do so.

Modelling Recovery Actions

Recovery actions have been selectively added to many of the risk dominatit

sequences. This is not documented in any way. The recovery action failure probabilities

appear without explanation in the sequence minimal cutsets. This leads to considerable

misunderstandings and misinterpretation of the results [QAS-RG-03(ii), QAS-SH-03(ii)

and ASA-RM-02(ii)]. All of this could have been avoided by supplying adequate

documentation of what was done. Such documentation should be provided for the final

report. It should include as a minimum:

a) A detailed description of the recovery action and the sequences/minimal cutsets

to which it applies.

b) A quantification of the likelihood that the condition cannot be recovered. This

may be a low probability if the recovery action is to use alternate equipment for

which normal component failure probabilities would apply. If the recovery action

is to repair or to manually actuate equipment which is closed or failed within the

minimal cutset, then there must be an assessment of the failure mode of the

equipment and judgements made as to whether the equipment can be made to

function.

80

c) A human error analysis of the reliability with which the operator performs the

action.

A specific concern is the recovery of the motorized valves in the sump lines which

are located outside the containment. One of these valves is required to open to switch

from injection to recirculation following a small LOCA. Both the independent failure

and common cause failure of these valves are considered to be recoverable. It is rather

unusual in PSAs to claim that such events are recoverable. We recommend that no

credit is given in the PSA for these recovery actions, particularly as this recovery does

not give a significant improvement in the reliability of the recirculation event.

11.2. Specific Concerns

Station Blackout

Core melt following station blackout is currently assessed to be the major

contributor to risk. The risk numbers are dominated by three items:

a) Frequency with which offsite power is lost

b) The duration of the loss of offsite power

c) Dependent (and random) failures which cause the loss of both diesels.

The offsite power data used is derived from US experience. For such important

probabilities every effort should be made by the Kori PSA team to obtain Kori specific

(or at the very least Korean specific) data. In fact Kori specific data has been obtained

(there have been 3 events) but not used. We recommend the following:

1. Perform a Bayesian update to combine the US data with the Kori data; and

obtain new estimates for frequency of loss of offsite power and duration of

loss probabilities.

81

2. Obtain data from other Korean nuclear sites. This should give sufficient data

to obtain reasonable estimates of the frequency and duration of offsite power

loss.

Loss of CCWS

There is a high conditional probability of core melt following loss of CCWS [QAS-

RM-03(ii)]. We believe this is in part due to conservatism in the event tree model,

namely:

1. The assumption that the operators will only try to use slow depressurization

and cooldown procedures which will not prevent séal failure following loss

of CCWS. We recommend that the Kori PSA team quantify the benefits

arising from a faster depressurization/cooldown procedure. Such a

procedure should enable the PSA team to claim a reasonable probability that

seal damage can be avoided by quickly achieving a low pressure operating

condition.

2. Pumps can be run for short period without CCWS. The PSA team should

investigate whether such operation will be effective in either (a) preventing

seal failure or (b) preventing core uncovery following seal failure.

82

12. DOCUMENTATION AND RESULT PRESENTATION

12.0. Background

A critical element of a PSA is the presentation of final and interim results,

including documentation of how results were obtained and what information was used.

It is certainly critical that a living PSA’s documentation be well structured, clear and

transparent, and easy to review and update. The documentation should describe all tasks

of the analysis in sufficient detail to permit the reader (i.e., KOPEC, KAERI, and

regulators) to understand the derivation (and perhaps to perform an independent

recalculation) of dominant accident sequences. All major assumptions and constraints

of the PSA should be clearly discussed.

12.1. Review of Draft Documentation for the Kori PSA

The most important observation is that the existing PSA documentation does not

reflect the actual work performed. This observation summarizes two major concerns of

the IPERS team. First, the results should follow from the stated approach for each task

[ASA-MAS-03(ii), DRP-SH-01, DFA-SH-05]. (Of course, changes to task methodologies

should also be reflected through revision of task plans.) Second, all work performed

should be documented; failure to report all analyses actually performed degrades the

credibility of the PSA and creates an update problem [ASA-WEV-01, ASA-MAS-06(ii),

ASA-MAS-09(ii), ASA-MAS-lO(ii), DRP-MPB-03, DRP-AM-01, DRP-AM-02].

12.2. Detailed Review Comments on Documentation

The overall plan for PSA documentation, as evidenced by review of the Table of

Contents, is adequate to explain the PSA results and to provide the capability for a living

PSA. Each event tree section contains the same level of detail (discussion of success

criteria, event tree headings, and accident sequences). Fault tree sections are consistent

with respect to each other; each section follows the same format and level of detail.

83

However, the current overall documentation is inadequate to support the PSA

objectives, nor does it favorably compare with documentation of other complex technical

projects with which we are familiar. Resolution of the following comments will help

provide an adequate level of documentation:

1. Explicit representation of the calculation trail is necessary to help the reader

better understand the methods and to make modifications [QAS-RG-03(ii),

QAS-MAS-Ol(ii), QAS-SH-03(ii)].

2. Abbreviations should be consistent throughout the report [ASA-AM-01, IEA-

SH-02],

3. PSA results should be organized to show dominant system, human error,

common cause failure, and maintenance unavailability contributions to risk.

Importance calculations (particularly, risk-achievement worths and risk-

reduction worths) should be provided [DRP-SH-02(ii)].

4. Supporting references should be cited [DRP-MAS-Ol(ii)].

5. Summary tables should be provided for success criteria [ASA-WEV-02], the

dependencies between common cause initiators and safety functions [ASA-

MAS-12(ii)], components and equipment with non-negligible seismic failure

probabilities [DRP-MPB-01], and wind fragilities [DRP-MPB-04].

6. The seismic hazard analysis report should be revised to indicate that mean

hazard curves are used [DRP-MPB-02].

12.3. Recommendations

The IPERS review team has identified the following major recommendations:

84

1. Summary tables of success criteria and CCI dependencies should be provided.

2. Explicit documentation of the calculation process is necessary to support the

living PSA.

3. Consistent use of abbreviations and terminology must occur throughout the

document.

4. Key assumptions and limitations must be clearly explained.

85

13. QUALITY ASSURANCE

13.0. Introduction

Quality assurance (QA) is a process for achieving and maintaining a high level of

quality by means of:

1. Use of good practice,

2. Independent checking or review,

3. Documentation, and

4. Administrative control.

Use of good practice implies that the analyses are well documented with all

assumptions clearly stated, in order that the analyses can be reproduced by a suitably

qualified analyst. Independent checking and reviewing includes those activities where

existing work products are reviewed (and possibly, recalculated), the basic information

is checked, and the results are verified by the PSA team members, plant engineers, and

other parties involved in the PSA preparation effort.

Documentation is perhaps the only tangible element of the QA process. It

includes control mechanisms to ensure that all PSA analysts are using the same set of

documents, and consistent nomenclature and format is followed. Administrative control

is the collection of all activities that are practiced to ensure that the above elements of

QA are implemented.

13.1. Treatment of Quality Assurance for the Kori PSA

Our review of the QA program for the Kori PSA has been limited to the review

of the draft final report and discussions with KOPEC and NUS personnel. We have not

checked the document trail of internal KOPEC and NUS reviews, nor have we reviewed

the QA program elements (such as procedures, audits, training, etc.).

13.2. Comments on Work Product Quality

Because the existing documentation was being augmented and revised during the

EPERS mission, it is difficult to project the quality of the final work products. The

quality level of the documentation reviewed by the IPERS team is, in general,

inadequate to support the objectives of the PSA. It is our understanding that the Kori

PSA project follows a set of project and task plans; as previously noted, we did not

specifically review these plans. However, the overall inadequacy of the current

documentation demonstrates that, in many cases, the PSA team is not following good QA

practice. This observation implies that either the project and/or task plans are

inadequate or they are not being used during the development, review, and approval of

work products. The following problem areas should be resolved to provide a quality

PSA:

1. Documentation often did not reflect the actual work that was performed [QA-

WEV-03, see also Section 12.1].

2. No reference citations were provided [DPR-MAS-Ol(ii)].

3. Feedback and information received from plant personnel should be better

documented [QA-SH-03, QA-WEV-01].

4. The abbreviation "MFW" (instead of "SFW") to denote the startup feedwater

system was used in the initiating events identification and accident sequence

analysis tasks; this caused some confusion among the IPERS team members

concerning initiator grouping and event tree headings [ASA-AM-01,

IEA-SH-02].

86

87

5. Proper document control measures should be utilized. For example, all

documents should show a control number on each page. Computer printouts

should provide the date they were generated. These measures, while simple,

provide the ability to trace sequence cut sets back through the PSA.

13.3. Recommendations

Based on the review of the available documentation, the following

recommendations are offered:

1. The final report should reflect the actual work performed and include a

complete list of references used in its preparation.

2. PSA task plans should be reviewed and revised if they are inconsistent with

the actual work performed.

3. A common nomenclature needs to be used for all elements of the PSA; a

project glossary should be provided.

88

14. LIVING PSA ASPECTS

The Living PSA means efficient use of a PSA to support safe plant operation.

This leads to a number of requirements concerning PSA modelling features, data,

computer tools, handling of PSA updates and extensions, and the role of PSA in the

overall safety management of the plant.

The main objectives of the Kori 3&4 PSA include evaluation of the safety of the

plant, identification of potential weaknesses and suggestion of improvements (if needed),

and providing guidance to the operators on how to cope with severe accidents. It has

not been expressed explicitly in the objectives that a Living PSA is the goal of the

project. However, during the mission the IPERS team learned that the owner of the

plant has an ambition to realize the Living PSA concept, at least in long-term

perspective. Specifically, PSA-based support to plant operation has been mentioned as

a type of application being of main interest.

The spectrum of possible applications of Kori PSA should be discussed in detail

with the utility and regulator before developing a detailed specification for the Living

PSA. Some of the applications which might be of interest for assisting plant operation

are:

- Definition of risk-acceptable allowed downtimes

- Definition of risk-acceptable surveillance test intervals

- Monitoring safety systems performance against set reliability targets

- Prioritization of inspection activities

- Scram frequency reduction

- Evaluation of safety significance of unplanned events

- Evaluation of aging affects and lifetime extension issues

- Justification of continued operation

- Resolution of regulatory issues.

89

Each of the applications above leads to certain requirements on the PSA plant

model, data and computer codes used. Generally, the Living PSA will benefit from

efforts being expended in the task of Kori plant-specific data collection. It would be

advantageous to plan for Living PSA applications as early as possible and to consider

which PSA features and computer code capabilities are desirable for different uses.

This review has identified a number of incompletenesses and inconsistencies in

the documentation of the Kori PSA, which are not in the spirit of the Living PSA

concept. They have been commented on in the documentation chapter and in the

chapters on specific modelling topics. These documentation deficiencies are, however,

typical for PSA documentation at this stage of the project and are expected to be dealt

with before finalization of this PSA.

The use of constant probability of failure on demand model for failure to operate

or failure to start modes, will make it difficult to use the Kori PSA for TechSpecs related

applications. By providing standby failure rates differentiation between varying test

intervals would be enabled.

The single most important issue for successful Living PSA programmes is

involvement of the utility, and more specifically of plant personnel. In the case of Kori

PSA there is a need to establish a plan addressing future maintenance and uses of the

PSA model. In addition, the PSA should be implemented at the plant and plant staff

should be eventually assigned to take responsibility for the Living PSA programme. This

issue has a high priority in long-term perspective.

Appendix A

Al. IPERS team (resumes)

A2. Composition of responding team

Al. IPERS Team

Ill

Name:

Position:

Organization:

Address:

Phone:

Fax:

Education

1966

1971

1973

Job History

1966-1968

Dr. Michael P. Bohn

Division Manager,

Adverse Environment Safety Assessment Division

Sandia National Laboratories

P.O. Box 5800

Albuquerque, New Mexico, 87123, USA

1-505-846-4927

1-505-844-0095

BSc in Engineering Mechanics,

Verginia Polytechnic Institute

Blacksburg, VA USA

MSc in Theoretical & Applied Mechanics

Stanford University

Standford, CA USA

PhD in Theoretical & Applied Mechanics

Stanford University

Stanford, CA USA

Atlantic Research Corp.

Design and dynamic/thermal analysis of rocket propulsion

systems.

IV

1968-1979 Idaho National Engineering Laboratory

Branch Manger in charge of fuel rod model development.

Developed research and licensing codes to US NRC.

1980-1984 Lawrence Livermore National Laboratory

Manager of Seismic Safety Margins Research Program (SSMRP).

Developed basic methods, codes and probabilistic structures to

allow performance of seismic PSAs.

1984-present Sandia National Laboratories

Division Manager of Adverse Environment Safety Assessment

Division. Responsible for external events research and application

and severe accident environment testing.

V

Name: Mr. Lennart Carlsson

Position: Department Head, Safety Analysis

Organization: Swedish Nuclear Power Inspectorate (SKI)

Address: Sehlstedtsgatan 11

Box 27106

S-10252 Stockholm

Sweden

Phone: 46 8 665 44 76

Fax: 46 8 661 90 86

Education

1972 MSc in Mechanical Engineering, Chalmers University of

Technology Gothenburg, Sweden

1972-1974 Research Assistant,

Reactor Technology, Chalmers University of Technology

Reliability research for Swedish State Power Board

Developing data collection system ATV

Fault tree computer code for Asea-Atom

Maintenance format and LER routings for Swedish Nuclear Power

Inspectorate

1974-1975 Military Service

1975-1976 Maintenance records on computer system for OKG and SV

1976-1977 University of Arizona Tusson

VI

MSc in Reliability Technology

Special course on refueling machine reliability for PWR,

San Diego Gas & Electric

Job History

1977-1980 Assistant Professor, Reactor Technology, Chalmers University of

Technology, Gothenburg, Sweden

PSA research for Swedish Nuclear Power Inspectorate

1980-1982 SKI, Swedish Nuclear Power Inpectorate

Project Manager of disturbance analysis and operational feed

back

1983-1988 SKI, Head of Reliability Analysis

Responsible for - Perodic Safety Review

-PSA

1988-1990 IAEA cost free expert

Risk management project for large industrial areas

IPERS - Borsselle, Netherlands

- Guangdong, China

- Forsmark, Sweden

1990-present SKI, Head of Safety Analysis

Responsibility - Perodic Safety Review

- PSA

- Incident evaluation

- Safety evaluation

vu

Name: Mr. Raducu Gheorghe

Position: Researcher

Organization: Institute for Nuclear Research

Address: Pitesti, District Arrges

0300, Romania

Phone: (40) 76-12610 (ext : 196)

Fax: (40) 76-12449

Education

1981 Power Engineer, Politechnical Institute, Bucuresti, Romania

Job History

1981-present Institute for Nuclear Research

1981-1987 Task leader in thermohydraulic analysis for accidents in CANDU,

VVER-1000 and WER-440 thermohydraulic computer codes

improvements

Development of steam generator model for simulator

1987-present Task leader in Cernavoda Probabilistic Safety Evaluation (CPSE)

Event trees development

Methods and analysis of dependencies

Analysis of human interactions

Quantification and analysis of accident sequences

Technical advisor in thermohydraulic analysis for CANDU

Vlll

Name: Dr. Stefan Hirschberg

Position: First officer

Organization: International Atomic Energy Agency (IAEA)

Address: International Atomic Energy Agency

Division of Nuclear Safety

Safety Assessment Section

Wagramerstrasse 5, PO Box 100

A-1400 Vienna, Austria

Phone: (43) 222-2360/2680

Fax: (43) 222-234564

Telex: 112 645

Education

1975 MSc in Engineering Physics, Chalmers University of Technology,

Gothenburg, Sweden

1981 PhD, Reactor Physics, Chalmers University of Technology,

Gothenburg, Sweden

Job History

1974-1982 Lecturer and Researcher, Department of Reactor Physics, Chalmers

University of Technology, Gothenburg, Sweden

Responsible for large parts of courses in reactor physics and

neutron physics and for radiation protection in the Department of

Reactor Physics. Independent research work in the fields of reactor

physics and neutron physics.

IX

1982-1990

1982-1986

1986-1987

ABB Atom, Vasteras, Sweden

Senior Engineer, Reliability Engineering and Risk Assessment

Group, Department of Engineering

Task leader in several PSAs

Responsible for method development and analysis of dependencies

in several PSAs

Systems and accident sequence analysis in several PSAs

Human factors engineering

Methodology and data base development for fire risk analysis

Life Cycle Cost Analysis

Responsible for courses on PSA and reliability engineering in

Sweden and abroad

Reliability analysis in non-nuclear fields (e.g. off-shore, coal

transport)

Group Leader, Reliability Engineering and Risk Assessment Group,

Reactor Division

Project Leader, Method development for the measurement of

multi-phase flow.

Project Leader, Nordic research project on development of methods

for handling common cause failures human interactions and

uncertainties in PSAs (1986-1990).

Project Leader, ABB Atom’s contributions to systematic comparison

of Swedish PSAs (SUPER-ASAR).

Project Leader, Seismic PSA.

Project Leader, Development of an integrated code package for risk

and reliability analysis, SUPERNET (1986-1990).

X

1987-1990

1990-present

Manager, Reliability and Risk Assessment Section, Reactor Division

Management of projects and marketing of ABB Atom’s services,

and technical work within the area of risk and reliability

engineering (nuclear and non-nuclear).

International Assignments (IAEA missions, guidelines, lectures,

etc.)

First officer, IAEA, Safety Assessment Section

Responsible for IPERS programs, parts of guidelines programme,

Coordinated Research Programme on Reference Studies on

Probabilistic Modelling of Accident Sequences, PSA methodology

development, courses, workshops and expert missions to Member

States to support PSA activities.

XIName: Mr. Ray H. Matthews

Position: Senior Consultant

Organization: SRD

Address: Wigshaw lane

Culcheth, Warrington, WA3 4NE

U. K.

Phone: +44-925-254298

Fax: +44-925-254570

Education

1979 BSc, Mathematics, University of Durham, U.K.

Job History

1979-1984 SRD

Responsible for the development of fault and event tree analysis

codes. Research into probabilistic risk assessment techniques.

Application of PRA techniques.

1984-1989 NNC Ltd, U.K.

Part of the team contracted to provide analysis case submission for

the Sizewell B PWR. Specific responsibilities included faults at

shutdown, computer code development, and PRA.

1989-present SRD

Head of section providing PSAs on a variety of nuclear, and non­

nuclear plants. Responsible for research into dependent failures,

uncertainty analysis and PRA tools for advanced reactors. Project

Manger for PSA on a U.K. research reactor (SGHWR).

Xll

Name: Dr. Ali Mosleh

Position: Professor

Organization: University of Maryland

Address: Nuclear Engineering Program

University of Maryland

College Park MD 20714

Phone: (301) 405-5215

Fax: (301) 314-9467

Education

1975 BSc in Physics, University of Technology Tehran, Iran

1978 MSc in Engineering, University of California, Los Angeles, USA

1981 PhD, Nuclear Science and Engineering, University of California,

USA

Job History

1981-1988 PLG, Inc.

Responsible for data analysis. Involved in several research and

development projects including common cause failure methods and

data development. Participated in 14 probabilistic risk assessments

of nuclear power plants.

1988-present Nuclear Engineering Program, University of Maryland

Teaching and research in the area of risk and reliability of

technological systems.

Xlll

Name: Mr. Martin A. Stutzke

Position: Senior Systems Engineer

Organization: Science Applications International Corporation

Address: 311 Park Place Blvd., Suite 360

Clearwater, FL 34619

U.S.A.

Phone: (813) 799-0663

Fax: (813) 797-3187

Education

1976 Bachelor of Science in Nuclear Engineering,

The University of Tennessee, Knoxville, TN, USA

mi U.S. Naval Reactors School,

Orlando, FL and West Milton, NY, USA

1983 Master of Science in Nuclear Engineering,

The University of Tennessee, Knoxville, TN, USA

Job History

1976-1980 United States Navy

Qualified to supervise the operation and maintenance of naval

nuclear propulsion plants onboard USS Enterprise. Served as

Electrical Division Officer and Reactor Training Assistant.

1980-1982 Nuclear Safety Engineer

Oak Ridge National Laboratory

XIV

Reviewed reactor core experiments for safety concerns. Qualified

operator of the Oak Ridge Research Reactor, the Bulk Shielding

Reactor, and Pool Critical Assembly.

1982-1984 Systems Engineer

Technology for Energy Corporation, Knoxville, Tennessee

Performed Level I PSA of McGuire Nuclear Station and Clinch

River Breeder Reactor.

1984-1986 Nuclear Engineer

Florida Power Corporation, St. Petersburg, Florida

Performed Level I PSA of Crystal River Nuclear Power Plant

1986-present Senior Systems Engineer

Science Applications International Corporation

Performed Level II PSAs of Davis-Besse, Arkansas Nuclear One

1&2, Waterford 3, Turkey Point 3&4, Cooper Station, Ft., Calhoun

Station, Ginna, and Dodewaard (the Netherlands)

XV

A2. Composition of Responding Team

Responding Person Organization Taskisï

Sun Koo Kang KOPEC All

Kwang Nam Lee KOPEC Initiative Events, Event

Trees, Quantification

Beom Su Lee KOPEC Data Base, Special Event Trees,

External Events

Hyun Tae Yim KOPEC Human Reliability Analysis, Fire

Jin Kyu Han KOPEC Fault Trees, Quantification

Beom Нее Jung KOPEC Fault Trees, Fire

Chang Kyu Park KOPEC Fault Trees, Data Base

Myung Ro Kim KOPEC Fault Trees,

Human Reliability Analysis

Yeun Jung Kim KOPEC Seismic Hazard

Byung Yoon Park KOPEC Seismic Fragility

Michael G. K. Evans NUS All

Paul Guymer NUS External Events

Gareth W. Parry

XVI

NUS All

In addition the following persons interacted with IPERS team members during the

IPERS mission :

Name Organization Remarks

S. Y. Hong KEPCO Project Manager (Utility)

B. D. Yu KEPCO

С K. Park KAERI Project Manager (Review)

T. W. Kim KAERI

T. J. Lim KAERI

Y. S. Hur KOPEC Project Manager (Contractor)

Appendix В

Bl. Agenda for pre-IPERS meeting

B2. Agenda for IPERS meeting

11

Bl. AGENDA FOR KORI 3&4 PRE-IPERS MEETING

VIENNA, AUSTRIA, 27-31 MAY 1991

Monday. 27 Mav 1991. 9:00 AM

1. Opening

2. Presentation of participants

3. Agenda

4. IPERS overview (S. Hirschberg, IAEA)

5. Overview of PSA work in R.O.K. (Dr. Park, KAERI)

6. Presentation of the status, scope, organization, project plan/objectives,

procedures and basic philosophy of Kori 3&4 PSA (Mr. Kang, KOPEC)

7. Presentation of specific tasks in the Kori 3&4 PSA (Mr. Kang, KOPEC)

Tuesday. 28 Mav 1991-Thursdav. 30 Mav 1991

1. Study of PSA documentation (IPERS team)

2. Generation of issue sheets (IPERS team)

3. Discussions within the expert group and with R.O.K. representatives

Friday. 31 Mav 1991

1. Final set of issue sheets; presentation of main problem areas (S. Hirschberg, IAEA)

2. Identification of matters of concern (e.g. need for supplementary documentation)

3. Updating of the agenda for the IPERS mission

4. Practical arrangements for the mission to R.O.K.

5. Close

Ill

B2. AGENDA FOR PHASE 1

IPERS FOR KOR1 3&4 PSA

SEOUL, R.O.K, 26 AUGUST-6 SEPTEMBER 1991

Monday. 26 August 1991

1. Opening, arrangements, etc.

2. Presentation of participants

3. Agenda

4. KOPEC presentation (Mr. Y. S. Hur, KOPEC)

5. Presentation of the objectives, scope and expected output of the mission

(S. Hirschberg, IAEA)

6. Updated status of Kori 3&4 PSA (Mr. S. K. Kang, KOPEC)

7. Status of responses (Mr. S. K. Kang, KOPEC)

8. Status of the review (S. Hirschberg, IAEA)

9. Comments from KEPCO (Dr. S. Y. Hong), KAERI (Dr. С. K. Park) and

KOPEC (Mr. Y. S. Hur)

10. Discussion

Points 1-10 in plenary session

Tuesday. 27 August 1991

1. Study of responses (IPERS team)

2. Generation of additional issue sheets (IPERS team)

3. Discussions within the expert group and with the PSA team

IV

Wednesday. 28. August 1991

1. Generation of additional issue sheets (IPERS team)

2. Continued study of responses

3. Discussions within the expert group and with the PSA team; written responses

from the PSA team

4. Integration of responses and resolution of issues of concern (together with PSA

analysts)

Thursday. 29 August 1991*

1-4 As above

Friday. 30 August 1991

1-4 As above

5. Planning of the work on main IPERS report

Saturday. 31 August 1991

1. Continued resolution of issues

Monday. 2 September 1991

1. Continued resolution of issues

2. Preliminary conclusions

3. Writing of the main report

* S. Hirschberg’s visit to KAERI (discussions on future PSA-related cooperation between R.O.K. and

IAEA, presentation for KINS); Dr. Bohn’s visit (Thursday-Friday) to the plant to carry out a detailed

walk-through as a part of review of external events analysis.

