B13099, Forwards Rev 2 to Probabilistic Safety Study Update.Advises That Study Update Will Be Integral Part of Util Response to Generic Ltr 88-20.W/three Oversize Figures Encl
| ML20235K243 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 02/10/1989 |
| From: | Mroczka E, Sears C NORTHEAST NUCLEAR ENERGY CO., NORTHEAST UTILITIES |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| B13099, GL-88-20, NUDOCS 8902270041 | |
| Download: ML20235K243 (250) | |
Text
_ _ _ _ __-. _ _ - _ - _ . - _ _ _ _ _ _ _ _ - _ -
/d .% .
i N UTHJTIES o norai orfic.. . seiden street Beriin, connecticut I a'8' 8 a m"" P.O. BOX 270 HARTFORD, CONNECTICUT 06141-0270 -
k k J 'Us" " SE,s7c"o"
""'""""*"","., (203) 665-5000 February 10, 1989 Docket No. 50-245 B13099 I Re: Integrated Safety l' Assessment Program U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 Gentlemen:
Millstone Nuclear Power Station, Unit No. 1 Probabilistic Safety Study Vodate (Revision 2)
In a letter dated July 10,1985,(1) Northeast Nuclear Energy Company (NNECO) submitted to the NRC Staff a summary report of the Millstone Unit No. 1 Probabilistic Safety Study (PSS). This submittal described in detail the background of the PSS, and focused in part on the ongoing implementation of the Living Probabilistic Risk Assessment (PRA) program for Millstone Unit No.
-1. The major element of this Living PRA program is the development, maintenance and use of PRA models for assistance in evaluating potential plant J backfits and operating procedures modifications. The Living PRA program affords us' the flexibility to quickly and accurately analyze the impact on plant safety of changes to the plant's design configuration. As such, the Living PRA provides an important input to NNEC0's assessment of backfit project priorities as part of the Integrated Safety Assessment Program (ISAP). ,
The PRA models and methodology supporting the Living PRA program must be periodically updated to incorporate plant design changes, significant operational changes, and relevant updated equipment performance data. The firstgch update was forwarc'ed to the Staff in a letter dated February 11, 1987. The purpose of this letter is to forward the results of the second update to the PSS that was recently completed.
The revisic,ns to the PSS have resulted in a net calculated reduct{on in the core melt freguency (CMF) for Millstone Unit No.1 from 5.72 x 10' per year to 8.81 x 10~ per year for internal events, floods, and fires. Long term cooling changed from contributing approximately 64 percent of the total CMF to providing only 8 percent. This was due to additional analyses and refinements (1) J. F. Opeka letter to J. A. Zwolinski, " Millstone Unit No. 1 Probabilistic Safety Study - Results and Summary Report," dated July 10, 1985.
(2) E. J. Mroczka letter to the U.S. Nuclear Regul atory Commission, I "Probabilistic Safety Study Update," dated February 11, 1987.
ggg22gggggj@ggj45 gd gp l P PDC ,
}
U.S. Nuclear Regulatory Commission B13099/Page 2 February 10, 1989 that removed excessive conservatism in previous evaluations. The long term cooling success criteria now require only one low pressure coolant injection (LPCI) train (alternate shutdown cooling mode) where two were previously prescribed.
The contribution of Station Blackout has also been substantially reduced to less than 1 percent due to the installation of the electrical cross connection between Millstone Unit Nos. I and 2 and also the use of a refined time dependent analysis which credits recovery of the emergency diesel generator and the gas turbine. Attachment I to this letter describes the changes in more detail. Attachment 2 consists of the amended text pages. NNECO believes that the Millstone Unit No.1 PSS, as amended, provides an accurate analysis of the core melt frequency associated with operation of the plant as of November 1988.
In a letter dated November 23, 1988,(3) the NRC Staff forwarded to licensees Generic Letter 88-20, " Individual Plant Examination for Severe Accident Vulnerabilities." Therein, the NRC Staff acknowledged the important role of plant specific PRAs (such as the one for Millstone Unit No.1) in identifying and addressing plant specific vulnerabilities to severe accidents. This ongoing PSS update effort will clearly be an integral part of our response to Generic Letter 88-20.
We are hereby forwarding twenty (20) copies of the update for distribution within the NRC Staff.
If you have any questions, please contact us.
Very truly yours, NORTHEAST NUCLEAR ENERGY COMPANY
$ b, I %.
E. J. Mroczka N Senior Vice President By: C. F. Sears Vice President (3) D. M. Crutchfield letter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, " Individual Pl ant Examination for Severe Accident Vulnerabilities - 10CFR50.54(f)
(Generic Letter 88-20)," dated November 23, 1988.
\ . .__ _____-_ _
U.S. Nuclear Regulatory Commission B13099/Page 3 February 10, 1989 Attachment cc: W. T. Russell, Region I Administrator M. L. Boyle, NRC Project Manager, Millstone Unit No. 1 W. J. Raymond, Senior Resident Inspector, Millstone Unit Nos. 1, 2, and 3 J
- - _ _ - . - _ _. A
l Docket No. D E 1111 90.9.2
\
l Attachment No. 1 Millstone Nuclear Power Station, Unit No.1 Probabilistic Safety Study Update Description of Changes February 1989
Attachment 1 B13099/Page 1 Attachment No. 1 Millstone Nuclear Power Station, Unit No.1 Description of Revision 2 to PSS
- 1. General Description of Chanaes The revisions to the PSS have resulted in a net reduction jn the core melt frequency CMF for Millstone Unit No. I to 8.81 x 10~ oer year from 5.72 x 10,4 (per) year for internal events, floods, and fires. The dominant contributors to core melt are as follows:
Event Percent of Total CMF Fire (all locations) 29%
Reactor Transients 15%
Large LOCA 13%
Loss of Normal Power 11%
(Station Blackout alone <1%)
Loss of Vital AC 9%
Loss of Feedwater 8%
Inadequate Long Term Cooling 8%
Small LOCA 7%
This reduction in the CMF reflects the following changes which have been incorporated since Revision 1:
o The long term cooling success criteria were changed to require only l'LPCI heat exchanger train for several transients. Credit is taken for throttling of LPCI flow to maintain adequate NPSH as specified in the Emergency Operating Procedures.
o The Isolation Condenser was credited for small LOCAs and spurious opening of a S/R valve, o The improved Millstone Unit No.1 - Unit No. 2 AC Power Cross-Tie was credited, o The new cable vault and control room halon systems were credited.
o The initiating event frequencies were updated to reflect improved plant performance (fewer trips).
o The diesel and gas turbine generator failure rates were updated to reflect recent performance, o Several Human Error Probabilities values were corrected to a "best estimate" value.
o A time dependent station blackout analysis was performed which allows for the recovery of failed systems before the onset of core damage.
E _______ ----_.-_-------------- - - - - - - - - - . - - - - - - - - - - - - - _-
~
Attachment 1 BI3099/Page 2 II. Lona Term Coolina In Attachment 2 to Revision 1 of the Millstone Unit No. 1 PSS, dated February 11, 1987, NN Cooling System (ASDC)gwas reported one of that failurecontributors the major of the Alternate to theShutdown core melt frequency. The PSS at that time was based on the perceived need for both trains of the LPCI system, including the heat exchangers, to operate to limit torus water heatup during certain scenarios. This resulted in a high incidence of calculated ASDC unavailability and hence the significant contribution to the core melt frequency.
Since that time, substantial reanalyses have been conducted using the COMPACT computer code. For most scenarios it was determined that only 1 LPCI pump / heat exchanger combination is sufficient to adequately cool the torus. For the other scenarios, principally Loss of Normal Power and a Stuck Open Safety Relief Valve, having only 1 LPCI pump / heat exchanger combination is sufficient if water is added to the torus from the Condensate Storage Tank (CST) a number of hours into the accident. This increases the NPSH available to the LPCI pump and prevents pump cavitation. Accordingly, Revision 2 of the PSS, reflected in the attached changes, discusses water addition to the torus.
Subsequent to Revision 2, credit has been taken for test results that demonstrated a LPCI pump can operate for a number of hours with only 80 percent of required NPSH without being damaged. This is enough time for the heat removal via ASDC to exceed decay heat generation and begin cooling down the torus. Only a few very degraded, low probability scenarios remained where allowing limited LPCI pump cavitation would be insufficient and water would need to be added to the torus to assure adequate pump NPSH. These scenarios include the following multiple failures:
o One SRV inadvertently opens and fails to reclose o Isolation Condenser fails to operate o Main Condenser and shutdown cooling are not available o One ECCS train fails (i.e., loss of the gas turbine or emergency diesel generator) o Only one LPCI pump operates on the operating ECCS train Based on all of the above, NNEC0 does not intend to implement any procedure changes. Since there are only a few very degraded scenarios where there is a potential need for water transfer from the CST to the torus, this will be addressed by operator awareness and training, t (4) ASDC is a combination of systems / components and procedures used to shut down and cool down the reactor during abnormal operating situations.
ASDC primarily consists of the LPCI system operating in the containment cooling . mode with Emergency Service Water cooling the LPCI heat exchangers.
_ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1
~ '
Attachment l'
.B13099/Page 3 III. Station Blackout In NNEC0's letter dated February 11, 1987, transmitting Revision 1 to the-PSS, Loss of Normal Power (LNP) was the most prevalent initiator contributing - over 30 percent to the core melt frequency. Since that
. time, steps have been taken that reduce the contribution to core melt of an LNP to 11 percent (of that, less than 1 percent now is contributed by station blackout (SB0)). This reduction is due first to the installation of the AC electrical cross connection between Millstone Unit Nos. I and .
- 2. This allows the units to share emergency power if necessary. In i addition, new analyses have been used to evaluate SB0 that are time dependent and allow for the recovery of onsite and offsite power sources prior to the onset of core damage. These mathematical analyses are more I accurate and more realistic since they reflect the fact that if onsite - ,
power sources fail to start or. fail to run, they may be repaired within a reasonable period of time. Additionally, it removes 'the inherent assumption that a generator may be removed from service for maintenance following an LNP event. These analyses are possible since there are 'only three major pieces of equipment / functions involved. Limited variables limit the complexity. This is an accepted practice within the industry.
This information may be useful to the Staff in evaluating our upcoming submitte,1 regarding 10CFR50.63, " Loss of All Alternating Current Power,"
and in its ongoing evaluation of contemplated Mark I containment upgrades <
which include accelerated implementation of 10CFR50.63. I I
.. m.
,'<...'(.
e ' Docket No.'50-245 Ii ' '
M C
i' 1
': E ~
Attachment No. 2 Millstone Nuclear Power Station, Unit No.1
~
Probabilistic Safety. Study Update Revised'Pages January 1989 m
- i__i_____________._._. _ _ _ _ _ _ _ _ _ . . . . _ _ _ _ _ . _ _ _ _ . _ _ _ _ _ _ _ _ . . . . _ _ _ __ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _-
w -
, , n .
uer.m m uw m . w 4 % c=-.- ~.. -
4-4 -_.c ,_ ___ ._ . _ w a . . _ . . _ _ . . .__, . .
_... a _. _ .. _ _ _ _ _
s
.,'- m t<
- .. ;~ ,
~
RDOVE INSERT , IDCM' ION 7. .
4 i' thru li' (each volumne)' ~i thru 11 (each volumne) . TABI.E OF CNTENTS w
dl v (each'volumne):~
~
v (each volumne)' TABIE OF CNTENTS
- l ;
3 '1 J1.1-2 1.1-2 SECTICH 1.1.1 < j 1.1-14 thru 1.1-16 SECTICH 1.1.2 1.1-14 thru 1.1-16 _.
a
' 1.1-20 thru 1.1-22 1.1-20 thtu 1.1-22. SECTICH 1.1.3 l 1.2-6 thru 1.2-10. '1.2-6 thru 1.2-10 SECTICN 1.2.1' 1.2-28 thru 1.1-29 1.2-2f1 thru 1.2-29 SECTICN 1.2.3 ,
l
- 2.0-1 thru 2.0-4 2.0-1 thru 2.0-4 . SFETICH 2.0 j q
2.1-1 2.1-1 SECTION 2.1 ,
TABLE 2.1-1 TABI.E 2.1-1 ~ SECTICN 2.1 3 2.2-1 thru 2.2-3 2.2-1 thru 2.2-3 SECTICH 2.2 & 2.2.1 -
. _. I, 2.3 2.3-1: SECTICN 2.3 2.3-4 thtu 2.3-5 2.3-4 thtu 2.3-5 ' SECTICH 2.3 i
2.4-1 2.4-1 SECTICN 2.4 ' i!
-l 2.4-2 thru 2.4-8 ' 2.4-2 thru 2.4-8 SECTICH 2.4.1 i 2.4-10 thru 2.4-14 2.4-10 thru 2.4-14 SECTICH 2.4.1 i i
w 2.4-17 thtu 2.4-21 . - - - 2.4-17 __. _
_ ._. , SECTICN . 2. 4. 2, . _ _ .
. g. ; .. )
." FIGURE 2.4.2-1. ,. .- -
. _ SECTICH 2.4.2 ..
.l ,
. -~~
>-2.4-2') thru 2.4 -- ---- 2.4-23 thru 2.4-28 . - SECTION 2.4.3 - - --- .- ~ .- ~
j J
2.4-31 2.4-31 SECTION 2.4.4 -
J 2.4-36 thru 2.4 2.4-36 thru 2.4-38 SECTICN 2.4.5 _
2.4-41 thru 2.4-42 2.4-41 thru 2.4-42 SECTICH 2.4.6 z-- 4 2.4 2.4-44 > SECTICN 2.4.6 2.4-47 thru 2.4-48 2.4-47 thru 2.4 SECTICH 2.4.7 -
2.4-51 thru 2.4-52 2.4-51 thru 2.4-52a SECTICH 2.4.8 l 2.4-53 thru 2.4-57 2.4-53 thin 2.4-57 SECTION 2.4.9 FIGURE 2,4.9-1 SECTICN 2.4.9 -
- - FIGURE 2.4.9_1 .
2.4-59 2.4-59 SECTICN 2.4.10 2.4-62 thru 2.4-63 2.4-62 thru 2.4-63 SECTION 2.4.10 i
2.4-68 thru 2.4-70 2.4-68 thru 2.4-70 SECTICE 2.4.12 )
FIGURE 2.4.12-1 FIGURE 2.4.12-1 SECTICH 2.4.12 !
i 2.4-72 thru 2.4-74 2.4-72 thru 2.4-74 SECTICH 2.4.13 i
pm:qu ':;f. m. ?q--na'Qr' :7Q:::W .;';' /:W,2.~:i~2:*?"T&iQ'3DM., ,',;..a. ,;w. ,'.Q*T.m'K.v. ?,[ '
~ s .
m: a : m . ~. .
w .w .
o
_- ___ _ _... _ _ _ ~ . _ .
l (CCtEINUED)! _
L.~..__.,__.__ -
_ ~. .s w _.-__m -
__ - ,__.- .____._,___.a._
45 m , ,&
- 2;4-80 thru 2.4-81a 2.4-80 thru 2.'4-81a' SECTICN 2.4.14.
'2.4-83 thru 2.4-87 2.4-83 thru 2.4 SECTICN 2.4.15 FIGURE 2.4.15-1" HGURE 2.4.15 SECTICN 2.4.15 i f
' 2.5-l'thru.2.5-8 SECTICH 2.5 2A-4 2A-4' APPENDIX 2-A',
2A-6 thru 2A-7 '2A-6 thru 2A-7' APPENDIX 2-A 2A-19 thru 2A-21 2A-19 thru 2A-21 APPENDIX 2-A 2A-24 thru 2A-26 -2A-24 thru 2A-26 APPENDIX 2-A .
20-lE -
2C-1 APPENDIX 2-C 2C-3 thru 2C-4 - 2C-31 thru 2C-4. APPENDIX 2-C 2C-6 thru 2C-12 2C-6 thru 2C-12 APPENDIX 2-C 2C-18 thru 2C-20 2C-18 thru 2C-20a APPENDIX 2-C FIGURE 2.C.4.1 APPENDIX 2-C
- ~-
MGURE 2.C.4.1-2 APPENDIX 2-C'
~
.- FIGURE 2.C.4.1-3 APPENDIX-2-C' ~
I ' FIGURE '2.C.4.1-4 .. APPENDIX 2-C-FIGURE 2.C 4.1-5 APPENDIX 2-C' MGURE 2.C.4.1-6 APPENDIX 2-C.
FIGURE 2.C.4.1-7' APPENDIX 2-C FIGURE 2.C.4.1-8 APPENDIX 2-C -
FIGURE 2.C.4.1-9 APPENDIX 2-C FIGURE 2.C.4.1-10 APPENDIX 2-C M GURE 2.C.4.1-11 APPENDIX 2-C
' FIGURE 2.C.4.1-12 APPENDIX 2-C L._- .___# .
. FIGURE 2.C.4.1-13 m.r, w . APPENDIX 2-C ,._ .
. ._- ;_ _. FIGURE 2.C.4.1-14 APPENDIX 2-C. . . .,
~ 2C-21 thru ~2C-23 ~ 2C-21 thru 2C-23b - APPENDIX 2-C~-- ~ ~ ~ ~ -
FIGURE 2C.9A-- - - - APPENDIX 2-C- .- - - - -. - -
M GURE 2C.9B APPENDIX 2-C FIGURE 2C.9C ~~
APPENDIX 2-C-FIGURE 2C.9D APPENDIX.2-C
_ _. M GURE 2C.9E APPENDIX 2-C-FIGURE 2C.9F APPENDIX 2-C L 2C-30 2C-30 -
APPENDIX 2-C
'2C-33 2C-33 thru 2C-33b APPENDIX 2-C FIGURE 2C.9G APPCNDIX 2-C FIGURE 2C.9H APPENDIX 2-C FIGURE 2C.9I APPENDIX 2-C FIGURE 2C.!KT APPENDIX 2-C '
FIGURE 2C.9K APPENDIX 2-C .l FIGURE 2C.9L APPENDIX 2-C 3.1-2 thru 5. .-3 ~ - - - 3.1 thru 3.1 SECTION 3.1.1 -
3.1-5 thru 3.1-7 3.1-5 thru 3.1-7 SECTION 3.1.1 3.1-12 thru 3.1-13~"- 3.1-12 thru 3.1-13 -SECTION-3.1.2 -- -
3.1-lS 3.1-15 SECTICH 3.1.3 l 3.1-17 3.1-17 SECTION 3.1.4 l
, m .,,.m.- . ._ : ...n,--....,.-.,.,.,.,,v = . _ -
Q 3.g.. g,gg,, ,,-jpqp;
.. w . .
QE'S -J' , , * '
', l;lc,ii?g ,1 ,.
,~~ 9, ;4.J n. ,, ,' ;;p\ 3] f, f.t % .
- - .umuuu.e :uwuws.uua sw wouun e .
L m .x ' -(OCNEDKED) - ;
p,_-f _ . - ..._,.-,s___.~..,.- --. ~ ,-a
. _ _ _ -. a - a .. _ pl g -- - . . _. l
~ ~
3.1 3.1-18 SECTION 3.1.5 L3.1-21 3.1-21' SECTION 3^.1.5. ' 1,
~
3.2'-l 3.2 SECTION 3.2 3.2-2 thru 3.2-6 3.2-2 thru 3.2 SECTICH 3.2.1 ,
f 3.2-21 3.2-21' SECTION 3.2.2 i 3.2-23 thru 3.2-34 3.2-23 thru 3.2-34 SECTICH 3.2.2 -
-4 FIGURE 3.2.2-20 H GURE 3.2.2-20 SECTION 3.2.2 E GURE 3.2.2-211 ' FIGURE 3.2.2-21 SECTION 3.2.2 "
FIGURE.3.2.2-22 FIGURE 3.2.2-22 SECTION.3.2.2-
-3.2-97 thru 3.2-98. 3.2-97'thru 3.2-98 SECTION 3.2.7 .
- . 3.2-105 3.2-105 SECTION 3.2.8 p
3.2-113- . 3.2-113 SECTION.3.2.9 q
3.2-12s . 3.2-120 _ SECTION 3.2.10 ,
3.2-203- 3.2-203 SECTION 3.2.16- ].
- e
- 3.2-220 3.2-220 SECTICN 3.2.18 3.2-223 thru 3.2-224 3.2-223 thru 3.2-224 SECTION 3.2.18 FIGURE 3.2.18-10 FIGURE 3.2.18-10 SECTICN 3.2.18 FIGURE 3.2.18-11 FIGURE 3.2.18-11 SECTICN; 3.2.18 ;
3.2-301 thru 3.2-305. 3.2-301 thru 3.2-305 SECTICH 3.2.23
+ . . ; 3. 2- 310.. ..._- _ _ . , _ _,3.2-310 =___. __ _ __ SECTICN 3.2.23_ -- _ _. _,.,m
,1 i 3.2-311 thrd 3.2-313 ~~ " 3'.2-311 ~thru' 3.2-313ki -
SECTICH 3.2.24 ~- ^
~~~ - " " [
. r _ . FIGURE-3.2.24-2 " -
-FIGURE 3.2.24-2 : - - SECTION-3. 2.24- - .-- . -
't
' 3.2-317 thru 3.2-319 - 3.2-317 thru 3.2-319 SECTION 3.2.25 l FIGURE 3.2.25-9 HGURE 3.2.25-9 SECTION 3.2.25 E GURE 3.2.25-10 -
- -FIGURE 3.2.25-10 SECTION 3.2.25 .
3.2-328 thru 3.2-329 SECTION 3.2.26 FIGURE 3.2.26-1 SECTICH 3.2.26 - l H GURE 3.2.26-2. SECTION 3.2.26 FIGURE 3.2.26-3 SECTICN 3.2.26 FIGURE 3.2.26-4 SECTION 3.2.26 i
- . - FIGURE 3.2.26-5 SECTION 3.2.26 FIGURE 3.2.26-6 SECTICE 3.2.26 EGURE 3.2.26-7 SECTION 3.2.26 TABIE ~4!3.1--~ ~ - - ~SECTION 4.3
-. ^
TABEE 4.3.1 * - -
5.0-1 5.0-1 SECTION 5.0 5.2-1 thru 5.2-2 5.2-1 thru 5.2-2 SECTICH 5.2 5.3-1 thru 5.3-7 5.3-1 thtu 5.3-9 SECTICH 5.3 TABEE 5.3-5 TABLE 5.3-5 SECTION 5.3 WA.g' g.7., =.py- - - - - . . .,;----- - - - - - - - . . , . - - - - . r e -- ,.
- - n. ; , ty 7
',, ' ' ' ,. . n*> e' 'f;y y;'; . ; f. ', ' ', ' ,,
WrKnUN .ucuwUnuns run twmauvar 4 (CNfINUED) m . _ c . _._ _ . . . _ _ ._ . . . _ _ , _ _ _
l REMNE INSERT IOCATICN 1 l
~6.1-1 , .
6.1-1 _
SECTICH 6.1 ~
6.1-3 thru 6.1 6.1-3 thru 6.1-6 SECTICN 6.1
~
6.1-8 thru 6.1-15 6.1-8 thru 6.1-15a SE C ON 6.1.1 HGURE 6.1.1-2 HGURE 6.1.1-2 SECTICH 6.1.1
- 6.1-19 thru 6.1 6.1-19 thru 6.1-25 SECTION 6.1.2 HGURE 6.1.2-1~ H GURE 6.1.2-1 SECTICN 6.1.2 6.2-3 6.2-3 SE m ON 6.2 6.2-4 thru 6.2-7 -6.2-4 thru 6.2-7 S5CTICN 6.2.1-
'6.2-8 -
6.2-8 -
SECTION 6.2.2 6.2-9 thru 6.2-10 6.2-9 thru 6.2-10 SE C ON 6.2.3-
~ '
6.2-11 thru 6.2-14 _
6.2-11 thru 6.2-14 SECTION 6.2.4 6.2-16 -
- 6.2-16 SECTION 6.2'.5 6.2-17 thru 6.2-18 6.2-17 thru 6.2-18 SECCN 6.2.6 6.2-19 6.2-19 SECTICH 6.2.7 6.2-20 6.2-20 SENCH 6.2.8 6.2-21 thru 6.2-23 6.2-21 thru 6.2-23 SECTICH 6.2.9
- .. - : ..a- -
...:--. .. .: .--. - . - . . - .= . _ - - - ,.--.un. _ _ ,
-6.2 ~.- 6. 2-25 . . . - - . . .. SE.C. TICN 6.2.10 ._ - - - _ _ . . .
- SEMCN 6;2vil- '-"-
~
6.2-26 thru 6.2-2 7 - -~ ~ -6;2-26 thru- 6.2 -
6.2-28 thru 6.2-30 _ 6.2-28 thru 6.2-30 SECTICH 6.2.12 6.2-31 thru 6.2-33 6.2-31 thru 6.2-33 SECTICH 6.2.13 -
~
6.2-38 6.2-38 SECTICH 6.2.16 ,
6.2-39 6.2-39 SECTICH 6.2.17
- 6.2-40 thru 6.2-41 6.2-40 thru 6.2-41 SECTICH 6.2.18 - _.
6.2-42 _
6.2-42 SECTICH 6.2.19
' ~
~
--6.2-46~ ~ ~ ~ ~ 6.2-46 SECTICH 6.2.20 6.3-1 6.3-1 SE m ON 6.3
~. . .
6.'3-3 thru 6.3-6 SECTICN 6.3
~
~ 6. 3 -3 ~ thru' 6. 3-6 ' ~
TAKE 6.3-5 TABLE 6.3-5 SECTICH 6.3 cm .; : -..; . . . . ,;~ .-,7 , ~ ~ . .. - ~-
, ; c. y :__.n .;r n . ; , . - ; v~- = ~ ~~ y7 s .. - -
- p - . - < , ~. .
- x. ,
. - ~ _ - _ - - _ _ _ _ ._ _ _ . _ _ _ _ _ _ . . _ _ _ . . _ . _ _ _ _ _ _ _ _ _ , _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ , _
SECTION- TITLE PAGE VOLUME 1' O-
.1.0. DETERMINATION OF INITIATING EVENTS 1.0-1 1.1 SYSTEMS INVESTIGATIONS 1.1-1
- 1.1 Consideration of Potential Transient Initiators 1.1-1 1.1.2 Consideration of System Dependencies and Systems Interaction Events 1.1-10 1.1 3. Consideration of Potential LOCAs 1.1-17:
1.1.4 Consideration of Potential Intersystem LOCAs 1'1-23 1.1.5- Summary 1.1-35' 1.2 INITIATOR FREQUENCY CALCULATIONS 1.2-1 1.2.1 . Frequency of Anticipated Transients 1.2-2 1.2.2 Frequency of Systems Interaction Initiating Events 1.2-11 1.2 3 Frequency of Potential LOCAs 1.2-28' 1.2.4. Frequency of Potential Intersystem LOCAs . 1.2-30 2.0 INTERNAL ACCIDENT SEQUENCL MODELING 2.0-1 2.1 SUCCESS CRITERIA 2.1-1 2.2 PLANT DAMAGE LEVEL CLASSIFICATION 2.2-1 2.2.1 Definition of Plant Damage Level 2.2-1 2.3 PLANT SUPPORT SYSTEM EVENT TREES 2 3-1 2.4 EVENT TREE MODEL 2.4-1 2.4.1 Loss of Normal Power 2.4-2 l 2.4.2 Deleted 2.4-17 2.4 3 Reactor Transient 2.4-23 AMUDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY 1' ,
. _ _ _ _ _ _ _ _ _ _ . - _ - - 1
SECTION TITLE PAGE 2.4.4 Loss of Feedwater '2.4-30 O
\ "
2.4.5 , Loss of Service Water 2.4-35
-2.4.6 Loss of Reactor Building Closed Cooling Water R.B.C.C.W. 2.4-40 2.4 7 Loss of T.B.S.C.C.W. 2.4-46
'2.4.8 Classification of LOCA Events 2.4-51 2.4 9- Small Small Break LOCA 2.4-53 2.4.10 Small Break LOCA 2.4-59 2.4.11 Large Break LOCA 2.4-65 2.4.12 Inadvertent Opening of Safety Relief Valve.(IORV) 2.4-68
-2.4.13 ATWS With Main Condenser Operating (A'IWS-1) 2.4-72 2.4.14 ATWS With Main Condenser Isolated (A'lWS-2) 2.4-77' l 2.5 Station Blackout Analysis 2.5-1 O
U 1
O AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY SHIDY
+
r SECTION TITLE PAGE. '
g VOLUME 4 f 3 2.21 Recirculation Pump Trip System 3 2-294 I 3.2.22 Standby Liquid Control System 3 2-296 3 2.23 Shutdown' Cooling System ~ 3 2-300 3.2.24 Alternate Shutdown Cooling / Containment Cooling -3 2-311 3 2.25 ' Emergency Service Water System 3 2-316 l 3 2.26 MP2 AC Cross-tie 3 2-328 4.0 HUMAN RELIABILITY ANALYSIS 4.0-1
4.1 INTRODUCTION
4.1-1 4.2 METHODOLOGY 4.2-1 4.3 TABULATION OF IMPORTANT OPERATOR ACTIONS 4 3-1 h.
5.0 MODELhUANTIFICATIONANDRESULTS .5.0-1 5.1 METHOD OF QUANTIFICATION 5.1 -'1 5.2 SUPPORT STATE QUANTIFICATIONS' 5.2-1 53 SYSTEM EVENT TREE QUANTIFICATION RESULTS 5.3-1 6.0-1 6.0 ACCIDENTS CAUSED BY FIRE 6.1-1 6.1 FIRE EVENT TREE MODEL 6.1-7 6.1.1 Control Room 6.1-18 6 P Cable Vault 6.1-30 )
6.1.3 Mezzanine
, '4 Feedwater Area 6.1-35 !
O ,
AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
E SECTION TITLE PAGE l: I i'
VOLUME 1
-f-
1.0. DETERMINATION OF INITIATING EVENTS 1.0 !
-1.1 SYSTDIS INVESTIGATIONS 1.1-1
, L1.1.1 Consideration of Potential Transient Initiators 1.1-1 1.1.2 Consideration of System Dependencies and Systems Interaction Events 1.1-10 1.1 3 Consideration of Potential LOCAs 1.1-17 1.1.4 -. Consideration of Potential Intersystem LOCAs- 1.1-23 1.1.5 Summary '1.1-35 1.2 INITIATOR FREQUENCY CALCULATIONS' 1.2-1 1.2.1 Frequency of Anticipated Transients -1.2-2 1.2.2 Frequency of Systems Interaction Initiating Events 1.2-11 1.2 3 Frequency of Potential LOCAs 1.2-28 1.2.4 Frequency of Potential Intersystem LOCAs 1.2-30 2.0 INTERNAL ACCIDENT SEQUENCE MODELING 2.0-1 2.1 SUCCESS CRITERIA 2.1 2.2 PLANT DAMAGE LEVEL CLASSIFICATION 2.2 2.2.1 Definition of Plant Damage Level 2.2-1 23 PLANT SUPPORT SYSTEM EVENT TREES 2 3-1 2.4 EVENT TREE MODEL 2.4-1 2.4.1 Loss of Normal Power 2.4-2 l 2.4.2 Deleted 2.4-17 2.4.3 Reactor Transient 2.4-23
/MENDMENT 2' MILLSTONE UNIT 1 PROBABILISTIC SAFETY S1UDY l
_, - _ _ _ _ _ _ _ _ _ _ = _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ ,
SECTION TITLE PAGE 2.4.4 Loss of Feedwater 2.4-30 '
2.4.5 Loss of. Service Water 2.4-35' 2.4.6 Loss of Reactor Building Closed Cooling Water R.B.C.C.W. 2.4-40 2.4.7 Loss of T.B.S.C.C.W. 2.4-46 2.4.8 Classification of LOCA Events 2.4-51 2.4 9 Small Small Break LOCA 2.4-53
-2.4.10 Small Break LOCA 2.4-59 2.4.11 Large Break LOCA 2.4-65 2.4.12 Inadvertent Opening of Safety Relief Valve (IORV) 2.4-68 2.4.13 A7W5 'sith Main Condenser Operating (A7WS-1) 2.4-72 2.4.14 ATiit 3291 Main Condenser Isolated (ATWS-2) 2.4-77 l 2.5 Station Blackout Analysis 2.5-1 A-V t
O mammT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
i SECTION TITLE -PAGE f3 TJ VOLUME 4 3 2.21 Recirculation Pump Trip System 3 2-294 3.2.22 Standby Liquid Control System >
3 2-296 3.2.23- Shutdown Cooling System 3 2-300--
3 2.24 Alternate Shutdown Cooling / Containment Cooling- 3.2-311 3 2.25 Emergency Service Water System 13 2-316-l 3.2.26 - MP2 AC Cross-tie 3 2-328' 4.0 HUMAN RELIABILITY ANALYSIS: 4.0-1 4.1- INTRCOUCTION 4.1-1' 4.2 METHODOLOGY 4.2-1 4.3 TABULATION OF IMPORTANT OPERATOR ACTIONS 4.3 5.0 MODEL QUANTIFICATION AND RESULTS 5.0 5.1 METHOD OF QUANTIFICATION 5.1-1 52 SUPPORT STATE QUANTIFICATIONS 5.2-1 o
5.3 SYSTEM EVENT TREE QUANTIFICATION RESULTS' 5 3-1 ;
6.0-1 6.0 ACCIDENTS CAUSED BY FIRE 6.1-1 6.1 FIRE EVENT TREE MODEL control Room 6.1 -7 6.1.1 Cable Vault 6.1-18 6.1.2 l 6 .1. ' Mezzanine 6.1-30 l 6.1.4 Feedwater Area 6.1-35 1
AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ - _ _ _ _ _ -. _ _ _ _ _ .- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __________________a
SECTION TITLE PAGE VOLUME 1-h.
U '1.0 DETERMINATION OF INITIATING EVENTS 1.0-1 1.1 SYSTEMS INVESTIGATIONS- 1.1-1 1.1.1 Consideration of. Potential Transient Initiators 1.1-1 1.1.2 Consideration'of System Dependencies and Systems Interaction Events. 1.1-10 1.1 3 Consideration of Potential LOCAs 1.1-17
-1.1.4 Consideration of Potential Intersysten LOCAs 1.1-23
'1.1.5- Summary 1.1-35 1.2 INITIATOR FREQUENCY CALCULATIONS 1.2-1 1.2.1 Frequency of Anticipated Transients 1.2-2 1.2.2 Frequency of Systems Interaction Initiating Events 1.2-11 1.2.3 Frequency of Potential.LOCAs .1.2-28 Q
V 1.2.4 Frequency of Potential Intersystem LOCAs , 1.2-30 2.0 INTERNAL ACCIDENT SEQUENCE MODELING 2.0-1 2.1 SUCCESS CRITERIA 2.1-1 2.2 PLANT DAMAGE LEVEL CLASSIFICATION 2.2-1 I
2.2.1 Definition of Plant Damage Level 2.2-1 23 PLANT SUPPORT SYSTEM EVENT TREES 2 3-1 2.4 EVENT TREE MODEL 2.4-1 )
l 2.4.1 Loss of Normal Power 2.4-2 '
l 2.4.2 Deleted 2.4-17 Q 2.4 3 Reactor Transient 2.4-23 3
--2 M1ttSTONE UN1T i PROBABILISTIC SAFETY STUDY
- - _ . l
SECTION- TITLE PAGE 2.4.4 Loss of.Feedwater.' 2.4 D '2.4.5 Loss of Service Water 2.4-35 2.4.6' Loss of Reactor Building Closed Cooling Water R.B.C.C.W.- 2.4-40=
2.4.7 Loss of T.B.S.C.C.W. 2.4-46
'2.4.8 Classification of LOCA Events 2.4-51 2.4 9 Small Small Break LOCA 2.4-53 2.4.10 Small Break LOCA 2.4 2.4.11 Large Break LOCA 2.4-65 2.4.12 Inadvertent Opening of Safety Relief Valve (IORV) 2.4-68 2.4.13 A1WS With Main Condenser Operating (A7WS-1) -2.4-72 2.4.14 A7WS With Main Condenser Isolated (A7WS-2) 2.4-77 l 2.5 Station Blackout Analysis 2.5-1 O
O AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
SECTION- -TITLE PAGE,
~O V. VOLUME 4 3 2.21 Recirculation Pump Trip System 3 2-294-3.2.22 Standby Liquid control System 3 2-296 3 2.23 Shutdown Cooling System 3 2-300 3.2.24 Alternate Shutdown Cooling / Containment Cooling 3 2-311 3 2.25 Emergency Servico Water System 3 2-316 l 3 2.26 MP2 AC Cross-tie -3 2-328 4.0 HUMAN RELIABILITY ANALYSIS 4.0-1
4.1 INTRODUCTION
- 4.1-1 4.2 METHODOLOGY 4.2-1 4.3 TABULATION OF IMPORTANT OPEliATOP, ACTIONS 4.3-1 O
5.0 MODEL QUANTIFICATION AND RESULTS 5.0-1 5.1 METHOD OF QUANTIFICATION 5.1-1 5.2 SUPPORT STATE QUANTIFICATIONS 5.2-1 i
53 SYSTEM EVENT TREE QUANTIFICATION RESULTS 5.3-1 i 1
6.0 ACCIDENTS CAUSED BY FIRE 6.0-1 1
6.1-1 6.1 FIRE EVENT TREE MODEL 6.1.1 Control Room 6.1-7 Cable Vault 6.1-18 6.1.2 6.1.3 Mezzanine 6.1-30 6.1.4 Feedwater Area 6.1-35 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
h SECTION TITLE PAGE" VOLUME 1 L$O'- -
. T .0 DETERMINATION OF INITIATING EVENTS' -1.0-1 q
1.1' SYSTEMS INVESTIGATIONS '1.1-1 1 .
1.1.1 Consideration of Potential Transient Initiators 1.1-1
.1.1.2 Consideration of System Dependencies and Systems Interaction Events' 1.1-10
'1.1 3 Consideration of Potential LOCAs '1.1-17 1.1.4 Consideration of Potential Intersystem LOCAs '1.1-23 1.1.5 : Stamary 1.1 1.2 INITIATOR FREQUENCY CALCULATIONS 1.2-1 1.2.1~ Frequency of Anticipated Transients' 1.2-2 1.2.2 Frequency of Systems Interaction Initiating Events' 1.2-11 1.2 3 Frequency of Potential LOCAs 1.2-28 1.2.4- Frequency of Potential Intersystem LOCAs , 1.2-30 2.0 INTERNAL ACCIDENT SEQUENCE MODELING '2.0-1 2.1 ' SUCCESS CRITERIA 2.1-1 2.2 PLANT DAMAGE LEVEL C' OSSIFICATION 2.2-1 2.2.1 Definition of Plant Damage Level 2.2-1 2.3 PLANT SUPPORT SYSTEM EVENT TREES 2.3-1 2.4 EVENT TREE MODEL 2.4-1 2.4.1 Loss of Normal Power 2.4-2 l 2.4.2 Deleted 2.4-17 2.4.3 Reactor Transient 2.4-23 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY i
( _ __
[.
L
- t. SECTION TITLE PAGE 2.4.4 Loss of Feedwater= 2.4-30
.. 2.4 5 Loss of. Service Water 2.4-35 2.4.6~ Loss of Reactor Building Closed Cooling Water R.B.C.C.W. '2.4-40 2.4 7 Loss of T.B.S.C.C.W. 2.4-46 2.4.8 Classification of LOCA Events 2.4-51 f 2.4.9 Small Small Break LOCA 2.4-53 .
2.4.10 Small Break LOCA 2.4-59 2.4.11 1 Large Break LOCA 2.4-65 1 2.4.12. Inadvertent Opening of Safety Relief Valve (IORV) 2.4-68 2.4.13 A1WS With Main Condenser Operating (A'IWS-1) '2.4-72 2.4.14 A'lWS With Main Condenser Isolated (ATWS-2) '2.4-77
' l - 2.5 Station Blackout Analysis 2.5-1 0
g tM%
i O ,
mmm2 MILISTONE UNIT 1 PROBABILISTIC SAFETY STUDY
r . ..
p, . , 4 e, , .
i
~. SECTIONf TITLE PAGE. ..
c f
. VOLUME 4 3 2.21 Recirculation Pump Trip System 3 2-294:
3.2.22 Standby Liquid-Control-Systen 3 2-2% -
3.2.23 Shutdown Cooling System 3.2-300 3.2.24 . Alternate Shutdown Cooling / Containment Cooling 3.2-311 3 2.25. Emergency Service Water System 3.2-316 l '3.2.26 MP2 AC Cross-tie 3 2-328-
.4.0 HUMAN RELIABILITY ANALYSIS 4.0-1 l
4.1 INTRODUCTION
4.1-1 4.2 METHODOLOGY 4.2-1 4.3 . TABULATION'0F IMPORTANT OPERATOR ACTIONS 4.3-1 5.0 MODEL QUANTIFICATION AND RESULTS 5.0-1 5.1 METHOD OF QUANTIFICATION 5.1-1 5.2 SUPPORT STATE QUANTIFICATIONS 5.2-1 53 SYSTEM EVENT TREE QUANTIFICATION RESULTS 5 3-1 6.0-1 6.0 ACCIDEtn'S CAUSED BY FIRE 6.1-1 6.1 FIRE EVENT TREE MODEL Control Room 6.1 -7 6.1.1 Cable Vault 6.1-18 6.1.2 6.1.3 Mezzanine 6.1-30
. 6.1.4 Feedwater Area 6.1-35 AMENDMENT 2 MILLSTONE UNIT 1
> PROBABILISTIC SAFETY STUDY
' Reactor Transients (Power Conversion System Available)
N '
'A', basic characteristic 'of. this category of events' is that Reactor Protection System trip limits are exceeded. Mitigation .'of : such events requires the following actions:
n o Reactor Protection System trip (to promptly reduce the generation .
of heat in the reactor core) o Turbine Bypass System and Main Condenser (to control- reactor pressure and prevent the opening of the Safety / Relief O 2,.z, and to remove decay heat) o Operation-of the Feedwater system (to provide reactor _ makeup)
An important characteristic of these events is that they do not necessitate use of the Shutdown Cooling System. Many of these events result- in a decision to return to full power operation within a short period of time. '
Should it be detennined that it is desireable to proceed to cold shutdown the preferred method is to use the Main Condenser. Modifications made at the plant allow cold shutdown to be achieved by using the auxiliary boiler for turbine gland sealing. Using this approach .the Shutdown Cooling System will only be used if it is necessary .to take the Main Condenser out of l.
service or to remove the reactor pressure vessel head.
In the event of the failure of these basic mitigating systems additional mitigating systems may be manually or ' automatically started - to provide decay heat removal and containment cooling. The operation of these systems is described in detail in the Event Tree Analysis in Section 2.0.
Based on a systematic review of potential anticipated transients the events listed in Table 1.1.1-1 were found to involve Reactor Transients with the Power Conversion System available.
v
- O .
1.1-2 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
I-R.B.C.C.W. ' w:ttr es a h:st sink. Thus in stamary tha Loss . of R.B.C.C.W.
Event'results in the following:
o High Drywell Temperature / Pressure Condition if o Automatic Reactor Trip o E.C.C.S. Actuation-o Loss lof the Shutdown Cooling. System Partial or Total Loss of 125V Station DC_ Power was investigated and it was determined that while numerous mitigating systens could be-disabled by loss-of DC, there are no transient events initiated by. loss of such buses. On the other hand, restoration of DC will result in a trip' of one or more f
' Recirculation pumps.-
Loss of 120V Vital AC Power results in a loss of the following:
o Loss of Automatic Feedwater Flow Control o Turbine Trip (with Condenser Available o Loss of Recirculation Flow Control (Flow Decreasing)
Loss of Control Rod Position Indication q o V o Locs of Reactor Power Indication o Loss of the Plant Computer o RPV level and pressure indication on Main Control Board failing low o Loss of High Level Feedwater Trip Although no automatic reactor trip will occur following a loss of vital AC, the operator is expected to trip the reactor based on control boarti indications. This event was considered to be a special initiator and. is modeled in a separate event tree. (See Section 2.4.15.)
Ioss of 120V Instnment AC Power results in a loss of a number of control board instruments, loss of both Emergency Service Water (E.S.W.) pressure regulating valves (which would prevent use of E.S.W.). Main Steam Isolation Valve trip logic would be half tripped but would require the In additional failure of a D.C. Bus in order to cause M.S.I.V. closure.
4 1.1-14 2 MILLSTONE UNIT 1 PROBABILISTIC , SAFETY SWDY
c_ - _ _ _
]
'I summary, ths loss ' of' 120V Instrument AC Powsr 'will ~ result in a number of :
instrument!s being failed low but no transients will be initiated. ]
(9 . ' Ims of Station Air will result directly in reactor trip via depressurizing Cl = i the scram pilot air header, simultaneously- the depressurization of the air supply to the feedwater regulating valves will result in the valves locking-up as is. This will result ' in 'either. a long term increase in reactor vessel water level (resulting in protective trip of the feedwater pumps) or a long term decrease in reactor vessel water level. In' either case this transient is bounded by. events already considered . in Section 1.1.1.
Table 1.1.2-1 summarizes the results of the initiating events which are related to plant specific dependencies and interdependencies. These events were added to the list of initiating events discussed in Section 1.1.1.
O (J
1.1-15 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
~l i
i TABLE 1.1.2-1 1..
- SYSTEMS INTERACTION EVENTS o has of Service Water Turbine Trip (Condenser Available) i Total Loss of Feedwater I Reactor Trip j Total Loss of C.R.D. Flow /
High Drywell Temperature / Pressure E.C.C.S. Actuation Loss of Shutdown Cooling 1
o Loss of T.B.S.C.C.W.
Total Loss of Feedwater Reactor Trip
. Total Loss of C.R.D. Flow o h as of R.B.C.C.W.
High Drywell Temperature / Pressure Reactor Trip E.C.C.S. Actuation Loss of Shutdown Cooling o Mss of 120V Vital AC Power Partial or Total Loss of Feedwater Reactor Trip Turbine Trip (condenser Available)
Loss of Recirculation Flow Control (Decreasing)
Loss of Control Rod Position Indication Loss of Reactor Power Indication Loss of Plant Computer bss of High Level Feedwater Trip
(
O 1.1-16 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY L---___-_--___-______._____._ _. ._
o M"nu:1 D:pr ssurizstion using at least 2/6 S:faty/ Relict Velv;s (to depressurize the reactor and reduce the break flow) !
s i
! ) l o Operation of 1/2 Core Spray or 1/4 L.P.C.I. pumps (to provide I
long term reactor makeup) o Long term operation of both Emergency Service Water (E.S.W.)
pumps and one L.P.C.I. pump per containment cooling loop in the (
Torus Cooling Mode for containment heat removal.
l In the event that the Feedwater System becomes unavailable, Manual I Depressurization or operation of the S/R valves in the A.D.S. . mode is required in a shorter time period. l
{
i The key differences between this break category and the sinall small LOCA category is that both the Main Condenser and Shutdown Cooling System will be unavailable. The Main Condenser will be unavailable due to the closure i' of the M.S.I.V.s. The Shutdown Cooling System is generally assumed to be O unavailable due to the fact that the reactor water level may not be
\ ")
1 recoverable up to the level required for shutdown cooling. l Inadvertent Operation of a Safety / Relief Valve )
1 The inadvertent operation of a Safety / Relief (S/R) Valve results in a steam j
mass loss equivalent to the range considered in the small LOCA . Plant response to this transient differs from the small LOCA due to the discharge of steam directly to the torus. This prevents the pressurization of the '
drywell which is typical of pipe breaks. Because there is no pressurization of the drywell no automatic reactor trip of ECCS actuation '
will occur., This necessitates operator action to detect the event and initiate imitigating actions. Mitigation is accomplished using the following systems:
A 1.1-20 AMENDMENT 2 MILLSTONE UNIT 1 i
PROBABILISTIC SAFETY STUDY
o R: actor Protection System and Rractor Recirculation Flow Control-System to manually shutdown the reactor (to reduce generation of
./~T. heat in the reactor core).
- u-.
s o Turbine Bypass System and Main Condenser (to depressurize the reactor, reduce S/R valve flow to the torus and remove decay heat).
o Main Feedwater System (to supply reactor makeup).
Large LOCA
' The Large LOCA category encompasses all liquid and steam region breaks larger than 0.2 sq.ft. For breaks in this regio $ the ability of the Feedwater system to provide reactor makeup is not credited as the Feedwater system may trip due to low pressure. Breaks in this range (particularly. in the steam region) are sufficient to cause prompt closure of the M.S.I.V.s and depressurize the reactor without any additional manual or automatic d(N actions. Similar to the Small LOCA category described previously, Shutdown Cooling or Alternate Shutdown Cooling can not be credited because the reactor vessel water level will be insufficient for entry to these modes.
Hitigation of liquid and steam region breaks in' this category is accomplished using the following systems shown below:
o Reactor Protection System trip (to promptly reduce the generation of heat in the reactor core) o Condensation of steam in the Torus by proper long term operation of the Torus to Drywell Vacuum Breaker Valves (to control containment pressure) o Actuation of the E.C.C.S. logic
[
L 1.1-21 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY S'IUDY
- o. Injection from 1/2 Core Spray or -1/4 L.P.C.I. pumps (to provida-short term reactor makeup)
- o. Operation of 2/2 E.S.W. ptanps and - at least 1 L.P.C.I. pump. in -
l eachI containment cooling- loop. in the i Torus Cooling Mode - (to l l. '
provide long tern containment heat removal)
J,i l
').
O ,
- O 1.1-22 Mme 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
'(
l TABLE 1.2.1-1 f%(,f DTIMA*IID FREQUENCY OF ANTICIPATED INITIATING EVENTS AT Mill 37011E UNIT 1-
)
Prior Millstone Unit 1 Updated Event Description Mean- Var. Events Years Mean Var. i Electric Load 2< ejection 0.55 0.723 4 14.75 0.285 0.018
- Electr'ic Load Rej. with TBV Failure 0.0156 0.015 0 14.75 0.0009 0.00006 Turbine Trip 0.672 1.621 9 14 75 0.612 0.040
[ Turbine Trip with TBV Failure 0.0156 0.015 0 14.75 0.0009 0.00006 Total Closure of All MSIVs (1) 0.219 0 300 7 14.75 0.473- 0.031 Loss of Normal Condenser Vacuum 0 344 0.388 0 14.75 0.019 0.001 i Pressure Regulator Fails Open 0.156 0.293 2 10 0.198 0.019
- Pre.ssure Regulator
'\ Fails Closed 0.172 0 304 0 14 75 0.006 0.0004 TBV Fails Open 0.047 0.045 1 14.75 0.066 0.004 TBV/TCV Fails Closed 0 328- 0.415 0 14.75 0.017 0.001 Recire. Flow Control Fails l Increasing Flow 0.188 0.282 0 14.75 0.008 0.0005 Decreasing Flow 0.063 0.060 0 14.75 0.004 0.0002 i
l A
U Agamm 2 1.24 MILLSTONE bNIT 1 PROBABILISTIC SAFETY STUDY
T:ble 1.2.1-1 (Contd.)
Single RCP Trip 0.063 0.060 4 14.75 0.257 0.016 All RCPs Trip 0.000 0.000 1 14.75 0.068 0.005 l RCP Seizure 0.000 0.000 0 14.75 0.000 0.000 Feedwater Flow Increase 0.172 0.208 5 14.75 0 33 0.021 l Loss of FW Heater 0.047 0.045 0 14.75 0.003 0.0002
]
Total Loss of FW 0.125 0.111 1 14.75 0.072 0.004 Loss of FW/Cond. Pump 0.078 0.073 2 14.75 0.132 0.008 FV Flow Decrease 0.406 0.403, 7 14.75 0.470 0.03 Rod Withdrawal 0.031 0.031 0 14.75 0.002 0.0001 Inadvertent Rod Insert- 0.094 0.086 0 14.75 0.006 0.0004 RPS Instrument Fault 0.078 0.105 0 14.75 0.004 0.0002 )
l Plant Occurrence Scram 0.281 0 300 6 14.75 0.4 0.025 RPS Spurious Instr. Trip 0 938 0 790 18 14.75 1.2 0.075 Manual Scram 0 781 1.825 1 14.75 0.088 0.006 I
(1) Due to high steam flow setpoints (120%) for main steam isolation, closure of one MSIV or partial closure of one or more MSIVs will j result in closure of all MSIVs.
Derived from EPRI NP 2230 data and with the first 2 years data eliminated for each individual plant.
v M MmT2 l' M MILLSTONE UNIT 1
{ PROBABILISTIC SAFETY STUDY
,I .