V

Tuesday. 3 September 1991

1. Continued writing of the main report

Wednesday. 4 September 1991

1. Continued writing of the main report

Thursday. 5 September 1991

1. Preliminary draft report review within IPERS team

2. Interactions between the experts and PSA team

3. Resolution of remaining issues

4. Review of preliminary draft report by PSA team

Friday. 6 September 1991

1. Plenary session - presentation of results of IPERS mission

2. Comments from the PSA team

3. Discussion of phase 2 IPERS

4. Close

Appendix С

i

ISSUE LISTS

This Appendix contains the issue lists that were generated in the course of this IPERS

review. A standard format was followed. Each issue list is identified according to the

following scheme :

ISSUE NUMBERS : XX(X)-YY(Y)-ZZ, where

XX(X) = Type of issue

YY(Y) = Initiator (initials)

ZZ = Running number

In order to distinguish between the issues prepared during the pre-IPERS meeting and

those generated during the IPERS mission to R.O.K., additional symbols "(ii)" are added

after "ZZ" in case of the latest mentioned issues.

For the "type of issue", the following notation is used :

GC = General Concerns

IEA = Initiating Event Analysis

ASA = Accident Sequence Analysis

SA = Systems Analysis

CDA = Component Data Analysis

DFA = Dependent Failure Analysis

HIA = Human Interaction Analysis

EEA = External Events Analysis

QAS = Quantification of Accident Sequences

DRP = Documentation and Result Presentation

QA = Quality Assurance

LPA = Living PSA Aspects

и

For identifying the reviewers the following initials are used :

MPB = Michael P. Bohn

LC = Lennart К. E. Carlsson

RG = Radulescu Gheorghe

SH = Stefan Hirschberg

MK = Mitja Kozuch

RM = Raymond H. Matthews

AM = Ali Mosleh

MAS = Martin A. Stutzke

WEV = William E. Vesely

Priorities have been assigned to different issues, according to the following :

Priority A = High priority; assigned to issues which potentially may have large impact

on the results of the PSA and/or where potential exist that present PSA

approach may jeopardize meeting of the main objectives of the PSA.

Priority В = Medium priority

Priority C = Low priority; assigned to issues which are matter of taste or are beyond

state-of-the-art and/or scope of current PSAs.

These priorities are given following resolutions of issues. For some issues, e.g. those

concerning rather trivial corrections or those recommending analysis extensions in the

long-term perspective, priorities are usually not assigned. This should not be interpreted

as if these issues were regarded as unimportant by the reviewers.

The purpose of assigning priorities is to distinguish in relative terms between the

importance of different issues, and consequently to facilitate implementation of IPERS

recommendations.

In few cases the responses are missing (mostly in the area of external events

analysis) and/or the resolutions of issues were not documented in writing. All issues

were, however, resolved and reflected in the main part of the IPERS report. In some

cases there are two consistent resolutions of issues since the resolutions were made

independently by two IPERS team members.

ISSUE LIST

Number: GC-LC-01

Statement of Issue or Background Info

The PSA is intended for both KORI 3/4.

List Questions arising out of this Issue

Are there différenciés between the units "tabulated" and will there be a special section for that?

Number:GC-LC-01

The Response of PSA Team

No, there is no differences between two units. So there will be no special section for that.

Number: GC-LC-01

Summary of Conclusions from Questions and Answers (List Conclusions)

See issue [GC-MAS-Ol(ii)].

Resolution of Issue (Conclusions and Recommendations)

Issue resolved.

ISSUSLigr

Number GC-LC-02

Statement of Issue or Background Info

The documentation of fault trees is obviously not the same as was calculated when dominant contributors were presented.

LisLQuestjans arising out Qf this Issue

Will we be able to have access to the actual modelled fault trees or am I mistaken on this point? Just one example among many: LPSI page 21 RWST Lo-Lo sensor is not in the fault tree.

Number:GC-LC-02

The Response of PSA Team

The fault tree shown in the report is the actual fault tree. The event RWST Lo-Lo sensor is in I&C fault tree(Chap. 13 F5A.).

Number: GC-LC-02

Summary of Conclusions, from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Issue resolved.

ISSUE UST

Number: GC-SH-01

Statement of Issue or Background Info

PSA organization, time schedule and task interactions.

At this stage of the project no accident sequence quantifications are available. Human interactions analysis, CCF analysis, data analysis are still at an early stage. Quantification based on screening values has hardly been used for focusing the effort. There is also an impression that the results being obtained do not impact significantly on the course of actions, i.e. there seems to be a certain inflexibility (some rules seem to be mechanistically followed).

List Questions Arising out of this Issue

Please comment on the interactions between the quantification and other project tasks, and on the realism of the current project plan.

Number:GC-SH-01

The Response of PSA Tenm

In the course of quantification, following analyses are required.

1. Accident sequence analysis2. System fault tree analysis3. Data development4. Human reliability analysis

Interactions between above activities are as follows;

1. Identification and modeling of system operatin modes following each initiating event.

2. HRA based on timing requirements according to accident sequence analysis.

3. Data base development for the event on fault tree based on component boundaries.

4. CCF modeling accorting to plant specific ■ characteristics.

Above interactions are well acknowledged and discussed in depth by the project team. However, we have used generic CCF parameters because the raw material such as NPE is not available at this stage.

NUMBER : GC-SH-01

Summary of Conclusions from Questions and Answers(List conclusions)

Accident sequence quantification is now available. Obviously, as expected there is a number of interactions between the tasks. However, there is no evidence of focusing the work on dominant contributors emerging in the course of the study.

Resolution of Issue (Conclusions and recommendations)

It is expected that the contributors will be prioritized (see also issue QAS-SH- 06) and this will lead to more efforts being concentrated on extended analysis of some of the topics given a superficial treatment at this stage. A plan for this type of feedback should be worked out. It is noted that it may be difficult to achieve this in view of the present tight time schedule for the project. (Priority : A)

ISSUE LISI

Number: GC-SH-02

Statement of Issue or Background Info

Objectives of the PSA.

The objectives are mainly limited to design evaluations

List Questions arising out of this Issue

Does the utility have a concept/plan for future uses of the PSA beyond the present primary objective (i.e. as a "Living" PSA tool and as a support for plant operation)?

Is KEPCO actively involved in this project?

How?

Is there a plan for information/technology transfer to KEPCO?

Will KEPCO have a dedicated group responsible for maintenance and use of the PSA?

NUMBER : GC-SH-02

Summary of Conclusions from Questions and Answers(List conclusions)

KEPCO involvement is described in the response. From discussions with organizations invovled it is apparent that at present the main part of the internal review has been delegated to KAERI.

Resolution, of Issue (Conclusions and recommendations)

1. Technology transfer from KOPEC to KEPCO should be defined.

2. A plan should be developed by KEPCO (with active assistance from KOPEC and KAERI) addressing future maintenance and uses of the PSA model.

3. Kori 3&4 PSA should be implemented on Kori site and plant staff should be assigned to take responsibility for maintenance and uses of PSA (initial assistance from KEPCO’s head office will be needed).

(Priority : A ; in long-term perspective)

ISSUE LIST

NUMBER :

Statement of Issue or Background Info

Dual unit risk

List Questions Arising out of this Issue

1. Which systems have cross-connects or interfaces between units2. How does the PSA team intend to address dual unit interactions

GC-MAS-01(ii)

??

NUMBER: GC-MAS-OI(ii)

Response from KOPEC PSA team

Dual Un.it

There are no cross connects for any safety systems. The only commonalities are the switchyard and service water intakes.

Dual unit risk has not been quantified.

NUMBER: GC-MAS-01 (ii)

Summary of Conclusions from Questions and Answers(List conclusions)

1. The only interfaces between units are the switchyard and the CCW intakes.

2. Dual unit risk has not been assessed.

Resolution of Issue (Conclusions and recommendations)

As there are no cross-connected systems between units, there are no concerns about dual unit recovery actions (that is using Unit 4 equipment to recover Unit 3). The external events analysis (notable, typhoon and seismic) will consider dual unit CCW intake failures.

ISSUE LIST

Number: JEA-MPB-01

Statement of Issue or Background Info

One initiating event at low power is being considered (T^j). Such slowly developing sequences involve many thermohydraulic timing questions and the possibility of non­standard (i.e., non EOP based) recovery actions.

List Questions arising out pf this Issue

a) What is mission time being used for this sequence.

b) What guidelines are being used to relate human recovery actions as a function of time in the sequence.

c) If this sequence is being considered for internal events, why should it not be evaluated for seismic events (where non-seismically designed components are called upon)?

Number : IEA-MPB-01

The Response of PSA Team

Tsd will not take into account. (Out of work scope)

Number: ŒA-MPB-01

Summary of Conclusions.from.Quest,ions and Answers(list Conclusions)

Tsd is now out of scope.

Resolution of Issue (Conclusions and Recommendations)

The PSA team should consider to incorporate other operating modes in the future.

reSUE LIST

Number: IEA-MPB-02

StatgmentÆfJssvie Qr.Paokgcaind.Info

In station blackout (SBO) there are competing processes of seal LOCA and loss of control to AFW-TDP. MARCH code analyses showed a variety of AFW mission times ranging from 2.2 hrs to 5.0 hrs.

List Questions arising out of this Issue

Most batteries have 4-8 hours capacity. The basis for the shorter AFW mission times needs to be explained.

Number : IEA-MPB-02

The Response, of_.PSA. Team

- The unavailability of AFW-TDP is gorvened by TOP room cooling capability (around l.Shrs). Former description are base on sensitivity study.

- After screening assessement, actual battery depletion time will be collected for final quantification.

Number: IEA-MPB-02

Summary of Conclusions from Questions and Answers(List Conclusions)

The calculated cooling capacity of the room is 1.8 hrs.

Resolution of Issue(Conclusions and Recommendations)

If the calculations are correct the battery depletion is not a problem.

No further actions.

ISSUE UST

Number: IEA-MPB-03

Statement of Issue or Background Info

In evaluating the station blackout scenarios of RCP seal failure, AFWS failure due to battery depletion or AFWS failure due to room heat-up, the current draft Kori PSA indicates that battery depletion is likely to dominate. However, when realistic battery capacity times to failure are used (8-12 hrs rather than 2.2 hours) it is likely that room heat-up will dominate.

List Questions Arising out of this Issue

Is it planned to perform either analysis or test to determine realistic times to failure for the AFWS TD pump given loss of room cooling. This will likely be quite important for the risk of such transient sequences.

Issue Number: IEA-MPB-03 Name:

PSA Team Response

See IEA-MPB-02.

Number: IEA-MPB-03

Summary of Conclusions from Questions and Answers(List Conclusions)

See IEA-MPB-02.

ISSUE LIST

Number: IEA-MPB-04

Statement of Issue or Background Info

In analyzing sequences involving operation with AFWS, the draft Kori PSA is only taking credit for the CST water source. But most plants have additional sources (e.g. the demineralizer tank, etc.) which can be used as the CST becomes depleted. (This may especially be important for low-power or shutdown sequences).

List Questions Arising out of this Issue

• Can Kori utilize other water sources as backups to the CST?

• Are these other sources - if any - seismically qualified?

Number : IEA-MPB-04

The Response of PSA Team

The CST at KORI has a large capacity of 900,000 gallons, and no makeup is needed for the 24 hour mission time.

Number: IEA-MPB-04

Summary of Conclusions from Questions and Answers(List Conclusions)

No further action.

ISSUE LIST

Number: IEA-LC-01

Statement of Issue or Background Info

Loss of off-site power can sometimes be defined differently from unit to unit. This has an influence on the IE-frequency if generic data are used.

List Questions arising out of this Issue

To what extent is the off-site power modelled? Is Korean data used for this IE?

Issue Number: IEA-LC-01Name:

PSA Team Response

Korean specific data will be used.

NUMBER: IEA-LC-01(RM)

Korean specific data will be used to determine the frequency of loss of off-site power

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: IEA-LC-02

Statement of Issue or Background Jnfb

Common Cause Initiators, CCI's were indicated to be identified with FMEA.

List Questions arising out of this Issue

Did you really identify CCI's or are you planing to do that later on? Can you describe the applied methodology?

Number : IEA-LC-02

The Response of PSA Team

- We already did by FMEA methods

I

NUMBER:IEA-LC-02(RM)

Common cause initiators can be identified by a variety of means1) Use of EPRI generic lists2) FMEA

No significant Common Cause initiators seem to be missing

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE UST

Number: IEA-LC-03

Statement of Issue .or_Background Mq

In the French PSA for standard reactors and also in Swedish PSAs the dilution transient has been observed and treated. In the French case design changes were introduced. I am not sure if the EPRI category 13 includes this transient.

List Questions .Arising. ouUrfJhis_Issue

Have you analyzed the dilution transient and the start up of one pump? Is this LED 9? If so, did you do a critically check analysis for cold nonborated water into the core.

Number : IEA-LC-03

The Response of PSA Team

KORI units do not operate with one inactive RCP pump. Also, as can be inferred from NUREG-1150 and many other PRAs, these initiating events are adequately represented by the selected IE groups.

NUMBER: IEA-LC-03(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

The boron dilution transient is covered by the standard US analyses which indicate that it is not a significant concern.

Resolution_of_Issue (Conclusions and recommendations)

No further action required.

ISSUE UST

Number: lEA-RG-Ol(ii)

Statement of Issue or Background Info

Loss of Component Cooling Water System (7A7.4)

To estimate frequency of loss this system only 3 types of contributor were considered. A fault tree was developed for this event.

List Questions Arising out of this Issue

Why was a complete fault tree not developed for loss of this system as initiating event and then quantified to establish the frequency? The same question for "Loss of Nuclear Service Cooling Water System". What method was used to develop the fault tree presented in figure 7.4-1?

Issue Number: lEA-RG-Ol(ii)

Response of the KOPEC PSA Team

See issue IEA-SH-07(ii)

Number: lEA-RG-Ol(ii)

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

See issue IEA-SH-07(H).

ISSUE UST

Number:IEA-RG-02(H)

Statement of Issue or Background Info

Definition of Success Criteria (Ch 4.4, pg 20 al 2)

a) It is mentioned that the main sources of information were Westinghouse technical report and FSAR for KORI units 3&4. Also it is mentioned that MARCH Code was used in this context.

b) (pg 21, al 2)It is stated that the primary consideration in the analysis of event sequences is the performance of the front-line systems.

List Questions Arising out of this Issue

a) Which were the criteria used to select event sequences to be modelled with MARCH Code? How many such event sequences could be evaluated with MARCH Code? How long was the real time modelled for each event sequence? Could you show a simple relevant example?

b) Is it taken into account that the systems (frontline and support ones) might be unavailable due to initiating event?

Issue Number: IEA-RG-02(ii)

Response of KOPEC PSA Team

MARCH Code Usage

a) The MARCH Code was used to determine the timing of events in order to be able to evaluate human error rates. The results of the MARCH analysis and the use made of the results is described in Appendix III.

b) Yes. Each system is analyzed to determine if its failure can cause an initiating event and remain failed when called upon to perform a mitigating function.

When constructing the event tree one of the questions at each branch point for a new function is "How is this system (and its support system) affected by the initiating event or earlier system success or failure. House events are used in system fault trees to switch systems on or off depending on the impact of earlier events.

Number: IEA-RG-02(ii)

The timing of events is determined by MARCH computer code, to evaluate the human error rates. The impact of the initiating event on different mitigating system is taken into account.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The event trees for the initiating events selected are developed having the dependence between initiating event and the systems reflected in each event tree.

Issue resolved.

ISSUE LIST

Number: IEA-RG-03 (ii)

Statement of Issue or Background Info

Successs Criteria for LOCA (pg 24)

a) The safety functions required to mitigate the initiating event consequences are defined. Also the systems involved in every function are identified.

b) Decay Heat Removal (pg 25)

During recirculation, one of two RHR pumps takes suction from the containment sump and discharge into the RCS cold leg after a extended period of time is necessary to change the flow discharged into hot legs.

List Questions Arising out of this Issue

a) What is the mission time considered for each system involved in event sequences? Same question for transients.

b) How long is the time for cold leg connection? Is there an automatic or manual action? Was this properly taken into account in the fault tree?

Issue Number: IEA-RG-03(ii)

Response .of KOPEC PSA Team

Mission Time

1. The basic mission time for an operating pump (fails to run) is 24 hrs. If the pump is only required to function for a much shorter time (injection mode) then the upperbound is used. The basic events for the various mission times are given in each of the fault trees and also in the relevant section of each event trees description. For example in section 5.2.1.2 (small LOCA) page 5 heading D 1 it sates that the mission times for the injection phase is 8 hours.

2. Cold leg recirculation lasts for 24 hrs. As the change over to hot leg recirculation uses the same pumps, the pump mission time is not afected by the changeover.

Number: ŒA-RG-03(ii)

The mission times for the systems involved in the event trees are presented in section describing in detail fault trees and event trees. The mission time for RHR pumps in any mode of operation is the same. Only a part of flow path - i.e. to the hot legs - is changed.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

Information about mission time for the system is included in Chapter 5 (Accident Sequence Analysis for internal events).

I agree that the mission time for the RHR pumps does not change, but the new flow path to hot leg has different mission time (if the total mission time is greater than 24 hrs, there is a need for the cold leg. Otherwise, it does not matter). This consideration is preserved anytime when a system configuration is changed during the event.

ISSUE LIST

Number: IEA-SH-01

Statement of Issue or Background Info

Grouping of LOCAs.

There are only three sizes of LOCAs in KORI PSA. In particular the small LOCA is quite broad (3/8" <. Break Diameter <2"). Most PSAs use more detailed breakdown e.g. very very small LOCA, very small LOCA and small LOCA. This distinction may be important since:

a) Different set of equipment may be required for mitigation of very small LOCAs.

b) Containment system response may be affected differently by a very small LOCA (detection time, other sensors needed).

List Questions Arising out of this Issue

Please provide rationale for the broad grouping of LOCA categories.

Number : IEA-SH-1

The Response of PSA Team

The differences in success criteria between small LOCA and very small LOCA are timings for feedwater supply and recirculation and containment dpressure suppression.

Although we have conservatively include very small LOCA in small LOCA category, above differences can not be a significant core damage contributor in Kori 3&4 plants. The reason is that Kori 3&4 have motordriren start-up feedwater pump and containment fan coolor system of which success criteria is one of four.

Number: IEA-SH-01

Summary of Conclusions from Questions and Answers(list Conclusions)

Present treatment is regarded as conservative.

Resolution of Issue (Conclusions and Recommendations)

Rationale for not using a breakdown of small LOCA category should be provided in the documentation. The issue would have to be readdressed in the future Level П PSA to check if containment system response is not affected differently by a very small LOCA

(PRIORITY: B)

ISSUE LIST

Number: IEA-SH-02

Statement of Issue or Background Info

Grouping of transient events.

Grouping in the Kori PSA is based on logical evaluation diagram (LED) and EPRI list of initiators. It is not clear how the final grouping (Table 4.3-1) is arrived at. In particular the first three transient categories (Tla, Tlb, T2) include some quite diverse initiators according to the description in Table 4.3-1. There seem to be some inconsistencies, for example for categories 19 and 20 (MFW available in 19 and presumably not available in 20, contrary to IE characteristics description).

List Questions Arising out of this Issue

It is unclear:

1) If the grouping is conservative

2) In cases it is conservative to what extent is the conservatism excessive?

3) Is MFW really always available during the whole mission time after turbine trip, as stated in the definition of category 33?

Number : IEA-SH-2

The Response of PAS Team

1. The event tree structures are such that they are modeled after the most limiting event in an initiating event group.

2. The extent of conservatism can be measured through sensitivity studies if needed.

3. MFW in Table 4.3-2 transient cotegories means motor- driven start-up feedwater system which can be used even if MFW pump is tripped.

NUMBER: IEA-SH-02

Summary of Conclusions from Questions and Answers(List conclusions)

According to the answer.

Resolution of Issue (Conclusions and recommendations)

Issue resolved. However, transient descriptions for T , T and T2in Table 4.3-2 are misleading "MFW available/unavailable" should be changed to "SFW available/unavailable."

ISSUE LIST

Number: IEA-SH-03

Statement of Issue or Background Info

Completeness of the analyzed common cause initiators.

There are five CCIs on the list of transients (Table 4.3-2). Some CCIs treated in other PSAs are not included, without any explanation. This applies to e.g. Loss of Instrument Air, Loss of Ventilation System, Reactor Water Level Instrument Line Failure.

Furthermore, it is unclear if categories Tn, Tf2, To address losses of particular AC and DC buses and to what extent the plant-specific factors have been taken into account.