TABLE:1.2.1-2 ESTIMAT@ FREQUENCY OF IDSS OF OFFSITE POWER EVENTS AT MIL 1 STONE UNIT 1 P'i - Posterior Event Description Mean Var. Events Years Mean- %
Loss of Offsite Power 0.154 0.00689 1 17 0.113. 0.003 O
)
i ,
O AMENDMENT 2 1.2-8 PROBABILISTIC SAFETY STUDY
5 TABLE 1.2.1-3 l
(3) ETIMATE FREQUENCY OF OCCURRENCE OF ANTICIPATED INITIATUR CATEORIES AT MILLSTONE UNIT 1 !
Mean a
Event Category Freauency Variance Reactor Transients (Power Conversion System Available) o Turbine Trip 24.89%
o Feedwater Flow Control l Failure (Decreasing) 19 11%
o Feedwater Flow Control Failure (Increasing) 13.41%
o Electric Load Rejection 11.59%
o Recire. Pump Trip 10.45% i o Pressure Regulator Failure (0 pen) 8.05%
o Feedwater/ Condensate Pump Trip 5 37%
o All Recire. Pumps Trip 2.76%
N, o Turbine Bypass Valves Fail Open 2.68%
2.46/yr 0.161 I
O
~
AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
L Reactor Transients (Power Conversion Systen Unavailable)
-} o Total MSIV Closure' 95.75%
' {O o Loss of Normal Condenser Vacuum 3.85%
0.494/yr 0.032 Reactor Trip Events (Power Conversion Syst e Available) o Spurious Trip Due to l RPS Instrumentation 71.01%
o Scram Due to Plant Occurrences 23.67%
o Manual Scram 5 21%
1.69/yr 0.106 i
Inss of Feedwater 0.072/yr 0.004 loss of Offsite Power
. 0.113/yr 0.003 Based on an Assurred Gamma Distribution
.r AMENDMENT 2
.-0 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY j l
1.2.3 Frequency of Potential LOCA Events The frequencies of . Large, Small, and Small' Small Loss of Coolant Accidents V (LOCAs) were assessed based on a review of other current BWR P engineering judgement. The frequency of Inadvertent Opening of a Safety / Relief Valve event was assessed based on a review of prior information from EPRI and recent experience from all BWRs using the newer two-stage target rock S/R valves. Table 1.2.3-1 summarizes the LOCA frequencies assumed for Millstone Unit 1.
O 4
O 1.2-28 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY S11JDY
TABLE'1.2 3-1 ESTIMATED FREQUENCY OF POTENTIAL LOCA EVENTS V AT MILLSTONE UNIT 1 Mean Freauency' Event Tvoe'.
Large LOCA. 1.00 E-4/yr.
Small LOCA 1.00 E-3/yr.
Small Small LOCA 1.00 E-2/yr.
Inadvertent Opening of a 1.22 E-2/yr.
' Safety / Relief Valve l
l :
O (
1.2-29 l nizam 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY f
- - - - i
2.0 INTERNAL ACCIDENT SEQUENCE M(DELING
,m. Section 2 describes the modeling approach utilized to determine the accident i !
event sequences associated with internal initiating events that could lead to '
core melt. A full range of internal initiating events were considered in the internal initiators Section 1.0. By similar plant response and effect, were reduced to a set of representative initiating event groups. Event tree and fault tree methodology were used in the analysis of these initiating events (except for the station AC Blackout Analysis which is described in Section 2.5). The approach used is consistent with the approach described in 2.0, NUREG-2300, PRA Procedures Guide. The information provided in Section details the various aspects of the MP1 event tree analysis, which are as follows:
- 1. Construction of the event tree models,
- 2. Success Criteria, 3 Plant damage states,
- 4. Support systems analysis, and
- 5. Event tree modeling assumptions.
I,,i O
Event Tree Model Construction The construction of the event tree models involved the development of system event trees that identify the various mitigating systems required to respond to each initiating event. In addition to the event tree models, two other models These were developed to aid in the analysis of internal accident sequences.
models, the supporting systems model Section 2.3 and the consequential antipicated transient without scram model Sections 2.4.13, and 2.4.14 were used The selection and ordering of in conjunction with the individual event trees.
l the event tree mitigating systems is based on an extensive review of the Millstone Unit 1 Emergency Operating Procedures and Offhormal Procedures (EOPs and ONPs), system descriptions, and the Millstone Unit 1 Final Safety Analysis Report. The iraportant EOPs and ONPs used in the event tree construction are b attached as Appendix 2-B. The event tree construction also required identifying the operator actions required to mitigate the internal initiating events. These cognitive operator actions are modeled explicitly in the event O
AMENDMENT 2 2.0-1 HILLSTONE UNIT 1 PROBABILISTIC SAFETY SHlDY
trse models and are based on ths E0Ps and ONPs. The human reliability analysis is discussed in Section 4.0.
I C The event trees also explicitly model restoration of the systems both from the control room and from outside of the control room. The restoration outside the control room is credited only if the area (where manual actf on is needed) is accessible and sufficient time is available for the operator to carry out the restoration. To ensure that the plant equipment operators (PEOs) will be available . to perform the manual actions, only one restoration at a time is l
considered outside the control room. The restoration efforts were limited to manual starting of pumps or opening valves, etc. No' equipment r.epairs were considered. The event tree models developed to analyze the internal accident The system sequences are presented in Sections 2.4.1 through 2.4.14 unavailabilities used to evaluate the event trees are presented in Appendix 2-A. These unavailabilities are compiled from the results of the fault tree analyses presented in Section 3.0. The unavailabilities are provided in tabular form for all support states. The purpose of this appendix 'is to provide all raw data used in the event tree quantification in a concise form
'for ease of reference.
(
Success Criteria Once the plant system event trees have been developed, success criteria for each event tree syctem or operator action must be defined. The system success criteria are translated into statements defining the criteria for system failures which ultimately become the top level events in the development of system fault trees. The" success criteria also are used in calculating the human error probabilities (HEPs) for operator actions. The system success criteria, presented in Section 2.1 are intended to be as realistic as possible I by using the BWR licensing models SAFE and CHASTE with realistic input assumptions. In addition, a number of calculations were performed using the MAAP computer code to determine core uncovery times or heat up rates for ,
various conditions. These analyses used 1979 ANS decay heat curve with a l The I multiplier of 1.0 to calculate the core heat following a scram.
thermal-hydraulic bases for the success criteria are presented in Appendix 2-C. ;
O V
AMENDMENT 2 2.0-2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
Plant Damage States C The output of the plant event tree analyses are the plant damage _ states. The plant system event trees model the possible accident scenarios ' following a given initiating event. These accident scenarios are either sorted into plant damage states or success states. The sorting process is based on the t.ype of accident, timing of core melt and status of the containment integrity. The plant damage states are discussed in detail in Section 2.2.
i i
Support States The Millstone Unit 1 event tree analysis included the development of a support state model to transfer the major common support systems outside the event tree structures. This systematically addresses a major contributor to common cause failure (common support system dependency) and significantly reduces the size .
of the event trees in terms of the number of possible sequences. The dominant support systems, those systems that are highly depended upon for the successful operation of. other mitigating or support systems, are developed into operating conditions that the plant could be in during an accident. These operating conditions, or support states, were analyzed using a separate event tree analytical model, Section 2 3 The subsequent analysis involves analyzing the individual event tree models for appropriate support states.
Modeling Asstanptions In performing the Millstone Unit 1 event tree analysis, several asstanptions applicable to all event trees were made. These assumptions are discussed below:
o All event tree models were developed assuming the plant is at 100%
power with normal initial conditions prior to the initiating event.
o The event trees take credit for only the normal injection systems.
Emergency Operating Procedure 576 provides (Appendix 2-B) a list of AMENDMENT 2 2.0-3 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
alt 0rnata injection scure:s, firs pumps, Emergr.ncy Servica wat:r, etc., which are not included in the present analysis.
- x o The drywell space coolers are designed to maintain drywell temperature between 135 F and 150 F during normal power -operation. On an ECCS signal generated by low-low level or high drywell pressure, the space coolers are tripped. The space coolers automatically restart when the ECCS signal is removed. A trip of the space coolers results in a gradual increase 'in drywell temperature, <1 F/ minute based on plant l experience. The heatup of the drywell requires many hours before the !
drywell temperature exceeds the drywell equipment environmental qualification. ibis long time allows the operator to take corrective ,
action by either restoring drywell cooling or by operating drywell l l equipment before it becomes inoperable due to high temperature. Based on analysis the short-term effect of loss of drywell space cooler on plant transients was found to be negligible and thus was not modelled in the event trees.
o Injection from the CRD pumps is not included in the present analysis because flow from 1/2 CRD pump (77 gpm) is insufficient by itself to ,
I') I
"' match core boil-off in the short term.
o An extended loss of cooling to certain types of recirculation pump seals could result in seal failure and seal leakage. The Millstone ;
Unit 1 recirculation pumps are Byron Jackson pumps and test results on similar pumps indicate that leakage from a Byron Jackson pump seal is less than a few gpm and does not increase appreciably with time.
Therefore, the event tree analyses do not consider consequential <
recirculation pump seal leakage, o Emergency Operating Procedure 580 (Appendix 2-B) delineates the conditions which must be satisfied before initiation of the drywell sprays. Based on best estimate analysis however, these conditions are found to be so restrictive that the operator may not be able to start drywell sprays in these sequences. Therefore in this study, no credit is given for use of the drywell sprays.
/~
(
w
- 2. M em2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
t b
(
2.1 SUCCESS CRITERIA The success criteria provided in this section are used in defining the top l ( )
- events of the fault trees and in calculating human error probabilities (HEP) for the operator actions. Table 2.1-1 summarizes the success criteria used in the study. These criteria are based on best-estimate (i.e. realistic) transient and LOCA analyses. The analyses are performed using GE's BWR SAFE and CHASTE with realistic and less licensing evaluation models conservative input assumptions than those used in the FSAR analyses. The following are some of the important basic elements of these best estimate analyses, o 100% of rated core power (2011 MWt) o 1979 ANS decay heat curve with a multiplier of 1.0 o Credit is taken of steam cooling after' the core is partially uncovered.
) o Measured system performance values (as opposed to the design values)
(
are used. For example, the measured heat removal rate of IC is about 25% higher than the design minimum value.
In addition, a number of calculations were performed using the MAAP code to l determine core uncovery times and fuel heat-up rates, etc., for various accident conditions. These calculations also used the realistic assumptions l mentioned above. The thermal-hydraulic bases for the success criteria are shown in Appendix 2-C.
e AMENDMENT 2 2.1-1 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
-O
, 2 in hl h t e o9 w*
e(
7 2
n iec hh r
o e
ly l
it a
t o m e
u p
r voe nene eo owtcelae Hpt x a Weme naos. e t t t
i sh h r cyv S wnt t n iwst a F hi r r
o E
T nt iaei on opr )e v o niav ot o n e p y h et s asr t u s ummetof eer e an d s.
s O it t
inb a t wt x er r v g c iab e o c vatd le niser t
N c ciaa f ol o r u aMas e a
mle m oo epl iu o l
el r e r. na l
s b oqh r
e i
o s. v eh os v o r ow Rlesi ia mto r t vt oe n/ c ne tc r a l
e ev t t t a tele a tele cvo r e rt a l
eSyea r r
e nuV l
r e uV v cd nsb e pip wb o pipn ec et er a ps ee v OmRl ao OmR h n Tu Os os y pt r h ct PTb eoi t h o es W p ly u-F e in r la e N e a on u0 k 0
r os r s t i sh n2 as e t e a mi nMe 1 t ei t 1
C st eu r n Wtun r w hCu n t
A F i yn
, , i t I R ym i
em r i W ywd r im r
a n a st r e as a n O s0 o0 F sCa0 A T s t u r sI I
R A
R s2 e
cn e 2 r
on eWn cFi f
o e ctee s4 n
E E ei t i e m e e eaui t
nh sh nen0 n n ninh T P i t
ei t o o t ii it n
I R O i w f
Rw f i o2 N N f i imw 1
- C 1
2 S S
,U ELB
. E C e C d t A U anaR r wS
/
T S r A n n in el o M in in sF1 t
R a i
a a ia a n( d E E r r r r r e
T T t
r t
r t
r t
r t
r dCnnI a S I R e e e e e e Y
S C t
a t
a t
a t
a t
a Ct o o )m py c l
S w wd w w w npugc d d e d d d o -
S e er e e e eo ak e5 ev E it e e e e 1 C F F s t
F F F l oa2l C
U 1 ir e 1 1 1 ism >av S
r r e e
.w t
s .
w o r t s
nW Wou t r
e nWaP e
e . cl t
a e . C.P ko a t isC. C. a ca w l
E E
isanC.
C.
Loam d w
k n a C. S. orml B ed l r e r R
C Fe r
e a T B. la o e T B.W B.N T
T r RmN F B
r r RST Sf ooo o An fo f f o of f f N t of ol o l S t c
E c s s sss iao ss l
a s lass s V a W a s s s s V e o mo s o R m T e oooot o E RLSL L O I S A RLLLLSL 0 M ET
/
t dI r
e a
w dn a k
p u
e S eC aM Y
!( i
, ! 1 il j! lill ll )
- =
L O
d .
l a is C) i s is kT T T S aCF CF CF E eP 0 T P( P0 P0 O ge1 0 g79 g00 n
F nr u2 i1n i3 it lt lt l
uant un un sa sr e eh a sa eh eh r pt r t r t ems h e s es h s es h se TTl e Tl e Tl r
p or p n tate m lye erf ms ps ud a ompea ue me l
p pna u plv v N io s e a s ul pa s eve t
O e s nd I n se ane eudnte t
h Ve otev mah 1 t
,pTthr ia t
T C ua l
t t /
Ru n t Ru r /n ym.o m. i t r A r ai nV n aSi m t aSi m R t s mR r a usf 2m t
s2 s2 O / spe r lyne2 0 lyne2 0 A T A
ly0S 2 s el vese l it lap lap I
R la 2 eh ab uon
) R unin e ct Vans et oi uon n E adni ih l i E n i
n t
n T P nh aip t e o nr aRaiW t a dni h t t 2 I R O Mwo N f i
t / vc sSaaF Maw Maw c
( C 1
- S S
O1 E 2 E C
C U
L k B S p p p p c p A A mh m u m uigr e M m m t u
T E iH u P
u u (n Pi s )e P
- P Ph u s elv T t s ys yns ys ysh a ys S i H a e aoe r a r ev aet r V_ ae r v Y C r v pl a r
pt p pl a pl vo pla S SV Sa r SV Sat R SV S
S e esl t l e e VnS r Ri o
/
e e o/ R o/ R r
o/ R r r E
C r
CS oow Ct y u CS o/in CSd de p t
CS C 1 2 Ad r
1 2 1 2ao 1 2 U 1 S
r
.e t .W.wok r e
n e W C.P aer t
a is C. C. lab w E n d E a C.S. mr l k k e R r oal a a e T Tr W B.B.N m e e F T SRT B r
B r
ooo o S f
of f f f
o N t c ssssa l
e l s
E l g
l a V V
E a ssss m e oooo r a m R O
s o
RLLLLS L S I L O A 2
y a
r p
2 T
N t S E i
e M s r D Y o N S C E M
A l lI!
' ]i i j;jl j]jji 11 ] i
+
{
~
F F' F y 0 0
1 1
'0' 0
1 8' 0 2 1 ~ 3
- = -
is i s i s
S T T' T :
E C C' C T P P' P O g g g N n n i n
it it t lu l
u lu s s s e
r e
r' e
r e e e h h h T T' T p p p I ms n r s ms C H ue ue ue P S N
pv pv r plv a s e w. lopN t e la s o l
e a s h
~
O nVe nVe f .
eve t sr t i
euor smdee r
of u a I
T oRu t oRu t yn ao ht Ru t eu ri t
C t o t u
A tr /n a Si tr / n a Si r i pt c tr / n aSi m i
i t
ah i t
i.
ah r 4 wee' q q' =
R O
t s2m t s2m SA er t
s2 in4 n iyi nflos rd a lyne2 0 A lyne20~ lyne2 0 e an yi T r ot o l
I R A lap lap lap la m' l
laml sa i
) R uon' uon _ .
Ca r uon ue u et pt t
E e o mina t E n i n d h i n ee nd a nii h nt nt asr n
o T P a dni ht a ni t
o SO ep Maw t
Ms asy MsTpm yh u c
I R O Maw Maw N
( C 1 S r 1
S e_ r e
2 E g n.
g C a .a t
n a
E C ,e r .h o .h L U r e g
. c x ,H
.x c
B S u k E t s c nyt n .E A A ose er u a r a e M t
.T E T
I R
E .
t ur Apu s ints )e
. ( ev h r cu xPHe m.a' n h e
T s s ph s s pet a sh l E si a /
pe S ye e .
pt ge mv yt I
Y R r r lv mve mir r mv o V r a W. . W'mn .
u o eua r mlv C
r l l l r S ua ua uh p ua uat R u C. P CgPV S PV PV P nl PV PVnS / P H e C. C WCaI n CRi o I
S I I I Cole I I CC C.
C P/ S P/ S Pt w L ay r P/ S L
P/in L Sdd pe SSRR EL CPS C L L t r xL U 1 2 1 2 1 sd 1 2 1 2 ao 1 1 1 2 21 E1 1 S
pk s t
r e
ce xre a
w t
s n . Wok r
e eb e W C.P ae t
a sll s E isn C.C.la r d
w e em a e e
E a C.S. rmB e k k tr s r
R r oall e a e
a e
t T Tr W SRT B.B.N m F B
r B
r t d nn t
n T f S f ea e N
E t
of f fooo o c ssssa l o
e l V
v eeg v
e l
s g la -
V E a e sss RLLLLS oooosm L s
o L
r a
S m R O
I l
Al a l r l lA -
n io m C et c e r
ue t
s D 2 j y S s n nS T si e w e N M r t Pn) og n) t am ne E E laI diC M T
wo C t uoD l r t es D S o oP h lt y N _
S M .
A llli l
ill lil Jj] ,!4 iij l ;l' l j )i
^
> _ ~
i' Q"
~
S E
T O
N
~
. in' asr Muo s o eh eo u
r ly l
a sw pt pnos e
r N o4 ht T ~' u n mf uia l i
m l 0 t a uia f i
e heF0 f
1 s n pr p s 1 ei r ht m yop us yr f
p C
t at
- A yw ,i it i n1 1
y b
d h mu b oumu R r ar ine h o i
a n2 / p dh n p A O T
ss es lywp t
s s t a1 g a2 g e n s n t A amu e:
sn i n eh in
~
I l
). R R cede u es c t hi ni er t h n n e
. t E E nt t t nin t n
n T P n n o asyea nat oiu b wr Owr u N o'
c I
R O iC f
Msh f i s - -
. (
C 1
- S 1 S 2 E C
E C g L U in .ta B S p~ dWe .
A A v .h W
.T M L R m .
io p C.C. W.
E u r T P dn C.
S rt g y s B C. s a C. s Y R n r r
u p R C. r m p B. r p omu S C it a P u o S. eg mT u
S lu S P gBn t
Po ed P S c t E r C Wl in T. ha Wwla t
W C L iC S Sodonx c Soo S C 2cae 1 Fi s l
E U 1 1 S
r e
w s s
. o e e WA e
.C P e t
e r r e E s C.O a l
T r
oT p
pt T r
E ip C. ll L m r t
n un t r t R on T B. a o r
e Se v pe T
T r RmN E v
PE N s pv uE N ofol Sfo S L S e E
t c e a sas l
e sms W Pt a V
E RLSLy o o T A NS nt ot a Nt LS r
e r 1 s n
e t
e a 2 -
d n W T M o em N E C T iec E S n S vt M C r s D Y ia L ey N -
S M S SS E M
A l!I! -
L
' 2. 2 - PLANT DAMAGE LEVEL CLASSIFICATION 6 A Probabilistic Safety' Study identifies various transient sequences with y
consequences to the reactor and secondary plant varying from benign conditions )
' (e.g., simple reactor trip) whose consequences are limited to lost generation l l to degraded conditions which result in extended outages for decontamination, '
component inspection, and fuel replacement. The most severe accident sequences are core melt conditions which challenge reactor vessel and containment integrity and involve significant public health as well as financial j consequences. The wide range of consequences makes it desirable that several plant damage levels be defined to categorize all sequences. The definition of the plant damage level should address not only the level of damage to the core, which is of prime importance, but also that of the reactor pressure vessel (RPV). This is because a severe damage to the RPV (e.g., loss of integrity) could ultimately threaten the core.
2.2.1 Definition of Plant Damage Level ;
Three plant damage levels are defined for the Millstone Unit 1 Probabilistic Safety Study. The criteria which define these damage levels are specified in Table 2.2-1. These criteria are stated in terms of key plant parameters such as water level in the core, peak clad temperature, and RPV peak pressure.
The three plant damage levels represent successive levels of damage and consequences. The first level (Level I) represents conditions where no operational impairment is anticipated. This damage level is not expected to result in an extended outage or extensive ;nspection and therefore is called a
" Success".
In level II, plant damage could range from limited local damage of fbel pins to extensive core wide damage, short of a core melt. An RPV overpressurization event (peak pressure > 1325 psig) will also fall into this category. The events in this category are not expected to result in any significant radiological release to the atmosphere. This category represents potentially severe economic consequences. However, from public safety point of view, since O
AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
L this category poses no appreciable threat of radiological release, it' is
- e. treated like the " success" category (Level I).
l The level III represents the onset of core melt, formation of a rubble' bed and l l
further degradation. The events in this category pose a significant risk of radiological release to the atzsphere. All level III events are. called core melts. These core melts are further subdivided into various plant damage states which are discussed next.
l 2.2.2 Plant Damage State Classification The plant . damage states (PDS) describe the type of initiator, the- timing of core melt and status of the containment at the time of core melt. Thesa PDS can be used in calculating radiological release and public consequences. All core melt sequences are divided into various PDS.
Each PDS is described by three characters (two letters and a number). The two letters describe the type of initiator and the timing-of core melt. The number provides condition of the containment at the time of core melt.
First letter - Type of Initiator A - Large LOCA (Break Area >_ 0.2 ft. 2)
S - Small and Small Small LOCA (Break area < 0.2 ft. 2)
T - Transient Second letter - Timing of Core Melt E - Early (time < 2 hrs.)
I - Intermediate (2 hrs. < time < 7 hrs.)
L - Late (time > 7 hrs.)
O G
- 2.2-2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
a .
h Third Number - Containment Status j%.
.t 1 - Containment' intact at the time of core melt -
).
2 - Containment faileo at the time of core melt For example:
AE1 represents an early core melt initiated ~ by a .large LOCA with' containment intact at the time of core melt.
TL2 represents a late core melt initiated by a transient with containment integrity breached prior to core melt.
Examination of systems available for core and torus cooling dictates three different core melt times with two containment statuses. Figure 2.2-1 depicts-
.the important combinations of core melt time and containment status.
Out of a possible total.'of 18 combinations,11 "PDS" were modeled by the event l
.g trees which are listed in Table 2.2-2. It was found that the remaining-7 PDS
' did not represent any real accident sequences and therefore were not modeled.
References
- 1. Millstone Unit 1, Technical Specifications, Docket Number 50-245, December' 1977
- 2. Letter from R. H. Bochholz (GE) to NRC,' Division of Operating Reactors, MPN 278-79, " Cladding Swelling and Rupture Models for LOCA Analysis", November 20, 1979 3 " Executive Summary, Phenomenological and Modeling Background for the PWR and BWR Core Heat-Up Codes", IDCORE, Technical Report 151B Analysis of In Vessel Core Melt Progression, September 1983 O
1 AMENDMENT 2 2.2-3 4 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
____ ____-____ D
23 PLANT SUPPORT SYSTEM EVENT TREES Section 2.4 documents' the plant systems event tree codels developed to describe the potential outcomes of initiating events. Quantification of these event tree models requires estimates of system unavailability for a number of normal-operating- and standby systems. The unavailability of these systems are-quantified using fault tree models developed in Section 3 2. Each of these fault l
L tree models is dependent on the availability of a number of vital support systems which are interdependent. To quantify the likelihood of a particular set l
of vital support systems being available, a support system event tree model was l developed. The quantification of the event tree model yields the split fractions for various unique sets of vital support systems being available given that an-initiating event has occurred.
The support systems modeled in the support system event trees were chosen based on the fact that they are common in all plant system event trees.
The support system dependency models reflect the dependencies shown below.
w Normal Power Available
- o. DC power is necessary for accomplishing a fast transfer of all AC loads from the Normal Station Service Transformer (N.S.S.T.) to the -
Reserve Station Service Transformer (R.S.S.T.) following any i
reactor / turbine trip. Failure of a DC Bus will prevent transfer of the AC Buses whose breakers are controlled by the two DC Buses, o If the DC Buses are available, AC power to the critical AC Buses (AC Buses 14-F and 14-E) is dependent on various breakers successfully transferring and closing onto the R.S.S.T.
o If the critical AC Buses successfully remain energized, the Service Water System cust continue to operate and thus supply an ultimate heat l sink for various component cooling and decay heat loads.
O 2 3-1 AMENDMENT 2 MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY
L l
i k The success criteria for AC Bus 14F for the Losc of Normal Power case involves the successful operation of the diesel generator and transfer
/3
- 1) of all vital loads.
1 The success criteria for AC Bus 14F for the loss of service water is the same as the case for normal power available.
i 5 AC Bus 14E - Node E Node addresses the availability of 4160V AC Bus 14E. The logic in the event tree reflects the fact that the unavailability of DC Bus 101A results in the unavailability of AC Bus 14E. The success criteria for AC Bus 14E for the support case where normal power is available involves successful transfer of all vital loads to the R.S.S.T. from the N.S.S.T.
The success criteria for AC Bus 14E for the loss of normal power case involves the successful operation of and transfer of vital loads to the emergency gas turbine. The success criteria for AC Bus 14E for 7]
L the loss of Service Water case is the same as the case for normal power available.
- 6. Service Water - Node S Node S addresses the service water system availability. The event tree model logic reflects the fact that loss of both AC buses results in a Loss of Service Water flow.
The Service Water System success criteria when normal power is available requires at least 2/4 service water pumps to provide cooling flow to the T.B.S.C.C.W., R.B.C.C.W. systems. Two service water punps are normally operating and credit is taken of manually starting the SW pumps within a half hour if the running pumps fail. l The success criteria for the Service Water for the Loss of Normal Power case is at least one SW pump providing cooling to the Diesel (3
J and R.B.C.C.W. systems and flow to the V Generator, T.B.S.C.C.W.
T.B.C.C.W. isolated. If flow to the T.B.C.C.W. is not isolated, then l
2 3-4 AMENDMENT 2 PROBABILISTIC SAFETY STUDY l
)
l
' th3 succ:ss crittria requir:s oper: tion of ct 1:ast 2/4 SW pumps.. No I credit is taken for manually starting the standby SW pump or isolating flow to T.B.C.C.W. to provide cooling flow to the Diesel. This is j
(
,)
because of the short time required for heat-up and subsequent failure {
of the Diesel. For the non-LNP case credit is taken for starting the .
standby pump or isolating flow to the T.B.C.C.W. to provide cooling flow to the T.B.S.C.C.W. and R.B.C.C.W. as sufficient time (> 1/2 l
hr) is available fo the operator to carry out the action.
For the Loss of Service Water case, the service water system is failed and the unavailability of Node S is Q3= 1.0.
The outcome of the basic support system event tree paths can be categorized in terms of unique combinations of support system failures. Fourteen l combinations were identified in Figure 2.3 1.. Each combination was defined I to represent a support state category. Millstone Unit 1 is not symmetrical with respect loss of one AC or one DC Bus. Loss of AC Bus 14E or DC Bus 101B has a different impact on dependent, mitigating systems than loss of AC Bus 14F, or DC Bus 101A. The support system categories are applicable
) to all three of the support system cases, normal power available, loss of normal power and loss of service water.
However, in case of an LNP, there is one difference in the interpretation i of these support states. In an LNP,- Loss of Service Water also results in a loss of the Diesel Generator Bus 14F. For example, in support state #4, loss of 14E and the Service W'ator results in a station AC Blackout condition due to consequential failure of the Diesel Bus 14F. On the other hand, if normal power is available, support state #4 represents only the loss of 14E and Service Water i.e; - Bus 14F remains available.
l L/ '
AMENDMENT 2 2.3-5 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
2.4' EVENT TREE MODELS
[ 4
- .This 'section documents the event tree' models - developed to modelE potential
' accident sequences (except for Station AC Blackout) , initiated by: .l o Loss of Normal Power
o Reactor Transients-(with and without the Main Condenser) o Loss of Feedwater o Loss of Service Water o- Loss of R.B.C.C.W.
o Loss of T.3.S.C.C.W.
o Small Small Break LOCA o Small Break LOCA o Large LOCA-o Inadvertent Operation of a Safety / Relief Valve In addition to these, event tree. models were also developed to adress the following consequential A.T.W.S. sequences:
o A.T.W.S. with the Condenser Available o A.T.W.S. with the Condenser Unavailable Each of the models used in the Millstone Unit 1 Probabilistic Safety Study includes the full event tree diagram, definition of all event tree nodes, definition of any condi'cional events, and a definition of the unavailability expression used to quantify the event tree model.
O mm 2 W
MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY m _ ___
7 I
- 2.4.1 less of Normal Power V Station electrical power is from the Normal Station Service Transformer (NSST). Following a reactor trip, the electrical power source for the station switches to the Reserve Station Service Transformer (RSST), which is supplied by the 345 kV transmission line. A loss of normal power (LNP) is defined as a loss of 345 kV transmission or any switchyard problem on the highside of NSST er RSST. Therefore, in an LNP, power is lost both from the NSST and the RSST.
The event tree model used in the analysis of Loss of Normal Power events is shown in Figure 2.4.2-1. This event tree is used for all support states in which at least one emergency power source is available. The particular case in which subsequent support system failures result in a complete station AC Blackout is addressed in Section 2.5. l Definition of Top Events:
- 1. Inss of Normal Power - Initiator T 3 g
' A loss of normal power (LNP) is defined as a loss of 345 kV transmission or any switch yard problem on the high side of the Normal or Reserve Station Service Transformers (NSST or RSST) whDh results in an interruption of normal electric power to station aux 111acies.
- 2. Reactor Trip - Node R A successful automatic reactor trip (RT) requires generatice of a reactor trip (RT) signal either by the Reactor Protection System (RPS) or Alternate Rod Insertion (ARI) system and full insertion of control rods. A failure A
of any 5 or more adjacent rods to insert is assumed to be scram failure.
RT signal would be generated by any of the following conditions following LNP:
Turbine stop valve closure 0 Turbine bypass valves failure on generator load rejection.
rm U
2.4-2 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
Condenser low vacuun V
- Reactor pressure vessel (RPV) low water level Reactor high pressure Failure of reactor trip results in an Anticipated Transients Without Scram (AWS), which is developed further in the AWS-3 event tree in Section [
2.4.14.
3 Operator Action to Restore RPV Level - Node 0)
Following ' an LNP , the immediate operator actions listed in ONP-503B l-(Appendix 28) include:
o Place IC in Service t
q o Close HSIVs V
If the RPV level continues to decrease, the operator will start FW or low pressure pumps to restore level. Success at node O g represents the cognitive operator determination of the need to stablize (or restore) the-RPV level by placing IC, FW or low pressure pumps (Core Spray or LPCI) in-service.
Following an LNP, if no system is autanatically or manually placed in service, the RPV level drops to the low low level (ECCS setpoint) in about If the operator ten minutes. This time is based on MAAP calculations.
initiates IC or FW within 20 minutes, no core uncovery is expected. If at that time, low pressure pumps are placed in service, some core uncovery durin6 the depressurization is expected. However, the RPV level will be rapidly recovered by the low pressure pumps, which terminates fuel heat-up and further degradation. Therefore, an operator action time of 20 minutes is assumed for this mode.
~
2.4-3 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
At low low level, the IC and FWCI will be automatically started. (The IC'.
p may be actuated earlier.on high RPV pressure if.the turbine bypass valves b' close due to low condenser vacuum). The failure to manually. initiate the core cooling systems is therefore backed up by the automatic initiation of these systems.
- 4. Safety Relief Valves Reclose - Node J 3 Following an LNP, after the HSIVs close, the Safety / Relief valves (S/R valves) begin to cycle. The valves continue to cycle until the RPV is .
depressurized. Success is defined as reclosing of all SRVs. Since the probability of a valve sticking open depends on total number 'of valve cycles .. (i.e. number of valves x number of cycles), it is important to determine:
- a. Number of cycles
- b. Number of valves in each cycles.
- a. Ntanber of Cycles
']o Following an LNP, the operator will close the MSIVs or they will close l automatically on the low low level. After the MSIVs close, the RPV pressure begins to rise. At 1085 psig, the IC is automatically initiated (if it has not already occured earlier). At 1095 psig, the Safety / Relief valves begin to cycle. The valves continue to cycle [
until the IC begins to depressurize the RPV, which occurs within 3 minutes after its initiation. Therefore, if auto actuation of the IC is successful, the Safety / Relief valves do not cycle for more than 3 minutes. However, if the auto actuation of the IC fails, then the l Safety / Relief valves may cycle for 10 minutes, which is the operator action time in Node 0 1. It is estimated that the Safety / Relief valves cycle at a rate of about 1 cycle per minute.
- b. Number of Valves in Each Cycle i
2.4-4 AMENDMENT 2 MILLSTONE UfET 1 ppnp ARTT.TSTTC S AFFTY STilDY
,In the first cycle all 1six Safety / Relief valves may open. In
.l subsequent cycles.only two valves (with setpoint 1095. and 1110 psig)
L' are expected to open. Be flow capacity of each valve 'is 818,000 lbs/hr of saturated steam at 1095 psig. . Therefore, 2 valves will be . ;
. able to discharge the core boil-off after the first cycle. The' l l remaining 4 valves have a setpoint of 1125 psig and therefore are not expected to reopen.
f Node' J 3 represents a ' conditional' probability of the Safety / Relief valves failing to reclose based on the success or failure of the operator action following an LNP. The failure probability of cycling Safety / Relief valves.
to reclose is calculated as follows:
If The Cognitive Operator Decision at Node 03 is correct .
Both manual and automatic initiation of IC are available and therefore the node failure probability is calculated by:
O J1 Il ~ OICAuto}
- 03 Cycles + OICAuto *0 10 Cycles Where Q = Failure probability of auto initiation of IC on IC Auto high RPV pressure Q3 = Probability of at least 1 SRV sticking open in 3 Cycles cycles Q 10 Cycles = Probability of at least 1 SRV sticking open in 10 cycles If the Cognitive Operator Decision at Node 01 is In rre t Only the automatic initiation of IC is creditec'. Berefore, the node failure probability is calculated by:
0 3 Cycles OJ1*
i
- j. AMENDF.ENT 2 2.4-5 MILLSTONE UNIT 1
)
t_:_____--_________ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ - - _ _ - _ _ - _
4 J. 5.. IC and'.Ic Make-Up - Node Kg Q(,)k This node . represents the conditional failure probability of14C and IC Make-up to operate based on automatic or manual initiation. Two cases are discussed below: a.
- a. If the Cognitive Operator Decision at Node 03 is co m t:
As - discussed 'in nodeg O , the operator will manually place . the IC in .
service. The success criteria for manual initiation of the IC are:
IC normally placed sin service from the control room. If the control o
room actuation fails, - tne operator initiates IC from the " reactor -
building.
o IC make-up being supplied automatically on low shell side. water level by fire water' system. If the automatic actuation fails, the operator u manually establishes at least 215 gpm of flow to the 'IC frm the fire l
( water system. A boil-off of 215 gpm matches decay heat at 45. min, time when initial IC inventory is exhausted.
o The operator opening and reclosing one SRV to remove non-condensible This action may be needed after gases from .the RPV and IC tube area.
several hours into the transient if non-condensible gases sufficiently degrade IC heat removal to cause RPV repressurization.
The error associated with the operator decision _( cognitive HEP) is accounted for in the node 03 .
- b. If the Cognitive Operator Decision at Node 03 is Incorrect i
Since the operator (cognitive) error has occured at node 03 , only the However, restoration of IC make-up is auto initiation IC is credited.
credited with a conditional operator (cognitive) error. Analysis indicates
'Iherefore, the restoration of IC make-up can be delayed until 50 minutes.
- D b .
AMENDMENT 2 2.8-6 MILLSTONE UNIT 1 DVP ACTI TCTTC S AFFTV NIDY
-:_______-_a___._-.____
- 1.f I
c)_ i
. the ~ conditional HEP. is calculated by dividing the operator errorLat 50 min..
af
- (using the Time Reliability Correlation)' by the HEP at Node 01 '
The following equation is used in calculating f ailure probability l of node; i.3 O "'
-(OIC + OHEP1) * (OIC RESTO + OHEPO) +
K1 O IOICMUP~RESTO + OHEP3) +
ICMUP-AUTO 0SRV-FTO + OSRV-FRC Where Qg3 = Total failure probability for Node K3 Failure probability of IC placed in service manually from
~
Q =
IC the control rom or automatically on high RPV pressure.
Q = Failure probability of IC restoration given control room IC-RESTO initiation failed. (Included only in the sequences where manual initiation of IC is credited).
O QICMUP-AUTO =
Failure probability of auto actuation of IC make-up on low shell side level.
Failure probability of IC make-up restoration given auto QICMUP-RESTO =
actuation failed.
Failure probability of 1 SRV failing to open.
QSRV-FTO =
t Failure probability of 1 SRV reclosing.
QSRV-FRC =
Error of commission, manual operation of IC from control QHEP1 =
room.
Error of commission, manual restoration of IC from reactor QHEP2 =
building (included only in the sequences where manual initiation of IC is credited).
AMENDMENT 2 2.4-7 MILLSTONE UNIT 1 DDop8RTT TRTTC S AFFTV R'nmV
R [
l l
Q Error of commission manual restoration of IC make-up from HEP 3 =
reactor building or fire pump house. This includes a
. (v) conditional cognitive HEP for the sequences where only auto action of IC is considered.
~
- 6. Fmergency Core Cooling System (ECCS) Actuation - Node Q.
The success criteria for Node Q is defined as generation of the low low level signal when the level in the RPV drops to 79 inches above top of the active fuel.
The low low level ECCS signal starts the I0 and WCI systems. l 7 W/WCI System - Node C 2 This node represents the failure probability of being able to restore and maintain RPV level with the W system. 'Ihis node represents l conditional values as discussed below.
f%
yl . a. If the cognitive operator decision at Node 03 is correct The success criteria for Node C2 is defined as the operator manually starting one W train from the control room before the Low Low Level set point level is reached and maintaining RPV level within the normal range of +10" to +50" on narrow range l Yarway indications.
One W train includes operation of 1 condensate,1 condensate booster and 1 W pump and proper operation of all associated l valves.
The HEP associated with manually starting the W train (error of comission) is included in the node. The cognitive HEP is acecanted for in Node 03 .
+
OC2
- OW-MANUAL HEP r
AMENDMENT 2
- b8 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
I q
Probability of at least 1- LPCI pump (and-QLPCI =
associated valves) not being placed' in - service manually.
Qgp =. Unavailability of low pressure permissive signal.
0 OI OHEP2 HEP 1 Probability of - failing the manually initiate operation of CS or LPCI pump'from the control room (Error of Commission).
- 9. - Safety Relief Valves -(manual) - Node I This node' represents the probability of failing to depressurize the RPV to allow low pressure pump (CS or LPCI) injection. The success criteria for Node I is defined as - the operator manually opening at least 2/6 Safety / Relief valves. The cognitive HEP associated with However, the error of this action is accounted for the Node 03 .
comission is included as shown below:
O OI* 02SRV + HEP
- 10. Recovery of Normal Power - Node U3 The success criteria for recovery of Normal Power is defined as l recovery of AC power such that both emergency buses 14E and 14F and-l non-emergency buses 14C and 14D are energized.
Recovery of normal power can be achieved by:
- o. repairing a switch yard fault if the reason for LNP was such l a fault or,
- o. by restoring the grid if the LNP was due to grid collapse.
The recovery of normal power is credited only if both DC l l buses (101A and 101B) are available. This is because DC Power is needed to control the associated AC breakers.
\
AMENDMENT 2 2.4-10 MILLSTONE UNIT 1 Moe ncTT TCTTP C,8CTTY STflDY
A successful recovery of normal power implies that the plant is now in
(,)
support state 1 1.e. no AC or DC failures.
Time of Normal Power Recovery:
The sequences where low pressure pumps are used to maintain the RPV level provide the most limiting time period (minimum) available to recover normal power. For these sequences, normal power needs to be restored before the torus heats up to a temperature where the net positive suction head (NPSH) requirements of the low pressure pumps are jeopardized. The torus heats up from a ncrninal initial temperature of 81 F to 176 F at about five hours (the low pressure pumps meet the NPSH requirements for temperatur e <176 F with no back pressure). Therefore, success is defined recovery of normal power at or before 4.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. This allows sufficient operator action time to start SDC or alternate SDC system.
- 11. Restoration of AC by Cross Connection - Node U4
-)
L.)
Station procedures currently address cross connection of AC buses.
This node represents the probability of failing to energize a faulted AC bus by cross-connection to the available AC bus or by providing the control DC power from the available DC bus. Such a cross connection is cr edited only in the long term with at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the transient. This allows sufficient time for the operator to correctly diagnose fault in the electrical system. Thus minimizing the possibility of cross-connecting two AC sources without isolating or repairing an existing fault.
- 12. Restoration of Main Condensor or IC Hake-Up - Node H5 This node represents the probability of the operator failing to restore the main condenser (MC) or IC make-up to ensure long term decay heat removal. Success of either of the two systems is sufficient to remove long term decay heat.
n (v) 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
k.
Main Condenser:
.G I
Restoration of the main condenser involves drawing a vacuum in the-condenser by. using the mechanical vacuum pump, starting at least 1 circulating ptanp and opening at least 1 set of MSIVs (i.e. . in one steam line).
Restoration of the main condenser is credited ' only if the following conditions are met:
o Feedwater is running - i.e. success at Node C2 o No fuel damage has occured Therefore,-
o Power on both AC buses (14E and 14F) is available.
either recovery of normal power is ruccessful (success at Node U)3 or AC cross-connection is successful (success at Node (j Ua ).
IC Make-Up If normal power is restored the long term decay heat removal can be -
achieved by restoring make-up to the IC. This can be achieved by starting the motor driven fire pump which was unavailable due to loss of AC power.
The restoration of IC make-up is credited for the sequences where the following conditions are met:
o All SRVs are reclosed (at Node J3 )
o IC succeeded, but IC make-up failed (at Node K))
o Normal power restored (at Node U3 )
D The following equation is used in calculating the failure probability of Node HS*
0 ~ COMC+ 0 HEP (1)IC-RESTO. + OSRV-FRC + OHEP2) l (O/ H5 AMENDMENT 2 2.4-12 MILLSTONE UNIT 1 .
wy - - -
c3 i
73 where Prodadility. of main condenser failing to be o , Q3c =
' restc, red. - ,
Conditional probability of IC make-upifailing to QIC-Resto=
recover given an earlier failure.
v .
Probability of. 4 Safety /Relier valves failing to QSRV-FRC =
reclose Error of. commission .to recover MC or IC make-up.
QHEP1' OHFP2=
- 13. SDC and Alternate SDC Systems-Node M This node represents the probability of failing to remove decay heat
' indefinitely using _ the shut down cooling (SDC) 'or alternate SDC.
Success of either of the two systems. ensures long term decay heat l removal.
The alternate SDC employes a feed and bleed process with water being circulated from the torus to the RPV using LPCI pumps and back to the torus via the opened Safety / Relief valves. ' At the same time, the [
torus is cooled using the ESW pumps and LPCI containment cooling heat exchangers.
Shut Down Cooling System:
The Success criteria for the Shutdown Cooling System (SDC) requires proper operation of the following equipment:
o 1 SDC pump o 1 SDC heat exchanger and the associated valves o 2 RBCCW heat exchangers and 1 RBCCW pump providing cooling flow to the SDC heat exchanger o SW system as defined in section 2 3 WMmT 2 MILLSTONE UNIT 1.
i.
f The- entry : conditions of. SDC system requires that- the RPV pressureLbe less than 150 psig. Therefore, if the RPV is not at low pressure, the n; system success also requires that the operator depressurize .the' RPV by_ .l Opening 2 SRVs.
The failure l probability for the SDC used in a- given sequence. is dependent on two things:
o Availability of AC power.
o Condition of fuel. If any fuel damage is expected, ~1t is assumed that SDC is unavailable. In order to initiate SDC, .
local operation of certain equipment is required. Therefore, the reactor building nust be accessible. If no fuel damage .
is expected, credit is taken for SDC -including . manual operation of MOVs in the reactor building.
Altemate SDC:
The Success criteria for the alternate SDC requires . the operator to
. (~~
k take the following actions:
o Open 1 SRV.
o Increase RPV water level by starting 1 LPCI pump' and establish a flow path through the SRV back to torus. l o Initiate torus cooling by:
o Placing at least one LPCI containment cooling heat exchanger in service with 1 LPCI pump and 2 ESW pumps per heat exchanger running.
The following equation is used in calculating failure probability of node M (O #
ALT-SDC HEP 2 02SRVs HEP 3) 0M~ (0SDC+0 HEP 1) !
Where Q = Unavailability of SDC system.
SDC fT J l
AMENDMENT 2 2.4-14 MILLSTONE UNIT 1 PFCEABILISTIC SAFETY STUDY
O 55555######f #5555555555555#########f f f f unf tf 5Nef ff MN#######5555555555##########
PAGES 2.4 2.4-21 INTENTICIIAllJ LEFT BLAE
- enevnene**menen**ene**e**ene***en*****maun********nen**annune***enue****mane t
O 9
i i
O AMENDMENT 2 2.4-17 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
l 2.u.3. Reactor Transient
.. 1,
, 0'
, .V- Reactor transient events (Section 1.1) have been classified into three catagories:- Reactor Transients with main. condenser (MC) available,- Reactor Transients without main condenser (MC), and . Reactor trip events. Reactor -
Transients with main condenser available~ include those events.-which are anticipated to occur during the life . of the. plant. Examples of such r
transients are:
f Turbine Trip Feedwater Control Failures Electrical Load Rejection Trip of One Feedwater/ Condensate Pump Pressure Regulator Failure Turbine Bypass Valves Fail Open Reactor Transients with the main condenser unavailable include events where the
. main condenser is lost directly as a result of the initiating event or events p which result ' in . MSIV closure. 'Unless restored for these events, the main V
condenser is unavailable for plant cooldown.
' Reactor Trip events include events where a spurious plant trip is experienced due to RPS instrumentation signals, plant occurrences or manual scrams. For these events, the main condenser is available for plant cooldown.
One event tree model was developed to represent the three types of Reactor Transients. The mitigating systems that respond to reactor transients with or without MC and to reactor trips are identical. The unavailabilities of the main condenser and reactor scram fbnction differ in the respective event tree evaluations. These differences are discussed in the node definitions for the Main Condenser, node H , and for Reactor Scram, Node R. The event tree model 3
is presented in figure 2.4 3-1.
Definition of Top Events: /
D m2 MILLSTONE UNIT 1
7-l
- 1. Reactor Transient' Initiator T2 pg i
The event tree model- presented . in figure 2.4 3-1 was evaluated ; for . [
three initiators, reactor transients with main ecndenser available, reactor transients without main condenser and reactor trip events..
- 2. Reactor Trip - Node R The success criteria for autmatic reactor trip is similar to that given in event tree - for LNP, section _2.4.1. For reactor transients with MC available the Reactor trip signal could be generated by one 'of the l-following conditions:
. Turbine stop valve closure RPV low water level High Neutron flux For reactor transients without MC, the reactor trip signal will be generated on low condenser vacuum or MSIV closure.
For the reactor trip events, the reactor is already scrammed and the unavailability of Node R was set to zero, Q(R) = 0.0.
- 3. Feedwater Operates Post Trip - Node C3 Following a reactor transient or trip, the feedwater system continues to operate with the feedwater regulating valves controlling reactor vessel water level. The success criteria for node C 3 is defined as at least one feedwater train continues to operate, i.e., one reactor feed pump, one condensate booster pump, one condensate pump and one fee 6eter regulating valve.
A U
AMENDMENT 2 2.4-24 MILLSTONE UNIT 1 PPORABILISTIC SAFETY STUDY
' Main rh . Post Trip - Node H 3 a.-
Node H 3 represents the operation of the main condenser as a heat sink following a reactor. trip. The success criteria for node H 3 ine'ludes operation of. the Turbine Bypass Valves (TBVs), Main Stream Isolation Valves (MSIVs) and operation of at least one circulating pump in the Main Condenser. The main condenser is employed only when feedwater is available.
For the Reactor Transients without main condenser initiators, the main condenser is unavailable post trip and the unava.ilability f or. Node H3 is Q(H1)_= 1.0.
5 Operator Action to Restore RPV Level - Node 010 Node 00 3
represents the cognitive operator decisions following a reactor trip and failure of the feedwater to continue operating post trip. On loss of feedwater, reactor vessel water level will begin to O
V decrease and reach the low low level setpoint in approximately 10 minutes. The Emergency Operating Procedures (EOP-570 Appendix 2-B) direct the operator to terminate the level decrease and restore vessel water level Actions to restore level include:
Restore feedwater flow Initiate or restore IC and IC makeup flow Initiate low pressure pump flow.
The time limit associated with performing any of the above actions is 20 minutes. (Refer to LNP event tree, Node 03 for discussion of 20 l j
minute time limitation.)
A i
2.4-25 AMENDMENT 2 MILLSTONE UNIT 1
"),
. 6.. . Restore Feedwater?- Node C 3'
-I '
- Node- C . represents restoration Lof feedwater flow , following loss . or -
3 feed flow post 1 trip (failure at Node 1C1 ). The success. criteria for Node C is defined as' the operator; manually starting ~one condensate .
3 pump, . one condensate booster ptrnp, and L one reactor feed - pmp. One.
feedwater? regulating valve is required to provide' flow : and ' level .
control. The human error associated with this. action is included in-4 Node C '
3 Q O C3
- FW ? OHEP The .. cognitive error associated with restoration of feedwater is already accounted for in Node 010*
- 7 Safety Relief Valves Reclose - Node J The- Safety / Relief valves will cycle following MSIV or TBV closure.
(The TBVs close on low condenser vacuum and the MSIVs close either on low low vessel water level or manually following loss of feedwater).
The S/R valves continue to cycle until the Isolation Condenser'(IC) is-initiated automatically on high RPV pressure or manually. The success-criteria for Node J is defined as reclosing all S/R valves. For discussion of the number of S/R valve openings per cycle and number of valves per cycle, refer to LNP event tree node J), Section 2.4.1.
Node K g represents the unavailability of Isolation Condenser (IC) and Isolation Condenser Makeup to operate based on automatic or manual
! initiation. The two cases are discussed below:
Operator Action at Node 010Succeeds 1
2.4-26 AMENDMENT 2 MILLST.ONE . UNI,T 1.
Operator action at Node 010 includes manually initiation of IC within 20 minutes of- loss of feedwater post trip. The success l
~
l .
criteria for Node K with manual initiation is defined in the LNP event tree, Node K), section 2.4.1.
Operator Action at Node 010Fails l
I Following operator error at Node 0 10, nly autmatic IC initiaton is available. However, restoration of IC Makeup following failure of the autmatic initiation ' of IC Makeup is -
included with a conditional human error probability. Refer to LNP event tree Nodeg K sF: tion 2.4.1 for further discussion.
The equation used to calculate the failure probability for Node K is identical to that presented in the LNP event tree Node g
K), section 2.4.1.
9 Core Spray or LPCI - Node E o-Node E addresses the availability of 1/2 Core Spray Pumps or 1/4 LPCI pumps. The development is the same as shown LNP event tree Node E, Section 2.4.1.
The cognitive error associated with the operator action to manually start a low pressure pump is accounted for in Node 0
10*
- 10. Safety Relief Valves (Manual) - Node I Node I addresses the availability of at least 2/6 S/R valves to depressurize the RPV. The development is the same as LNP event tree Node I, Section 2.4.1. The cognitive error associated with the operator action to manually open S/R valves is accounted for .
in Node 0 10*
- 11. Restoration of AC By Cross Connection - Node U4 E
m 2 MILLSTONE UNIT 1__ ,_
y; addresses the ability to restore AC power to. both AC
0.2 2
ft ,
The l All three event trees represent breaks either in steam or liquid regions.
event trees are developed considering the limiting factors of both break locations. However, for a given break location, this approach may present some conservatism. The following are the main features of the three break categories modelled in the event trees. These features are also summarized on
,m Fig. 2.4.8-1.