List_Questions Arising out of this Issue

What is the basis for the CCI analysis generally and for treatment of the above mentioned particular CCIs?

Number : IEA-SH-3

The Response of PSA Team

- Loss of instrument air is already considered. (Table 4.2- 7)

- For loss of ventilation system, more explanation will be added in I.E section.

Number: IEA-SH-03

Treatment of plant-specific CCIs has now been extended and covers the identified, missing equipment-related CCIs. In applicable cases these initiators are considered to be covered by standard transient categories. The issue of possible numerical significance of the frequencies of those CCIs as compared to standard transient categories has not been addressed.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

1. Qualitative analysis carried out. Issue resolved.

2. It should be checked and demonstrated that the CCIs under consideration do not contribute significantly to frequency of standard transient categories.

(PRIORITY: B)

ISSUE LIST

Number: IEA-SH-04

Statement of Issue or Background Info

Shutdown state initiators.

The PSA is apparently limited to full power operation. There is one exception, loss of cooling during shutdown inspection.

List Questions arising out of this Issue

1) Why was one particular shutdown initiator selected?

2) Is there an intention to extend the PSA in the future to cover shutdown and low power operation?

Number : IEA-SH-4

The Response of PSA Team

1. Out of Workscope.

Number: IEA-SH-04

Shutdown and low-power PSA out of scope.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Future extension of Kori PSA to include modes of operation other than full power should be considered.

ISSUE LIST

Number: IEA-SH-05

Statement of Issue or Background Info

Frequency of initiating events.

Frequencies are not to be found in the documentation. This is unusual at this stage of the

PSA.

List Questions arising out of this Issue

Please explain how you will obtain the frequencies for LOCAs and transients. In particular how will you assure that CCI frequencies are plant-specific?

Number : IEA-SH-5

The Response of PSA Team

The initiating event frequencies and their derivation will be described in the report. The CCI frequencies will be estimated using models of the appropriate systems and in that way will reflect the plant specific nature. They may, however, be quantified with some generic parameter estimates-

Number: ŒA-SH-05

Initiating event frequencies are now covered in section 7.4 of the report.

Summary of Conclusions from .Que_stions_and Answers(list Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Issue resolved. Several new issues concern details in initiating event frequency estimation.

ISSUE USX

Number: IEA-SH-06(ii)

Statementj)Oss.ue_or_Background Info

Frequency of initiating events. Inconsistent numbers used. Numbers given in table 7.4-1 for transients Tla, Tib and T2 are the prior estimates. Presumably HM the (lower) posterior frequencies will be used in accident sequence quantification.

List Questions Arising out of this Issue

Which numbers are actually used? In case you are using the posterior means (which you should) the contents of table 7.4-1 should be corrected.

NUMBER: IEA-SH-06 (ii)

ResppnsjLP-f KOPEC PSA tequn

The posterior means are to be used and Table 7.4-1 will be corrected.

Summary of Conclusions from Questions and Answers(List conclusions)

NUMBER: IEA-SH-06(ii)

According to the answer.

Resolutions of Issue (Conclusions and recommendations)

Issue resolved. Table 7.4-1 will be corrected.

ISSUE JJSI

NUMBER : IEA-SH-07(ii)

Statement of Issue or Background Info

Frequency of loss of CCW (partially applicable to loss of NSCW)

Both estimates are low (2.6E-5/y and 5.9E-6/y/, respectively); in case of CCW the estimate is extremely low. This conclusion is given in view of data used in US PSAs:

Component Cooling Water Service Water

Surry 2.0E-3/yr Zion 9.OE-4/yr Millstone 6.7E-4/yr (Surry is similar to Kori 3&4)

Millstone 1 ZionCon. YonkeeSeabrookSurryMillstone 3

7.8E-3/yr 9.0E-4/yr 1.ЗЕ-4/yr 2.5E-6/yr

< 1E-7/yr 1E-8/yr

List Questions Arising out of this Issue

Potential underestimation might be due to several factors:

1. Actual operating experience has not been explored.2. Unavailablity of only few components in the systems considered was taken into

account.3. No operator errors have been taken into account.4. No pipe ruptures have been taken into account (only this contribution would

be higher than the current estimate).5. The frequency equation given on page 11 of section 7.4 (also on page 12 for

NSCW) ingores significant contributors such as e.g. failure of all pumps (no maintenance of heat exchanger) pump maintenance in combination with other failures). These contributions (several combinations exist) are of the same order or larger than those accunted for.

6. The background of the recovery factor (for NSCW) is not explained. Please comment and explain.

Issue Number: IEA-RG-01 (ii)IEA-SH-07 (ii)

Response of KOPEC PSA Team

For the loss of CCW system initiating event a fault tree was constructed. The tree was developed by identifying events that cause a change from normal (one pump operating, all others in standby), specifically maintenance acts or failures, and modelling the failure of the standby trains. It was however not quantified. Instead, only one term was quantified. The fault tree will be quantified, at first using generic values of parameters, and later incorporating plant specific data. A preliminary evaluation shows that the failure of a pump and a CCF of the three standby pumps dominates, increasing the initiating event frequency. This will also occur for the NSCW system (see response to ША-АМ-13 (ii)), and a fault tree will need to be constructed.

It is true that plant specific operating experience has not been taken into account. No single pipe break can fail the system.

As a point of information, loss of CCW for Surry was estimated as 2E-4/yr (see page 4.3 9 of NUREG/CR 4550 Vol.3).

NUMBER: IEA-SH-07(i i)

The present analysis is incomplete and has to be extended/corrected. This applies to both CCW and NSCW. Frequency of loss of CCW is probably underes­timated by a factor of 3-10. The same applies to NSCW where in addition an arbitrary recovery factor has been used.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue(Conclusions and recommendations)

1. A fault tree for CCW should be checked for completeness and quantified.

2. A corresponding fault tree should be constructed for NSCW and quantified.

3. Operating experience for both systems should, if possible, be taken into account.

4. Use of the NSCW recovery factor must be supported by analysis. It is expected that only a relatively small portion of e.g. pump failures could be recovered in the available time frame.

(Priority: A)

ISSUE UST

Number: IEA-MK-01

Statement of Issue or Background Info

Initiating event selection. Pressurizer Spring Failure will cause primary pressure to drop rapidly and SI will be actuated so the transient is more dangerous than spurious safety injection. The point is that RCS boundary will be challenged. You may end with pressurizer solid as well as integrity broken.

List Questions Arising out of this Issue

Why do you claim the PSF transient has no impact on integrity?

Issue Number: IEA-MK-01

Response of KOPEC PSA Team

1. Pressurizer spray failure is more likely to cause RCS pressure increase than pressure drop (i.e., it is more likely to be a loss of spray than increased spray). If spray is failed close.

2. If spray is failed open, SIS will be activated. KORI SIS shut off head is higher than PORV setpoint. Thus this scenario is the same as inadventent safety injection, which already was taken into account in initiating grouping.

NUMBER : IEA-MK-01 (RM)

Pressurizer spray faults (failure and inadvertent actuation) are considered to be initiating events. They are already taken into account in the initiating event grouping.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: lEA-RM-Ol(ii)

Statement of Issue or Background Info

Definition of medium LOCAs. A primary safety valve inadvertently opening / sticking open should be classed as a medium LOCA (p6 of section 4).Further to this in the U.K., it is normal practice to calculate the anticipated number of demands for PORVs and SRVs and hence calculate the frequency with the valves stick open.

List Questions Arising out of this Issue

If this has not been done, what arguments are presented to document that the contribution of such events is not significant for the initiating event frequencies.

NUMBER: IEA-RM-01 (ii)

Response of KOPEC PSA team

Medium LOCA

The inadvertent opening and sticking open of safety relief valve when no transient has occured would constitute a medium LOCA and is included in the frequency used for the medium LOCA initiating event in this study.

The following conditions would lead to a challenge to an SRV.

1. Loss of feedwater or turbine trip followed by failure of the RPS to scram the reactor (ATWS tres). Failure of an SRV to reclose is considered in this tree.

2. Any transient which causes sufficient surge in the RCS and rise of pressurizer level to challenge a PORV combined with failure of all PORVs to open. This may lead to an SRV challenge.

The probability of all PORVs failings to open and an SRV failing to reclose is << than medium LOCA initiating event frequency so all transfer from Q are treated as a PORV which sticks open and hence small LOCA.

Number: lEA-RM-Ol(ii)

1. A safety relief valve failing to open does constitute a medium LOCA and the assessment of medium LOCA is claimed to include this possibility. There is, however, no evidence of this in the presented analysis both in the description and the calculation of initiating event frequency. Such evidence needs to be provided.

2. The frequency with which the safety relief valves are demanded needs to be calculated to support the claim of the PSA team that consequential safety relief valve LOCA has a much lower frequency than inadvertent opening of a safety relief valve.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution, of Issue(Conclusions and Recommendations)

The PSA team should document:

1. The classification of safety relief valve failures as medium LOCAs.

(PRIORITY: C)

2. The lack of data for such an event. That is, there have been no occurences of spurious opening of safety relief valves.

(PRIORITY: B)

3. The analysis to justify the statement mode above; namely, "the probability of all POR Vs failing to open and an SRV failing to reclose is < < the medium LOCA initiating event frequency".

(PRIORITY: B)

ISSUE LIST

Number: IEA-AM-01

SiaismgniQf issugiir_Ba£kgrQWP<i info

Initiating Event Frequencies

Method of estimation is not discussed in the report, however the PSA team members indicated that generic distributions will be updated with plant-specific data.

List Questions arising out of this Issue

1) Which data base(s) will be used for this purpose?

2) Will there be event screening for applicability? This is especially important since the initiating events are grouped according to plant-specific considerations.

3) Will plant-to-plant variability be considered and accounted for in the genericdistributions^

4) What method will be used to quantify the support system initiating events?

Number : IEA-AM-01

The response of PSA Team

1. Generic data sources such as NUREG/CR-3862 of transient, EPRI-URD for LOCA are used. LOP will be used after specific data collection

2&3 Initiators from NUREG/CR-3862, will be grouped and screened according to the PSA grouping criteria, and distributions will be constructed to represent the plant to plant variability in the frequencies of these groups.

i4. Fault tree models.

NUMBER: ГЕА-АМ-01 (LC)

The answers to the questions were gine in section (7.4) and presented inSeoul.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

The detailed information raised other questions.

ISSUE USX

Number: ŒA-AM-02

Statement of Issue or Background Info

Interfacing system LOCA.

In calculating the frequency of the initiator caused by failures in hot leg recirculation line (P-6), the two failure modes considered for the MOV = rupture and leakage.

List_Ques_ti.ons.Arising out_oi_thj.s_Issue

Consideration should also be given to the failure mode in which the valve is actually open but indicates closed. About 10% of MOV failures are caused by mechanisms which can produce the above effect.

Number : IEA-AM-02

The response of PSA Team

The report is already modified to include this failure mode. The mean frequency of "failure of an MOV to close on demand and indicate closed" is 1.1Е-4/demand. This data is obtained from Seabrook PSA. Anyway, thank you for your comments.

NUMBER: IEA-AM-02 (LC)

Modification is already Included in the report.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

No further action.

ISSUE LISTNUMBER: IEA-AM-03(ii)

Statement of Issue or Background InfoDifferent methods are used for estimation of initiating events frequencies.These include :

a. classical statistics (e.g. LOCAs)b. Bayesiam Methods

List Questions arising out of this Issue1. Why does the method of estimation change from one initiator to

another ? Is there a reason for not us using Bayesian method for all lEs ?

Issue Number: ŒA-AM-03(ii)

Response of KOPEC PSA Team

The "classical" method is not really classical statistics. It is an approach to use event data to construct what is essentially a prior.

One problem is the way in which the event statistics are obtained i.e. as pooled event data. When there are even a small number (e.g. 3) of events, the use of a non-informatic prior would give very narrow distributions which do not reflect any potential plant to plant variability. With zero events, a non-informatic prior would give an improper posterior. Therefore the somewhat adhoc process you see here is adopted.

ISSUE LIST

Number: IEA-AM-04(ii)

Statement of Issue or Background Info

The following comments are made regarding the calculation of LOCA frequencies as documented in section 7.4.1. The central values as well as the distributions can be improved per following suggestions.

List Questions Arising out of this Issue

1. Are the estimates provided for

a) Large LOCAb) Medium LOCAc) Small LOCA

mean or medium? Table 7.4.1 implies that they are treated as mean values which seems to be inconsistent with the method of derivation on Pg. 3, Sec. 7.4.1, for medium and large LOCAs.

2. Since we are reasonably confident that no large or medium LOCA has occurred in LWRs worldwide, a much larger number of reactor years of experience (close to 2500 years) can be used in estimating the corresponding frequencies. In this case we have

Ф (A) = U 43:> = 9.Ш0-4 5 / year2x2500

which is a significant improvement.

3. The range factors for medium and large LOCAs are too small given the uncertainties involved. A number like 10 seems more in tune with the current practice. What is the basis for the selected range factor of 3?

4. The range factor of 10 for small LOCA is too large. Eased on the experience of2 events in 660 reactor years, a range factor of 3 is more appropriate. Adding uncertainty about the validity of data, the range factor can be increased to 5. Please explain why 10 is used as the range factor.

Issue Number: IEA-AM-04 (ii)

Response of KOPEC PSA Team

1. The values for the large and medium LOCAs are indeed median values, and the table 7.4-1 will be corrected.

2. The comment is appreciated and the suggestions will be adopted.

3. An error factor of 10 will be adopted.

4. An error factor of 10 is used for the small LOCA frequency to compensate in some way for not having taken into account plant to plant variabihty. This gives a .05 probability that KORI could have a small LOCA frequency larger than 10'2. Probably we should apply the same argument to the SGTR frequency and use an error factor of 10 there too. The EF=10 is consistent with other analyses, e.g. NUREG/CR 4550.

NUMBER: IEA-AM-04(i i)

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

As agreed by the PSA team the following heed to be done.

1. Use the correct mean values for large and medium LOCAs in the analysis and in Table 7.4-1

2. Modify the "experience years" for large and medium LOCAs3. Use error factor of 10 for small medium and large LOCAs.

If small LOCA shows up as an important contributor the assignment of a range factor of 10 can be revisted for possible reduction (please note that the choice of error factor influences the results only if the point estimate is interpreted as median). (Priority*C)

ISSUE UST

Number: IEA-AM-05(ii)

Statement of Issue or Backgroundjnfo

The frequency of STGR initiating event is calculated using Bayesian method with 4 events in 400 years, and a non-informative prior.

List Questions Arising out of this Issue

1. Since Bayesian updating is used to assess the distribution why not use the resulting posterior? Even if a lognormal form is preferred at the end, the error factor should be chosen based on the posterior (gamma) distribution characteristic.

2. A plant-to-plant variability analysis similar to what has been done for transient events is more appropriate here. It will increase the range of uncertainty.

Issue Number: IEA-AM-05(ii)

Response of KOPEC PSA Team

1. The Gamma distribution could be used as this was the result of the analysis. The uncertainty range would however be quite small.

2. A plant to plant variability distribution would indeed have given a broader distribution. However, the data was only available in the reduced form of 4 events in 400 years, and hence not in the form to generate plant to plant variability. This was the reason for choosing to represent the distribution as a lognormal with EF=3. This is broader than the Gamma. However, see response to IEA-AM- 04(ii) where it is argued that an EF=10 might be more appropriate.

NUMBER: ГЕА-АМ-05(11)

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

As it is suggested in item 4 of PSA team response to IEA-AM-04(ii) an error factor of 10 (I recommend 5) will be more realistic than the error factor based on the Gamma distribution. This will capture the plant -to-plant variability. However, if no plant-specific update is being done, there is no need to use a non-informative prior. You may directly assess the distribution based on mean and error factor.(Priority; B)

ISSUE LIST

Number: ША-АМ-Об(й)

Statement of Issue or Background Info

General Transient Frequency Estimation

P.6, Section 7.4.2.1 states that the data of plants which have too little experience are excluded as they do not provide reliable estimates.

List Questions Arising out of this Issue

Please clarify whay is meant by "too little experience"? Do you mean a different criteria than "less than one year"?

NUMBER: IEA-AM-06(i i)

Response of KOPEC PSA team

The criterion adopted was to exclude plants with less than five years experience.

NUMBER: IEA-AM-06(ii)

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

For transient events*excluding 2-5 years worth of data from a significant number of plants in the data base seems too conservative particularly with no supporting evidence that the data is statistically unreliable. Please note that more refined analysis will most likely not have a sizable impact on results since the plant-specific data is dominant.

ISSUE LISTNUMBER : IEA-AM-07(ii)

Statement of Issue or Background InfoIn estimating general transient frequencies (Tla, Tib, and T2) the method of matching moments is used to estimate parameters of gamma distribution which seem to represent the plant-to-plant variability of the frequency. The resulting distributions are then updated with Kori plant-specific data.

List Questions Arising out of this Issue1. Why is plant-to-plant variablity considered here and not for

other initiators (e.g. SLOCA and STGR) ?The final distributions are kept in their gamma form. In other cases (e.g. small LOCA) the distributions are converted to lognormal. Why ?

2

Issue Number: IEA-AM-07(ii)

Response of KOPEC PSA Team

1. The reason for not constructing distributions that represent plant-to-plant variation in frequency for the rarer events such as small LOCA or SGTR, is the lack of data in the correct format. The only data source readily available gives total number of events in total number of calender years. If the data were available on a plant by plant basis, most plants would have zero occurrences of these initiating events. This data would produce a bi-modal or a very skewed distribution, which would produce a biased mean value. Therefore the occurrences were treated as being Poisson distributed rare events.

2. The use of a lognormal is "standard" PRA practice.

NUMBER: ГЕА-АМ-07(11)

2. The question was why lognormal is not used for transients in contrast with other initiators?

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

1. Resolved.

2. Please remove the inconsistency. (PriorityJC)

ISSUE LIST

Number: IEA-AM-08(ii)

Statement of Issue or Background Info

Kori plant-specific data on transients Tla, Tib, T2 are based on 7.26 operating years of experience for Kofi units 3&4. (P.8 section 7.4).

List Questions Arising out of this Issue

Does 7.26 operating years include first year of operation for the two units? If so, the data is not consistent with the statement about excluding first year data from generic data (P.6, section 7.4).

Issue Number: IEA-AM-08(ii)

Response of KOPEC PSA Team

The 12b operating years does include the first year of commercial operation. To make the calculation consistent, these will be excluded and the initiating event frequencies reevaluated.

NUMBER: IEA-AM-08(ii)

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

PSA team agrees to exclude the first year of commercial operation data from KORI-specific data base and requantify the initiating event frequencies.

ISSUE LISTNUMBER : IEA-AM-09(Ü)

Statement of Issue or Background InfoLoss of offsite power frequency is based on 5.25 operating years, for Kori 3&4 and 12.67 operating years for Kori 1&2.

List Questions Arising out of this Issue1. Total operating years for Kori 3&4 is reported as 7.26 on P.8,

section 7.4. Which number is correct ?2. Are any of the events for Kori 3&4 and Kori 1&2 common ? If so,

they should be counted only once. This will reduce the loss of offsite power frequency.

3. Do you count events during shutdown as well as power operation ?4. What is the form of the distribution for LOP frequency ?

Issue Number: IEA-AM-09(ii)

Response of KOPEC PSA Team

1. Total operating years for KORI 3&4 are calculated as follows;

Transient: from commercial operation to 8/1989

KORI 3: 3.92 ryKORI 4: 3.34 rvTotal 7.26 ry

LOSP: commercial operation to 12/1990 - There are two switchyards, one for KORI 1&2, and one for KORI 3&4. The number of switchyard years is

for KORI 1&2: 12.67 (’78.5 ~ ’90.12), site yearsand for KORI 3&4: J25 (’85.5 ~ ’90.12) " "Total 17.92 site year

2. No, there was no common LOSP event between KORI 1&2 and KORI 3&4.

3. There was no LOSP event during shutdown.

4. A non-informative prior (l/f1/2) will give a Gamma distribution.

Number: IEA-AM-09(ii)

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of , Issue.(Conclusions and Recommendations)

1. Resolved. (Please correct the report to say "switchyard years" rather thanoperating years for LOP).

2. Resolved.3. Resolved.4. PSA team agrees to use a non-informative prior distribution for LOP initiator.

ISSUE LISTNUMBER : IEA-AM-10(ii)

Statement of Issue or Background InfoLoss of offsite power frequency is estimated at 0.11 per year. (P.9, section 1.4.2.2)

List Questions Arising out of this IssueIf the estimated frequency of 0.11 is events per calender year, then the actual loss of offsite power frequency should be obtained by multiplyinq this number by the expected fraction of the time that the plant is in power, say about 80%. The reason is that we are looking at plant risk during operation only.

NUMBER: IEA-AM-10 (ii)

Response of KOPEC PSA team

We agree with this comment.

NUMBER: IEA-AM-10(ii)

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

PSA team agrees to adjust the frequency of LOP by plant availability number (please add a discussion to the appropriate section of the report).

ISSUE LISTNUMBER : lEA-AM-ll(ii)

Statement of Issue or Background InfoThe report states (P.9, section 7.4) that the frequencies of the Main Steam Line Break initiating events TS1 and TS2 are calculated based on 2 events in 1000 reactor years.

List Questions Arising out of this Issue1. What is the basis of 1000 reactor years ? This number is

different than 660 years used for other initiating events.2. Assuming 2 events in 1000 years we expect to see a frequency of 2 X 10 ’ rather than lO3 as reported on P.9, unless the two

events are assigned to different initiators TS1 and TS2. Is this true ?3. What is the form of the distribution for TS1 and TS2 ? The

report does not discuss any distribution assessment.

NUMBER: IEA-AM-11 (ii)

Response of KOPEC PSA team

This original analysis was based on work done for Maanshan. For consistency we will re-analyze using the URD data base (1 event in 660 years).

NUMBER:IEA-AM-11(ii)

Summary of Conclusions from Questions and Answers(List conclusions)

Questions 2 and 3 remain unanswered.

Resolution of Issue (Conclusions and recommendations)

1. PSA team agrees to modify the success data for MSLB inititators TS1 and TS2.

2. Allocation of events between the two MSLB categories should be clarified and documented. (PriorityjB)

3. Uncertainty distributions should be developed for TSI and TS2. (PriorityrC)

ISSUE LISTNUMBER : IEA-AM-12(ii)

Statement of Issue or Background InfoIn calculating the annual frequency of loss of service water initiating event, it is assumed that a train under maintenance can be recovered with probability of 0.9 (PNR = 0.1, page 12, section 7.4)

List Questions Arising out of this IssuePlease explain the basis and justification for this assumption.

NUMBER: IEA-AM-12 (ii)

Response of KOPEC PSA team

This needs to be revised. This was a Maanshan estimate.

NUMBER: IEA-AM-12 (Ü)

Suminarv of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

PSA team agrees to revising the recovery factor estimation used in calculating loss of SW initiating event frequency.