(v) 2
- a. Small Small Breaks (Area 10.01 ft )
For the breaks in this category, the feedwater system can maintain the RPV level and prevent core uncovery. Since~the core is kept covered, no fuel damage is expected and therefore, the main condenser can be used for cooldom and long term decay heat removal. As discussed below, for certain breaks in this category, the feedwater system can maintain a maximum of only 3500 gpm.
For the breaks in the steam region, the MSIVs may close on low RPV pressure. With no make-up to hot well, flow capacity of the emergency condensate transfer (ECT) pump, which transfers inventory from the
" CST to the hotwell, becomes the limiting factor for the feedwater ;
I system. Therefore, for the breaks in this category, a feedwater flow rate of 3500gpm which is the flow capacity of the ECT, is assumed. l Also, since for some steam region breaks the MSIVs may close, it is q
G i
f MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY )
[ ,
assumed that for- all breaks-:in this category, 'use of. that main-condenser. ' will : require ' opening, of the' MSIVs :and reestablishing ^ the' g-
- V vacuum. Additional long term decay. heat removal systems available are-
' the : SDC and the Alternate SDC: system., Note, .use of; the SDC system requires 'a normal RPV level, which can be achieved for breaks,in this -
category.
2
- b. hall Breaks (0.01 < Area < 0.2 ft )
For breaks in this range, the feedwater system cannot maintain: the RPV' 4 level indefinitely. This is because .the leak flow rate may be more than 3500gpm. For these breaks, the MSIV close on low RPV pressure;-
therefore, the feedwater system can maintain a flow rate >3500gpm only until the hotwell level depletes. Successful mitigation for these breaks requires use' 6f the low' pressure (LPCI or CS) pumps. LThe feedwater only, allows for a longer operator action time (~1d min): to -
start low pressure pumps if they fail to come on automatically. : Also, an ADS or manual depressurization is needed for low pressure; pump.
injection.
For these breaks, only the Alternate SDC is credited as a long term decay. heat removal . system. The use of .the main condenser was -not credited due to possible trip of the feedwater on low. hotwell level.-
" For some liquid region breaks, the' water level may not recover beyond j
We break elevation. Therefore the SDC system is also not~ credited.
2
- c. Large Break (Area'> 0.2 ft ):
,r For these breaks, the feedwater system is not credited as it may trip due to a very rapid depressurization of the RPV or due to low hotwell level. The low pressure pumps do not require an ADS or manual depressurization as the break itself depressurizes the RPV rapidly.
The long term decay heat removal is provided by the torus cooling, which uses the same equipment as the Alternate SDC. For breaks in the l' O
AMENDMENT 2 2.4-52 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
p' liquid region, since the RPV level can not be. recovered beyond' the break elevation,;the SDC system is not credited, n.
V-l l
l r
.Ls O
2.4-52a AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
2.4 9 Small Small Besak LOCA i% . .
The Small Small Break LOCA event tree (Figure 2.4.9-1) models all postulated
-( } pipe' breaks in the drywell with flow area less than 0.01 ft ,
2_
Definition of Top Events
- 1. Small Small Break IDCA Initiator SSB The initiating event is any break in RPV piping in the drywell in the-2 liquid or steam region with flow area f_ 0.01 ft ,
- 2. Reactor Trip - Node R A successful reactor trip requires generation of an auto signal by the The signal will be RPS or ARI and insertion of control rods.
generated most _ probably by high drywell pressure. A successful I
reactor trip could also be manually generated by the operator. .The success criteria for the reactor trip is given in LNP event tree Node R, Section 2.4.1. Failure of reactor trip results in an AWS, which
() is developed further in ATWS-1 event tree (Section 2.4.13).
3 Vapor Suppression - Node B During the blowdown phase of a LOCA, steam released in the drywell is directed to the torus via the vent pipes where it is condensed in the suppression pool. An open vacutan breaker valve provides a steam diversion path from the drywell to the torus air space. Steam which gets diverted through the vacutrn breaker does not get condensed and thus pressurizes the containment (drywell and the torus).
i If any vacutan breaker is left open during a blowdown, enough steam could be diverted to the torus air space which results in pressurizing the containment above its design limit. Therefore, the success criteria for Node B is defined as all vacuum breaker valves remaining closed during the blowdown. Current E0Ps address controlling this AENDENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY l
F - . - - . -- .
a, s i
situation (EOP 580; Appendix 2B' ) via Emerg:ncy VIssol D:prcosurization (using 4/6 S/R valves) but the. impacts of' this procedure were not
.j credited in the analysis.
- 4. Feedwater Operates Post Trip - Node C) x Success at this node requires that at 'least one train of FW continues to run. Development of this node is the same as in the Reactor Transient event tree Node C), Section 2.4 3
- 5. Operator Action to Restore RPV Level - Node 030 Node 0 represents the cognitive operator decision to manually 30 control RPV water level following failure of feedwater system after reactor- trip. Emergency Operating Procedure 570 (see Appendix 2B) directs the operator to recover ' and stabilize the RPV level by restoring the FW system or by starting low pressure pumps.
is defined as the operator p The success criteria for Node 030 restoring the RPV level within 20 minutes by the following actions. l
\,.
0 Restoring FW system .qr l
o Starting low pressure pumps (LPCI or Core Spray) and opening 2 S/R valves to depressurize the RPV.
l If the feedwater l's being used to recover the RPV level, the Node 0 also models the cognitive operator error to start the Emergency 30 Condensate Transfer (ECT) pump to replenish the " hot well". The time j available to start the ECT pump is more than 40 minutes.
- 6. Restoration of Feedwater - Node C3 Success at this node requires restoration of at least one train of the j FW system.
NM 2 MILLSTONE UNIT 1 M 1 SM SM
D:valopment of this node is the sam: as in ths R: actor Transicnt event tree Node 3c ' Se ti n 2.4.3 s 1 7 Operator Action to Start ECT Pump - Node 031 l
i The cognitive decision at Node 0 31 is nsidered nly if the l feedwater system continues to run after reactor scram. This node represents the cognitive operator error to start the Emergency i I
Condensate Transfer (ECT) pump to replenish the hotwell inventory.
The time available to start the ECT pump is more than 40 minutes.
The success criteria for Node 0 31 is defined s the operator starting the ECT pump within 40 minutes. i l
- 8. Condensate Transfer Pump - Node C4 is defined as the operator starting The success criteria for Node C4 the emergency condensate transfer (ECT) pump and opening the i
associated valves to establish a flow rate of 3500 gpm from the CST to
) the hotwell.
wJ However, The ECT pump automatically starts on high drywell pressure.
in case of smaller breaks in this category, the drywell pressure may not increase to the setpoint value. Therefore, the autanatic starting of the ECT pump is not credited.
Additionally, if the operator cognitive decision to start the ECT canp redit is given for the normal condensate transfer fails (Node 031),
system to provide mAeup to the hotwell to extend the available hotwell inventory until such time as either shutd'own cooling or alternate shutdown cooling is initiated. In this case, the success criteria is one condensate trcnsfer pump continueing to run and successful opening of the associated valve to establish flow to the hotwell.
l (y N.Y 2.4-55 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
9 Core Spray'and LPCI - Node E
. Same as LNP event tree Node E, Section 2.4.1. The cognitive . error V associated with.the operator action to manually start the low pressure L pumps is accounted for in Node 030' The low pressure pumps automatically start on high dr' ywell pressure.. l However, for the reason discussed in the definition of Node C4 , the l automatic start of the low pressure pumps is not credited.
- 10. Safety Relief Valves _(Manual) - Node I Hode I addresses the ability to manually open at least 2/6 S/R valves
.in order to depressurize the RPV. The development of this node is.the=
same as LNP event tree Node I, Section 2.4.1.
- 11. Operator Error To Follow Procedure - Node 033 Following restoration of the RPV level, the Emergency Operating A '
Procedures (see E0P 570, Appendix 2B) direct the operator _ to maintain the RPV level between +10" and +50" on the narrow range yarway level indications. The feedwater system will normally maintain the level I within this band. If the low pressure pumps are - being used for injection, the pump flow would have to be manually throttled to keep the RPV level below +50". Following a LOCA inside the drywell, the indicated RPV level increases as the reference leg of the yarway indication heats up. If the drywell temperature increases above the RPV saturation temperature, the level indication may fail due to flashing of the reference leg. The failure mode is such that the operator will see an increase in the RPV level, even if the actual level is not varying. If the operator begins to throttle the low pressure pumps to stabilize level at this Therefore, the point, the actual level may begin to decrease. Emergency Operating Procedures (EOP 580) direct the operator to
.p disregard the indicated level and flood the RPV. %J 2.4-56 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- Node 033 represents. the human error probability (HEP) for the the. procedure.
operator. not following' the instructions in (,) Specifically, the operator fails'to disregard the indicated level and
.does not f'lood' the RPV when the drywell' temperature ' reaches the RPV saturation temperature.
- 12. Restoration of AC by Cross-Connection - Node U4 If both electrical buses are not ~ energized, this node addresses the -
The restoration of power on both buses by cross-connection. development of this node is the same as in the LNP event tree Node U4 , Section 2.4.1. 13 Restoration of Main Condenser - Node H3 This node addresses the restoration of the main condenser as. a long-term decay heat removal system. The development of this node is the same as in the Beactor Transient Node 3H , Se ti n 2.4 3 rg b
- 14. SDC and Alternate SDC Systems - Node M Node M addresses successfully placing the reactor on the Shutdown Cooling or the Alternate Shutdown Cooling for long term decay heat l
removal. The development of this node is the same as in the LNP event tree, Node M, Section 2.4.1. i
*~
MILLSTONE U!ET 1 AMENDMENT 2 PROBABILISTIC SAFETY STUDY
2.4.10 'Small Break LOCA (- The Small break event tree (Fig. 2.4.10-1) models all postulated pipe breaks (v/ 2 with flow area between 0.01.and 0.2 ft . Definition of Top Nodes
- 1. Small Break LOCA - Initiator S The initiating event tree is any break in the RPV piping in the drywell in the liquid or steam region with flow area between 0.01 and 2
0.2 ft ,
- 2. Reactor Trip - Node R A successful reactor trip requires generation of an auto signal by the RPS or ARI and insertion of control rods. The signal will be '
generated by high drywell pressure. The succe is criteria for the ] reactor trip is given in LNP event tree Nod + R, Section 2.4.1.
! Failure to trip reactor is treated as a core melt.
3 Vapor Suppression - Node B l Node B addresses the proper operation of the Vapor Suppression System including Vacuum Breaker valves. The development of this node is the same as in the small small break event tree Node B, Section 2.4 9
- 4. Fmergency Core Cooling Syst a (ECCS) Signal - Node Q3 The success criteria for Node Q 3 is defined as the automatic generation of both ECCS signals (i.e. low low RPV level and high drywell pressure).
- 5. Feedwater Re s - Node C 3 2.4-59 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
The ' error of commission associated with the operator action of starting the LPCI and selecting the intact recirculation _ loop. for injection is based 'on the rule based behavior (see' Section 4 for
~
~
discussion of the rule based behavior).
-If the cognitive operator decision action at Node Og was incorrect and ECCS signal was generated (Node Qj ):
is defined as an autanatically The success criteria for Node E 3 starting of at least 1/4 LPCI pumps and alignment for injection into the intact recirculation loop, selected by the loop selection. logic.. (The injection requires opening of the admission valve).- l
- 11. Low Pressure Permissive - Node P The low pressure permissive (LPP) signal allows the Core Spray and LPCI admission valves to open. The success criteria for Node P is the LPP signal being generated and providing a signal- to open the j admission valves for both the Core Spray and LPCI. . (Note: mechanical failures of these valves are included in Nodes F,E.)
- 12. Operator Fails to Follow Procedures - Node 026 i
This node represents the cognitive operator decision to flood the RPV when the drywell temperature increases to the RPV saturation temperature. A det' ailed di.scussion of this operator decision is provided in the small small break event tree, Node 0 33, Section 2.4 9 13 Containment Cooling - Node G2 i Following a small LOCA, as the torus heats up due to the leak energy from the break, the containment cooling provides a mechanism to remove l the long term core decay heat. It involves cooling the torus with Emergency Service Water (ESW) flow. The containment cooling is V i l 2.4-62 ) AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
c. l in LNP cv nt tres Noda H similar to the Alt::rnsts SDC discussed (Section 2.4.1), except that the operator does not need to open the S/R valves. This is because the break provides a path for LPCI flow i ,
)
to spill back to the torus. is defined as the operator taking The success criteria for Node G2 the following actions: in l. o Placing 1/2 LPCI containment cooling heat exchangers service l o Starting 2 of 2 ES'd pumps for each LPCI containment cooling heat exchanger running
- o Starting 1 LPCI pump per train (if not already running) o Closing the bypass valves to the LPCI containment cooling heat exchangers, so that the LPCI injection gets cooled as .
it flows through the heat exchangers. fw i 1
%) .
also For the support states where one AC bus has failed, the Node G 2 models the probability of failing to cross-connect the 4160V AC buses and reenergize the failed bus prior to starting the containment cooling.
'4 2.0-63 MILLSTONE UNIT 1 AMENDMENT 2 PROBABILISTIC SAFETY STUDY
d i 2.4.12 .InadvIrtcnt Opening of Safety Relitt Valve (IORV) [ The inadvertent opening of a Safety / Relief Valve (IORV) event tree models the
. transient initiated by a safety / relief. valve opening. This is a type of LOCA event.- However, due to the break location both the SDC and the Main Condenser systems are available to remove long term decay heat removal.
Definition of Top Events
- 1. Inadvertent Opening of a Safety Relief Valve (IORV) - Node IORV An IORV is defined as a safety / relief S/R valve spuriously lifting and failing to reseat.
- 2. Reactor Trip - Node R The reactor trip must be manually initiated by the operator because no RPS monitored parameter will be affected. The success criteria for the reactor trip is similar to that discussed in the LNP event tree Node R,'Section 2.4.1.
3 Feedwater Operates Post Trip - Node C) Success at the node requires at least 1 train of FW continues to run. The development of the node is the same as in the Reactor Transient event tree Node C), Section 2.4 3
- 4. MP2 AC Node Cross-Tie - US i
Node US represents the capability of supplying MP1 with AC power from l one of the MP2 emergency diesel generators. This node is only l considered in the event that all AC power at MP1 has been lost (i.e., failure of both the diesel and the gas turbine). O l 2.4-68 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY ) __ - 1
Succ:ss at this node' requires .that both of ths MP2 diesel generators - l: start and- continue to run and. that the associated circuit breakers
- n. fbnction.
U< ! 5 Operator Action to Restore RPV Level - Node 03
- . Node. 0 represents the cognitive operator decision to restore the 3
RPV level following the failure of feedwater after scram. The Emergency Operating. Procedures (EOP 570, Appendix 2B) direct the
operator to recover and stabilize the RPV 1evel by restoring the FW system or by manually depressurizing the RPV and injecting water from .
the low pressure pumps. is defined as the operator manually The success criteria for Node 03 restoring the RPV level within 20 minutes by the followilg actions:- o Restoring the FW system ,o_r_ r o- Starting the Low pressure pumps (LPCI or Core Spray) D o Manually opening at least'2 S/R valves.
- 6. Restoration of Feedwater - Node C3 This node addresses successfully restoring 1 FW train.
The development of this node is the same as in the Reactor Trcnsient event tree Node C , Se tion 2.4 3 3 7 Core Spray and LPCI System - Node E This node addresses manual starting 1/2 Core Spray Pumps or 1/4 LPCI pumps. The development of this node is the same as in the LNP event tree Node E, Section 2.4.1. L
- 8. Safety / Relief Valve (Manual) - Node I
]
- 2. W Amm 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
a
' ~ The success. criteria for' Node I is dsfinedias the operator, manually opening at least 1. out of the remaining 5 Safety / Relief valves.
7 l
;l j .
9 Restoration of AC by Cross-Connection - Node,U4 L If both electrical buses are not; energized and the MP2 cross tie is not 'in use, this node addresses the' restoration of AC power on both
.4160V_AC buses.by cross connection. The development'of-this node is the same as in the LNP event tree Node Uy , Section 2 M.1.;
- 10. - Restoration of Main Condenser - Node H3 This node addresses the restoration of the main condenser as..a longL term:decey heat removal system. .The development of this' node is the same as in the Reactor Trip' event tree Node 3H , Se ti n 2.4 3
- 11. IC and'IC Makeup Available - Node IC O
Node IC addresses the availability of the Isolation Condenser and-Makeup. The development of this node is the same as in the LNP event" tree Node Kg .
.p
- 12. SDC and Alternate SDC. System - Node M i
! Node M addresses successfully placing the reactor on Shutdown Coolind -
or Alternate Shutdown Cooling for long term decay heat removal. The development of this node is the same as LUP event tree Node M, Section
.2.4.1.
p O 2.u-70 MILLSTONE UNIT 1 AMENDMENT 2 PROBABILISTIC SAFETY STUDY
2.4.13 A W S With Main Condenser. Operating (A11G-1) p The Anticipated Transient Without Scram (AWS) event trees apply to those U transients and Small Small. Break LOCA sequences for which the reactor failed to scram. The event tree discussed in this section models the transients in which the main condenser continues to function (A WS-1) and controls the RPV pressure during the event. This event tree model is entered via a " transfer-in" from the Small Small LOCA and reactor transient with main condenser (MC) available event trees. Definition of Top Nodes
- 1. ATWS With Main Condenser Operating (ABG-1)
An ATWS with the main condenser operating is a combination of the following events:
'o Failure of the control rods to insert after an initiating event occured.
o Successful operation of the Main Condenser as it continues to remove core heat and control RPV Pressure.
- 2. TBVs Maintain RPV Pressure - Node H)
In an ATWS, the turbine bypass valves (TBVs) open following turbine trip and discharge steam into the main condenser (MC) where it is condensed and returned to the vessel via the Feed System. The TBVs keep the steam line pressure at 980 psig which translates into a pressure of about 1030 psig in the TRPV dome. the main condenser The success criteria at Node H3 are defined as: continues to remove core heat and the TBVs maintain the RPV pressure between the two limits described below. O b 2ammT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
-o. higher than the low pressure: setpoint (825 psig) at which. the .J l
MSIVs close, isolating the main condenser. A l I. ); ' Lower,than.the setpoint for.the SRVs (1095 psig) to avoid cycling .) o-them and diverting ' steam from the core to;the torus, causir:g it to heat'up. The equipment needed for success at Node H involve 1 operation. of all TBVs and.at least 3 circulating water pumps in~the main condenser. 3 Operator Action to Start SLCS - Mode 070 a In an AWS event, the core power increases to about 130%' following j turbine trip 'due to loss .of FW heating. Since 130", power is . higher than the - rated heat removal capacity of the main condenser, its pressure begins to increase (i.e.,:the MC begins to lose vacuum). At.
-Low Vacuum (7" of Mercury Vacuum) the TBVs close, isolating -the Main Condenser. The Emergency Operating Procedures (EOP572 & 576, Appendix
- 2B) direct the operator to take the following actions to reduce core g.. power:
Q o Trip the recirculation pumps o Start the standby Liquid Control System (SLCS) to inject a concentrated Sodium Pentaborate solution into the vessel-o Maintain the RPV level above the top of active fuel (TAF). o Isolate the Reactor Water Clean Up System (RWCU) if it has not automatically isolated on a low RPV level. l Node 0 represents the cognitive operator error to perform the task 70 described above. The success criteria for the node is defined by the operator carrying out these actions before the TBVs close on 2ow main condenser vacuum. O 2.4-73 MILLSTONE UNIT 1 AMENDMENT 2 PROBABILISTIC SAFETY STUDY
i-I L 4 -Feedwater Maintain the RPV Livs1 - No e C)
.Following an ATWS, the_feedwater system continues to operate-with the RJ regulating valves controlling the RPV water level. The success at Mode Cj is' defined as ~ both trains of RI system continuing to operate i.e. two FW pumps, two condensate booster pumps, two condensate pumps-and both RT regulating valves.
5 ~ Standby Liquid Control System - Ncde Y).
' is defined as at least 1/2 Standby The success criteria for Hode Y)
~ Liquid Control System (SLCS) pump. trains . injecting Sodium Pentaborate at a rate of 43 gpm. This node also includes the firing of one-explosive squib' valve.
- 6. Operator Actions for Long Term Decay Heat Removal - Mode 073 The Emergency' Operating Procedures .(EOP572, Appendix 2B) direct the operator to start the plant cooldown after 470 pounds of boron have 1
O- been injected. . Following an ATWS, the operator will use either the ig. Main Condenser or the Shutdown Cooling System for cooldown. This node represents the ' cognitive operator decision of not providing for.. long-term decay heat removal by starting the SDC or by restoring the Main Condenser if the MSIVs had isolated it. 7 Restoration of Main Condenser - Mode H 3 During the period when the SLCS is being used, the operator may reduce the RPV level below the Low Low level setpoint to further reduce the l corepower (see E0P 575, Appendix 2B). This may cause the MSIVs to . close, isolating the Main Condenser. Therefore, use of the Main Condenser for cooldown may require restoring it as a heat sink. The success criteria for Mode H3 is defined as drawing vacuum in the Main Condenser by starting the mechanical vacuum pump, starting at least one circulating pump and opening at least one set of NSIVs (i.e. , in one steam line).
'O v
AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
p, . o- Low:r thm. RPV level to reduce the cora pow:r; although' the level is to be maintained above the core at'all times. .V .o Isolate the Reactor Water Clean-Up System (RWCU) if it has not already occured automatically. o .After 470 Pounds of Boron are injected, the operator recovers the RPV level by starting FW or the low pressure pumps.- 5 Standby Liquid Control System - Node Y3 Node Y addresses the ability to start at least 1/2 SLCS pumps and 3 open 1/2 explosive squib valves. The development of.this node is the same as for AWS with main condenser operating event tree -(ATWS-1) Node Y , Section 2.4.13 3
- 6. Operator Action to Depressurize RPV - Node 073 This node represents the cognitive operator decision in maintaining an adequate heat capacity of the torus. During the transient the torus M -- heats-up and the Emergency Operating Procedures direct the operator to
- depressurize the RPV by opening the Safety / Relief valves to keep the RPV pressure below the torus heat capacity temperature limit . curve (EOP 580, Appendix 2B). This action is necessary to avoid unstable steam condensation in the torus which may cause oscillating loads, [
challenging the integrity of the containment. As instructed in E0P 580, the operator will start to depressurize the RPV when the torus heats up to 160 F, which is estimated to occur in about 15 minutes. The success criteria for Node 073 is defined as the operator keeping the RPV pressure below the heat capacity temperature limit of the torus by depressurizing it (RPV). 7 Safety Relief Valves (Mamml) - Node I O AMENDMENT 2 2.4-80 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
h Nods I addrtss s ths ability to manually open at.' Itast 2/6 Safety / Relief valves in order to depressurize the RPV. The development
. of the node is the same as in 'the LNP event tree Node I, Section r'T O 2.4.1.
- 8. Restoration of Feedwater - Node C3 Success at this node requires restoration of at least one train of W system. Node C represents restoration of the RPV level.by starting 3
the W system. The success criteria for Wode C 3 18 d*fi"*d' 8 manual starting of one W train to recover. and maintain the RPV level in the normal range. One W train includes operation of 1 condensate, 1 condensate booster, 1 W pump, 1 W regulating valve . and other associated valves. The error of commission associated with this action is included with Node C3. The cognitive error associated with starting the feedwater is accounted for in Node 050 9 Core Spray and LPCI Systen - Node E This node addresses manual starting of st least 1/2 Core Spray Pumpa f}
' or 1/4 LPCI pumps. The development of this node is the same as in the LNP event tree Node E, Section 2.4.1.
- 10. Shutdown Cooling System and Tonas CMing - Node M2 In an A'NS with main condenser isolated, the torus continues to heat-up during the time period when the SLCS is being used to inject poison in the system. A successful mitigation of the event requires the operator to take the following action: ,
o Place the reactor on the Shutdown Cooling System for cooldown. o Initiate torus cooling. 2.4-81 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
... ' Tha succ:ss criteria for 'the 3DC is 'the same as in ths AWS-1' evznt '
tree (Section 2.4.12).. The succesc' criteria for the torus cooling is'- defined as the operator taking the following actions. 73 (/' o Placing 2/2 LPCI containment cooling heat exchangers o Starting 1 of 2 ESW ptanps per LPCI containment cooling heat exchanger running o Starting at. least 1 LPCI pump per train - taking suction from the torus and discharging . back to it- via the heat exchangers. f I l O u
- 2. W m mT2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
2.4.15 Loss of 120V Vital A.C.
~ ' r'3 The loss of vital A.C. event tree' models a transient initiated by a loss of
([ U < 120V Vital A.C. concurrent with a manual reactor trip. It,is expected that the operator would scram -the reactor based on indication from the control room panel's (CRP.) following a loss of vital A.C. As the high level feedwater trip f is powered by vital AC, the feedwater pumps need to be manually tripped in. , order to prevent a possible water hammer in the main steam lines and the IC ; which would cause extensive damage.- ( Definition of Top Events:
- 1. Loss of 120V Vital A.C. -Initiator 7 A loss of Vital A.C. is defined as loss of power to all components powered by the 120V Vital A.C. power system.
- 2. Operator Manually Trips the Reactor - Node R Loss of Vital A.C. power results in symptcms resembling a loss - of reactor vessel water level or an AWS event due to loss of power to 4 of 5 RPV water level indicators, annunciation of a half-scram condition and lack of rod-bottom indicating lights. This analysis assumes that the control room operators follow their training, believe their instruments and take action to manually scram the reactor and trip the turbine. Failure to manually scram the reactor results in a long term quasi-steady state with the inability to change feedwater flow.
Success at this node requires that the operator adequately diagnoses the event ' prior to tripping the reactor and manually trips the Feedwater Pumps. Failure at this node is assumed to lead to water hammer in the main steam lines and the IC resulting in a loss of the IC and main condenser for decay heat removal. y 3 Feedwater Restoration - Hode C 3 MGMsT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
<F This node addresses successfully restoring one RJ train -from the ,
e j/"% i-: control ' room before the low-low ' level setpoint is ' reached. One ' Fil i s/. . train includes operation of 1 Condensate Pump, 1. Condensate __ Booster Pump, '1 Feedwater Pump and proper operation of all. associated valves. The cognitive error associated 'with restoration of feedwater is accounted for in Node 0g3 i
- 4. Core Spray or LPCI System - Node E.