ISSUE LISTNUMBER : IEA-AM-13(ii)

Statement of Issue or Background InfoLoss of service water initiating event frequency estimation.

List Questions Arising out of this Issue1. Has consideration been given to the impact of external events,

typhoon in particular, on service water operation ?2. Has a distribution been developed for the estimated frequency ?3. Other cut sets also contribute siginificantly. Why is the

quantification limited to the "dominant” cutset ?

Issue Number: IEA-AM-13(ii)

Response of KOPEC PSA Team

1. External events impact on service water, particularly typhoons, will be discussed elsewhere.

2. Not yet, but it will be done using the uncertainty module of NUPRA.3. This is possible. The current evaluation is based on Maanshan estimates. This

needs to be revisited to check if they are applicable to KORI. If necessary, a fault tree like that for the CCW system can be constructed.

NUMBER: IEA-AM-13(Ü)Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue(Conclusions and recommendations)

1. The typhoon analysis includes an analysis of this cause of failure but the analysis appears to be inadequate. [see EEA-MPB-45(ii )]. This may produce the most dominant common cause unavailability of SW system. It should be considered. (Priority'A)

2. Per response of PSA Team these distributions should be developed (Priority C)

Full fault tree analysis need to be developed as the basis for initiator frequency, even if Maanshan estimate is found to be appropriate. This is important for future application of the PSA, completeness of documen­tation, and quality assurance. (PriorityiB)

3.

ISSUE LISTNUMBER : IEA-AM-14(ii)

Statement of Issue or Background InfoInterfacing systems LOCA

List Questions Arising out of this IssueCheck valves 004 and V003 are not modeled. Are these not designed to hold the pressure ?

NUMBER: IEA-AM-14 (ii)

Response of KOPEC PSA team

No, check valves 004 and 003 are not modelled. The design pressure of these check valve is 600 psig.

ISSUE LISTNumber:IEA-MAS-01(ii)

Statement of Issue or Background InfoMapping of common cause initiator (CCIs) on to EPRI catagories.

List Questions arising out of this Issue

1. Why is loss of 13.8 kv bus N-5E-NA-S01 placed into EPRI category 1 while bus N-5E-NA-S02 is in EPRI category 30?

2. Loss of CCW is EPRI category 31; loss of NSCWS is EPRI category 32. The documentation (text) should be updated.

Issue Number: lEA-MAS-Ol(ii)

Re_s^gnse_QÍKpreC-P.SA_Te_am

1. It looks like loss of bus N-SE-NS-502 should also be included in category 1.

2. Agree, but we cannot find where they are not so referred to.

NUMBER: IEA-MAS-01(i i)

Summary of Conclusions from Questions and Answers(List conclusions)

Loss of N-SE-NS-505 will be included in ERRI category 1.

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LISTNumber: IEA-MAS-02(ii)

Statement of Issue or Background InfoLoss of HVAC as an initiating event.

List Questions arising out of this IssueWhy has loss of ESF switchgear HVAC been dismissed as an initiating event while the station blackout event trees are concerned with loss of switchgear HVAC? There seems to be an inconsistancy.

NUMBER: IEA-MAS-02 (Ü)

Response of KOPEC PSA team

Loss of HVAC

There are two completely independent means of cooling the switchgear room, NCHW which is normally in use and ECHW which can be used in the event of NCHW failure. In the event of loss of off-site power NCHW is lost leaving a single system, ECHW. This is the reason for including it in the LOOP trees.

NUMBER: IEA-MAS-02 (ii)

Summary of Conclusions from Questions and Answers(List conclusions)

1. Loss of HVAC in the switchgear room requires failure of both NCHW and ECHW.

2. . The time from loss of HVAC to switchgear failure is 8 hours.

Resolution of Issue (Conclusions and recommendations)

The PSA team should consider treating loss of switchgear HVAC as a CCI. While the reliability of the HVAC equipment may be high, one should compare the mean repair time to the 8 hour limitiation.

ISSUE LISTNUMBER: IEA-MAS-03(Ü)

Statement of Issue or Background InfoLoss of power supply to nuclear instrumentation.Loss of power to channel IV leads to a control rod withdrawal scenario, which is terminated by a reactor trip on high flux or high flux rate.

List Questions arising out of this Issue1. Could loss of power to any other nuclear instrumentation channel

cause the same scenario?What is the relation, if any, of the control rod drive control system and the RPS high flux and high flux rate instrumentation ? Is there a connection such that loss of power to a nuclear instrumentation channel could cause a rod withdrawal scenario and failure to trip on high flux ?

2

NUMBER: IAE-MAS-03(i i)

Response of KOPEC PSA team

1. No, there is no nuclear instrumentation channel to which loss of power causes the same scenario.

2. Only the loss of power to nuclear instrumentation channel IV causes a rod withdrawal, but reactor trip is initiated on high flux or high flux rate by other remaining channels.

NUMBER:IEA-MAS-03(ii)

Summary of Conclusions from Questions and Answers(List conclusions)

1. Only the loss of power to nuclear instrumentation channel IV will lead to a control withdraw! accident.

2. During a control rod withdraw! accident caused by the failure of power to nuclear instrumentation channel IV, reactor trip will occur upon detection of high flux in the remaining channels.

Resolution of Issue (Conclusions and recommendations)

No further action required.

resuE Ljgr

Number. ffiA-WEV-01

Statement of Issue or Backi ioia

Plant specific initiating events incorporating support system failures and involving specific locations of LOCAs have been important core damage frequency contributors in past PSAs. Plant specific contributors do not appear to be given the attention that other

state of the art PSAs give them. Additional analyses need to be provided to show that ■plant specific initiating events have been adequately considered.

LÍSt.C>uS$tii?ns arising put of this bsug

What analyses were carried out to evaluate the potential unique initiating event contributors for KORI including:

• Nonrecoverable loss of the 250 V and 125 V dc buses• Loss of individual AC buses• Turbine plant closed cooling water• Essential chilled water• Central chilled water• Solid state logic• NSSS in the BOP Control Cabinet• Specific steam line break locations which have potential for

instrumentation and control failures• Specific LOCA locations including analyses by which location specific

consequences are included in the LOCA event trees (e.g. RHR hot leg ruptures, HPI ruptures)

• Plant specific transitions which included additional equipment failures beyond those identified in the EPRI categories.

Number : IEA-WEV-01

The Response of PSA Team

О Besides SLB location & LOCA location, all contributors are already considered by FMEA methods

О For the matters of the locations

Number: IEA-WEV-01(RM)

Summary of Conclusions from Questions and Answers(List Conclusions)

1. Different locations of LOCA and SLB were considered explicitly.

2. The remainder were considered using FMEA

Resolution of Issue(Conclusions and Recommendations)

No further action required.

JSS.UJELIST

Number: IEA-WEV-02

Statement of Issue or Back;muui4 info

Estimates of plant specifíc initiating event frequencies can be quite different from generic values. Loss of offsite power frequencies and durations need particularly to be carefully evaluated because of their potentially large contribution. Any trends in the initiating event frequencies and differences between the initiating event frequencies for different units can also significantly affect the core damage frequency evaluations.

List Questions arising out of this Issue

What approach is to be used to estimate plant specific initiating event frequencies, to identify potential trends, and to identify differences between units? How is the plant specific loss of offsite power frequency versus duration going to be estimated? Specifically, how is the frequency of loss of offsite power for critical durations going to be modeled (e.g. for durations which will cause seal LOCA's)? Also how are specific grid stabilities and seasonal variations to be handled?

Number : IEA-WEV-02

The Réponse of PSA Team

1. No differences between unit 3&4

2. Specific LOP frequency & duration in Grid stability will be estimated.

3. No seasonal variation will be addressed

Number: IEA-WEV-02(RM)

There is no significant difference between units 3 and 4. There are not sufficient years of operating experience on these units to identify any trends.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

No further action required.

ISSUE LIST

Number: IAE-WEV-03

Statement of Issue or Background Info

Seal LOCAs caused by local rupture of a seal can be important contributors to very small LOCAs. It is not clear whether these contributors were considered and if so, how they were estimated.

List Questions arising out of this Issue

Do very small (i.e. small-small) LOCA frequencies include local failures of a seal? How are they evaluated for the initiating event frequency? How are subsequent dependencies considered?

Number : IEA-WEV-03

The Response of PSA Team

LOCA caused by RCP seal failure is an important contributor to the overall small LOCA frequency. The initintor of Loss of CCW, Loss of NSCW, and SBO take into account the seal failure.

»

NUMBER: IEA-WEV-03(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

Local failure of the RCP seals is considered as a contributor to the small LOCA frequency. There have been two events on US plants in this category. Leakages below 0.375 in diameter are not considered to be covered by the transient analysis (category 5 of Table 4.3-1).

Résolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: ASA-MPB-01

Statement of Issue or Background Info

In extending a level 1 PRA to a level 2/3 PRA, one must keep separate track of the

competing station blackout scenarios:

• Seal LOCA due to loss of RCP cooling• Loss of all AFWS due to battery depletion• Room heat-up for critical areas

Time-dependent degradation models of seal failure, battery depletion and room heat-up

are required.

List Ousstions grisingjatt Qf this Issus

Are these scenarios being developed or kept separated?

What is the basis for models of seal failure, battery depletion and room heatup, and will these be documented in final report?

Are the same models - but without possibility of recovery of offsite power being used in the seismic PRA?

Number : ASA-MPB-01

.The Response of PSA Team

1. Yes, The scenarios are being kept separated and being developed.

2. The model were included in Rev.2.

3 Yes.

Number: ASA-MPB-01(MAS)

1. The competing scenarios of RCP seal LOCAs, battery depletion, and room heatup have been addressed in the LOP and SBO event trees.

2. The bases for the above have been documented.

3. The seismic PRA models are based upon the internal events models.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue (Conclusions and Recommendations)

No further action required. See also ASA-MAS-13(ii).

ISSUE LIST

Number: ASA-LC-01

Statement of Issue or Background Info

Transfers in event trees are found from TpSBO etc. to some S-LOCA.

List Questions Arising out of this Issue

What modifications were made in the quantification process of the accident sequences?

The initiating event is loss of power which is not the case for S-LOCA.

Issue Number: ASA-LC-01

Response of KOPEC PSA Team

The transfers are made after recovery of offsite power.

NUMBER: ASA-LC-01

The TPBIQ frequency is low enough at this stage. It adds on the percent scale to the small LOCA initiating event.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

No further comments unless the V-branching simply could be removed.

JSSUJMST

Number ASA-LC-02

Statement of Issue or Background Info

The depressurization with so called X-action.

You indicated that X-action for S2 is inadequate. (1 PORV & Slow depressurization)

Li.St OpeSti.Qn$ .arising put of this I$$yg

Have you analyzed further the depressurization function? Will you not be able to enter with low pressure system?

NUMBER: ASA-LC-02

Rpsnnnse t.ha KOPEC PSA te^

Success criteria

After X action,

for depressurization is one steam dump S one PORV

low pressure recirculation can be used.

NUMBER: ASA-LC-02

c^msrv nf cnnrlusions frnm Questions and Answer^(List conclusions)

O.K.

Rpsnlution of Issue (Conclusions and recommendations)

No further action.

ISSUE UST

Number: ASA-LC-03

Statement of Issue or Background Info

The development of the event trees is a very important step. In some recent PSA’s diagrams are drawn based on operating or disturbance procedures. (Overall procedures). This proved to be easy to review and afterwards draw the event trees.

List Questions Arising out of this Issue

What did you do to assure that event trees reflect operating emergency conditions?

NUMBER: ASA-LC-Q3

PQcpnn*P of thT PSA

EOP 1 AOP were reviewed and Incorporated In the construction of the

trees.

event

NUMBER: ASA-LC-03

The PSA team should make sure that operating teams agree to the developed

fault & event trees.

Summary of Conclusions from Questions and Answers(List conclusions)

pollution of Issue (Conclusions and recommendations)

No further action.

ISSUE UST

Number: ASA-LC-04

Statement of Issue or Background Info

Test arrangements for check valves.

IS-LOCA

List Questions Arising out of this Issue

Can you describe the test procedure for the valves? Or, did you really look at this question.

NUMBER: ASA-LC-04

Response, of the.KOPEC PSA team

We reviewed the test procedure carefully. The check valve have Unes for these test. The RHR suction lines are tested for each train. The procedure number is ST-0-12. You can see the procedure when you visit Seoul.

NUMBER: ASA-LC-04

Summary of Conclusions from Questions and Answers(List conclusions)

No further recommendations.

Resolution of Issue (Conclusions and recommendations)

No further action.

îSSUELISI

Number: ASA-LC-05

^at£n^nL0,f_ISSlLg_Q.r^fl£kgr9tinti Info

Isolation valves possibility to close under certain accident conditions. NRC and US- utilities are doing a huge program for plant verification.

List Questions arising out ofjhis lssue

Are you aware of the problem with MSIV closing after a steamline break or the other isolation valves? Is it relevant for your plant?

ISSUE LIST

Number: ASA-LC-05

Statement of Issue or Background Info

Earlier issue was not clear.

There is a question on the MOV’s possibility to open under accident conditions. Many plants in the world undertake a specific verification program for the valves to open as designed.

List Questions Arising out of this Issue

This could be valid for some of the valves at Kori 3&4. It should be considered when data are assigned if applicable.

NUMBER: ASA-LC-05

Response of the KOPEC PSA team

We cannot follow you.

Number: ASA-LC-05

The PSA team will get information about the verification program

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team can consider to check the MOVs verification program.

Priority: C

ISSUE LIST

Number: ASA-LC-06(ii)

Statement of Issue or Background Info

I can see that the small time windows are calculated based on one inch break. The break diameter for small LOCA is 3/8 to 2 inches. To my knowledge this can be considered a generic PSA question since I am not sure this has been treated correctly in the past. The small LOCA very well have an IE in the order of 10'2 and if you loose HHSI (10'2 -10"3), the time window could be too narrow to depressurize and use the LP system.

List Questions Arising out of this Issue

Why not make the time window calculations on the upper end of small LOCA?

NUMBER: ASA-LC-06(i i)

Response of the KOPEC PSA team

Small LOCA time windows

A number of different time windows have been studied for the small LOCA for break times ranging from 3/8" to 2". In fact the timing used for the operator error for the Y function is currently based on a 2" LOCA. The cue occurs at 700°F when the operator is directed to procedure C3 and at 1200°F to procedure Cl. The total time window from 700°F to 2200°F is estimated to be 17 min with a median time for actions of 10 min. giving the value of 8.4E-2 for probability of operator failure.

This is being reviewed as part of the overall review of the human reliablity data calculations.

Number: ASA-LC-06(ii)

The answer is valid.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should carefully review the time windows available. The operator action will be analyzed by the PSA team.

Priority: A

ISSUE UST

Number: ASA-RG-Ol(ii)

Statement of Issue or Background Info

Small LOCA Event Description (Ch 5, pg 1)

Safety Injection signal automatically starts the low pressure RHR pumps, but if the RCS pressure is above 234 psig, the EOP-O stipulates that the operator must stop the pumps.

List Questions Arising out of this Issue

Was this operator action modelled and how? Does he start again the pumps when RCS pressure falls below 234 psig? How is the mission time for low pressure RHR system defined?

Issue Number: ASA-RG-Ol(ii)

Response of KOPEC PSA Team

Operation of Low Head Pumps

The operator actions "fail to stop pumps" and "fails to start pumps" are included at the fault tree level.

Failure to run is only included when the pumps are required to perform the mission.

Number: ASA-RG-Ol(ii)

The operator actions related of the RHR pumps stop and start are included in the fault tree. ТЪе mission time for low pressure RHR system is not clearly defined.

Summary of Conclusions from Questions and Answers(List Conclusions)

Rosolutipn of Issue (Conclusions and Recommendations)

The operator actions seem to be correctly modelled in the fault trees.

For those systems which change their state during the time of the event analyzed, the mission time must be well defined for each state, even if timings are presented for the whole event.

(Priority: B)

ISSUE UST

Number: ASA-RG-02(ii)

Statement of Issue or Background Info

Small LOCA (Ch 5 pg 4)

Following the inadequate core cooling condition, 17 minutes are sufficient to reach 2200°F full temperature.

List Questions Arising out of this Issue

What is the credited available time for the operator to take the appropriate actions?

Issue Number: ASA-RG-02(ii)

Response of the KOPEC PSA Team

Inadequate Core Cooling

10 min is median time to perform actions (see chapter 8 Section 8.4.2.1).

Number: ASA-RG-02(ii)

The available time for the operator to take the appropriate actions during a SBLOCA, with an inadequate core cooling conditions, was considered to be 10 minutes.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The time from the beginning of the initiating event until the operator is credited to take actions must be stated in the report.

Priority: C

ISSUE UST

Number: ASA-RG-03(ii)

Statement of Issue or Background Info

Small LOCA (Ch5, pg 7)

As is presented in ch. 3.3.1. "The RCS is arranged as three rector coolant loops connected in parallel to the reactor vessel each containing a reactor coolant pump and a steam generator." In success criteria for heading L it appears that 1 out of 3 AFW pumps injects to any one of three steam generators.

List Questions Arising out of this Issue

Is there any link between the three parallel cooling loops? If yes, how does it look? Otherwise, how is it possible to inject in any steam generator, given that one breaks? Could any steam generator be used as heat sink for a given small LOCA? Same questions for heading D2 (Low Pressure Safety Injection).

NUMBER: ASA-RG-03(i i)

Response of the KOPEC PSA team

Cooling Loops:

АП cold legs are common therefore water from all legs mixes in the inlet plenum before entering the core. Therfore heat removal from any steam generator removes heat from the RCS and hence the core.

Number: ASA-RG-03(ii)

All cold legs on a common inlet plenum can remove heat from any steam generator.

Summary_oC Conclusipns_frQ.m Que.stiqns and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The answer clarifies the problem. Issue resolved.

ISSUELIST.

Number: ASA-SH-01

Statement of Issue or Background Info

Definition of core damage states (CDS)

The only failed state defined in event trees is core melt (CM). This is not a good practice. Level I/Level II interface definition is a part of Level I PSA. Since extensive deterministic calculations were performed to define success criteria it should be easy to use the results to support definition of CDS.

LisiOyestigns arising ppLpf this Issue

1) Do you intend to define CDS?

2) If yes, how many and based on what principles?

Number : ASA-SH-i

The Response of PSA Team

The plant damage states are considered in the level 2 event trees.

NUMBER : ASA-SH-01

Summary of Conclusions from Questions and Answers(List conclusions)

Core damage states (CDS) have not been defined yet.

Resolution of Issue (Conclusions and recommendations)

It would be preferable to define core damage states and thus Level I/II interface as a part of Level I PSA. This would provide a better perspective on Level I results. (Priority : B)

ISSUE UST

Number: ASA-SH-02

Statement of Issue or Background Info

ATWS Event Tree.

The same structure of the event tree is used independently of the character of initiating event. The present status of documentation does not allow to review how the accident propagation is analyzed in detail. PSAs frequently distinguish between ATWS by e.g. Loss of Main Feedwater, Loss of Offsite Power, Loss of Circulation Water and other transients. This is important since success criteria and timings for system actuations/operator actions might be different.

List.Questions Arising out of this Issue

Please explain how you address the potential differences as outlined above.

Issue Number: ASA-SH-02

Response of the KOPEC PSA Team

ATWS is modelled with the limiting LE. of loss of load followed by loss of feedwater with the frequency of all transients. The ATWS transfered from other LE. will be checked if the frequency is more than the screening frequency. The screening criteria for this event is 1.0E-8. Generally speaking, the ATWS transfered from other events are not significant. For example, the ATWS transfered from LOSP has the frequency of about 1.0E-7. If DG fails it is conservatively assumed that it directly leads to core melt. The CM frequency of this event is about 1.0E-9.

Number: ASA-SH-02

Treatment of ATWS is conservative.

Summary of Conclusions from Questions and Answers(List Conclusions)

Respluîion Qf Issue (Conclusions and Recommendations)

Issue resolved.

ISSUE LIST

Number: ASA-SH-03

Statement of Issue or Background Info

Event tree for loss of offsite power

After successful power recovery the plant is assumed to be in a stable state. This implies that load shedding and restored operation of MFW are assumed to be successful. Is that trivial?

List Questions Arising out of this Issue

Are no manual actions involved in restoration of MFW?

Why is there only power recovery after 30 minutes?

Response of the KOPEC PSA Team

All LOSP initiated event trees have been modified.

Issue Number: ASA-SH-03

NUMBER : ASA-SH-03

LOSP initiated event trees have been modified. Operator action to initiate start-up feedwater system is represented in the fault tree for that system. Also additional recoveries (after longer times) have been added.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

Issue resolved through the modifications of event trees.

ISSUE LIST

Number: ASA-SH-04

Statement of Issue or Background Info

Treatment of reactivity accidents.

This category of accident is hardly commented on from the point of view of potential for large reactivity insertions in a short enough period of time to cause catastrophic fuel damage.

Examples include: Rod ejection accident, LOCA with sump water diluted, LOCA with diluted ECCS water from more than one accumulator or RWST.

List Questions Arising out of this Issue

Please comment on your views with respect to treatment of such accidents.

Issue Number: ASA-SH-04

Response of the KOPEC PSA Team

All of these accidents are adequately covered by their probabilities, consequences and mitigative system responses by the categories already modeled in the event trees. Rod ejection, for example, would be similar to any other transient with or without scram, with the difference that some localized fuel damage might occur in the case of the former which might have not occurred otherwise. However, the frequency of events severe enough to cause any fuel damage is significantly smaller than events already considered.

NUMBER : ASA-SH-04

Documentation provided does not demonstrate that all mentioned reactivity accidents are covered by other transient categories and/or that they have insignificant frequencies, as stated in the response.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

The issue needs to be addressed explicity, demonstrating that what is claimed is correct. It is probably true that the events under consideration will not contribute significantly, but the issue deserves more attention especially in view of dilution accidents identified in French PSAs. (Priority : B)

ISSUE UST

Number: ASA-MK-01

Statement of Issue or Background Info

Small LOCA: Success criteria for 3.1/3 AFW Pumps core cooling recovery 2/3 Accumulator 1/2 LPSI Pumps

I think that if you have no HPSI you should have more demand for AFW pumps like 2/3 Mot. Op. or 1/1 turbine driven pump.

List Questions Arising out of this Issue

What is the basis for such optimistic success criteria?

Issue Number: ASA-MK-01

Response of the KOPEC PSA Team

OK. We corrected it already (2/2 MDP, or 1 TDP).

NUMBER: ASA-MK-01(MAS)

Summary of Conclusions from Questions and Answers(List conclusions)

For SLOCAs the success criteria for auxiliary feedwater is 2 motor-driven pumps or 1 turbine-drive given loss of HPSI. These have been implemented.

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: ASA-MK-02

Statement of Issue or Background Info

The heading Feed & Bleed covers component failures as well as operator action. Among fault trees there is no Feed & Bleed there is only PORV addressed. In the PORV fault tree stuck open PORV is included.