This node addresses manually starting 1 of 2 Core Spray pumps or 1 of 4 LPCI pumps. The development of this node is the same as in'LNP
' event tree Node E, Section 2.4.1.
The cognitive error associated with the operator action to manually.. start a low pressure pump is addressed in Node R. 5 Safety Relief Valve (Manual) - Node I The success criterion for Node I is defined as the operator manually depressurizing the RPV by opening at least 2 out of 6 Safety / Relief valves. The development is the same as LNP event tree, Node I, l Section 2.4.1. The cognitive error associated with the ' operator action to manually open S/B valves is accounted for in Node R..
- 6. Restoration of AC by Cross Connection - Node U4.
\
Node U4 addresses the ability to restore AC power to both AC buses via-cross connection. The development is the same as LNP event tree Node U4, Section 2.4.1.
- 7. Restoration of Main Condenser - Node H3 This node addresses the restoration of the main condenser as a long term decay heat removal system. The development of this Node is the same as in the Reactor Transient event tree, Node H3, Section 2.4 3 O
v ) 2.4-84 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- 8. SDC and Alternate SDC - Node M jg .
Q) Node M addresses successfully placing the reactor on Shutdown Cooling or Alternate Shutdown Cooling for long term decay heat removal. The development of this node is the same as LNP event tree Node M, Section 2.4.1.
,-~\
L)
'[N bg 2.4-85 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY S'IUDY
25 TIME DEPEIOENT STATION BLACKOUT ANALYSIS .p lQ Introduction and mmmary This analysis was performed to elimate some of the conservatism inherent in the Station Blackout modelling in this study. A lot of the conservatism arises from the time-independent nature of the Emergency AC Power fault tree analysis. Three conservative assumptions from this analysis that result in time-independent modelling are as follows:
- 1. The emergency generators are assumed to be required to run for a 24 hour mission time, regardless of the length of the offsite power outage.
- 2. If a generator fails to run anytime during the 24 hour mission time, it is assumed to be unavailable for the entire 24 hours.
3 If a generator is out of service for maintenance, it is assmed to be removed from service immediately prior to the loss of normal power. l In order to eliminate the conservatism induced by these assmptions, a time-dependent Station Blackout model was developed. This model is only used to model the dominant sequences for a Station Blackout following a Loss of Normal Power as the initiating event. l J Model Development The expression for the total frequency of Station Blackout due to the loss of ,
'1 both generators can be approximated by four distinct cases of generator unavailability. These cases are as follows:
- 1. Both generators are unavailable at the time of .the Loss of Normal Power (LNP). This includes independent failures to start and generator maintenance (common cause failures are not included due to the diversity of design of the diesel and gas turbine).
AMENDMENT 2 2 5-1 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- 2. One generator is unavailable due to maintenance and the other fails while running.
() 3 One generator fails to start and the other fails while running.
- 4. Independent failures of both generators to run.
By rearranging and modifying the equations from Reference 4.5-1 to account for-the diverse power supply and the MP1-MP2 AC Power Cross-Tie, expressions for the frequency of a Station Blackout of duration "r" hours or longer were developed for each of the four cases.
- 1. Both generators unavailable at the time of the LNP 1
P D1
- An[9fg*9fd fg( fd(7} "On ( )' 2( }
+ A g ggg exp(- A n O(
n 2 fg md [ + A qfd Anexp(- An tNn( 2 fd(7 mg
+7
= A9 9 eXp(-(a +ag )7)[Aexp(-aT)+Bexp(-bT)]exp(-A d 27) n fg fd
+ [A mg9 fd(An/(An+ "g))eXp(-ad + "g} #}
+ A md 9 fg( " (An+ "d))exp(-(ad + "g)7)3
* [A exp(-a7) + B exp(-bT)]exp(-A27)
- 2. One generator, is out for maintenance and the other fails while running:
m=
^ AfdeXp(-Afd*)0fd(7 mg(*+7)A**P(~Y n
PD2
- ot
- Qn(x-t+7)Q2(x-t+ 7)dxdt AMENDMENT 2 2.5-2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY S M Y _
==
'+ A AfgeXP(- Ag x)Qg(7)((x+7)A eXPC-A n t) l n
m *T () _
- On(x-t+7)Qp(x-t+ 7)dxdt
- AAn mgA fd e exP(-(ag +a d+ 2)T)
An ^fd"g
~'
- Aexp(-a7) Bexp(-b7) I
+ l (Afd+"g+a+A2 } (Afd+"g+b+A2 ) l
+ AA n M A fgexP(-(a+d+YT) g An+Afg+"d _
* ~ Aexp(-ar) Bexp(-b 7) ~ l, .
(A fg+a +a+Ap ) (A fg+a +b+A ) d d 2 3 One generator fails to start and the other fails while running
/
(, P D3
- A9n fd0fd(7) Arg eXP(-Afg W)Qfg(W+7)Qn( +7) 2(W+7)dw "O
+ A9n fg0fg(*) A fd**P(~ Afd W)0fd( +7)0 (W+7)Q n (W+7)dw 2
O
=A9 n Afd eXP(-a fg 7) d AexP(-(a +a+A g 2)T)
Bexp(-(ag+b+A )7) 2 i (Afg+ag+a+A2 ) . (Afg+"g+b+A2 ) _
+A9 A eXP(-a "Aexp(-(a +a+Ap )T) g7) n fg fd d Bexp(-(ad+b+Ap )T) i (Afd+g+a+A) 2 IAfd+"d+b+A2 ) !
- 4. Both generators fail while running mm P
D4
- An ArgeXP(-Afg x)Qfg(t-x+7)Qn(*+7)
- Q p(x+7)A fd eXPC- Afd t)Qfd(7)dtdx f
N)' MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
+ An N txp(-Afd*)Ord( ~*+7}En (*+7) 0X t}.
- Q (*+7) Afgexp(-Afg t)Qgg(7)dtdx 2
= AAn fg Afd**P(~("g+"d }7)
-(ag+Afd) ,
'~ ~
# Aexp(-(a+Ap )T) Bexp(-(b+A2 )T)
_(Agg+Afd+a+A2 ) IAfg+Afd+D+A )2, where: PDx = Frequency of core melt for case "x" A n
= rate of Loss of Normal Power Amd = Diesel maintenance rate A
mg
= Gas Turbine maintenance rate Afd = Diesel rate of failing to run A
fg = Gas Turbine rate of failing to run qfd = probability of the Diesel failing to start qf .= probability of the Gas Turbine failing to start ' i Omd(t) = Qg(t = probability of non-recovery of the Diesel by time t after maintenance / failure
= exp(-ad)
((t) = Qgg(t) = probability of non-recovery of the Gas Turbine by time t after maintenance / failure j l
= exp(-ag t) d= for the Diesel mean time to repair "g = for the Gas Turbine mean time to repair Q (t) = probability of non-recovery of Normal Power n
= Aexp(-at) + Bexp(-bt)
A,B,a,b = constants fitted to empirical data Q2 (t) = probability of failing to cross-tie to MP2 by time t z exp(-Ap t) where A 2 is a constant fitted to calculated data 7 = Coping time j
- AMENDMENT 2 MILLSTONE UNIT 1 l
PROBABILISTIC SAFETY STUDY
Determination of Realistic Station AC Blackout _* Coping Times'2 W m There are several' competing effects which determine the coping time during an
'Q '
AC Station Blackout event at Millstone Unit 1: o Successful initiation of the IC and IC makeup. I
- o. Successful reclosure of the S/R valves, l
o Rate of depletion of the Station Batteries. An event tree (Figure 2 5-1) was developed in, order to quantify the probability distribution of the coping time. The available times for each node were
. determined using the MAAP computer code and simplified hand calculations. The definition of each Node is as follows:
4
- 1. Station Blackout - Node' STB 0 A Station . Blackout is defined as a loss of normal power with coincident failure of the gas turbine and the diesel generator to power AC buses 14E and 14F.
- 2. 'IC Manually Initiated - Node ICM Success at this node implies that the IC is initiated within 7 minutes of the LNP whiah precludes the S/R Valves from opening.
3 S/RVS Fail to Reclose - Node S/RV This node represents the probability of S/RV failing to reclose if Node ICM is not-successful.
- 4. Manual or Auto IC - Node M/AIC This node represents the probability of initiating the IC (including restoration) given that Node ICM was not sucessful in the first 7 minutes.
AMENDMENT 2 2.5-5 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
q , NN; gi: W
'> ak
}
- 5. Manual.orAutoICMakeup-Nod $M/AICH. b s
WThis' node 'representslthe probability of" providing makeup to the' IC 5 p
- 7) using the Fire Water System. ,,,
~
.]
- 6. DC Batteries.> 8 hours - DC8 ]
The distribution times for battery . depletion were constructed based on- .j available test ' data that indicates a ~ 95% confidence of ' providing ' sufficient DC power for.12 hours.
- 7.- 'DC. Batteries > 12 hours - Node'DC12 The' distribution times for battery depletion were constructed based on
. available test data that' indicates - a 47.4% confidence of providing.-
sufficient DC power for greater than 16 hours. A
.The event tree was. quantified with a resulting PDF as follows:
yc 7 P( 71 ) 1 c -0.5 hrs. 4.38E-4 1.0 hrs.. 2 94E-3 1.5 hrs. 1.13E-2 l' 8.0 hrs. 4.92E-2 12.0 hrs. 4.92E-1
>16 hrs. 4.44E-1 Using this distribution a mean coping time of 13 42 hours was obtained. Final calculation of Station AC Blackout core melt frequency uses Monti Carlo sampling from the above distribution.
5 O 1 AMENDMENT.2 t 2.5-6 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY _ _ = _ _ _ _ _ _ _ _ _ _ -
ii
\
I 1 e .
- Data'Used in the Core Melt Frequency Model 1-Distribution Data Source-Tenn ' Mean'Value .yariance iA n 1.13 x 10-1/hr- 3 00 x 10-3 Gamma section 1.2.1 Section-3;1 3 Ag 1 31 x 10-3/hr 15 44 x 10-3 . Gamma A
Gamma Section 3 1 3' 1.0B}10-2/hr 1.87'x'10-4 A 9 53 x 10-4/hr 7.80 x 10-7 Gamma. Section 3 1 3 fd: A ; 1.49 x 10 3/hr- N/A Point Estimate "ecbion 3 1.3-S f8 3 56 x.10-2 # 1.27 x 10-3 . Beta Section 3 1 3&3 2.4 qfd 3/34 x 10-2 N/A- Point Estimate' Section 3 1 3 qEg
# Includes failures of SW-9 -
The non-restoration distributions are given by the following expressions: , Dnergency Diesel: Qg(t) = Qfd(t) = exp(-adO asM on M a j s from Section 3 1.3) a d = 1/10.1 hrs (based on data Emergency Gas Turbine: Q (t) = Qfg(t) = exp( gt) from Section c-g = 1/25 5 hrs 3 1.3) Offsite Power: Q (t) = Aexp(-at) + Bexp(-bt) A = 0.4 a = 0.297 (Reference 2.5 1) B = 0.6 b = 4.6 Y f' w i i i 4
-A: AMENDMENT 2 2.5-7 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY ,
---___--_-_a__ -
MP2 AC Cross-tie: -Q (t). exp(-A t) 2 2 (fitted to data from Section 3 2.26) D
'Q A2 = 1.12 Results i.
The overall' Station AC Blackout Core. Melt frequency was calculated using Monte Carlo simulation techniques with a sample size of 40,000 via .the SPASH Code. - The results are summarized below: f I
. Case <A> (A) 95 .
Case (1) 9.73 x 10-7/yr 4.02 x 10-6/yr . i Case (2) 1.58 x 10-8/yr 6.48 x 10-8/yr. Case (3)- 4.87 x 10-9/yr 1.35 x 10-8/yr , i Case (4) 2.09 x 10-9/yr 6.54 x 10-9/yr j 1-Total 9 96 x 10-7/yr 4.08 x 10-6/yr l l f 5 O mm2 2. M ' MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
; l l
1 E M I
!: T S S S N S S S N N N R R R I R R R I I I G H H H M H H H M M M nv N
I P s 2 8 0 6 2 8 0 0 0 i 1 9 1 1 9 6 3 O C > > E E R B T O R T P N E E V M E I T 1 1 2 2 3 3 4 4 3 4 T 0- 0 0 0 0 0 0 0 0 0 U G - - - - - - - - - O N E E E E E E E E E E K I 7 5 5 i 3 7 7 1 4 0 C P A O 3 8 0 i. 7 4 4 7 9 3 L C 4 4 4 i 6 7 7 1 2 4 B C A SS ER N IH 2 O - R 1 I DCE2 C T T1 D A T T A> S B
,I ,I i P
M S ES I R 1 H B CR EB C 5 DT D T> A 2 B E R U
/. G R I 7 OCP M F IU C L E I AOK A UTA /
NUM M AA M RC DI C I LO A AT / U M NU AA M OE ST S V V O R RLL
/I E C /
S SA R F D YE LT LA M . CAI C IUT I - NI _ AN . MI 2 T N E T 7 NU M OO D IK TC 0 B T 3 f M m _ AA S A TL _ SB
'. e t 1l ll e
TABE 2A-1 (') . SYSTEM DESCRIPTION UNAVAILABILITY REFEREEE Fmm SYSTEMS l Reactor Trip 1.0E-5 Section 3 2 7 Vapor Suppression System: At least One Vacuum breaker valves fails to remain closed 2 31E-5 Section 3.2.10 ECCS: Low Low Level Fails 1.55E-4 Section 3 2.16 High Drywell Pressure Fails- 1 55E-4 Either high drywell Pressure or 3 11E-4 Low Low Level Signals fails Low Pressure Permissive 1 55E-4 Section 3 2.17 Safety / Relief Valves: Failure to reseat on demand 1.0E-3 Section 3 2 9 Probability of 1 S/R Valve sticking open in 3 cycles 9 97E-3 in 10 cycles 2 37E-2 Recovery of offsite Pouer See Figure l Section 3 2.2 2A-1 for Probability of Recovery 2 Loss of DC 101A or 101B 2 3E-4 Section 3 2-1 i
- 1. The human error probability (HEP) associated with recovery of offsite power is based on the Rule based behavior model (i.e. QHEP = 1 3E-2).
- 2. The value used in Support State Quantification.
O AMENDMENT 2 2 A-4 MILLSTONE UNIT 1 mrdrwerLvswe enrsE7 292s?
TABLE 2A-2 V LOSS W 4.16ky AC BUS NON-UIP CASE REF: SECTION 3 2.2 Description Loss of 4.16 kv AC Bus' Loss of 4.16 kv AC Bus 14F# 14E# Unconditional.Value 1.11E-3 3.97E-4 Loss of 14E Given 14F has i 1 Failed 1 96E-2 Loss of luE Given 14F has . 1 Succeeded 3 97E-4 1 I f~ U) 6 The Values used in Support State Quantification
- 1. Conditional Unavailability of 14E is calculated as shown:
l 0 0 14E "AND" 14F = 6.43E-6 14E/14F = Q34p+ 3.28E-4
+ Non-Restorable O
AMENDMENT 2 2 A-6 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
D l
. TABLE 2A-3 , \_/
LOSS & 4.16kv Bus l. le 1 . IJF CASE RIF: Section' 3 2.2 Description- Loss of 4.16 kv Bus Loss of 4.16 kv Bus 14F# 14E# i Unconditional value 3 12E-2 1.20E-1 I Loss of 14E Given'14F 1 35E-1 has failed Loss of 14E Given 14F 1.20E-1 has succeeded
# The values used in Support State Quantification.
- 1. Conditional unavailability of 14E is calculated as shown below:
14E "AND" 14F = 4.20E-3 014E/14F = 0 347 3 12E-2 O i MILLSTONE UNIT 1 meAaTLfsfe mm:my sul
TAB E 2A-14 AUTGl& TIC DEPRESSURIZATION SYSTEM (ADS) AID SAFETY / RELIEF VALVES (S/R VALVES) BUTH N054JIP AID LIIP :5urrumi STATES Retr.urx ES: SECTION 3.2.18 Support State 2/4 Valves Open Auto S/R Valves Manual Failed Systems Given both ECCS Available 2/6 Valves Ocea Manually 1 Nothing 2.57E-3 6.70E-4 2 SW 2.57E-3 6.70E-4 3 14E 2.57E-3 6.70E-4 4 SW ' 14E 2.57E-3 6.70E-4 5 14F 2.57E-3 6.70E-4 6 14F # SW 2.57E-3 6.70E-4 7 14E
- 14F 2.57E-3 6.70E-4 8 101B 0 322 6.81E-4 9 101B # SW 0 322 6.81E-4 10 101B # 14F 0 322 6.81E-4 11 101A 0 346 1.28E-3 12 101A
- SW 0 346 1.28E-3 1.28E-3 l 13 101A
- 14E 0 346 14 101A
- 101B 1.0 1.0 1
1 l l l l AMENDMENT 2 2 A-19 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
r I ( ., ly). TABLE 2A-15 AC CROSS-CONNECTION NON-LNP SUPPORT STATES
REFERENCES:
SECTION 3.2.2-SS. Support State Definition Restoration of Notes
# Failed Systems- Failed AC Bus By Cross-Connection l
1 Nothing Not Needed 2 ~SW Not Needed 3 14E 1.11E-3 Cross-Connection at 480V Level 4 SW # 14E 1.11E-3 Cross-Connection at' 480V Level 5 14F 3 97E-4 Cross-Connection at 480V Level 6 14F # SW 3 97E-4 Cross-Connection at 480V Level
.7 14E # 14F 1.0 8 101B 3 97E-4 Cross-Connection at 4.16kv Level V 9 101B ' SW 3 97E-4 Cross-Connection at 4.16kv Level 10 101B # 14F 3 97E-4 Cross-Connection at 480V Level 11 101A 1.11E-3 Cross-Connection at 4.16kv Level 12 101A
- SW 1.11E-3 Cross-Connection at 4.16kv Level 13 101A
- 14E 1.11E-3 Cross-Connection at 4.80V Level 14 101A
- 101B 1.0
- 1. The human error probability (HEP) associated with cross-connecting AC Buses is based on the Rule based behavior (i.e. QHEP= 3E-2).
AMENDMENT 2 2 A-20 MILLSTONE UNIT 1 mromBTLSm7?rd esrs7 28Mi6Fl
TABLE 2A-16 (G y/ AC CROSS 4(MBCTICII LNP SUPPORT STATES RE'ERENCE: SECTION 3.2.2 SS Support State Definition Restoration of Notes
# Failed Systems Failed AC Buses by Cross-Connection l 1 Nothing. Not Needed 2 SW 1.20E-1 Cross-Connection at 4.16kv Level 2
3 14E 3 12E-2 Cross-Connection at 4.16kv Level 4 14E # SW 1.0 5 14F 1.20E-1 Cross-Connection at 4.16ky Level 6 14F
- SW 1.20E-1 Cross-Connection at 4.16kv Level 7 14E
- 14F 1.0 8 101B 1.20E-1 Cross-Connection at 4.16kv Level g
i 9 101B
- SW 1.20E-1 Cross-Connection at 4.16kV Level 10 101B
- 14F 1.20E-1 Cross-Connection at 4.16ky Level 11 101A 3 12E-2 Cross-Connection at 4.16ky Level 12 101A # SW 1.20E-1 Cross-Connection at 4.16ky Level 2
13 101A # 14E 3 12E-2 Cross-Connection at 4.16kv Level 14 101A
- 101B 1.0 I
i
-1
- 1. The human error probability (HEP) associated with cross connecting AC Buses is based on the Rule based behavior model (i.e. QHEP = 1 3E-2). f l 2 Partit.1 recovery of 14E. It is limited by the total load on 14E and 14F not to exceed the Diesel Generator capacity.
r ( x. AMENDMENT 2 2 A_21 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY l
i l i u j d TABLE 2A-19 I (o ' BOTH NON-LW AID LMP SUPPORT SMTES 1 I
REFERENCE:
SECTION 3.2.23 SS Support State Description 1 SDC Loop Local 1 SDC Loop No Local I
# Failed Systems Recovery of MOV Recovery of MOVs Possi~ ole i.e. No 1.e. Fuel Damage Fuel Damage Non-LNP LNP 1 Nothing 2.28E-2 3 21E-2 1.0 2 SW 1.0 1.0 1.0 3 14E 4.68E-2 5.61E-2 1.0 .t 4- 14E
- SW 1.0 1.0 1.0 5 14F' 1.0 1.0 1.0 6 14F
- SW 1.0 1.0 1.0 7 14E # 14F 1.0 1.0 1.0 8 101B 4.68E-2 5.61E-2 1.0 9 101B
- SW 1.0 1.0 1.0 10 101B
- 14F 1.0 1.0 1.0 11 101A 1.0 1.0 1.0 12 101A
- SW 1.0 1.0 1.0 13 101A
- 14E 1.0 1.0 1.0 14 101A
- 1018 1.0 1.0 1.0 l
b AMENDMENT 2 2 A-24 HILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
l TAB E 2A ,20 r
.(
ALTEMATE SIRmX2BI COGlNG SYSTEM
REFERENCE:
SECTION 3.2.26 l-SS Support State Definition Both Loops of Alternate Failed Systems I
# SDC 1 Nothing 2.13E-3 2 SW 2.13E-3 3 14E 7.50E-2' 4 SW
- 14E 7.50E-2 5 14F 3 19E-2 6 14F # SW 3.19E-2 7 14E
- 14F 1.0 8 1018 3 19E-2 9 101B
- SW 3 19E-2
/O 101B # 14F 1.0 V 10 11 101A 3.19E-2 12 101A # SW 3 19E-2 13 101A
- 14E 1.0 14 101A # 101B 1.0 l
- 1. The human error probability (HEP) associated with initiating the Alternate j I
SDC is based on Rule based behavior model (i.e. QHEP = 1.3E-2). 4
)
AMENDMENT 2 2 A-25 , MILLSTONE UNIT 1 i PROBABILISTIC SAFETY STUDY
O ! 1 m ...... m . m . m . m m . m m m m m ..... m .. m ..... m m ...... m ... 11iIS PAGE IlmMT1 "UJ LEFT BLAK
*nuna m m enennmane**ea m en m a.*****.e m annen. m e m a m aa m . m m m e n O
AMENDMENT 2 2 A-26 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
APPEIDIX 2-C 'DIERMAL HYDRAULIC BASE 3 FOR SUCCESS CRITERIA r"x. This appendix documents. the analysis which ' formed the bases for the success criteria used- in the study. The results' are obtained from five categories of-analysis. 'These four categories are: o ' Detailed _ plant specific transient analysis performed by General' Electric for Millstone 1 utilizing the SAFE and CHASTE computer codes. 1 o Simplified boil-off and clad' heat calculations. o Generic analysis performed for BWR/3s by General Electric for the BWR Owners Group. o Generic analysis performed by the National Laboratories under contract with l the NRC. o Best Estimate Analysis performed using the MAAP and COMPACT computer codes. pi The following sections strnmarize the methods used in the analyses, and the results. b G AMENDMENT 2 2C-1 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
20.1 i Method'and' Assumption p The success' criteria usedlin this study. are based on the results of
-the best. estimate (i.e' ' realistic) thermal hydraulic - analyses.
. In addition to computer analysis L with Hillstone Unit 1' specific . input-
'(Reference ' 1), -a number of simplified boil-off and clad: heat-up calculations.(hand calculations) were performed.: ,
The: computer analysis. utilized G.E.'s approved licensing evaluation models (SAFE and CHASTE). The SAFE code is' used to track the vessel inventory.and to model ECCS performance. The CHASTE code - is used : to calculate the fuel cladding heat up rate, peak cladding . temperature and cladding oxidation. To obtain realistic results, several inputs were . changed 1from the values G.E. normally uses for_ licensing analyses. The following are the most" significant realistic input changes: o Best Estimate Core Decay Heat Source
; The analysis utilized 1979 ANS decay heat curve with a multiplier.
of x 1.0. o Realistic Treatanent of CCFL~ The SAFE code provides .a. good overall prediction of the system mass and energy balance. While the effects of' Counter Current Flow Limitation (CCFL) are not modeled, the overall results remain conservative. CCFL at the top of the core tends to limit the downflow of ECCS . water delivered to the core from above. CCFL at the bottom of the core, however, tends to limit the rate at which water drains from the core and facilitates refilling the core with water even before the lower plenum refills. While the combined effects are not equivalent, the lack of CCFL modeling in SAFE tends to produce a conservative estimate of core inventory. l In addition, integral system tests demonstrate that CCFL at the top of the core breaks down rapidly during core spray injection AMENDMENT 2 2C-3 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- i. .
L._______1_____ __
( ~'., r,
.resulting..-in r:pid draining of water. from fabove ' thefcore, ,
- p/od'ucing . rapid . core 'reflooding. Therefore,-- neglectingMCCFL
.f - effects does not cause any non-conservatism in~ the prediction' of -
k "overall system response. o : Steam Cooling'
~ The analysis: took credit for steam cooling .in the region of fuelt above the two phase level (i.e. uncovered ~ portion of th'e core).
'o ' Measured System Perfor1 nance Data
.Whenever~ available,. the analysis. used the measured system
. performance data instead of design minimum values.
Boil-off ' and heat-up calculations using the MAAP code utilized the -l
-1979 ANS ' decay heat curve with a : multiplier ~ of x - 1.0. The - core boiloff rates for various scenarios where calculated. by assuming the.-
initial RPV inventory at saturated conditions at 1050 psia.
~
Initial RPV inventory at 100% inventory at 100% . power is 4.06x10 5~ lbs, which corresponds to a level of 512.5" from the bottom of .the RPV. Table ~ 2C-1 summarizes water volumes ' for various elevations in the RPV.