LisLOuestions Arising out of this Issue

Why there is no difference? If the PORV gets stuck open, you should have transfer from Small LOCA to Medium LOCA

Issue Number: ASA-MK-02

Response of the KOPEC PSA Team

A stuck open PORV sequence would be transferred to the small LOCA event tree if the frequency is higher than the screening value. The screening value is 1.0E-7.

NUMBER: ASA-MK-02(MAS) .

Summary of Conclusions from Questions and Answers(List conclusions)

1. A single stuck-open PORV is an SLOCA.

2. The transient event trees consider stuck-open PORVs (Event Q); these sequences are transfered to the SLOCA event tree.

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: ASA-MK-03

Statement of Issue or Background Info

There are different initiating events involved. For every initiating event several trips are designed.

List Questions Arising out of this Issue

Why there is no evidence of potential trips and fault tree that would reflect different trips involved?

Issue Number: ASA-MK-03

Response of the KOPEC PSA Team

For any given initiator any number of reactor trip functions may get activated. What would actually trigger reactor trip is largely inconsequential to the PRA model.

NUMBER: ASA-MK-03(MAS)

Summary of Conclusions from Questions and Answers(List conclusions)

Knowledge of the specific reactor protection system (RPS) parameters (such as flux, etc.) that sense each initiating event’s occurrence is not required in the PSA.

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE UST

Number: ASA-MK-04

Statement of Issue or Background Info

If the high head injection system is not working you have no seal injection.

List Questions Arising out of this Issue

Have you assumed to operate RCP without seal injection?

NUMBER: ASA-MK-04

Response of KOPEC PSA- team

RCP operation

RCP operation is not required after reactor trip, so RCPs are not modelled in any of the functions. For example no credit is taken for RCPs for spray operation in depressurization. This is done by opening a PORV.

NUMBER: ASA-MK-04(MAS)

Summary of Conclusions from Questions and Answers(11st conclusions)

RCP seal injection fails if HPSI fails.

Resolution of Issue (Conclusions and recommendations)

As per ASA-MAS-06 (11).

ISSVEJJST

Number ASA-AM-01

SiaismsaL^fJssyg pr PaçkgwwKUnfo

Initiating Events Categorization.

Inadvertent safety injection (EPRI Group 9) is grouped under 'Transients with MFW available' and RCS integrity challenged". However with a safety infection signal main feedwater is isolated, and AFW pumps are started.

yitQug.sti9niarisLngiMiLgf.üigJ¿si¡g

How is the event tree quantified to account for the specific situation?

Number : ASA-AM-01

The Response of PSA Team

MFW is modelled as the startup feedwater pump, which is manually started and aligned for operation.

NUMBER: ASA-AM-01(MAS)

The only portion of the MFW system considered after reactor trip is the startup feedwater pump (SFW), which is manually actuated. As a result, it is appropriate to group inadvertent safety injection into the T1a category.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution,, of, Issue (Conclusions and recommendations)

No further action required.

ISSUE UST

Number: ASA-RM-Ol(ii)

Statement of Issue or Background Info

Timings for a loss of main feed event.Fig. in 1.3.1-1 gives a reactor trip at 0 sec into the transient.

List Questions Arising out of this Issue

i) At what time does the loss of main feed event occur?If it is at 0 seconds (the same as reactor to trip)

ii) What signal causes the reactor to trip?If it is at -X secs, then this reduces the post-trip time to SG dry out and hence increases the probability of failure to initiate Bleed and Feed.

NUMBER: ASA-RM-01(i i)

Response of KOPEC PSA, team

Loss of main feedwater

The loss of main feedwater will result in reactor trip on SG low level. When running MARCH time 0 is the time of reactor trip and the water level in the SG is set to the low level setting with the feed pumps failed.

The timing for determining the operator action is not based on the time of loss of feedwater or reactor trip, but the time at which the feedwater level in the SG reaches 6%. This is his cue to go to feed and bleed. The time available to him is the time at which SG level reaches 6% to 5 minutes after steam generator dry out.

NUMBER: ASA-RM-OI(ii)

Summary of Conclusions from Questions and Answers(List conclusions)

1. The MARCH assessment of time to SG dry out is based on a trip from the low-low SG level.

2. The timing is critical to a large number of sequences.

Resolution of Issue (Conclusions and recommendations)

The PSA team should consider confirming the analysis of time to SG dryout using a code other than MARCH. (Priority.;B)

ISSUE LIST

Number: ASA-RM-02(ii)

Statement of Issue or Background Info

The base event RECT3S05 (probability 0.1) appears in the dominant MCS list for T2LH1. This is a recovery of the accident sequence. The sequence has failure of secondary heat removal and failure of high pressure cold leg recirculation (following success of primary bleed and feed)For the dominant minimal cutsets:

1) The secondary heat removal is failed by a CCF failure of the chillers which causes loss of room cooling to all the pumps.

2) High pressure recirculation is failed by CCF in the low pressure system.

List Questions Arising out of this Issue

What is the recovery action?

How can you be confident that you can recover CCFs?

It may be better to claim that the original assessment was conservative in assuming that the pumps would fail, if the room cooling failed. This line of argument would remove these MCS from the sequences. If the doors to the rooms were open, can the pumps run for long period without room cooling? (The same arguments would apply to RECT2S06).

NUMBER: ASA-RM-Û2(i i)

Response of the KOPEC PSA team

Recovery Actions

Recovery actions have only been treated in a very primitive way in the initial quantification. This has resulted in the use of the same basic event name for RELT 2 S05 for two completely different actions. It is the intention to do the following for the final report:

1. Identify failures which can be recovered by operator action or use of alternative systems.

2. Identify the step in the procedure which will direct the operator to perform these actions.

3. Determine how long it will take to perform the recovery action.

4. Determine the time available to perform the recovery action (i.e. from the occurrence of the cue to either core damamge or another cue which will direct the operator to go to an alternative procedure).

5. Quantify the probability the operating team will fail to perform the action and the probability of failure of the equipment.

6. Add the event to the appropriate fault trees or sequence cut-sets.

NUMBER: ASA-RM-02(i i)

Summary of Conclusions from Questions and Answers(List conclusions)

Recovery actions will be treated better in the final report, as indicated by the above response.

Resolution of Issue (Conclusions and recommendations)

The PSA team will treat recovery actions as follows:

1. Identify the sequences which can be recovered. The identification in general will be at the minimal cut set level. Only by exception will it be at sequence level.

2. Identify the step(s) in the operating procedures that will direct the operator to perform these actions.

3. Determine the time available to perform the action.4. Quantify failure to perform the action and failure of any additional

required hardware.5. Add the event to the fault tree or sequence minimal cut sets.6. Document the above. (Priority;A)

,ISSUE_L_I_SJ

Number: ASA-RM-03(ii)

Statement of Issue or Background Info

Event Tree for SGTR .

The safe shutdown condition is not well defined. U.K. there is a requirment to

1) isolate the SG either physically by MSIV closure or2) depressurize and move to cold shutdown.In the longer term (2-3 days) we also have the requirment to move to cold shutdown to repair the tube rupture.

Lis_t_Questions arising out of this Issue

1) What are the safe shutdown conditions?

2) How do the end sequences correspond to the defined safe shutdown conditions?

3) Sequence TR leaves the plant at a high pressure with an isolated SG. Should the event tree go further and bring the plant to a safe shutdown condition (i.e. cold shutdown)

NUMBER: ASA-RM-03(i i)

Response of the KOPEC PSA team

Questions:

1. What were the safe shutdown conditions.

The safe shutdown conditions in the event tree are the stable state that can be maintained for greater than 24 hours with no further functions required.

This includes, in the event of failures to isolate the steam generator the ability to refill the RWST and maintain to the RCS to make up for the water lost through the ruptured SG tube. The following stable states are applicable to the various sequences.

2. Correspondence of end sequences

1. RHR shutdown cooling S02, S13(RCS < 200°F atmospheric pressure)

2. RWST make up, secondary heat S03, S05removal, steaming through SG.(RCS > 212°F) :

3. Secondary heat removal SOI, S12through 2 unaffected SGs.(RCS pressure < faulted SG)

4. Cold leg recirculation with pressurizer S07PORV open

5. Cold leg recirculation with open S08containment.

3. Sequence TR.

In the first sequence TR (SO 1) the steam generator is isolated and acting as a pressurizer, with secondary heat removal from the other two steam generators. This state can be maintained for many hours as was the case at GINNA. In the long term cooldown and depressurization is required to mend the steam generator tube. Failure to do this in the first 24 hours does not lead to core damage so it is not included in the event tree.

Number: ASA-RM-03(ii)

The SGTR event tree leaves the plant in conditions that, while they are stable, do not represent a condition that can be maintained in the longer term. Further, for such sequences, the event tree does not represent the likely course of events. The operator will attempt to depressurize so that he can repair the failed tubes. This sould be considered for high pressure sequences SOI, S07, S08, S09, S10, S12. Thus, the PSA team should consider failures arising out of this operator action. We accept that it will make no significant difference to the core melt frequency.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should consider modelling cooldown and depressurization, and subsequent initiation of RHR shutdown cooling, for those sequences where technically it is not required to prevent core melt but is, nevertheless, an anticipated action.

(Priority: B)

ISSUE LIST

Number: ASA-RM-04(ii)

Statement of Issue or Background Info

Quantification of small LOCA together with high pressure recirculation failure. The human error probability is assessed conservatively. The need to recirculate will be well understood by the operators once they have diagnosed that a LOCA has occurred. Thus the only question in the operator’s mind is that of determining the time when recirculation becomes necessary.

List Questions Arising out of this Issue

Please comment on the above. It should be possible to justify a lower probability of failure; perhaps take out the diagnosis element entirely.

Issue Number: ASA-RM-04(ii)

Response of the KOPEC PSA Team

Page 27 of the HRA chapter does in fact provide an argument for a low value of HRH1, which has already suppressed the cognitive part of the failure.

Number: ASA-RM-04(ii)

The conservatism has already been removed from the analysis.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue(Conclusions and Recommendations)

No further action required.

ISSUE—UX3T

NUMBER : ASA-MAS-01(ii)

Statement of Issue or Background Info

Definition of core damage states (CDS)

List Questions Arising out of this Issue

1. What work has been done to ensure that CDS definitions, to be developed in the future level 2 PSA, will not require revision of the current level 1 event trees.

2. How has the impact of containment system failures or successes been treated in the level 1 PSA ? For example, operation of containment spray during small LOCAs and transients (during feed and bleed) changes the time when recirculatin is required; human reliability analysis results are seansitive to sequence timing.

NUMBER: ASA-MAS-01(i i)

Response of KOPEC PSA team

Core Damage States

1. Little or no work has been done in this area with the exception of ensuring where possible that containment systems which result in core damge are close to the end of the current event trees so minimizing potential modifications. . It is to be expected that if the level 2 goes into significant detail (resulting in for example 40-50 plant damage states) then changes will have to be made.

2. MARCH runs have been performed for each LOCA size in order to determine exactly this type of information and hence enable the His to be modeled as accurately as possible.

Number: ASA-MAS-Ol(ii)

1. The event trees have been structured to facilitate future level 2 PSA; the PSA team acknowledges that some changes may be required to accomodate CDS definitions.

2. The PSA team has based human failure event probabilities on MARCH runs, which cover a variety of system failure and success states.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

The MARCH runs described in the existing documentation provided to the IPERS team do not show consideration of containment system failures or successes; parameters such as containment pressure are not plotted. Documentation should be increased in this area.

(Priority: A)

ISSUE-LIST

NUMBER : ASA-MAS-02(ii)

Statement of Issue or Background Info

Success criteria for SLOCA

The discussion for heading L (secondary heat removal) gives two different success criteria, depending on the status of HPI. However, the fault tree top logic shows only one tranfer to the AFW system fault tree (GAF1100). This gate is not further developed in the AFW system fault tree.

List Questions Arising out of this Issue

1. Where is the development of GAF1100 ?2. How have the two different SLOCA success criteria for AFW been reflected in

the logic model ?

Issue Number: ASA-MAS-02(ii)

Response of the KOPEC PSA Team

1. GAF1100 should read GAFM122.

2. For the case of SLOCAL, where the success criterion is difficult, a new fault tree for AFW, with the success criteria, 1 TD pumps, or 2 MDP pumps, has been constructed (filename K3AF02M, Table DI 1.1-1) although it was not included in the documentation received. This will be included in the final report.

Number: ASA-MAS-02(ii)

As per PSA team response.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

The PSA team should ensure that the documented logic model reflects the one used to generate the core-damage frequency results. The ability to trace sequence cut sets through the logic model is important to (1) validate the PSA results, (2) provide the ability to maintain and update the PSA, and (3) support PSA applications.

(Priority: A)

ISSUE LIST

NUMBER : ASA-MAS-03(ii)

Statement of Issue or Background Info

Success criteria for containment heat removal (heading G for SLOCA event tree)

Either containment fan coolers or RHR heat exchangers may be used. The only failure mode of the RHR heat exchangers is loss of CCW (gates GCCM1512 and GCCM1562).

List Questims Arising out of this Issue

How does the logic address the failure of CCW to one RHR heater and loss of RHR flow through the other RHX heat exchanger ?

NUMBER: ASA-MAS-03(i i)

Response of KOPEC PSA team

Modelling of containment heat revomalThe logic shown in the event tree diagram was not used. The logic used

combined failure of RHR Ht ExA with RHR Ht ExB and included all dependencies thus introducing all the terms.

Number: ASA-MAS-03(ii)

The correct RHR model has been used; the documentation was incorrect.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue (Conclusions and Recommendations)

Update documentation for event G in SLOCA tree.

(Priority: A)

ISSUE LIST

NUMBER : ASA-MAS-04(ii)

Statement of Issue or Background Info

Success criteria for MLOCAs

The MLOCA range covers 2-6 inch LOCAs. Per section 5.2.2.1, reactor coolant pressure for a 2 inch LOCA stabilizes at 800 psia when HPSI is operating. However, the accumulators start to inject when reacotr coolant pressure drops below 660 psig.

List Questions Arising out of this Issue

How is it possible to take credit for the accumulators given failure of secondary heat removal at a 2 inch LOCA ?

Issue Number: ASA-MAS-04(ii)

Response of the KOPEC PSA Team

Medium LOCA Success Criteria

The analysis for medium LOCA shows that the most challenging case is a 3" LOCA and in this case 1HHSI pump and two accumulators are success. If the LOCA is greater than 2" but less than 3" then all decay heat is removed through the break and high head system maintains inventory. The SIT injection point is not reached. In either system it is assumed that high head recirculation is required.

Number: ASA-MAS-04(ii)

For LOCAs in the 2-inch to 3-inch range, RCS pressure does not drop below the accumulator setpoint. However, all decay heat will be removed from the break; thus, S/G cooling is not required.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue (Conclusions and Recommendations)

The existing success criteria for medium LOCAs; no further action required.

LSSjJL-LJST

NUMBER : ASA-MAS-05(ii)

Statement of Issue or Background Info

Success criteria for MLOCA

List Questions Arising out of this Issue

What reference was used to support the success criteria for HPSI (1 of 3 HPSI pumps) ? Note that this same success criteria is also used for SLOCA ; I would expect a criteria of 2 of 3 HPSI pumps for MLOCA.

Response of KOPEC PSA team

Medium LOCA Success CriteriaWCAP 9754 states that if one HPSI pump is available core cooling will be

recovered for the medium LOCA.

NUMBER: ASA-MAS-05 (ii)

Summary of Conclusions from Questions(List conclusions)

As per PSA team answer.

Resolution, of Issue (Conclusions and recommendations)

No further action required.

and Answers

ISSUE LIST

NUMBER : ASA-MAS-06(ii)

Statement of Issue or ..BacJsaLPundJLnfo

General transient event tree top logic heading

List Questions Arising out of this Issue

1. How has the probability of Heading Q been estimated ? ( I would expect tosee a fault tree development of event Q that relates heat imbalances to PORV challenges and failures to isolate stuck-open PORVs).

2. How have post-trip failure of RCP seal support systems (seal injection and thermal barrier cooling) been addressed ?

Issue Number: ASA-MAS-06(ii)

Response of the KOPEC PSA Team

Heading Q

Heading Q has been evaluated by multiplying the challenge frequency for a given transient (based on Westinghouse analysis) by the probability that the valve sticks open following a demand and that the operator fails to isolate the stuck open PORV. The latter functions are developed using a fault tree.

RCP Failure

The probability of RCP seal failure occurring at any time is covered in the tree for loss of CCW or NSCW. This is because if a seal failure occurs then the transient is treated as a small LOCA and would transfer the loss of CCW flow of NSCW trees.

Number: ASA-MAS-06(ii)

1. Heading Q was developed as per PSA team response.

2. Failure of RCP seal support systems is considered in the Loss of CCW event tree.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The final documentation should contain the Heading Q fault tree development.

(Priority: A)

ISSUE „LISI

NUMBER : ASA-MAS-07(i i)

Statement of Issue or Background,Info

Accident sequence timing following total loss of feedwater (TLFW)

List Questions Arising out of this Issue

1. Does the MARCH analysis consider any delay from TLFW to reactor trip ?(Greatly affects calculation of S/G dryout time.)

2. Why is the time for last chance to start feed and bleed (about 60 minutes) different from the time of core uncovery (70.6 minutes) ? (Since the shutoff head of the HPSI pumps is 2393.2 psia, I would expect that feed and bleed could be successful long after S/G dryout).

3. Why is the time between the time of S/G dryout and the time of core uncovery so short (about 10 minutes) ?

4. Why is the time between core uncovery and core melting so long(about 19 min)?

Issue Number: ASA-MAS-07(ii)

Response of the KOPEC PSA Team

Total Loss of Feedwater

1. Yes.

2. The Westinghouse analysis indicates that if feed and bleed is not started within five minutes of SG dryout the core damage criteria will be violated. Hence the instruction in the EOPs to start feed and bleed when SG levels reach 6%.

3. It does not take long to boil off the water.

4. This is from the beginning of core uncovery to the point when the hottest node indicates the onset of core damage. During boil-off steam becomes super heated.

Number: ASA-MAS-07(ii)

1. MARCH runs consider the time delay from TLFW to reactor trip.

2. The Westinghouse analysis indicates that feed-and-bleed must be started no later than the time of S/G dryout in order to succeed.

3. The PSA team considers a 10 minute time period for core boildown to be reasonable and supported by analysis.

4. The PSA team considers a 19 minute time period from the point of core uncovery to core damage to be reasonable and supported by analysis.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The bases for TLFW sequences are adequately documented, and no further action is required. However, the PSA team should be aware that containment analysis codes (MARCH, MAAP, SRP) may not be adequate for sequence timing determination; codes such as RELAP are preferred.

ISSUE LIST

NUMBER : ASA-MAS-08(i i)

Statement of Issue or Background Info

Mission times during LOP eventsDiesel generator mission time is 6 hr. switchgear cooling mission time is 24 hr.

List Questions Arising out of this Issue

1. The basis for the diesel generator mission time is NUREG/CR-4550 (Surrey), which developed on "average" based on the probability of offsite power restoration in U.S. plants. What has been done to validate the 6 hr mission time for Kori ?

2. Why are the two mission times different ?

Issue Number: ASA-MAS-08(ii)

Response of the KOPEC PSA Team

1. Since the recovery probabilities are taken from generic U.S. sources, the 6 hour time is considered appropriate.

2. We agree that the mission time for the room coolers ought to be 6 hours also. This will however make only a minor difference to the results as the failures to start of the chillers dominate.

Number: ASA-MAS-08(ii)

1. Due to lack of Korean plant-specific data, restoration of off-site power probabilities will be based on generic U.S. data. Thus, the 6 hour mission time is appropriate.

2. The mission time for switchgear cooling will be changed to 6 hours.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

Implement item 2 above.

(Priority: B)

.IS_S_U_E_LISI

NUMBER : ASA-MAS-09(ii)

Statement of Issue or Background Info

RCP seal failure

List Questions Arising out of this Issue

1. How has the Weibull model of RCP seal failure probability been used to calculatethe pribability of event Q1 ?

2. The assumption that a RCP seal failure leads to a 450 gpm LOCA seem overly conservative. Why was the older data used (Zion PRA) instead of the newer data (for example, WCAP-10541) ?

3. Have any tests been done on the RCP seals installs at Kori ?

NUMBER: ASA-MAS-09(i i)

Response of KOPEC PSA team

RCP Seal FailureThe value was determined by the following integral

ns*

S(t) dt = .225.Q

Based on the Weibel 1 function S(t) with 5% at 1 hour and 95% at 19 hrs. and 0 at 0.5 hrs.

The 2.5 hr was derived from the time to core uncovery following seal LOCA for the limiting leakage rate (2hr) and the time before core damage if no recovery of off-site power (4.5 hr).

No tests have been performed at KORI.

NUMBER: ASA-MAS-09(i 1)

Summary of Conclusions from Questions and Answers(List conclusions)

As per the answers.

Resolution of Issue (Conclusions and recommendations)

If the current RCP seal LOCA model dominates the PSA results, the PSA team should consider using the more recent WCAP-10541 model (which states that the flow rate is well below 450 gpm, thus lengthening the time to core uncovery.

■IS_S_U.E_I.IST

NUMBER : ASA-MAS-10(i i )

Statement of Issue or Background Info

Steam generator tube ruptures following main steam line breaks

List Questions Arising out of this Issue

1. The test refers to this as "Heading Q3" while the events trees use "Heading Q2".

2. How is the probability of this event calculated ?

NUMBER: ASA-MAS-10(i i)

Response of KOPEC PSA team

Steam Generator Tube Rupture follow main steam line breakThe value of 1.05-2 is based on engineering judgement (used in other PRAs

such as NUREG/CR 4550).

Number: ASA-MAS-10(ii)

The probability of steam generator tube rupture following main steam line breaks was taken from NUREG/CR-4550, which used engineering judgement.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The reported value, 1.05 x 10'2, seems overly precise given its origin in judgement.

(Priority: B)

ISSUE LIST

NUMBER : ASA-MAS-11(ii)

Statement of Issue or Background Info

High pressure safety recirculation (HPSR) during main steamline breaks.

The stated success requirements for HPSR are the same as those for the general transient.

List Questions Arising out of this Issue

1. How has the operation of containment spray been addressed during main steamline breaks ? (Operation of spray will deplete the RWST in a short ime, which may impact the probably of human error in aligning for recirculation).

NUMBER: ASA-MAS-11(i i)

Response of KOPEC PSA team

High Pressure Recirculation following Steamline Break

The timing and operator action evaluation will be re-evaluated.

Number: ASA-MAS-ll(ii)

Sequence timing for main steamline break and HPSR will be reassessed.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

Perform sequence timing reassessment.