.O-2C-4 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
i 2C.2 Loss cf Normal Power Transient
' Following an ' LNP event', the- reactor scams and the feedwater and CRD
/]
V At this point,. all injection ' sources capable' of pumps trip. maintaining the RPV inventory are lost. ' The _ immediate ope'ator r actions are to close the MSIVs and initiate the 'IC (see ONP 503 B, ;l' Appendix 28). In this analysis it is asstuned that the . operator closes the MSIVs. However, since the purpose - of .this' analysis is to determine the mimimum time available for the operator to restore RPV level, it is arbitrally assumed that the operator's immediate action of ' initiating the IC fails. The RPV pressure rises to the Safety / Relief - the valve setpoint -(1095 psig) and valve with -lowest setpoint begins- to cycle (See Section 2.4.1 for number of valves which will cycle). The RPV inventory depletes and. the RPV level begins to drop. Table 2C-2 lists some of the pertinent data for this analysis. E0P 571 (Appendix 2B) instructs the. operator to depressurize the RPV to 900 psig by manually opening. S/R valves. The purpose' of depressurization is to stop S/R valves from cycling and thus prevent
, possible valve failure. The RPV pressure is maintained at 900 psig by manually keeping S/R valve (s) open. .As the RPV is depressurized, RPV inventory flashes. As listed in Table 2C-2, total loss of inventory 4
due to flashing is estimated to be 1.45 x 10 1bsm. At ten minutes following the LNP, the RPV level drops to the low-low l setpoint. The RPV inventory at that time has been depleted from an 5 5 initial value of 4.06 x 10 lbs. to 3 39 x 10 lbs. iIf no additional operator action were taken and if FWCI and IC failed to initiate automatically on low-low level, the boil-off would continue and level would drop to the top of the active fuel (TAF) in about l, 4 twenty-two minutes (corresponding RPV inventory lost is 9 95 x 10 lbs). For this analysis, it is assumed that at ten minutes when the level is at the low-low level setpoint, the operator takes action to restore l, l RPV water level. The operator has at least 3 methods of restoring RPV O N2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ \
+
4 kevel ~ and any one. of tha three . methods = is sufficient . as discussed
- below:
\. h .
~
o: Level Restored by FWCI i The operator starts 1, Feedwater. train. - Since FWCI can linject l.1 L - water' at ' full' system pressure, no: depressurizationiis' needed. FWCI ..will begin to , increase - RPV ;1evel, thus . preventing'. core
-uncovery.
o- Level Stablized and Recovered by IC: The' operator places the IC in service. The IC condenses the core-boil-off and returns the condensate to the RPV. Since the IC can condense more steam than' generated due to. core boil-off at ten minutes, the RPV will begin to depressurize. The S/R valves, which were manually opened to maintain' RPV pressure at 900 psig are closed. Even though the RPV is not. losing any. inventory, the water level decreases due to increases in. density' of 'the' remaining inventory as RPV pressure drops. It is estimated. that RPV ' pressure drops to 200' psig in about 1 hour, and ' RPV : water level remains a few inches above the top of the active fuel l. (TAF). For . this analysis, it is assumed that the operator' restores RPV level within one hour by starting a pump (for example, a CRD purnp) and.thus prevents core uncovery. o Level Restored by Low Pressure Pumps The operator starts one low pressure pump (LPCI or CS) and 1 manually opens 2 S/R valves to rapidly depressurize the RPV. As lk the pressure falls, the RPV inventory deceases due to flashing and core boil-off. The RPV collapsed level not only decreases due to a decrease in RPV inventory, but also due to the increase l in density of the remaining inventory. When the RPV pressure falls to 235 psig, the operating low pressure pump begins to inject. The pump injection rate increases as the RPV pressure
.V l
2C-7 ; AMENDMENT 2 MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY i
l l. drops. ~It is estimated that at 200 psig, the. pump flow rate exceeds core boil-off and flashing rate and therefore the- RPV-l level begins to increase. The minimum RPV level achieved during (.n,) . the depressurization is estimated to drop below TAF. However, l l due to steam cooling, significant cladding damage is not expected. The MAAP Code (version 3 0) has been utilized-to evaluate the mininum intervention time for each of the following operator actions following l. l a Loss of Feedwater (bounds LNP case) which are considered to restore the RPV water level.
- 1. The operator recovers the feedwater within 25 minutes after the accident initiation time.
2 .- The operator manually opens the S/R valves within 20 minutes to ' rapidly depressurize the RPV and initiate the low pressure coolant injection pumps (LPCI pumps) or the low pressure core spray pumps (LPCS). A base case was conducted in which neither the RHR, nor any operator action to restore the RPV level was credited. Note that in all the cases of Loss of Feedwater which are considered in this section, no credit is given to the CRD flow. Eesults of various key events for the cases studied are summarized in Table 2C-2.2. Note that LPCI Flow started after about 21.7 minutes for the case where the operator manually opened the S/R valves within 20 minutes after the accident initiation. , 1 O M mamm 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
.n. Table 2C-2.1 Pertinent Values'for an 1.NP Event
' Description Value Initial-RPV Inventory 4.06 x 105 lbs.
Water Volume below Low-Low level Setpoint 7200 ft 3 Water Volume below TAF 6200 ft 3 4 Inventory lost due to flashing in 1.45 x 10 lbs. depressurizing RPV to 900 psig Mass of water in RPV when collapsed level 3 39 x 105 lbs. 4 is at Low-Low level Setpoint i (saturated water at 900 psig) Inventory available for core boil-off 5.24 x 104 lbs. above Low-Low level Setpoint Time at which collapsed level drops to 10 minutes
; Low-Low level Setpoint Mass of Water in RPV when collapsed 2.92 x 105 lbs. ;
level is at TAF-(saturated water at 900 psig) Inventory available for core boil-off 9.95 x 104 lbs. above TAF Time at which collapsed level drops to 22 minutes TAF I i i O l AMENDMENT 2 2C-9 MILLSTONE UNIT 1 PROEABILISTIC SAFETY STUDY < l
o. V Table 2C-2.2 e Stamary of Key Events for the Cases Studied [ Accident Initiator: Loss of FW at t=0]- . 4 Timing of Key Events Type of . Operator Core Core Fuel . Vessel Operator Action Intervention Uncovery Recovery Damage Failure No Operator Action-
# No IC ~21 ~1.1 ~2.05
# No RHR minutes hours hours
# NO CRD Floy . I FW recovered
# No-IC FW recovered '~21 ~25.6
# No CRD Flow within 25 min. minutes- minutes from accident initiation Open S/R Valves
# No IC S/R valves ~21 ~22.2
# No CRD Flow manually minutes minutes l- opened within 20 minutes from accident-initiation l
1 i t O AMENDMENT 2 2C-9a i MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY ! l
I t 2C.3 Station AC Blackout With Failura cf IC Transient s . The Station AC Blackout transient is similar to the LNP transient
) described in Section 2C.2. Following the blackout, the operator will close the MSIVs and try to initiate the IC (See ONP 503C, Appendix l 2B). Since the purpose of this analysis is to determine the minimum l time avaiable for the operator to restore AC power and RPV level to prevent core melt, it is arbitrarily assumed that the IC is l j unavailable. The RPV pressure increases to the S/R valve set point and the S/R valves begin to cycle.
The only pump independent of station AC power is the diesel-driven fire pump (see Section 3 2.15). Use of this pump for RPV injection requires running fire hoses to a FW heater drain line in the Turbine Building. It is estimated that it will take an operator about an hour l to line-up the fire pump for injection to the RPV. Therefore, unless I AC is restored earlier, all injection sources are lost for at least one hour. Since the IC has been assumed to be failed, the RPV inventory will continue to be depleted and the RPV level will fall. ( O In a station blackout scenario, since the operator is aware of loss of l all injection resources, it is likely that the operator will not depressurize the reactor to 900 psig to stop the S/R values from l cycling. By not depressurizing the RPV, the operator prevents loss of inventory associated with flashing. This inventory becomes available for decay heat removal (i.e. , core boil-off) and thus delays core uncovery. Table 2C-3 lists some of the pertinent values used in this analysis. As the boil-off continues, the core will begin to uncover at about twenty-five minutes. As the RPV level drops to fifty feet above the bottom of active fuel (BAF), the peak cladding temperature (PCT) will be about 1700 F. In this analysis, it is conservatively assured that any further drop in RPV level will result in the onset of core melt. O AMENDMENT 2 2C-10 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY __-- 1
P l s - t Tha 'RPV .wattr level willi drop -to 50" abovt BAFlin cbout; forty-eight &
' minutes, assuming 1that' steam being generated in the lower portion of.
m .. the core does not entrain any water droplets. . l Therefore,- the steam r J superheats asiit rises through the uncovered fuel. . However,_if.itiis [" assumed that; the steam does entrain water' droplets which boiliin- the 1-
> upper portion of the corei .the' RPV ; water ' level is calculated - to drop to 50" 'above BAF in , about forty-three _ minutes. . - (For the later1 ]
calculation, enoughz droplets were asstmed to be entrained to - keep 1 steam saturated in the core). This analysis assumed the time when the- l RPV -level drops to 50" above BAF to:be forty-five minutes' (an average
.value).
Justifications of PCT = 1700 When Level is at 50" + BAF Figures 2C-1 through- 2C-4 provide the transient . results' of an isolation event. Specifically,the scenario is as follows: o- Reactor trips from 100% power, FW flow drops to zero and o -IC Fails.to initiate either automatically or manually. ' p, o 1 CRD pump (77 gpm) continues to run.
-RPV water level drops to 50" above BAF in about 1 hour.
( . o o At 1. hour, the operator depressurizes the RPV by manually opening 2 S/R' valves and recovers 'the level by injecting with one LPCI-pump.
' The PCT for this scenario is calculated to be 1520 F (Fig 2C-4).
The transient analysis results presented in Figures 2C-1 through 2C-4 can be used in estimating the PCT for the station blackout scenario undse consideration. This is because the PCT 'in a transient 'is determined by three variables, which are: i o Maximum Core Uncovery (i.e. Minimum level) and o Duration of Core Uncovery and o Time after reactor trip of MAXIMUM core uncovery. l ( ( AMENDMENT 2 2C-11 MILLSTONE UNIT 1 ! PROBABILISTIC SAFETY STUDY
lIn the two casts baing compared,' ths minimum level Machieved is the same-(50" + BAF). Also,-the duration of core uncovery is comparable,
.<~ 'in .both cases : the core will be completely recovered in about - forty \ minutes,after uncovery starts.
The time of maximum core uncovery is one hour in Figure.2C-3 versus 45 minutes in the Station- Blackout case.- The higher decay: heat ~. associated with earlier- time of minimum level results in higher PCT. Such an increase in the PCT can be estimated-by taking ratios of decay 1 heat as shown below: PCT (@ 45 min level)= Decay Heat Fraction at' 45 min' , PCT for 1.hr-Decay Heat Fraction at 1 hour
=: 1.096-X.1520 .
= 1700 F.
O l l t 1 1 1 O AMENDMENT 2 2C-12 MILLSTONE UNIT 1 L PROBABILISTIC SAFETY STUDY i {- c --__-____ -
8 r b 1-2C.4 loss of Feedust";r Transient
/N ' The Loss of Feedwater (LOF) transient is similar to the Loss.of Normal p Power (LNP) transient- described in the Section 2C.2, 'except'; that the J
reactor trip.' signal is' generated on low RPV water level rath'er than at normal RPV level as in the LNP transient.
.MAAPI(Modular Accident Analysis Progran) Code (BWR1 version 3.0) has ;
been utilized' to simulate : the ' loss of Feedwater. scenario. OperatorR I. intervention to recover the reactor coolant system-(RCS) inventory'has been credited in this study. L l l
.The- analysis of this : scenario, using the' MAAP Code, showed1that_ RPV; level recovery could be achieved by either one ofL the! following two'.
manual operator actions: 1.) Recovery of feedwater (W) after 25 minutes from the accident' initiation time (t=0). or: 2.) Manually opening the safety relief valve (SR/V) after twenty minutes to depressurize the primary system and
, initiate either the low pressure coolant injection. systen '
{
.(IPCI) or the or the low pressur'e~ core spray system'(LPCS), l The resulta .of both scenarios are sunmarized in Tables 2.C.4.1 andL j 2.C.4.2. A Figures 2.C.4.1 ' through 2.C.4.14 show the trends of key ' parameters during these scenarios.
i j Note: ] A parameter study on the recovery action time showed that recovering - Feedwater after fifty minutes from the initiation time has resulted in a maximum core temperature of about 2331 F (after 50 minutes) and that the reactor core was uncovered for about 30.5 minutes. I O 2C-18 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
l Alternatively, when the SRV's were opened after 45 minutes- from the L ' initiation time, the maximum core temperature. was about.'1684 F ;
~
; -(after 45 minutes) and the reactor core was uncovered. for about 26.5 1
~
minutes. l The following assumptions are made during the loss of Feedwater Scenario: I 1.) Feedwater-is lost at t=0. I 2.) Isolation condenser is inoperable. 3.) No CRD flow. 4.) No ADS. ( i AMENDMENT 2 2C-19 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
.. i
l Table 2C-4.1 ) [fu W=ane of Events for Insa of Feedwater Transient 1 Time 0.0 secs.- Trip of all FW pumps initiated L 5.0 secs. Feedwater flow drops to zero. 14.0 secs. RPV water level drops to Low Level Setpoint 38.0 secs. Reactor Trip signal is generated. RPV water level drops to Low-Low Level Setpoint MSIVs begin to close. Recirculation purnps are tripped. IC initiation' signal is generated. > 43 0 secs. MSIVs fbily close and RPV pressure increases to the S/R valve setpoint. 8.00 mir. RPV level drops to TAF + 3', if IC Auto Initiation fails. 15 00 min. RPV level drops to TAF, if IC auto initiations fails and the operator actions to recover level fail. 3
- water volume below TAF + 3 ft is 7140 ft AMENDMENT 2 2C-20 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
1( Table 2C-4.2 Imsa of Feedwater with Operator Intervention (FW recovered after 25 minutes) Kev Event -Time Reactor Trip- ~17.0 secs. Core Uncovery 21.1 min. (RPV Level drops to TAF) Core Recovery 25.6 min. Maximum Core Temperature ~672 F after 25 min. O V Table 2C-4 3 loss of Feedwater With Operator Intervention (SRV opened after 20 minutes) Key Event Time Reactor Trip ~17.0 secs. Core Uncovery 20.0 min. (RPV Level drops to TAF)
- Core Recovery 22.2 min.
1 Maximum Core Temperature ~593 F after 21.7 min. LPCI Initiation 21.7 min. O AMENDMENT 2 2C-20a MILLSTONE UNIT 1 M &8u r& R T W r e @ M r s t m ite w
,n.
""q
~ . - - - . _ - , . .-
l' j_ FIGURE 2.C.4.1-l'
./ Y
_ CORE WATER HEIGHT. ,
/+ REFERENCED'T0 VESSEL BOTTOM 1M MP1 LOFW2 CASE STUDY NO.2 -
'T 27-JUN-88.10:35:20 .
~CT LOSS OF FEEDWATER SCENARIO ,
50'- (WITHOPERATORINTERVENTION)' 9, , 1 e
- \
40-Maximum Core Temperature s672*F after 25 minutes l W w LA e" 4.5. min. , M i i 30- \ TOP 0F ACTIVE. FUEL L 1 l 20- . . . i i i i.i.i. .i.i l A 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 TINE IN HOURS m2 f
- l. . _ _ _ _ _ _ _ - _ _ -
!.4 .n FIGURE 2.C.4.1-2 HEIGHT OF WATER;IN THE SHROUD:
/~Y : REFERENCED TO VESSEL B0TTOM l' k f ; .MP1 LOFW2 CASE STUDY NO.'2-27-JUN-88.10:35:20' LOSS OF FEEDWATER^ SCENARIO
;.7 6 0' .
(WITHOPERATORINTERVENTION). u.. s 5 0' -
.i t
b u. 40-30-
' h N Feedwater Recovery after 25 minutes 20- , ,
O 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 TIME IN HOURS AMENDMENT 2
.. r
L U FIGURE'2.C.4.1-3
^
MAXIMUM TEMPERATURE IN1 CORE-1 MP1 LOFW2 CASE-STUDT NO.2 27-JUN-88.10:35:20 670-l 660-e,672*F after-650- 25 minutes 640 - l 630-l 620-610-
,e
' LI y 600-E a
590 580-570-560-f l 550-
) 'h 540- %
530-i i .i... . . . . ., , 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.0 0.9 1.0 TIME IN HOURS AMENDMENT 2
FIGURE' 2..C.4.1-4
'c-AVERAGE CORE TEMPERATURE:
MP1 LOFW2 ( - CASE STUDY NO.2
\
27-JUN-88.10:35:20 LOSS OF FEEDWATER SCENARIO 580- (WITHOPERATORINTERVENTION) 578 F after 25 minutes 570-560-w U,, g e o
< i 550-f Y '
540-i 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 TIME IN HOURS
- i. AMENDMENT 2
. j:l- .._
FIEJRE 2.C.4.1-5 I'
. ['Y WATER-MASS IN CORE MP1: LOFW2
- (/ CASE STUOY NO.2.~ {
27-JUN-88.10:35:20L ! I LOSS OF FEEDWATER SCENARIO I 130000 - (WITHOPERATOR. INTERVENTION) j
'l 120000 --
I
- r. 1 1.0000 - -{
100000-90000-
, 80000-E o
70000-60000-50000-40000-l 30000 - Feedwater Recovery [ after 25 minutes 20000-T . i . i i . . . i ( 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 2 TIME IN HOURS I-
*=
.e
~ FIGURE 2.C.4.1 -
. CORE INLET FLOW RATEL
~
HP1 LOFW2'
'h-[-] : CASE STUDY'NO.2' 27-JUN-88.10:35:20
-LOSS OF FEEDWATER-SCENARIO 8.0E+07- , (WITHOPERATORINTERVENTION)
- 7. 0E+07 -
' 6. 0 E + 0 7. -
- 5. 0E+07 -
- 4. 0E+07 -
, kg ,
- 3. 0E+07 -
- 2. 0E + 07 -
W !
- 1. 0E 4 07 -
\
0.0E+00- -
]
Feedwater Recovery after 25 minutes
- 1. 0E + 07 -
i i ' ' ' i l I 8 i '& l ' 4 l l I 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 TIME IN HOURS AMENDMENT 2 '
. FIGURE 2.C.4.1-7 PRESSURE IN PRIMARY SYSTEM ?'T : >
MP1 LOFW2 () CASE STUDY NO.2 27-JUN-88.10:35:20 i LOSS OF FEEDWATER SCENARIO 1140- (WITH OPERATOR INTERVENTION) 1130-1120-1110- . Feedwater-Recovery l after 25 minutes
'1100-I 1090-1080- '
L 1070-1060- " j
/N 1050-I
-6 j g l en
' 1040-1030-1020-1010-1000-990-980-970-960-950- , ,
1 [* 1.0 ( 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 TIME IN HOURS AMENDMENT 2
I FIGURE 2.C.4.1 n CORE WATER HEIGHT D- REFERENCED TO VESSEL BOTTOM MP1'LOFW3 CASE STUDY NO.'S 27-JUN-88.13:21:24 L'0SS OF FEEDWATER SCENARIO 50- (WITH OPERATOR INTERVENTION)
~
40- h n tj .2 min. r b 30-._____________j_ __ _ __ _ _ _ _ _ _TpE .QF_ AC_TJy,F,_EllfL _ Maximum Core Temperature 593*F after about 21.7 minutes. 20-BOTTOM 0F ACTIVE FUEL
._ _ _ _ _ _ _ ._ _ _ _ _ .i ____
LPCI Started after 21.7 minutes SRV opened after 20 minutes 10-0, 0.0 i - 0.1 i .i 0.2 i. 0.3 0.4 0.5 0.6 0.7
.i.i 0.8 0.9 i
1.0 AMENDMENT 2 TIME IN HOURS L_1_ _ _______ __ __ __ _ . _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _________ _ _____ __ _ _
FIGURE 2.C.4.1-9
- HEIGHT OF WATER -INLTHE SHROUD
'"f REFERENCED T0. VESSEL 80TTOM MP1.LOFW3 CASE STUOT.NO.3 27-'JUN-88.13:21:24 s
LOSS OF FEEDWATER SCENARIO 70 -
.(WITHOPERATORINTERVENTION)-
l SRV opened after 20 minutes 60-h 50-s
' (
4 1 ,
~
40- a s N W 30-LPCI Started after 21.7 minutes 20-i . i . i .
. i . .i k 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 TIME IN HOURS AMENDMENT 2 w-_______ _
' FIGURE 2.C.4.1-10
/~y
's
- MAXIMUM TEMPERATURE IN CORE MP1 LOFW3-CASE STUDY NO.3 .
27-JUN-88.13:21:24 LOSS OF FEEDWATER SCENARIO' 600- (WITHOPERATORINTERVENTION)~
'593*F after 21.7 minutes SRV opened after 20 minutes-500-
-Q-
.( .j - u.
h400-8 C 300-O ' 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
)
AMMDMMT 2 TIME IN HOURS
.. m __ _. _ _ _ _ _ _ . _ . _ . . _ _ . _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ . _
FIGURE 2.C.4.1-11' j ' AVERAGE-CORE TEMPERATURE. l MP1 LOFW3 CASE STUDY NO.3 l 27-JUN-88.13:21:24
.s.
LOSS OF FEEDWATER SCENARIO 600- (WITHOPERATORINTERVENTION) l.
')
\.
)
.500-O w w
y 400-
-S o
3U0-1 J SRV opened te i 200-O . 0.0 i 0.1 i 0.2 i 0.3 0.4 0.5 0.6 0.7 0.8 0.9 i 1.0 TIME IN HOURS _ - __ _ _ -_--____ - -___ . _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ . _ _ _ _ _ - . ._ . _ _ _ _ - __-_-__-_____J
FIGURE 2.C.4.1 I WATER MASS IN CORE (~j
~ MP1 LOFW3-CASE' STUDY NO.3-27-JUN-88.13:21:24 LOSS OF FEEDWATER. SCENARIO-160000 - .(WITHOPERATORINTERVENTION)
'150000-140000-130000-E 120000- -
110000-
-100000-90000-U .
g 80000-t E-
@ 70000-60000-50000-40000- g 30000 -
20000 - 10000 - LPCI Started 4 after 21.7. minutes 0 .,
-10000 -
i i i,,,,,i. ., i. 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 , TIME IN HOURS f AMENDMENT 2 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . - - - - _ _ _ -. J
- -. =-__ __--_.
h
. FIGURE 2.C.4.1-13
- c. .
CORE INLET FLOW. RATE e). ( MP1 LOFT 13 CASE-STUDY NO.3 27-JUN-88.13:21:24 LOSS OF FEEDWATER SCENARIO 8.OE+07- , (WITHOPERATORINTERVENTION)
- 7. 0E+ 07 -
- 6. 0E+07 -
L
- 5. 0E+07 - g
- 4. 0E+07 -
E k
- 3. 0E +07 -
i
- 2. 0E+ 07 -
- 1. 0E+ 07 -
- 0. 0E+ 00 - '-
=y
< LPCI Started after 21.7 minutes I
- 1. 0E + 0 7 -
, i -
- i. .i i i.i i i.i.i k 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 TIME IN HOURS
- AMENDMENT 2 i
_-_.___-_..._..-_L_. . - . - _ - _ . _ . - _ . ._ - -
1 f :. FIGURE 2.C.4.1 ?~t PRESSURE IN PRIMARY SYSTEM i. MP1 LOFW3 CASE STUOY N0.3 -
!- 27-JUN-88.13:21:24 LOSS OF FEEDWATER SCENARIO E '1200- (WITHOPERATORINTERVENTION)
> J 1000-900-800-
; 700-( -
g 600-n. 500-400-300-
. 200 -
SRV opened after 20 100 - minutes i 1 ' i O o. .
. . . .!.............. 0.7 0.8 0.9 1.0 0.0 0.1 0.2 0.3 0.4 0.5 0.6 AMENDMENT 2 TIME IN HOURS
.2C.5 Stuck Open Sar;ty/ Relief Valve Tran:ient
["j In a Stuck Open Safety / Relief Value (SORV) transient, the electric
pressure regulator (EPR) or mechanical pressure regulator (MPR),
maintains the RPV pressure constant by partially closing the turbine control valve. Feedwater flow adjusts to maintain the RPV level. Diversion of 10% of the steam (capacity of 1 S/R Valve) to the torus through the open valve, slowly heats the torus. However no automatic reactor trip signal is generated. The Technical Specification requires the operator to initiate a manual scram when the torus heats l up to 110 F (See E0P 580 Appendix 2B). For the purpose of calulating operator action times, it is arbitrarily assumed that the reactor trip is initiated at the same time when the S/R valve sticks open (i.e. t:0 sec). This assumption has no effect on the calculation as the RPV parameters (level & pressure) remain unchanged until reactor trip is initiated. Following the reactor trip, the RPV pressure begins to drop. The MSIVs close on LOW pressure (825 psig) in about four minutes (Figure 2C-5). Feedwater would restore and maintain the RPV level, therefore (^')
it' was arbitrarily assumed that Feedwater is initially unavailable.
At this point, all injection sources capable of maintaining RPV level are lost. The RPV level drops due to core boil-off and depressurization associated with the stuck open S/R valve. The core . begins to uncover in about fourteen minutes. The following discussion shows that if the operator takes corrective action at twenty minutes, the PCT will be less than 2300 F and significant fuel damage will be avoided. The corrective action postulated is as follows: At twenty minutes: The operator opens 2 S/R values (in addition to the valve stuck open) to rapidly depressurize the RPV and starts at least 1 LPCI pump. (The operator may also use the IC l
/
,)
i (_,/ AMENDMENT 2 2C-21 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY L_
to' cid in depr:ssurization. However, it is not credited). s V. .As shown in Figures 2C-5 and 2C-6, at twenty minutes the RPV depressurized to about 420 psia and-the level drops to 25 2 ft (4.4 ft below the TAF). When the operator opens 2 S/R valves, the RPV rapidly depressurizes. When the RPV pressure falls to the shut-off head (235 psig) of the LPCI pumps, the pumps begin to -inject. The injection rate increases as the RPV pressure drops. It is estimated that.at 200 psia, the pump flow rate exceeds the core boil-off and flashing rate (due to depressurization) and therefore, the RPV level . begins to increase. Table 2C-5 summarizes pertinent data for this transient. The RPV minimum level (20 ft) occures at 1600 -secs. (20 min v 400 sec, duration of depressurization). Figures 2C-7 through 2C-9 provide RPV pressure, levels and clad temperature plots for a SORV case with 1 CRD pump and 1 LPC1 pump
/3 operatin;' No operator action to open additional ' S/R valves (for d faster depressurization) is credited. The PCT for this case is
~2300 F. The results of this transient can be used in estimating the PCT for the SORV case being analyzed here (i.e. with operator action at 20 minutes, but without the CRD ptap). Thus the parameters which mainly determine the PCT, can be compared between the two cases. The parameters are:
o Maximum core uncovery (minimum level), o Duration of core uncovery and, o Time after RT of maximum core uncovery. Comparing the transient results presented in Figures 2C-7 through 2C-9 with the SORV case being analyzed, the following can be concluded: o The minimum level shown in Figure 2C-8 is lower than the minimm level calculated (20 ft.).