(Priority: A)

ISSUE LIST

Number:ASA-MAS-12(ii)

Statement of Issue or BacMCPimd .Info

Incorporation of common cause initiators (CCIs) into system and top logic fault trees.The LPSI fault tree documentation states that CCW is a required support for the pump motors and seals. Cutsets for TC1XDZ contain failures of the LPSI pumps; however, the initiating event (loss of CCW) should directly fail the LPSI pumps.

List Questions Arising out of this Issue

1. How are CCIs incorporated into system-level fault trees and event tree top logic?

2. There is a dependency matrix for front-line systems and support systems; how have dependencies between initiating events and plant systems been summarized?

NUMBER: ASA-MAS-12(ïi)

Response of KOPEC PSA team

ÇÇIs1. Currently CCIs are incorporated into the system level fault trees for each

initiator on a case by case basis. This will be included explicitly for- the final quantification in the form of a table showing how each fault tree is to be modified for the CCI.

2. The dependency of LHSI on CCW has been removed from D2 in the response TC1X D2 as the pumps are only required to operate intermittently (1Q min every 2 hours) and can do as without CCW. Heat removal is being performed through the SGs not through the RCP seal leakage alone.

I

Number: ASA-MAS-12(ii)

1. CCIs are incorporated into fault trees on a case-by-case basis.

2. The final report will contain a table of all CCIs and the corresponding fault tree dependencies.

3. CCW is not required to run the LHSI pumps in sequence TCIXDZ; the pumps can be run 10 minutes every 2 hours.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Implement item 2 above.

For LHSI pumps dependency on CCW, see QAS-RM-03(ii).

(Priority: A)

ISSUE LIST

Number: ASA-MAS-13(ii)

Statement of Issue or Background Info

Loss of offsite power and station blackout event tree structure.

There are two ways considered which can lead to station blackout: (1) loss of diesel generators, and (2) loss of switchgear HVAC. Two SBO events trees have been developed to address each case since the sequence timing varies. Each event tree contains events that consider restoration of offsite power. Several events have been used to address RCP seal LOCAs, switchgear failure due to loss of HVAX, and turbine-driven auxiliary feedwater pump failure due to loss of HVAC.

List Questions Arising out of this Issue

General comment: I think that these event trees produce the correct cut sets (that is, thecut sets for each sequence seem to reflect the success criteria and the sequence timing).

1. Given success of DG, why is it necessary to consider B1 (restoration of offsite power by 60 minutes)?

2. How is loss of HVAC leading to turbine-driven auxiliary feedwater pump failure modeled? (Event LS considers TDAFWP failures; however, logic flag XHOSNSBO seems to delete the dependency of the TDAFWP on HVAC).

3. Why has B2 (restoration of offsite power prior to switchgear failure) been considered? (B2 is considered only when DG succeeds; thus, V can only occur due to HVAC equipment failure, not loss of power to HVAC.)

4. Battery depletion is modeled in the DC power fault tree. It is necessary to consider battery depletion with respect to restoring offsite power? (The AC breaker fault trees show a need for DC actuation power; is it possible to manually operate these breakers?

5. Event В considers restoration of offsite power for several cases; the discussion shows a range of times from 1 hour to 4.5 hours. Is Event В quantified using conditional probabilities (depending on Events B1 and В2)?

NUMBER: ASA-MAS-1S(i i)

Response of KOPEC PSA team

Station Blackout

1. (B1) This was done in order to take credit for Motor Driven Feed Pumps. It is not necessary from the event tree point of view and will be deleted.

2. LS is modelled for station blackout (i.e. HVAC has failed) therefore only non HVAC related failures can lead to failure of the TD pump. In the success path for LS the requirement to restore HVAC within 1.8 hours to prevent pump failure is the basis for the timing for restoration of power (B).

3. The HVAC is dependent upon Emergency chilled water (ECHW) and normal chilled water (NCHW). ECHW is diesel powered, NCHW is supplied from off­site power supplied. Recover of offsite power will enable the independent NCHW system to be used. B2 models failure to recover off-site power or failure of the NCHW system given recovery of off-site power. (Note: mechanical failure of NCHW are << failure to recover off-site power so have been excluded from the function).

4. Yes the 4.16 KV breaker can be closed by hand following restoration of off-site power so enabling DC to be restored through the battery changers.

5. Each of the functions under В is quantified to represent the time available to reactor hence the different function equation namesSB1 ВSB1 SEAL В SB1 AFW В SB1 PORV В SB2 B etc.

Number: ASA-MAS-13(ii)

1. Consideration of event B1 given success of event DG is not required, and will be deleted.

2. LS only applies to SBO scenarios; thus, failures of TDAFWP room cooling equipment need not be modeled.

3. B2 generally consideres the restoration of switchgear room cooling (V) prior to switchgear failure. The major failure modes of V are failure of the room cooler equipment and ECHW equipment. (Power to ECHW is not an issue since DG has succeeded). Thus, B2 considers restoration of off-site power to allow use of NCHW.

4. The 4160 VAC breakers can be manually closed.

5. Quantification of functions В are sequence-dependent; unique names have been assigned.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

No further action required for items 2, 4, and 5. The LOP event tree should be revised as per item 1. The PSA team should note that some failures of V (failures of switchgear room cooling equipment) are not recoverable by restoration of offsite power.

(PRIORITY: A)

ISSUE UST

Number: ASA-WEV-01

Statement of Issue or Background Info

For ATWS, the success criteria can depend upon the power level at which the transient is initiated, e.g. whether at high power or low power. Also, peak RCS pressure is related to the reactor moderator temperature coefficient (MTC) at the time of the transient. Above a critical value of MTC there is insufficient negative feedback to maintain RCS pressure. These factors can significantly influence the ATWs event tree and do not appear to be addressed in any detail.

List Questions Arising out of this Issue

What analyses were carried out to differentiate power levels and to analyze reactor moderator temperature coefficient critical values and percentage of time the reactor is at or above these critical values for ATWS?

Number: ASA-WEV-01(MAS)

The ATWS event tree is based on WCAP-11993.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should provide a table that compares the WCAP-11993 reference plant and Kori (in particular, core physics parameters such as moderator temperature coefficient) so that the applicability of WCAP-11993 to Kori is demonstrated. The reviewer was told that Kori-specific core physics calculations of ATWS have been performed; these should be referenced.

(PRIORITY: B)

resvEusT

Number: ASA-WEV-02

Siatsrnsnt. pf fesyg or.Baçkgr9yn.tf Jnfo

It is useful to explicitly identify the general event tree ground rules and success criteria that are used for the event trees. These general rules and success criteria include:

Criteria for running mission timesRCS inventory makeup criteriaRCS pressure control considerationsSeal cooling criteriaFeed and bleed criteriaPrimary pressure relief criteriaPORV criteria and ground rulesCooling and subcooling requirements for pumpsRecirculation criteria

These general ground rules and success criteria do not appear to be assembled or be identified which can lead to inconsistencies in the event trees.

List Questions arising out of this Issue

What general ground rules and success criteria have been used for the event trees, specifically including the above areas. Also, with regard to safety function requirements, what are the system success requirements for each function for a given initiating event (e.g. small LOCA, medium LOCA, etc.)? It would be useful to generate a table of such success requirements for each function for each initiating event.

Issue Number: ASA-WEV-02

Response of the KOPEC PSA Team

These topics are covered in the report.

Number: ASA-WEV-02(MAS)

Success criteria are discussed in each event tree section.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

The PSA team should consider developing a master table of success criteria. Such a table would be a useful "road map" through the accident sequence analysis and promote consistency.

(PRIORITY: A)

ïssmusi

Number: ASA-WEV-03

Statement of festig or Backgrowodinfo

Reactor coolant pump (RCP) seal LOCA models are necessary to determine specific leak rates, probabilities of failure, and times to failure. These models can be significant in determining station blackout event tree scenarios and frequencies. It is not clear that a detailed RCP seal LOCA model has been used in developing the station blackout event tree.

LisLOuestions arising out of this Issue

What model has been used for the RCP seal LOCA, what are the results of the model, and how has this model been used in the station blackout event tree?

Issue Number: ASA-WEV-03

Response of the KOPEC PSA Team

Ibis will be fully discussed in the report. (App. Ш.2)

Number: ASA-WEV-03(MAS)

RCP seal LOCAs have been discussed in the documentation.

Summary of Conclusions from Questioniand Answers(list Conclusions)

Resolution of Issue (Conclusions and Recommendations)

It is important to provide complete documentation of risk-significant issues, such as RCP seal LOCAs, while the PSA is being performed. Assumptions or insights may be lost when documentation is delayed until the PSA completion.

See also ASA-MSA-09(ii).

(PRIORITY: A)

ÎSS-UELIST

Number: ASA-WEV-04

Statement of issue рг Background info

Battery depletion is a potentially important contributor to station blackout event sequences. Battery depletion for example, can be extended by shedding of nonessential loads on the buses. When DC power is lost, operation of the bus feeder breakers needs also to be examined. Battery depletion and its consequences do not appear to be addressed in any detail in the station blackout event trees.

Li$t.QwstiQn5 jujsmg.Pftt.Pf lhiS.I$5us

What specific analyses and assumptions were made regarding battery depletion times, consequences, and possibilities for load shedding? Why wasn't battery depletion explicitly included as a top event in the station blackout event tree?

Issue Number: ASA-WEV-04

Response of the KOPEC PSA Team

The room heat up is dominant contributor at this stage.

Battery depletion will be considered for finnl quantification. The full details on the modelling are covered in the report.

Number: ASA-WEV-04(MAS)

Battery depletion has been considered; however, room heatup effects are more limiting.

Battery depletion is modeled in the DC power fault tree.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

As per ASA-MAS-13(ii).

(PRIORITY: B)

ISSUE LIST

Number: ASA-WEV-05

Statement of Issue or Background Info

Interfacing system LOCAs are often important contributors to not only core damage frequency but also to public risk. Interfacing system LOCAs were given special treatment in the first phase reports and it appears that state of the art techniques are being used in the interfacing system LOCAs. However it appears that there are inconsistencies in the analyses that were performed.

List Questions Arising out of this Issue

For the cold leg injection line, the probability of leakage or rupture of the third check valve is treated as a conditional common cause probability. Data giving fraction of failures of check valve leakage or rupture is used for the probability of the third check valve. For hot leg recirculation lines, however, the probability of the third MOV rupture or leakage is treated as an unavailability and the rupture or leakage failure rate is multiplied by one half the test interval (one year). This unavailability approach gives significantly lower probability values (by two or three orders of magnitude) than the conditional probability approach. Whey were these two different and apparently inconsistent approaches used? Also, why weren’t double leakage cases examined for the conditional leakage probability (Pcc (leakage)) like double rupture cases were examined for the conditional rupture case. Furthermore, the check valve demand probability used is 2.8-4/d which appears to be low compared to other values used (e.g. 1.0-3/d in NUREG 1150). What is the basis for this number?

Number : ASA-WEV-05

The Response of PSA Team

The inconsistencies and Pcc(leakage) is aready modified in the reports. The check valve demand failure probability is obtained from the NUREG/CR-5102.

Number: ASA-WEV-05(MAS)

The inconsistancies noted have been corrected.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

As per AS A-WE V-14. Prior to final quantification, a review should be held to ensure that ISLOCA-related check valve ruptures are treated consistantly. The check valve demand probability for ISLOCAs should be the same as for other sequences; otherwise, justification for a different value should be provided.

(PRIORITY: B)

ISSUE LIST

Number: ASA-WEV-06

Stëtgmçm çf fea» дг Baçkgrpynd.info

For station blackout one needs to consider non-isolable faults in the steam generator. If these faults occur then heat removal from the steam generators cannot be performed. These non-isolable faults can occur when power is lost to both the steam generator level control valves and the steam generator atmospheric relief valves.

List Questions arising out of this issue

What analyses have been carried out to determine whether faults can occur in the steam generators which can not be isolated. Also, what analyses have been done to determine the number of times safety relief valves will open during a blackout?

Number : ASA-WEV-Об

The Response of PSA Team

This comment is simply not correct. Loss of level indication might eventually lead to the failure of turbine driven pump due to steam generator overfill, and a stuck open atmospheric relief valve is a totally inconsequential failure. Furthermore, there is nothing unisolable about these failures^

Number: ASA-WEV-06(MAS)

1. Loss of S/G level indication may cause turbine-driven pump failure due to S/G overfill.

2. Stuck-open S/G PORVs can be manually isolated during SBO.

3. S/G overfill can be terminated by closing manual valves in AFW.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

Failure of the turbine-driven auxiliary feedwater pump (TDAFWP) may occur if (1) the S/Gs are depressurized due to a stuck-open S/G relief valve [see SA-RM-03(ii)], or (2) the S/Gs are overfilled such that water is carried over to the TDAFWP turbine. Recovery actions are possible; however, they involve ex-control-room activities for SBO scenarios. The AFW fault tree should be revised to consider all possible ways in which the TDAFWP steam supply can be failed. In addition, the human reliability analysis (HRA) should carefully consider the likelihood that the operators can successfully recover the TDAFWP.

(PRIORITY: B)

ISSUE UST

Number: ASA-WEV-07

Statement of Issue or Background Info

The Kori PSA apparently assumes 1/2 hour for seal failure in a station blackout sequence (SBO).

This can be conservative. More recent studies (NUREG 1150) predict 1 1/2 to 2 1/2 hours.

The Westinghouse report which is apparently used has been updated.

List Questions Arising out of this Issue

What is the basis for the time assumed for seal failure?

Issue Number: ASA-WEV-07

Response of the KOPEC PSA Team

No such assumption has been made. The assumption is that there will be no seal failure in 1/2 hour.

Number: ASA-WEV-07(MAS)

Documentation of the RCP seal failure probability has been provided in the report.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution .of Issue (Conclusions and Recommendations)

No further action required concerning documentation. See ASA-MAS-09(ii).

ISSUE LIST

Number: ASA-WEV-08

Statement of Issue ю BagkgrQHnd.iof9

As an outcome of preliminary accident analyses in the PSA, areas are identified for which up to date analyses and models are most important because of their sensitivity. For the PWR NUREG 1150 PRA, for example, the sensitive areas identified were ATWS, feed and bleed, RCS depressurization, station blackout, pump cooling requirements, and seal cooling requirements.

List Questions arising pyt pf thigj^e

What approach is being used to identify those areas in the accident sequence analyses which are sensitive and important areas?

What areas are identified as being the most important areas where detailed analyses and information are required?

Issue Number: ASA-WEV-08

Resp_onse_of the KOPEC PSАТешп

These issues will be identified after final quantification.

Number: ASA-WEV-08(MAS)

Risk-sensitive areas will be identified after final quantification.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Early identification of risk-sensitive areas using conservative screening methods is suggested to ensure that adequate analysis of such areas occurs before the conclusion of the PSA.

(PRIORITY: A)

ISSUE ШТ

Number: ASA-WEV-09

Statement of Issue or Background Info

Switchover to recirculation can involve systems which are inside containment and not qualified for LOCA environments. For example, in some PWRs the RHR system is inside containment and when this alternative is considered in the event trees then the impact of the LOCA environment needs to be incorporated in the accident sequence analyses. The potential for LOCA environments in recirculation does not appear to be considered in the accident sequence analyses.

List Questions arising out of this Issue

How have LOCA environments been considered in switchover to recalculation? What systems are inside containment? Are they qualified for LOCA environments?

Number : ASA-WEV-09

The Response of PSA Team

Only systems that are environmentally qualified are taken credit for in the PRA. The RHR system is outside containment.

Number: ASA-WEV-09(MAS)

Components inside the containment that are required for recirculation are qualified for post-LOCA environments.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolutipn of Issue (Conclusions and Recommendations)

The PSA team should be mindful that plant-specific data collected on equipment located inside the containment may not be representative of equipment performance in post- LOCA environments. In particular, failure mechanisms due to containment high pressure, temperature, or humidity are not detectable during routine tests. The PSA team should provide additional discussion concerning the origin and applicability of all data (generic or plant-specific) that pertains to equipment located inside containment. See also DFA- WEV-02 and DFA-WEV-03.

(PRIORITY: B)

ISSUE LIST

Number: ASA-WEV-10

Statement of Issue or Background Info

For small or small-small LOCAs, containment pressure suppression or containment heat removal can depend on the containment spray system working or may not be dependent if natural condensation, steaming, etc. provide sump inventory.

List Questions-arising out of this Issue

What is the bases for the assumptions used for containment pressure suppression or containment heat removal with regard to dependence on the containment spray system?

Issue Number: ASA-WEV-10

Response of the KOPEC PSA Team

There is no need for containment heat removal of any kind for small LOCAs, if core heat removal functions are successful. The success criteria for containment heat removal are as follows:

For large LOCA

One RHR heat exchanger train + One containment spray train

For medium LOCA and others

One RHR heat exchanger

or

One containment fan cooler

Number: ASA-WEV-10(MAS)

Review of the SLOCA event tree shows that containment heat removal has been added.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

No further action required.

ISSUE LIST

Number: ASA-WEV-11

Statement of Issue or Background Info

The interactions between feed and bleed and seal injection flow (seal cooling) have been important in past PSAs. Also interactions between loss of feedwater and feed and bleed have been important.

List Ouestions-arisine out of this Issue

When seal injection (cooling) is assumed lost can feed and bleed be still carried out? What is the basis for the assumption? When feedwater is lost and feed and bleed is considered, how are seal cooling and possible seal LOCAs considered?

Issue Number: ASA-WEV-11

Response of the KOPEC PSA Team

Loss of seal failure will also fail feed and bleed. Seal failure occurs only SIS failure AND loss of CCWS.

Number: ASA-WEV-11(MAS)

The occurrence of a RCP seal LOCA implies that feed and bleed is not available (HPSI supports the RCP seals and provides the "feed"). The event trees consider RCP seal LOCAs and failure of feed and bleed through fault tree linking.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

As per ASA-MAS-06(ii).

ISSUE LIST

Number: ASA-WEV-12

Statement of Issue or Background Info

RCS cooldown and depressurization in station blackout sequences has been an important contributor to core damage in past PRAs. The time at which cooldown and depressurization should be initiated and rates are important considerations in these often dominant sequences.

List Questions arising out of this lssue

What is the bases for the assumptions used for RCS cooldown and depressurization in station blackout?

Number : ASA-WEV-12

The Response of PSA Team

Secondary heat removal in SBO is not asked until offsite power is recovered.

i

Number: ASA-WEV-12(MAS)

During station blackout, RCS heat removal is considered using the turbine-driven auxiliary feedwater system. Cooldown and depressurization is not addressed because these functions are required to prevent core damage.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

No further action required.

ISSUE LlgT

Number: ASA-WEV-13

Statement of Issue or Background Info

Restoration times of offsite power are important considerations for the accident sequence development. Steam generator depletion times and feed and bleed initiation times are also interdependent and important considerations.

List Questions arising out of this Issue

How sensitive are assumptions regarding recovery times for offsite power and steam generator depletion times? The event trees show one recovery time for offsite power (30 min). Is this related to steam generator depletion time instead of seal failure time?

Number : ASA-WEV-13

The Response of PSA Team

The 30 minutes is the time before which it is assumed no seal failure will occur. Steam generator dryout can only result from loss of AFW, which without recovery of offsite power leads to core damage anyway.

Number: ASA-WEV-13(MAS)

1. The 30 minute time is based on RCP seal LOCA concerns (this LOCA will not occur until at least 30 minutes after loss of RCP seal support systems).

2. The SBO event trees consider S/G dryout (1 hour after loss of feedwater).

3. Core-damage frequency results are sensitive to offsite power restration times.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

As per ASA-MAS-13(ii).

ISSUE LIST

Number: ASA-WEV-14

Stattarem of issve or P^p.kgroupdJnÍQ

For interfacing LOCAs, in addition to ruptures and leakages, the check valves could fail to close after repressurization. Leak tests may or may not be done when the reactor is shutdown. One valve may also stick open which would not be detected. The analyses which are performed in the Kori PSA do not appear to include these considerations, which can affect the interfacing LOCA frequency calculated.

List Questions arising out of this Issue

How have repressurizations and leak tests been incorporated in the evaluations of the interfacing LOCA? How has the possibility for the valve sticking open been included in the analyses? These contributions can increase the interfacing LOCA frequency.

Issue Number: ASA-WEV-14

Response of the KOPEC PSA Team

The Kori plants test the check valves in LPI and HPI lines individually except the third check valves of high pressure injection lines. The possibility of the third check valve sticking open will be considered in the reports.

The possibility of check valve fail to close after repressurization is difficult to consider. If you have any idea for considering these events, please let me know about that. My opinion is that the probability of check valve to reclose after repressurization would be less than that in the pressure of shutdown. Anyway, thank you for your comments.

Number: ASA-WEV-14(MAS)

1. Check valves in the HPSI and LPSI systems are tested individually except the third check valve in HPSI.

2. The difficulty in estimating the probability of a stuck-open third HPSI check valve is recognized by the PSA team.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The probability that the first two HPSI check valves transfer open should be small, based on the test procedure. It may be possible to assume that the third check valve is always stuck-open without adversely affecting the risk contribution due to ISLOCA.

(PRIORITY: B)

I$SUE_LI-ST

Number: SA-MPB-01

StgtemgnLpf Issue OLP-agjkgrpund Info

Most PRAs for PWRs now assume Feed & Bleed (FNB) as an action given loss of AFWS. But some plants have a very short time in which FNB can be initiated for success. Other plants may not be able to perform FNB depending on size & design of PORVs. To my knowledge, FNB has not yet been demonstrated physically for a US plant. Finally, in US, not all plants yet have approved FNB in emergency procedures.

LiSl..QPSS_tiQn$ arising put Qfjhis.ISSüS

• Is FNB included in KORI EOP’s?• Is there a basis for assuring that FNB can be performed for the scenarios in which

it is being taken credit?• Is the timing for initiators of FNB understood for such scenarios, and its impact

on any HEP’s.

Number : SA-MPB-01

The Response of PSA Team

The success of feed and bleed is considered from plant specific design on a case by case basis, based on WCAP analyses applicable to the plant design of interest under realistic or conservative assumptions.

Initiation of feed and bleed is also described in emergency operating procedure. Operating procedure and timing is

analyzed by using MARCH code.

Number: SA-MPB-01(RM)

1. Feed-and-bleed is included as part of the emergency operating procedures.The justification for inclusion is based on WCAP analysis.

2. The PSA team believes they understand the timing for these scenarios. The understanding is based on MARCH analyses. We, however, have reservations concerning the claimed times. We believe them to be optimistic.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue (Conclusions and Recommendations)

The PSA team should consider the MARCH analysis suporting bleed-and-feed and justify their confidence in this use of the code.

(PRIORITY: B)

FSSUE.LISl

Number: SA-LC-01

Statement of Issue or Background Info

This issue was mentioned together with another issue on data. Experience in France

indicated a problem with SUMP ONES 2 report).

List Questions arising out of this ISSUS

Have you considered analysis of your SUMP in more detail?

Number : SA-LC-01

The Response of PSA Team

See comment CDA-LC-01.

Number: SA-LC-01

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

See resolution of issue CDA-LC-01.

ISSUE LIST

Number: SA-LC-02

Statement of Issue or Background Info

Starting of the feed water system seems to be automatic. Modelling of feedwater systems are in many PSA not highly developed.

List Questions arising out of this Issue

What are the details of the actuation of the feedwater system?

Number : SA-LC-02

The Response of PSA Team

Only the Start-up Feedwater pump is modeled for the success of Main Feedwater. This pump is operated manually, and uses the same flow paths as the main FW pumps.

NUMBER: SA-LC-02

If the start-up feedwater system is manually operated the operator action should be modelled.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

No further action. Appropriate operator action model will be used.

ISSUELISX

Number: SA-LC-03

Siatemem of issue or Background fofo

The fault trees for the accumulators leave out the nitrogen system.

List Questions arising out of this Issue

The nitrogen system could cause a CCF on the accumulators. Has it been judged or analyzed not to have a contribution?

Number : SA-LC-03

The Response of PSA Team

Pressure indicator of accumulator are installed and verified by operator routinely.

Number: SA-LC-03

Every 12 hr the pressure is checked. This gives a low probability

~10-7x 12 ~ E-6

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

A basic event should be introduced in the fault tree for both high and low pressure.

(PRIORITY: C)

ISSUE LIST

Number: SA-LC-04

Statement of Issue or Background Info

ECCS - in recirculation mode

List Questions Arising out of this Issue

Same question as before about the sump. I do not see it in the fault trees. Should it be there? (French experience)

Why not include the RWST?

Number : SA-LC-04

The Response of PSA Team

See comment CDA-LC-01

Number: SA-LC-04

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

See resolution of issue CDA-LC-01.

\

‘V

ISSUE UST

Number: SA-RG-Ol(ii)

Statement of Issue or Background Info

Less of CCWS (8.3.2)

There is the assumption No. 6 which stipulates that system piping failure, CCW surge tanks and heat exchangers failures are not considered because of the veiy low probabilities of failures, and heat exchanger failures can be included in double MCS.

List Questions Arising out of this Issue

What is the failure rate of the pipe and how long are the pipes (sum of segments)? What are the probabilities for surge tank plugging or heat exchanger plugging? What about surge tank or heat exchanger break?

Issue Number: SA-RG-Ol(ii)

Response of the KOPEC PSA Team

We have adopted the usual practice that passive failures are less important than failures of operating equipment. The water in the CCW is clean water and there is little opportunity for plugging. Piping failure rates are typically on the order of 10'9/hr/section compared with failure of a pump to run of 10'5/hr.

Therefore on a train basis, failure of pump to run for 24 hours is X failure of pump to start

~10'5 X 24 X W3

as compared with 10‘9 x 24 for pipe failure.

In addition, there is no single pipe failure that could fail the whole system.

Tank/heat exchanger ruptures are on the order of 10'7/hr. So while this may give a comparable contribution to the failure of the two pumps in a train, on a system basis this will not contribute, as there are cut sets such as a failure to run multiplied by a CCF of the three standby pumps, which will dominate.

Number: SA-RG-Ol(ii)

The questions are related to few types of component failure which are not taken into account in the fault trees (e.g. pipe, surgetank, heat exchanger) for CCW system. Because clean water is used, there is a very low probability for the heat exchanger and surge tank plugging. For the piping it was considered that also its failure rate could be of the order of 10‘9/hr/section, being much less than 10"5/hr pump failure to run. Also there is no single pipe failure which could fail the whole system. The heat exchanger or tank have also low break failure rate of about 10'7/hr.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The answers could be summarized that the plugging and breaks of heat exchanger or tanks could be neglected given the low failure rates in comparison with other ones taken into account.

I think that for system piping, even if the order of failure rate is about 10‘9/hr/section, it would be reasonable to consider it taking into account pipe sections and their length. Also one simple calculation could be done to check the influence on the CCW fault trees.

(PRIORITY: C)

ISSUE UST

Number: SA-MK-01

Statement of Issue or Background Info

For AFWS there should be operator action to align for operation (since there is no automatic start).

List_QuestionsArising put of this Issue

Why haven’t you modeled operator action? The logic for success criteria should appear to be 2/2 motor operated pumps and 1/1 turbine driven pumps (depending if you have steam or not).

Number : SA-MK-01

The Response of PSA Team

The SG level low-low signal automatically start all AFW- pumps^ and the all MFWP trip signal also automatically start the MD AFW pumps. The success criteria of AFWS in ATWS event tree are divided in three cases, 1/3 pump, 2/2 MDP or 1 TOP, and 3/3 pumps.

NUMBER : SA-MK-01(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

The ATWS analysis was judged to be covered by the WCAP analysis and is not considered to be a significant risk contributor. The necessary operator actions are considered within the WCAP analysis; as are the relevent success criteria

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: SA-MK-02

Statement of Issue or Background Info

In the AUXILIARY FEEDWATER SYSTEM there is missing a modulated event for AFW TDP. For the air operated valve you have used the standardized FAULT TREE. For this tree there is a basic event of no gas. Since the valve is I.O. you don’t need gas, you don’t need power to open the valve.

List Questions Arising out of this Issue

Why don’t you distinguish between F.O., I.C. and other states?

Issue Number: SA-MK-02

Response of the KOPEC PSA Team

System specific condition is considered in developing each system fault tree. Standard fault tree is used as a reference.

NUMBER: SA-MK-02(RM)

Summarv of Conclusions from Questions and Answers(List conclusions)

See above

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: SA-MK-03

Statement of Issue or Background Info

Concerning PORV. The stuck open PORV is according to drawing 5.1-1 3", which corresponds to medium LOCA S2".

List_Questions Arising out of this Issue

Why are you addressing the stuck open PORV as 1.5"? What is the basis for this?

Issue Number: SA-MK-03

Response of the KOPEC PSA Team

Valve throat area, and not its nominal pipe diameter, is equivalent to a small break LOCA.

Number: SA-MK-03(RM)

Summary of Conclusions from Questions and Answers(List Conclusions)

The effective size of breach is limited by the valve throat area and not the pipe diameter.

Resolution of Issue(Conclusions and Recommendations)

No further action required.

ISSUE UST

Number: SA-MK-04

Statement of Issue or Background Info

Page 13 statement 6. You need power supply for nomral operation of SSPS. (normally we should assume that loss of power would cause trip due to the fail safe position).

List Questions Arising out of this Issue

Why do you model electrical power supply if it is not necessary for trip which is fail safe position?

Issue Number: SA-MK-04

Response of the KOPEC PSA Team

We did not model electrical power supply for reactor trip in loss of offsite power event.

NUMBER : SA-MK-04(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

The PSA team did not model power supply to the reacotr trip in the event of loss of offsite power

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LISTNUMBER : SA-RM-Ol(ii)

Statement of Issue or Background InfoFurther to SA-WEV-06

List Questions Arising out of this IssueCould you explain why the question of truncation is irrelevant ; as truncation occurs all the way up the fault tree and dependencies between AND gates at a high level in the tree (or even between trees in the accident sequences) may be lost due to order truncation.

Issue Number: SA-RM-Ol(ii)

Response of the KOPEC PSA Team

The purpose of the standardized fault trees is to provide guidance to the fault tree analyst, each component is looked at individually for its support system dependencies.

Since we are using the fault tree linking approach to solution, any dependencies will drop out automatically.

This is not a question of truncation.

Number: SA-RM-Ol(ii)

NUPRA uses a fault tree linking approach. So any dependencies between trees will automatically be accounted within the analysis.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The final report should contain a more detailed explanation of the NUPRA method.

(PRIORITY: C)

ISSUE UST

Number: SA-RM-02(ii)

Statement of Issue or Background Info

Fault trees for low pressure recirculation. The fault tree indicates that CCF of MOVS HV-102/202 should be the first order MCS but it does not appear in the MCS list in table in 1.2.1-4 of appendix Ш.

List Questions Arising out of this Issue

Why not?

Issue Number: SA-RM-02(ii)

Resßftnse_pf the KOPEC. PSA, Team

The CCF of HV-102/202 is regarded as being recoverable by manual opening of the valves. Table П1 1.2.1-4 is only the first few cut sets after recovery has been included. This CCF term will appear in a lower probability cut set combined with the non-recovery probability.

Number: SA-RM-02(ii)

The valves HV-102 and HV-202 are outside the containment and the CCF is judged to be recoverable. Thus it forms a second order MCS.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should consider whether credit can be given for recovery of CCF failures. The team should examine the failure modes associated with the CCF event and consider the liklihood of recovery for each failure mode.

(PRIORITY: A)

ISSUE LISTNUMBER : SA-RM-03(ii)

Statement of Issue or Background InfoThe TD AFWS pump may be used following on SG blowdown.

List Questions Arising out of this IssueHave you analysis to confirm that there is sufficient steam pressur to drive the pump ?

Issue Number: SA-RM-03(ii)

Response of the KOPEC PSA Team

AFWS Pump

The turbine driven pump will operate down to a steam pressure of 85 psi, so the pump will continue to operate following the early stages of cooldown and depressurization.

Number: SA-RM-03(ii)

1. The TC AFW pump will operate down to a steam pressure of 85 psi. Thus the pump will continue to operate during an operator controlled cooldown and depressurization until such point as the low head pumps can provide primary cooling.

2. An uncontrolled blowdown on steam generators 1 and 2 will reduce pressure below 85 psi.

3. There are check valves on the inlet times to the turbine to prevent 1 SG blowdown event reducing pressure to the turbine below 85 psi.

4. If there is a blowdown on 1 SG and a common cause failure of all MSIVs then there is affectively a blowdown on all 4 SGs.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should consider

1. A close examination of the operator controlled cooldown and depressurization operating instructions, to ensure that the operator is made aware of the need to maintain steam pressure in SGs 1&2 if feedwater is being supplied via the TC AFW pump. Failure to maintain pressure should be quantified as a human error.

(PRIORITY: B)

2. Failure of the MSIVs in conjunction with an SG relief valve sticking open should be modelled as a possible functional failure for the TD AFW pump.

(PRIORITY: B)

ISSUE LIST

Number:SA-RM-04( i i)

Statement of Issue or Background Info

Events HSVVOOOUs and HSVVHCV1TS have a probability of 3.25 X 10'5 and represent valves in the RWST discharge line transfer closed. The possibility of these valves being in a closed position due to test and maintenance errors is considered seperate!y (see event HSVVHCV1US)

kist._Questions arising out of this Issue

What is the failure mechanism of concern? and how is the probability derived ? What is the underlying failure rate ? It should be possible to argue that (without human mal-operation following maintenance) such events can be discarded from the fault tree.

NUMBER:SA-RM-04(ii)

Response of KOPEC PSA team

The failure mode is plugging or transfer closed. We agree that this is potentially conservative. However, its inclusion does not dramatically effect the CDF.

NUMBER : SA-RM-04(ii)

1. The underlying failure mechanism is plugging or transfers closed.

2. The assigned probability of 3.25 x IQ"5 is potentially conservative.

3. Its inclusion, however, does not dramatically affect the core frequency.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

No further action required.

damage

ISSUE LIST

Number: SA-RM-05(ii)

Statement of Issue or Background InfoFailure modes associated with the Boron Injection tank.

List Questions arising out of this IssueShould the possibility of the BIT being filled with unborated water be considered as a human error ? The consequences of such a slug of unborated water entering the core will lead directly to core melt.

Issue Number: SA-RM-OS(ii)

Response of the KOPEC PSA Team

Boron Injection Tank

There are no records of this having occurred at PWRs in the US, so the frequency is considered to be less than IE-4 and therefore it is not modelled as a failure of the injection system.

Number: SA-RM-05(ii)

1. The issue of unborated sources of water entering the core is a concern in E.C. While such events have not occurred, slugs of pure water entering the core can lead directly to a core melt.

2. The PSA team has not modelled such possibilities on the basis that there have been no incidents on US plants.

Summary of Conclusions from Duestions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should consider

1. Modelling the possibility of the presence of unborated sources of water in injection systems (BIT, RWST). Human error in filing these sources is the mechanism by which unborated water may be present. Thus, a human error analysis of such possibilities should be provided.

2. or alternatively, justify that the consequences of injecting such unborated water into the core are acceptable.

(PRIORITY: A)

ISSUE UST

Number: SA-MAS-Ol(ii)

Statement of Issue or Background Info

Test and maintenance unavailabilities for PORVs.

Per section 5.1.5, the PORVs are only tested every 18 months (during outage). There is only one block valve per PORV; most utilities would not allow PORV maintenance while the reactor is operating (due to personnel and reactor safety concerns).

List Questions Arising out of this Issue

1. What is the basis for the PORV test and maintenance unavailability? (Is it the probability that the PORV has been blocked during reactor operation due to minor leakage? If so, the value 1.60E-03 is very small compared to typical values of 0.1 or higher.)

2. What process is used to prevent the creation of test and maintenance events which are not consistent with plant operating policy?

Issue Number: SA-MAS-Ol(ii)

Response of the KOPEC PSA Team

This is a good point. Probably the "T+M unavailability" should be replaced by "block valve closed" with a higher number, on the order of 10'1. This will be checked by discussion with plant staff. Discussions with operation personnel on maintenance issues, to identify practices that are not correctly modeled, has yet to be done.

Number: SA-MAS-Ol(ii)

1. PORV test and maintenance unavailability will be replaced with the probability that PORV block valves are closed during on-line operations.

2. Test and maintenance events will be reviewed with the plant staff to ensure consistency with plant operating practice.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Implement corrections indicated above.

(PRIORITY: B)

ISSUE LIST

NUMBER : SA-MAS-02(ii)

Statement of Issue or Background Info

Battery capacity

The system description (section 10.1.3.6.3) and the LOP event trees use a battery lifetime of 2.2 hours. However, the fault tree assumptions (section 10.3.2, item 10) use a lifetime of 5 hours.

List Questions Arising out of this Issue

What is the correct battery lifetime ?

Issue Number: SA-MAS-02(ii)

Response of the KOPEC PSA Team

2.2 hours is the design life, but capacity tests have shown that the life can be greater than 4 hours. We agree the times should be consistent.

Number: SA-MAS-02(ii)

1. The designed battery lifetime is 2.2 hours.

2. Tests have shown that the actual battery lifetime is greater than 4 hours.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Ensure consistance of battery lifetimes between the event trees and the fault trees.

(PRIORITY: B)

ISSUE LIST

NUMBER : SA-MAS-03(ii)

Statement of Issue or Background Info

Diesel generator load sequencing

List Questions Arising out of this Issue

1. Why is there no fault tree development under gates GEKM212 and GEKM912 that considers failures of the load shed and sequencing function ? Failure of each load circuit breaker to open during the load shed process should be modeled.

2. Failure of each 480V load center circuit breaker to reclose during the sequencing process is not considered.

Issue Number: SA-MAS-03(ii)

Response of the KOPEC PSA Team

DG Sequencer

The DG sequencer common mode failure is considered to dominate and is therefore included in the DG tree as a failure of AC to ALL loads. Individual subcomponent failures make an insignificant contribution and are included in the failure of the breaker boundary.

NUMBER: SA-MAS-03(ii)

Summary, of Conclusions froip Questions and Answers,(List conclusions)

The PSA team consideres failure of the local shed and sequencing function to be adequately modeled by a single sequencer common mode failure.

Resolution of Issue (Conclusions and recommendations)

Per drawings 3-J-SA-215 and 3-5-PB-203, the D/E output breaker will close if both the preferred and alternate source PCBs are open; failure to shed other loads (Table #2, 3-5-SA-216) will not prevent the D/G from loading. However, the PSA team should consider D/G stalling immediately after its output breaker closes due to unshed loads. Probabilistically, this may be significant since 15 loads should be shed.

ISSUE LIST

Number: SA-WEV-01

Statement of Issue or Background Info

The way events are grouped or modularized in a fault tree can not only affect future applications but can cause inconsistencies or can cause certain contributions to be missed (e.g. common cause contributions). The specific criteria for grouping of basic events was not presented in the draft reports.

List Questions arising out of this Issue

What specific criteria were used to group and modularize basic events in the fault trees. How were grouped events decomposed and evaluated when grouped events were "added" together in the minimal cut sets to treat common cause contributions among similar components? Also, how were test and maintenance contributions treated for a grouped event?

Number : SA-WEV-01

The Response of PSA Team

Modularization is not performed on a random basis. Maintenance and test related unavilabilities, common cause failures, human errors, and shared components are never placed inside modules.

NUMBER: SA-WEV-01 (RM)

Summary of Conclusions from Questions and Answers(List conclusions)

The PSA team took account of likely dependencies when choosing the modules. Potential dependencies such as human errors, common cause failures, and shared components were not placed inside modules.

Resolution of Issue (Conclusions and recommendations)No further action required.

ISSILELIST

Number: SA-WEV-02

S^tsmentpfisgue orgaekgrQyndJníp

Minimal cut set truncation criteria are important in assuring completeness, in allowing

for uncertainties, and in evaluating minimal cut sets for common cause failure

contributions. The truncation criteria are not presented in the draft reports.

List Questions arising out of this Issue

What truncation criteria were used for truncating the minimal cut sets? How are minimal cut sets to be evaluated for common cause failure potentials?

Issue Number: SA-WEV-02

Response of the KOPEC PSA Team

Component groups, and not minimal cutsets are analyzed for common cause failures. Truncation value is set on a case by case basis, from a consideration of individual event probabilities and overall failure probability or frequency, typically a minimum of three or four orders of magnitude below the expected results.

Number: SA-WEV-02

The truncation criteria was set on a case-by-case basis, typically 3 or 4 orders of magnitude below the expected results. Further, component groups, and not minimal cut sets, were used as the basis for common cause evaluation.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

No further action required.

ISSUELISI

Number: SA-WEV-03

Statement of Issue or Background Info

Passive component failures can be important contributors to system failure when a single

passive component failure can fail the system. Past PSAs have included single passive

failures in the fault trees (e.g. NUREG 1150 PRAs). Passive failures are generally not included in the Kori fault trees.

LiSiQuestipng arising put pf this I$gpe

What was the basis for not including passive failures in the fault trees, even single

passive failures? What analyses were done to assure that passive failure are not dominant contributors to system failure?

Number : SA-WEV-03

The Response of PSA Team

Any probabilistically significant passive failures would be included. Typically, however, the contribution of event signle passive failures is more than two orders of magnitude below the dominant active failures for a front­line or support system for accident mitigation (i.e.v for a 25 hour mission time, where the initiating event is not related to the system of interest). Passive signle failures usually become dominant contributors to the failure frequency of normally operating system as common cause initiating events. Thus, they are most likely to appear in the logic modèls (é.g., fault trees) that are constructed for initiating event frequency quantification.

Number: SA-WEV-03(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

Any passive failures that are judged to be significant have been included.

Resolution of Issue (Conclusions and recommendations)

The PSA team should consider passive failures within systems systematically and eithera) model them in the fault tree orb) state the reasons for excluding them in the documentation. This need not be

a complex justification; a simple statement "not considered on the basis of low probability of. occurrence" would suffice. The majority of passive failures may be resolved this way.(Priority: B)

ISSUE LIST

Number: SA-WEV-04

Statement of Issue or Background Info

Misconfiguration of components after a test or maintenance can be a dominant contributor to system unavailability. In many of the fault trees (FTs) for Kori, in fact test and maintenance errors of misconfiguration are dominant contributors. However no specific criteria are given how such errors are identified in the FTs.

List Questions arising out of this Issue

How are components identified for a given test and maintenance (T/M) which are

susceptible to misconfiguration errors? How are common cause failures among

misconfiguration errors treated?

Number : SA-WEV-04

The Response of PSA Team

1. After serening analysis, only dominant B.E.'s are re­investigated during final quantification.

For stagged Maintenance, No CCF are considered. Specific analysis will be carried out for not- staggered maintenance.

2.

NUMBER: SA-WEV-04(RM)

Only the dominant basic events are to be re-investi gated during final quantification. This means that the possibility of misconfiguration will only be considered if either:1) it is judged by the PSA team to be significant (RWST level-sensor mis-

cal ibration, is an example of this)2) the fault tree assessment indicates the contribution from random failures is

significant.Further common cause failures arising from systematic miscalibration are only

considered if the maintenance is back-to-back.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

The PSA team has agreed to provide a more systematic means of identifying significant miscalibration. For example, model miscalibration errors in the fault trees and use screening values in initial quantification runs. At the very least, the exclusion of miscalibration faults should be included in the list of assumptions in the fault tree. (Priority: B)

The PSA team should consider whether to include an analysis of common cause failures arising from systematic miscalibration, which would include items under a staggered maintenance schedule. (Priority: A)

ISSUE LIST

Number: SA-WEV-05

Statement of Issue or Background Info

A ground rule is given that heating and ventilation (HVAC) for the diesels is not considered as a source of diesel failure. In some other PSAs, HVAC failures have been

signifícant contributors.

List Questions arising out of this Issue

What is the basis for ignoring HVAC failure contributions to diesel generator failure?

Number : SA-WEV-05

The Response of PSA Team

Loss of HVAC is now included in the model.

NUMBER : SA-WEV-05(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

Loss of HVAC is now included

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: SA-WEV-06

SlatemgJPt gf JS£»£.Qr-Ba£kfirQpn^.Infi)

Standardized fault trees are used in the Kori PSA for pumps and motor operated valves. Standardized fault trees are very useful and can save time in the fault tree analysis. However, special analyses have to be carried out to assure that common support systems are identifled when multiple standardized components appear in the same minimal cut set. Also, truncation criteria can eliminate minimal cut sets with multiple standardized

components without identifying common support system contributions.

List Questions arising out of this Issue

How were common support system contributions identified when multiple standardized components appear in the same minimal cut set? How were minimal cut sets of multiple standardized components truncated so that common support system contributions were identified before the minimal cut sets were truncated?

Number : SA-WEV-06

The-Besp_onse of PSA Team

The standardized fault trees were only used as an initial quide, and were then modified according to the specific component desing. Even without modification, the comment does not apply, because each 'generic' component of the standardized tree is modified with unique component identifiers. The question of truncation criteria is irrelevant to this issue.

NUMBER : SA-WEV-06(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

The standardized fault trees were only used as an initial guide to the fault tree developing to help ensure consistency of modelling

Resolution of Issue (Conclusions and recommendations)

No further action required (issue SA-RM-I(ii) is related).

ISSUE LIST

Number: SA-WEV-07

Statement of Issue or Background Info

The failure mode code table (Table 1.4-5) is very good. However certain failure modes

are not identified.

List Questions arising out of this Issue

How are sensor failure modes of no output, fails high or fails low identified? Also how is the battery failure mode of no output identified? Human errors of both omission and commission are grouped under the failure mode H. Why aren't different types of human

errors separately identified? Also, because of their importance why aren't different common cause failure modes identified instead of lumping all of them under the failure mode W? The 10 digit labeling scheme which is used seems to be very constraining.

Number : SA-WEV-07

The Response of PSA Team

Sensor failures are modeled as failures in the appropriate mode to produce failure in the funcation required. The failure probability used should be the conservative one for all modes.

Human errors are modeled as errors of omissions as far as their impact goes i.e., the only consequence is "did not perform required action". The probability should include both errors of omission and commission, however. This is standard PSA practice in the US.

CCF terms are modeled as failures to perform the mission.

NUMBER : SA-WEV-Q7(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

It was not considered to be necessary.

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: SA-WEV-08

Statement of Issue or Background Info

Test and maintenance contributions can be important contributors to component unavailability. However, no test and maintenance contributions is identified in the

standardized fault tree for the motor driven pump (MDP 1)

List Questions arising out of this Issue

Why isn't a test and maintenance contribution identified in the standardized fault tree for

the motor driven pump?

Number : SA-WEV-08

The Response of PSA Team

Test and maintenance is considered as segment-base not component-base. Also see comment SA-WEV-06 .

Number: SA-WEV-08(RM)

Test and maintenance is considered at a different level in the fault tree.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

No further action required.

ISSUE LIST

Number: SA-WEV-09

Statement of ™ Background Info

For the HPSI system, one of the pumps is continuously operated to maintain the water

level in the RCS pressurizer. However, the rotation cycle for the pumps is not given

which is needed for future unavailability evaluations.

List Questions arising out of this ÏSSUÆ

What is the rotation cycle for the HPSI pumps? How was this rotation cycle considered

in unavailability evaluations and for test and maintenance considerations?

Number : SA-WEV-09

The Response of PSA Team

One pump is assumed as continuously operating in the model. Plant-specific data incorporate the effect of the rotation cycle for not-restored data.

!

NUMBER : SA-WEV-09(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

The impact of rotation cycles for the HPSI pumps is not significant for the PSA

Resolution of Issue (Conclusions and recommendations)

No further action required.

re$uE list

Number: SA-WEV-10

Statement of Issue or Background Info

Care must be taken in labelling and referencing components in the descriptions of the

fault trees and event trees. This is a somewhat minor comment but several component labels as referenced in the discussions are different from those given in the figures.

List Questions arising out of this Issue

For the HPSI description, the normally open MOVs from the volume control tank are

given as LV-115B and LV-115E (page 4). In Figure 2.1-1C in the flow diagram the

valves are labelled as LV-115C and LV-115E. In the description of the flow paths of the

HPSI discharge on page 7 MOV HV-20 is identified as the normally closed valve in the alternate flow path (item 4 on page 7). However, this valve is not the valve in the alternate path as identified in the flow diagram. What are the correct labels? Also the boron recirculation line isolation valves MOV HV-28 and MOV HV-29 are not shown in the diagram. Please assure that all labelling is consistent.

Number : SA-WEV-10

The Response of PSA Team

Thank you. we will correct.

NUMBER : SA-WEV-10(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

Noted and corrected

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: SA-WEV-11

Statuent pfJssw gr Baçkgrpynd infp

The HPSI accident procedures require the operator to close the HPSI pump miniflow

valves during the injection phase. However, failure to close thesë valves is not considered in the fault tree analysis.

List Questions arising opt pf

Why is the operator required to close the miniflow valves if these will not affect the HPSI

function as assumed in the fault tree? Will not the failure to close these miniflow valves

not affect the function for the top event of failure to inject in one of three RCS loops?

Number : S A-WE V-11

The Response of PSA Team

Miniflow line of the HPSI pump does not show flow diversion due to flow restriction orifices.

NUMBER : SA-WEV-11(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

Flow diversion via mini-flows is limited due to presence of flow restriction orifices.

Resolution of Issue (Conclusions and recommendations)

No further action required.

ISSUE LIST

Number: SA-WEV-12

Statement of Issue or Background Info

Failure or miscalibration of flow indicators is not considered as a contributor to HPSI unavailability. However if the indicators fail high the operator may throttle or reduce the pump flows.

List Questions Arising out of this Issue

Why wasn’t the flow indicators’ high miscalibration with subsequent reduction of flow by the operator considered in the fault trees?

Number : SA-WEV-12

The Response of PSA Team

This should be considered if operator would not have other indicators for the amount of low. More importantly, EOP'S should be checked to see if the operator is instructed to adjust HPSI flow (which is doubtful). If he is not told to monitor flow, there would be no reason to model this, since it would involve multiple failures (hardware and operator).

Number: SA-WEV-12(RM)

The operating instructions should include the balancing of flow post-LOCA. Thus there may be a need to throttle HPSI pumps following a small LOCA

The consequences of not balancing flows may lead to a degraded situation. It is judged, however, that it is not significant.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should consider presenting the above in the list of assumptions for the HPSI fault trees.

(PRIORITY: C)

ISSUE LISI

Number: SA-WEV-13

Statement of Issue or Background Info

Failure of the BIT is not considered in the HPSI fault tree. This single failure however can be an important contributor. More generally, elimination of failures before the fault tree is constructed is not a good practice unless sensitivity studies or otherwise justifiable

ground rules allow the contributor to be relaxed.

List Questions arising out of this Issue

Why wasn't failure of the BIT considered in the HPSI fault tree? Isn't this a single failure of the system? Also, have boron crystallization effects been considered in evaluating failure contributors and a cause of possible increased failure rates?

Issue Number: SA-WEV-13

Response of the KOPEC PSA Team

Since the catastrophic failure probability of the BIT is very low and this failure is not a single failure we did not model the SIT failure in the HPSI fault tree.

At this stage boron crystallization has been considered by modelling heat tracing failure.

NUMBER : SA-WEV-13(RM)

Summary of Conclusions from Questions and Answers(List conclusions)

Failure of the boron injection tank is not considered to be a significant contributor, and has not been modelled in the fault tree.Boron crystallization has not been considered in the existing analysis.

Resolution of Issue (Conclusions and recommendations)

the PSA team should consider if assumptions relating to BIT failure modes should be part of the written fault tree assumptions. (Priority:C)

ISSUE LIST

Number: SA-WEV-14

Statement of Issue or Background Info

Failure of pump room cooling is not considered in the HPSI fault tree because the reason

given is that the failure rate is small (Section 2, page 24). However, contributors should

not be eliminated based on failure rate arguments, since the unavailability can still be

large and perhaps more importantly failure of pump cooling could affect multiple pumps.

List Questions arising out of this Issue

What analyses were done to show that failure of pump room cooling is not an important contributor to HPSI unavailability (beyond the failure rate argument)?

Number ; SA-WEV-14

The Response of PSA Team

See. 5.7.2 room heat-up calculations.

I

Number: S A-WE V-14(RM)

Calculation of room heat-up rates are given in section 5.7.2 of the report.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

No further action required.

ISSUE LIST

Number: SA-WEV-15

Statement of Issue or Background-Info

For the HPSI the dominant contributors are two single human errors involving leaving

the RWST discharge valves in a misconfigurcd position after test and maintenance. However there is no discussion of these dominant contributors or identification of the

need to do further plant specific analyses for these contributors. For HPSR

(recirculation) manual switchover is required but this is not identified as an important

single failure contributor.

List Questions arising out of this Issue

What further plant specific analyses will be carried out for the single failure dominant contributors identified in the HPSI?

What further plant specific analysis is planned to better evaluate the operator switchover action for HPSR?

Number : SA-WEV-15

The Response of PSA Team

Only screening values aire used for His at this stage. Important His ate identified and more detailed analysis will be performed for them later on.

NUMBER : SA-WEV-15 (RM)

Summary of Conclusions from Questions and Answers(List conclusions)

It is intended to carry out a more detailed assessment later in the PSA

Resolution of Issue (Conclusions and recommendations)

No further action required.

ÏSSUELJST

Number: SA-WEV-16

Smgmgnt qf issyg or Background, jpfo

The tests on the MOVs for the HPSI are not described sufficiently to identify what failure modes of the valves are actually tested. Partial tests (e.g. tests only to the valve stem) can result in high unavailabilities for certain failure modes (e.g. valve plugging) and have

been important contributors in past PSAs.

List Questions arising Qutjpf this Issyg

What specific pieceparts and failure modes of the MOV valves are tested by the

surveillance tests? Specifically, how arc valve plugging modes tested for in the

surveillance tests?

Number : SA-WEV-16

The Response of PSA Team

Stroke tests do not test against plugging. Test procedures in the system write-up should be described in more detail.

Number: SA-WEV-16(MAS)

Summary of Conclusions from Questions and Answers(List conclusions)

1. Valve plugging is not detected by stroke tests.2. test procedures will be described in more detail.

Resolution of Issue (Conclusions and recommendations)

As per SA-WEV-13.

ISSUE LIST

Number: SA-WEV-17

Statçmgnt pf Issue <?r BackgrpundMo

For the accumulators, the dominant contributors are common cause failures of check valves with risk achievement worths of 40,000. The equivalent beta factors were

assigned to be 0.06. There is apparently little bases for these contributors and these

contributors are not identified as requiring additional plant specific analyses.

List Questions arising out of this Issue

What additional analyses will be performed on the dominant contributors which are

identified as being very sensitive contributors by the risk achievement worths?

Number : SA-WEV-17

The Response of PSA Team

Only sensitivity analysis will be doen. See general comments on CCF. .

Number: SA-WEV-17(MAS)

The sensitivity of the results to common cause beta factors will be investigated.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution.of Issue(Conclusions and Recommendations)

A consistent set of beta factors should be used in the initial quantification. See resolutions to DFA-SH-05 and DFA-AM-01.

(PRIORITY: A)

ISSUE LISI

Number: SA-WEV-18

Statement of Issue or Background Info

The unavailability for 2 out of 3 PORVs failing to open is calculated to be 2.96-3. For any 1 out of 3 failing to open the unavailability is calculated to be 5.17-4. There is no

apparent justification or basis given as to why 1 out of 3 failing has a smaller probability than 2 out of 3 failing. Also, the dominant contributors include the operator failing to

isolate the faulted PORV with the sensitivity of this contributor not identified nor

planned plant specific analyses identified. Another dominant contributor is the common

cause failures of all PORVs with risk achievement worth of 1900 showing it to be an

extremely sensitive contributor.

List Questions arising out of this Issue

Why is the unavailability of 2 out 3 failing to open higher than the unavailability of 1 out 3 failing? What is the basis for the extremely sensitive and dominant contributors which were evaluated and quantified involving the PORV common cause failures and the

operator failing to isolate the faulted PORV. What specific re-evaluations are planned

for these contributors?

Number : SA-WEV-18

The Response of PSA Team

WEV had understood the situation backwards

Number: SA-WEV-18(MAS)

The unavailability of 1 out of 3 POR Vs failing to open is 2.96E-03; 2 out of 3 PORVs failing to open is 5.17E-04.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

These unavailability values should be revised when the final data set is available.

(PRIORITY: C)

ISSUELISI

Number: SA-WEV-19

Statement of Issue or Background-Info

The unavailability calculated for the containment heat removal system is relatively high

and is 3xl0'2. The dominant contributor is the single failure of miscalibration of all the pressure transmitters. A value of IxlO*2 is assigned for this miscalibration error which is

significantly higher than other miscalibration errors assigned. Also there is no

differentiation of miscalibration errors into high and low miscalibrations.

bist Questions arising out Qfjhisissug

Why is the miscalibration of pressure transmitters assigned such a high probability, which is significantly higher than other miscalibration error probabilities assigned? What is the calibration procedure? What is the validation procedure?

Number : SA-WEV-19

The Response of PSA Team

These are screening values.

There is no need to model both high and low miscalibration errors. Is this because only one failure mode is applicable ?

Number: SA-WEV-19

1. The value of 1.0E-02 for miscalibration of the containment heat removal pressure transmitters is a screening value. It is not based on consideration of calibration or validation procedures.

2. Only low miscalibrations (detector output is lower than the true value) are applicable.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

1. A consistent set of miscalibration screening values should be used throughout the PSA See resolution of HIA-WEV-01 and ША-АМ-05.

2. Fault tree basic event should contain a complete failure mode description.

(PRIORITY: B)

resuELisj

Number: SA-WEV-20

Statement of Issue or Background Info

For the containment fan cooler system manual start (recovery) is included but manual recovery is not considered for any other system. It is also assumed that pump room cooling is not required. Finally, the containment fan cooler, system is located entirely

within the containment and hence the components may be exposed to more extreme

environments, e.g. higher temperatures and pressures.

List Questions arising put pf .thisJsSHS

Why is manual start considered for the containment fan cooler system at this stage of the

analysis when it is not considered for any other system? What is the basis for assuming that pump cooling is not required? What is the basis for not considering possible extreme

environments that the fan cooler system components may experience? In some other PSAs extreme environments have significantly changed failure probabilities.

Number : SA-WEV-20

The Response of PSA Team

There is no manual start.

See section 5.7.2 room heatup calculation.

CFC is safety related and environmentally qualified.

i

Number: SA-WEV-20

1. Manual start of the containment fan cooler system is not currently modeled in the fault tree.

2. Room heatup calculations have been performed to determine the scope of the room cooling modeling effect.

3. The CFCS is designed to withstand the post-LOCA containment environment.

Summary of Conclusions from Questions and Answers(list Conclusions)

Resolution of Issue (Conclusions and Recommendations)

See ASA-WEV-09, DFA-WEV-02, and DFA-WEV-03.

ISSUE LISI

Number: SA-WEV-21

Statement of Issue or Background Info

For the auxfeed system certain assumptions are made for which no bases or justifícations

are given. These assumptions include:

1. That the two condensate tanks are independent of one another

2. That failure of tanks and piping is not considered even if they are single

failures of the system

3. That there is no need to transfer to the raw water reservoir even for longer

term requirements

List Questions arising out of this Issue

What is the bases for the above assumptions which are made and which can influence the system results? A basis should be provided for each assumption made.

Number : SA-WEV-21

The Response of PSA Team

All these failures are of low probaility during mission time. There is no need for long term transfer of water (CST inventory of 900,000 gallons will last well beyond the 24 hour mission time).

Number: SA-WEV-21(MAS)

1. Low probability passive failures (tank and pipe ruptures) are not considered.

2. The CST inventory of 900,000 gallons is more than adequate for a 24 hour mission time.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

These assumptions are documented and justified in Appendix I. However, the PSA team should consider adding tank failures to ensure consistency with the external events analyses (particularly, seismic).

(PRIORITY: B)

ISSUE Ш1

Number: SA-WEV-22

Statement of Issue or Background Info

For the auxfeed system, a steam binding of the pumps is an important contributor. However, the models for steam binding nor the basis for the probability assignment are

given.

List Questions arising out of this Issue

What are the models and bases for the contribution steam binding of the pumps? What is

the basis of the probability assignment?

Number : SA-WEV-22

The Response of PSA Team

Steam binding will be modeld as a signle basic event which results in failure of all three pumps. Its probaility will be evaluated along the lines performed in NUREG/CR-4550, Vol. 3, suitably modified for KORI specific design and operational practices (particularly with respect to check valve capability to prevent steam backflow).

Number:

Steam binding of the auxiliary feedwater pumps has been modeled failure of all pumps.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue (Conclusions and Recommendations)

No further action required.

SA-WEV-22(MAS)

as a common cause

ISSUE LIST

Number: SA-WEV-23

Statement of Issue or Backgroundinfo

For the nuclear service cooling water system (NSCWS) test and maintenance contributions are not considered. Also, misconfiguration errors are not considered. These assumptions are justifiable for running components, but are not justifiable for standby components. These test and maintenance contributions are, moreover, considered for all other system fault trees.

List Questions arising out of this Issue

Why are test and maintenance contributions and test and maintenance misconfiguration errors ignored for NSCWS?

Number : SA-WEV-23

The Response of PSA Team

T/M for pump has been modeled. Misconfiguration has also been considered, except for those with control room indication.

NUMBER : SA-WEV-23(MAS)

1. Test and maintenance contributions to NSCWS pumps will be modeled.

2. Miscalibration errors have been considered.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

Pre-initiator human-related errors should be treated constantly. See resolution of HIA-WEV-Q1 and HIA-AM-05.

ISSUE LIST

Number: SA-WEV-24

Stâ-tgmgniflf Issue pr.BaçkgrQtindJnfg

For the class IE standby power system, the capacity of the fuel systems is not considered. Also, room cooling of the diesel is not apparently considered. In other PSAs (e.g. NUREG 1150) these were important contributors.

List Questions arising out of this Issue

Why wasn't the capacity of the fuel systems not considered? Also why isn’t room cooling of the diesels apparently not considered in the fault tree?

Issue Number: SA-WEV-24

Response of the KOPEC PSA Team

The DG can operate for 4 hours without any fuel transfer. Failure of fuel transfer system after 4 hous until 20 hours will be modeled.

DG cooling has been modeled.

Number:

Summary_of Conclusions from Questions and Answers(List Conclusions)

1. Diesel generator fuel transfer system has been modeled.

2. Diesel generator room cooling has been modeled.

Resolution of Issue(Conclusions and Recommendations)

SA-WEV-24(MAS)

No further action required.

resuELisi

Number: SA-WEV-25

Statement of Issue or Background Info

The dominant contributors to the man feedwater system are single failures of two control circuits (MFCK0221AN and MFCK0936 AN). These single failures need to be validated from detailed design drawings (as do all single failures found in fact). These single failures cause the feedwater system to be highly unreliable.

List Questions arising out of this Issue

What is the basis for the result that the two above control circuit failures are single failures of the feedwater system? What validation checks have been performed on these contributors?

Number : SA-WEV-25

The Response of PSA Team

The model only includes the startup feedwater pump, not the entire feedwater system.

Number: SA-WEV-25(MAS)

Summary of Conclusions from Questions and Answers(List Conclusions)

Single failures of control circuits (AFCK0221AN and AFCK0936N) apply to the startup feedwater pump, not main feedwater. The startup feedwater pump is a backup to AFW.

Resolution of Issue(Conclusions and Recommendations)

The PSA team should confirm that (1) the failures of the control systems are single failures, and (2) the correct probabilities have been assessed.

(PRIORITY: B)

ISSUELIST

Number: SA-WEV-26

gatçmçiit Qf Issu? W B,a£kgrpup¿_lnia

For certain fault trees, the standardized component fault trees are sometimes not applicable. For example, for the auxfeed system, when the AOV fails open then power is not required to the valve. It appears that the standardized components were not evaluated for their direct applicability in each fault tree.

List.Questipng arising,out j)f this Issue

What checks have been performed to validate the applicability of the standardized component fault trees for each system fault tree? Specifically, with regard to the AOV contribution to the auxfeed system, why isn't the standardized fault tree modified to reflect the fact that power is not needed to the valves?

Number : SA-WEV-26

The Response of PSA Team

The stanardized fault trees are only used as an aid, as mentioned before.

NUMBER : SA-WEV-26(MAS)

Standardized fault trees were used as an aid to fault trees developed specific equipment.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

See resolution of SA-WEV-06 and SA-RM-1 (II).

ISSUE LIST

Number: SA-WEV-27

Statement of Issue or Background Info

For the essential chilled water system, failure of the air separator is not considered. In at least one other PSA this has been a nonnegligible contributor. The reason given for not considering the air separator is that no data exists and that the failure rate would likely be low anyhow. It is important that all assumptions be checked to assure that they do not impact the final results.

List Questions arising out_of this Issue

What checks have been carried out to assure that the air separator is not an important contributor to the chilled water system unavailability?

Number : SA-WEV-27

The Response of PSA Team

According to system designer, failure of air separator doesn't affect system function for a extended period of time and failure probability is very low compared to pump or chiller.

NUMBER : SA-WEV-27(MAS)

Per the cognizant system engineer, failure of the essential chilled water system air separator is a very long-term system failure.

Summary of Conclusions from Questions and Answers(List conclusions)

Resolution of Issue (Conclusions and recommendations)

This information should be documented in the PSA.

ISSUE LIST

Number: SA-WEV-28

Staismentüf hm отЗыЩоШЖъ

For the low pressure fault tree there is no identification in the fault tree of interfaces with the RWST even though the description of the fault tree says there is.

List Question? arising out of .this Issue

Why isn't interfaces with the RWST shown in the low pressure system fault tree? More generally, have the system fault trees been checked to assure they are consistent with the system descriptions and failure criteria?

Number : SA-WEV-28

The Response of PSA Team

We will model failure of RWST.

4

Number: SA-WEV-28

The RWST will be modeled in the LPSI fault tree.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should consider developing a fault tree interface diagram. This will help ensure that (1) all required models are developed, and (2) the various system models link together.

(PRIORITY: B)

ISSUE LIST

Number: SA-WEV-29

Statement pfJssueor PagkgroyndJnfa

Plugging of inlet strainers in service water systems has been a significant contributor in some past PSAs. Plugging can also be an important common cause contributor in that multiple strainers often become plugged. It appears that plugging is only considered as a contributor for typhoons (external events). Plugging can be a high contributor especially for brackish water intakes.

List Questions arising out of this Issue

What is the plant specific basis for the way strainer plugging is considered or is not considered in the PSA? What experience is used as a basis for the models and probabilities estimated?

Number : SA-WEV-29

The Response of PSA Team

This impacts the losë of Service Water only as initiating event, and not as a standby unavailability.

an

Number: SA-WEV-29(MAS)

There are no plans to model post-initiator plugging of service water strainers.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

Water system failures due to strainer plugging has been found to be a risk contribution in other PSAs. The PSA team should discuss this issue in the documentation, and justify the omission of post-initiator plugging.

(PRIORITY: B)

ISSUE 1Л ST

Number: SA-WEV-30

Statement of Issue or Background Info

Control system trains in the fault trees are assumed to be symmetric. Also pump trains are assumed to be symmetric and identical in the system fault trees. However there is no identification that reviews have been carried out to verify these symmetric and identical assumptions. In some recent PSAs, trains which were thought to be symmetric were in fact highly nonsymmetric. More generally, reviews of systems need to be carried out to assume the fault tree assumptions are valid and the trees represent the as-built, current systems.

List Questions arising out of this Issue

What reviews have been carried out to validate the symmetric and identical train assumptions in the PSA? More generally, what reviews have been carried out to assure that the fault trees are valid and represent as-built, current systems?

Number : SA-WEV-30

The Response of PSA Team

No a prior assumption iä ever made on symmetry, are modeled exactly as they are.

Systems

Number: SA-WEV-30(MAS)

The PSA team has attempted to model each equipment train without making prior assumptions about symmetry.

Summary of Conclusions from Questions and Answers(List Conclusions)

Resolution of Issue(Conclusions and Recommendations)

The PSA team should be aware that discrepancies between the true plant design and the design indicated by plant documentation have caused risk-significant events. The accident sequence precursor (ASP) program is starting an investigation of such events; preliminary results suggest that traditional PSA methods do not consider such events. It is acceptable to base a PSA on existing plant documentation, supplemented with plant walkdowns, so long as a complete list of references is maintained.

(PRIORITY: A)