,/
b AMENDMENT 2 2C-22 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- r. .
Duration of the core uncovery in- Figure 2C-8 ' is also . longer.
~
L1 o This is because, there is no rapid depressurization which allows
- s
(-] - t U a quick recovery (See Fig. 2C-7 ) . Whereas, in the SORV case being analyzed here,: .the operator depressurizes the RPV :at 20 minutes, which allows a quick recovery of level by theJ LPCI . pumps. p o In the two. cases being' compared, the time of minimum level is comparable. Based on the above- assessment, it is clear that the transient presented in Figures .2C-7 through 2C-9 is a more severe one. Therefore, it. can be concluded- that for a SORV case if the operator takes the corrective action,. at 20 minutes, .the resulting transient
~
will have a PCT of 2300 F. The previous analysis examined the response of the In-vessel Key parameters such as the reactor pressure vessel- (RPV) level, pressure,-
.A. and inventory.
-Q COMPACT Code (Compartmentalized Analysis of Containment Transients) has been utilized to study the ex-vessel key parameters related to the LPCI pump cavitation and the torus temperature during stuck open safety / relief valve scenarios with and without isolation condenser.
COMPACT Code has also been used to determine the conditions (time of addition, flow rate, and LPCI pump throttling) of water addition to the torus to prevent the LPCI pinp cavitation. The requirement of preventing pump cavitation can be represented by the following
. inequality:
(NPSH)available (NPSH) required V 2 M MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
L- i The analysis conducted by COMPACT Coda is based on the following assumptions:
,m b] 1 - Initial temperature of water in the torus is 75 F.
2 - Emergency Service Water temperature "ESW" is 70 F. 3 - Reactor tripped after seven minutes. The decay heat added to the the torus water reflects the reactor trip time. J 4 - One LPCI loop is available (one LPCI pump and one LPCI heat exchanger). 5 - Two ESW pumps delivering a total of 5000 gpm to the LPCI heat i exchanger. q l Analysis of the results of COMPACT runs showed that:
'(, m,) 1- If the isolation condenser is operable (IC has heat removal a
capability of 206 BTU /hr) and LPCI pump throttling is credited, then no water addition to the torus is needed. Figure 2C-9A compares the NPSH available versus NPSH required during the 150,000 second transient. As can be seen from Figure 2C-9A, the LPCI pump throttled three times with the first throttling step started after approximately four hours. Figure 2C-9B shows the torus water temperature during the transient. The maximum temperature of approximately 169 F was reached after about 32.5 hours. 2- This case considered the response with the isolation condenser inoperable and no water addition to the torus. Figure 2C-9C compares NPSH available versus NPSH required of the LPCI pump. As can be seen, pump cavitation occured after about 6.21 hours. > Figure 2C-9D displays the torus temperature during the 150,000 j 7 AMENDMENT 2 2C-23a MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
},
second' transitnt.: Tho maximum temperature was about 211 F reached after about 16.81 hours. N A2 3 - A final case considered the response with the isolation condenser
~
is inoperable and water addition to the torus is considered. In this case study, it is assumed that water is added to the torus at 200 gpm flow rate. Water addition started after 1' hour for a duration of about 14.41 hours (this corresponds 'o the addition - of 4 feet of water to the torus). , Figure 2C-9E compares NPSH available versus NPSH required of th'e LPCI pump. As can be seen in Figure 2C-9E the LPCI pump has to be throttled three times (from 5000 gpm to 3500 gpm) to avoid cavitation. Figure 2C-9F shows the torus water temperature during the transient. Water addition: started when the torus water temperature reached approximately 135 F. The maximum torus temperature' of approximately 186 F was. reached after about (~ 17 73 hours. V]- O AMENDMENT 2 2C-23b MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
FIGURE 2C.9A COP ACT 9r02 32 !9-AM 61 SORV' CASE WITH THE ISOLATION CONDENSER OPERAELE 50.
! l I
t 40 ! I
\. AVAILABLE !
t \ N . I l
- 30. % l l u
;- i ~- %_ i i I1
[
- REQUIRED T I I !
l l . o
'% 20 i
I io. ---
- i .
I I : I i I I ; l 0. b b 0 b 0 0 8 8 8 8 8 8 8 i N 8 0 8_ N_ !_ 0_ 8
~
l { 1 TIME (SECONDS) j i O AMENDMENT 2 i
F i
,, FIGGE 2C.9B .
( ) 9:0,<51 19 ADR-6E CDW ACT SORV CASE WITH THE ISOLATION CONDENSER OPERABLE l l l 175 t l
, l ISO. / _
I C e-O 125
$ l 5 E '
i i ,
! s 100. '
e '
.3, Lgo .
i
" i 75 j m i 2
a I 1 50. k 2 l l 25 i I l l I e i a i
=
i s~ i 8 i a a i 8 i i 8
~ r e e t. ~
TIME (SECONDS) rm AMENDMENT 2 e esipan h- " _m_ma-_____----..-:-
FN FIGURE 2C.9C COPFACT SORV CASE WITHOUT WATER ADDITION AND E 10 55 30-mar-THE ISOLATION CONDENSER IS INOPERABLE
- 50. -
l 40. START OF. PUMP / m\ /CAVIT ATION 7 REQUIR'[D / E V ;
/
/
/
0* /
- 20. / ;
ACTUAL i s l
- 10. '
1 I I D. s~ R
- 8 .
~
. 8
_ _ e a TIME (SECONDS) AMENDMENT 2
[N FIGURE 2C.9D
\*) COMPACT SORV CASE WITHOUT WATER ADDITION AND THE 6 05:54 30-M W-6E ISOLATION CONDENSER IS INOPJ!utABLE O=
m 1 200. \ c [ \ 0 M5 ---- - - - ' - - - - - - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - ' - e !
' \
g 150. ; 4 b - 1
~
I g vw 5 400 l
" i i
tu l 8 i
- 2 i 5 l t i t 50.
I I h8
'1 5
al
--t i D!
1:
.. i N
a a N a N a
- g S l l: N 8
o TIME (SECONDS) AMENDMENT 2
- _ ___-_ __-___ _____________ ._ i
.l 7
\
l l p*w J (]_ FIGURE 2C.9E. COMPACT
.MP 6452:40 Oi-JJL-65. .,
SORY CASEa (100% R.H.1979ANS. TRIPS- AT 7 MIN.NO 10. ADO WATER 200 CrM) j WESTINGHOUSE PROPRIETARY CLASS 2 AVAIL ABLE NPSH (FT) ) 50. AVAILABL1: i 40.
,/ /
i J0.
- g. N s __ /
u. REQUIRED
. m E
20. 10. O. 5 b d 5 5 8 5 5 5 8 8 8 8 8 8 N 8 0 8 8_ N_ 8_ 0_ 8
~
TIME (SECONDS) AMENDMENT 2
I [,- FIG.1RE 2C.9F (f COMPACT 8:51ed4 On-JA -6E MP) SORY CASE s (100% R.H.1979 ANS. TRIPS AT TMIN.NO IC. ADD ~ WATER 200 GPM) - WESTINGHOUSE PROPRIETARY CLASS 2 TEMPERATURE. LOWER REOIAN NODE. 3 (DEC F) . 200. 186 F 175 - i, x t 1 1 l50. ' u i \
- o. I W
135 F I I
'125.
8 ; i 8 l .l \
' I
- r . ! I 8 100. ' I (Ag l
.V " !
8 . l
.$' ! I
- 75. I '
I e B , l
- 1 5- '
E . N I l f I i I 25.
< 1 l
l I i i i I! 1
- 0. I b b Y b Y' 8
~
8 8
~
8 8 8 8 8 e 2 b n TIME (SECONDS) AMENDMENT 2 v
+ .(
b 2C$ Isolation Condenser Related Times and Flow. Rate'
) The Isolation Condenser (IC) removes core decay heat and depressurizes a
" 'w
.the RPV by condensing the core boil-off and returning the condensate 7
back to the RPV. . The shell side of .the -IC contains 2941. ft7 3
-(22,000 gallons)Lof water, out of - which 2861 L ft3 is the usable inventory.- (The remaining : inventory is below. the tube bundle)'. The'
. total heat' removal ~ capacity of this initial usable inventory:is about .
' 8
.1 99 x 10- BTU.
'As a.part of th'e Technical Specification. surveillance,,a heat balance was performed on' the IC to determine- its heat removal' capacity. -The 8
IC heat removal rate has. been calculated to be 2.73 x110 Btu /hr (based on results of test data). Based on this heat removal rate, the l limited IC inventory will: last ' for 44 minutes. - It should be! noted-that this heat removal rate applies when'the RPV is at full operating .
. pressure. As the RPV depressurizes, the IC; heat' removal rate drops.
Therefore, the IC inventory. will actually last for more than '.44 minutes. At - 44. minutes .-.the core decay heat '.can' be ' removed ^ by . supplying 215lgpm to the IC shell. O
" MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
1 SDC pump
- 1 SDC Heat Exchanger
(
\/ - 1 RBCCW Pump 2 RBCCW Heat Exchangers The Alternate SDC provides Long Term Cooling by cooling the torus. At a torus temperature of 176 F, two trains of the Alternate SDC can 6
remove well' above 65 x 10 BTU /hr of heat from the torus. Clearly, the torus water temperature will begin to drop before 4.8 hours as the
~
torus heat removal rate is larger than the heat addition rate to it (i.e. the decay heat level). Two trains of Alternate SDC are required and defined as: 2 LPCI Containment Cooling Heat Exchangers 1 LPCI Pump per Heat Exchanger 1 ESW Pump per Heat Exchanger The COMPACT Code (Compartmentalized Analysis of Containment-
. r~N Transients) has been used to develop the success criteria for torus b '
long term cooling under the loss of Normal Power '(LNP) condition without crediting the Isolation Condenser (IC). The following initial conditions were assumed in the analysis: 1 - Initial torus water temperature = 75 F (Best Estimate Value) 2 - Emergency service water temperature = 70 (Best Estimate Value) 3 - No Isolation Condenser 4 - Two emergency service water pumps (ESW ptrnps) delivering a total of 5000 gpm. 5 - One LPCI train with one LPCI pump in service and one LPCI heat exchanger. (./ AMENDMENT 2 2C-33 gg g, PROBABILISTIC SAFETY STUDY L .-- - - - _ _ _ _ _ _ _ _ _ _ _ _
.a / : 6.- The d: sign. flow rate 'of the LPCI . pump is 5000 gpm.:
7 - LPCI pump throttling is credited. Up to four throttling steps, V' with a flow reduction of 5000 gpm in each step, the LPCI pump is. allowed to be throttled from.5000 gpm to 3000 gpm. The ar.alysis conducted by. the COMPACT. Code included. three ' scenarios-for the LNP case; , Case A No credit is given 'to the Alternate Shutdown - Coolingi System (ASDC) : as a means of removing heat from the torus. As1can'be seen in Figure 2C-90, the LPCI pump throttled from 5000.gpm to 3000 gpm and finally cavitated after' 5.15 hours from the' accident . initiation. Figure 2C-9H shcws that.the torus water temperature reached _about-193 F after 5 98 hours. O Case B Both LPCI pump throttling and torus heat removal through the ASDC System are credited. Figure 2C-9I shows that the LPCI pump
~
throttled from 5000 gpm to 3000 gpm and finally cavitated after 11.15 hours. Figure 2C-9J shows that the maximum torus water temperature. is I 195 F reached - after about 24 31 hours from the accident-initiation time. At the maximum temperature, the torus heat removal through the LPCI heat exchanger matches the decay heay delivered to the torus water. After the point of maximum temperature, the heat removal by the LPCI heat exchanger is greater than the decay heat and the torus water temperature starts to decrease. MILLSTONE UNIT 1 l PROBABILISTJC SAFETY STUDY
;7 a -
,4 '
' JJEA.C ;
.-/ : WithL the stuck 'open safety. relief. valve .(SORV); scenario,< . COMPACT :
- Code , analysis showed 'that whenL the ' isolation 1 condenser'tist
- credited Jas ' a means ~ of ~ removing heat from! the RPV,j no' . water .-
~
addition to ' the torus is -requir'ed. . ;The maxiy, mum torus 1 L .temperatdbewas ~169 F after 35.23 hours.1The LPCI pump did not. a cavitate provided that pump throttling.is credited. j- Since the~. stuck .open safety relief : valve' ist a more limiting : I scenario which bounds the Loss of Normal Power case,othen it'can be concluded l that crediting the ~ ICaas 'well as -LPCI. pump throttling are' sufficient 1 conditions -to.-prevent LPCI pump cavitation given the same assumptions of initial conditions which were previously cited in.the SORV scenario. i
'(
~.
. AMENDMENT 2 2C-33b MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
= _ _ _ _ _ _ - - _ _
I.
-g^) i .- FIGURE 2C.9G.
(j-
.COMoAC7 MP-1 LOSS OF NORMAL POWER (NO IC, NO SDC, AND WATER ADDITION) 50.
40. AVAILABL1:NPSH N 30
\ 9\
x REQUIRED NPSH gm' \' START OF PUMP-
$ CAVITATION 20.
l0. O. O N N s 8
- e a n 1 l
TIME (SECONDS) l-l AMENDMENT 2
- v
l riousts ac.se [UY COMo4CT' ;MP-1 LOSS OF NORMAL POWER 12:07 55 04- A08t46 ' (NO IC, NO SDC, AND NO TORUS WATER ADDITION) 200. -i l Tmax = 193'F / 175
/
ISO. , c' E Y 125 / 100. I O-g- 75 i 3 u
.g' 50.
25. O. d f
- ~ ~
TIME (SECONDS) AMENDMENT 2
T l
- i. ,y%
L) FIGURE 2C.9I COMoACT MP1 LOSS OF NORMAL POWER (NO IC AND'NO TORUS WATER ADDITION) 50.
'A0.
( REQUIREI l NPSH n, / ng zo-u 5 k
\
- 20. W /
\AVAILAELE NPSH-10.
O. 6 8 8 5 8 8 8 8 8 8 8 8 O 0 8 0 8_ 0_ 8_ 0 8 c TIME (SECONDS) AMENDMENT'2
._ _____-_____ _ _ w
[ (/"') V PIGURE 2C.9J COMPACT MP1 LOSS OF NORMAL POWER 12 52 47 30-MAR-E (NO IC AND.NO TORUS WATER ADDITION) 200. ITmax = 155'F 175. 150. 125 C v 100.
,gg O
B.
% .75.
e m S 50. 25. D. d g d 5 6 d
- d e 8 8 8 8 0 8 0 $ 8 8
- _0 0 8
_ _ ~ TIME (SECONDS) i AMENDMENT 2
. /N Lf FIGURE 2C.9K COPFACT MP-1 LOSS OF NORMAL POWER 6:45 40 3:-MAR-61 (NO IC AND WITH WATER ADDITION TO THE TORUS) 50.
40.
~
/ AVAILABDE NPSil 30.
"\ i A- #
/
.S Y r%
e
-Ca N
c k REQUIRED NPSH 20. I 10. O. . - . _ . . 1 & 5 5 6 5 6 5 1 8 8 8 8 8 8 $ 8 0 8 0 8_ N_ $_ 0_ 8 l TIME (SECONDS) AMENDMENT 2 l l 1 - _ _ _ - - ._ . _ _ i
l
.'/m.
,: ) . .-
FItERE 2C.9L C0ffAct ' 6:44'57 31-MAR-E' MP-1 LOSS OF NORMAL POWER (NO IC AND WITH WATER ADDITION TO THE TORUS) 200. i l Tmax = 178'F , 175 7 - ( 150. g' 125 L 100, i e s 75 m E 50, 25. O. 6 6 5 6 6 5 g a 0 8 8 8 8 8 g 8 8 0 8 0 0_ 8 8_ E_ n_ ~ TIME ISECONDS) (
3.1.1 Plant Data Collection l () To perform calculations of component failure rates, two basic pieces of j information are necessary: , o raw numbers of actual component or system failure o total number of demands or inservice hours. l To determine the number of actual failures for each component type, primary reliance was placed on an internal reliability data base system known as BEARDS (Baseline Events Analysis Reliability Data System), developed and maintained by the Nuclear Operations Department at Northeast Utilities. This data base includes failure events which are reportable to the N.R.C. as well as those I which are non-reportable. Each of these events is categorized by component type, component I.D. number, event date, and nature of the event. The BEARDS Data System also provides cross referencing to Liscensee Event Report (L.E.R.s) numbers and other records maintained by the NU Nuclear Plant Records Department. < To supplement these records and verify the completeness of the data, additional m, reviews were conducted of both plant maintenance logs and the Shift Supervisor's i i V log books going back to the initial operation of Millstone Unit 1. By use of these multiple and diverse sources of information, reasonable assurance was provided that a complete set of raw failure experience was collected. The determination of total demands necessitated use of different sources of information. Certain of the components were equipted with dedicated cycle l counters and this proved to be a major asset in identifying the actual number of demands experienced to date. In addition to this, the plant has administrative 1y logged each start of the diesel and gas turbine, inc]uding: demand number, purpose of the start, and outcome. Total demands for other components were derived based on plant maintenance and test records. Included in this effort was a review of tests performed due to scheduled periodic surveillance tests and unscheduled tests required by Technical Specification Action Statements. The determination of total run hours of individual components was accomplished using run hour logs kept for each q (3 individual pump in the plant since initial operation of the plant. O AMENDMENT 2 3.1-2 MILLSTONE UNIT 1 i PROBABILISTIC SAFETY STUDY
Upon review of the reliability data, it was noted that motor operated valves J p (MOVs), located within the drywell appeared to exhibit higher failures than did
- d. id'entical valves located in the more mild environment of the reactor building or l turbine building. Because of this, MOV' failure rates were categorized into those MOVs within the drywell vs. those located elsewhere. Table 31.1-1 shows the raw i number of failures: f, and demands: D, collected for a number of typical plant components and failure modes. For comparative purposes, the mean unavailability on demand is provided along with the 95th percentile bound determined by X* estimation: q (oo,) .= O2fg +2 o ost Table 3 1.1-2 shows the raw numbers of failures: f, and run hours: T, collected for a number of typical plant components and failure modes. Again, for i comparative purposes, the data is compared to the 95th percentile bound determined by X' estimation:
( A),,, Xher 2,o os)
, (2)
O A number of observations can be made from the raw data: V
- 1. MOVs, in general, appear to have higher failure rates than those assumed in WASH-1400, with MOVs in the drywell having the highest unavailabilities on demand.
- 2. Based on limited statistics with no observed failures, the failure of 5CCS check valves to open or close appear to have comparable failure rates to those asstrned in WASH-1400. Insufficient statistics exist at present to show significantly lower failure rates.
- 3. From the data collected thus far ECCS pumps (two low pressure core spray pumps and four low pressure coolant injection pumps) show slightly lower unavailability on demand than those asstrned in WASH-1400. Similar trends are noted for other balance of pla*
(B.O.P.) pumps. AMENDMENT 2 3 1-3 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
TABLE'3.1.1 RAW CGIPONDrf FAIIERE DATA COLLECTED AT MILLSTONE UNIT 1 u Component / Failure Mode ' Failures- Demands Mean.Q Upper Bound Q MOVs (outside drywell) fail to open 29 5497 5.28(E-3) 6.62(E-3) fail to close 19 5497 3 46(E-3) 4.80(E-3) MOVs (inside drywell) fail to open 5 369 1 36(E-2) 2.67(E-2) fail to close 7 369 1.90(E-2) 3 39(E-2) ECCS check valves fail to open 0 1 272 Q.86(E-4) 1.51(E-3) fail to close 0 1272 q.86(E-4) 1.51(E-3) Feedpump check valves fail to open 0 676 <1.48(E-3) 2.84(E-3) fail to close 3 676 4.44(E-3) 1.04(E-2) ECCS pumps fail to start 0 954 <1.05(E-3) 2.01(E-3)
' Service Water pumps.
fail to start 0 827 <1.21(E-3) 2.32(E-3) Faergency Service Water pumps l-fail to start 9 258 3 49(E-2) 5.84(E-2) R.B.C.C.W. pumps fai.1 to start 0 501 <2.0(E-3) 3.83(E-3) Shutdown Cooling pumps 1.16(E-2) ! fail to start 3 259 2.72(E-2) T.B.S.C.C.W. pumps fail to start 0 414 <2.42(E-3) 4.64(E-3) Feedwater pumps fail to start 0 451 <2.22(E-3) 4.26(E-3) Condensate Booster pumps fail to start 1 252 3 97(E-3) 1.55(E-2) Condensate pumps fai) to start 0 239 <4.18(E-3) 8.04(E-3) AMENDMENT 2 3 1-5 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
Emergency Condensate Transfer pumps fail'to start .0 158 <6 ~. 33( E- 3) 1.22(E-2) f
% C.R.D. pumps fail to start 1 .342' 2.92(E-3) _1.14(E-2)-
Diesel Driven Fire. pumps fail to start 8 158! 5.06(E-2) 8.73(E-2)^ Motor Driven. Fire. pumps fail'to start' 0 158 <6.33(E-3) 1.22(E-2)
.4.16KV breakers fail to operate 3 34,333 8.77(E-5).- 2.05(E-4) 480V breakers
' fail to operate 6 11,238 5 34(E-4) 9.95(E-4)
Diesel' Generator fail to start 3 792 5.59(E-3) 1.04(E-2).
' Gas Turbine Generator +
- fail to' start 31 927- 3 34(E-2) N/A Main Feedwater System operate post-scram .1 97 1.03(E-2) 4.03(E-2)
# Note: 'For cases of no failures, one failure is assumed for computations.
V
+ Point Estimate'only D
U AMENDMENT 2 3 1-6 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
TABLE 3 1.1-2 RAW CGtP00 LENT HOURLY FAILURE RATE DATA COLLECTED AT MILIE1011E UNIT 1
'd Component / Failure Mode Failures Hours Mean Upper Bound-Feedwater Reg. valves fails to operate 18 148,479 1.21(E-4) 1.70(E-4)
Service Water pumps fails to run 9 238,572 3 77(E-5) 6.32(E-5)
.R.B.C.C.W. pumps fails to run 1 117,883 8.48(E-6) 3.31(E-5)
Shutdown Cooling pumps fails to run 0 15,050 <6.64(E-5) 1.28(E-4)- T.B.S.C.C.W. pumps fails to run 1 111,704 8.95(E-6) 3 50(E-5) Feedw'ter a pu ps fails to run 0 110,029 <9 09(E-6) 1.75(E-5) Condensate Booster pumps fails to run 9 179,390 5.02(E-5) 8.40(E-5) 1 Condensate pumps fails to run 0 188,787 <5 30(E-6) .1.02(E-5) l I C.R.D. pumps fails to run 0 101,652 <9.84(E-6) 1.89(E-5)- Diesel Generator fails to run 1 , 1,201 9.55(E-4) 2.55(E-3) Gas Turbine Generator + fails to run 1 672 1.49(E-3) N/A Battery Charger fails to run 5 229,488 2.18(E-5) 4.29(E-5)
# Note: for cases of no failure, one failure is assumed in computations.
l + Point Estimate only MENMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
I l TABLE 3 1.2-1 1 ( V) FAIIERE RATE UNCERTADrIT DISTRIBUTICIIS FOR TYPICAL MILISTOIIE UNIT 1 COU'ONElffS Component / Failure Mode Distribution Type Mean Variance i MOVs (outside drywell) { fail to open Beta 4.45(E-3)/d 6.40(E-7 ) ' fail to close Beta 3.00(E-3)/d 4.33(E-8) NOVs (inside drywell) fail to open Beta 3 79(E-3)/d 2.11(E-6) fell to close Beta 4.90(E-3)/d 2.73(E-6) ECCS check valves fail to open Beta 1.15(E-4)/d 7.40(E-9) fail to close Beta 6.60(E-4)/d 2.45(E-7) Feedpump check valves fail to close Beta 2.29(E-3)/d 1.08(E-6) Feedwater Reg. valves fail to operate Gamma 2.48(E-4)/hr 2 34(E-8) O () ECCS pumps fail to start Beta 7.48(E-4)/d 3 15(E-7) fail to run Gama 7 99(E-5)/hr 3.89(E-8) Service Water pumps fail to start Beta 7.89(E-4)/d 3 51(E-7) fail to run Gamma 3.81(E-5)/hr 1.60(E-10) Emergency Service Water pumps fail to start Beta 6.41(E-3)/d 3.79(E-6) j fail to run Gamma 7 99(E-5)/hr 3.89(E-8) R.B.C.C.W. pumps 1 fail to start Beta 9 24(E-4)/d 4.80(E-7) fail to run Gamma 9.71(E-6)/hr 8.09(E-11) T.B.S.C.C.W. pumps fail to start Beta 9.67(E-4)/d 5.26(E-7) fail to run Gamma 1.02(E-5)/hr 8.99(E-11) Shutdown Cooling pumps fail to start Beta 2.84(E-3)/d 1.69(E-6) i fail to run Gama 9 59(E-6)/hr 5.61(E-10) AMENDMENT 2 3 1-12 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
Fredwat:r. pumps
!' fail to start Beta 9.48(E-4)/d 5.05(E-7)
[') fail to run Gamma 1.46(E-6)/hr 1.31(E-11) Condensate Booster pumps [ L fail to start Beta 1.66(E-3)/d 9.88(E-7) fail to run Gamma 5.05(E-5)/hr 2.78(E-10) Condensate pumps fail to start Beta 1.07(E-3)/d 6.42(E-7 ) fail to run Gamma 8.60(E-7)/hr 4.51(E-12) Emergency Condensate Transfer pumps fail to start Beta 1.12(E-3)/U 7.10(E-7) fail to run Gamma 7 99(E-5)/hr 3 89(E-8) C.R.D. pumps fail to start Beta 1.57(E-3)/d 8.89(E-7) fail to run Gamma 1.58(E-6)/hr 1.53(E-11) Diesel Driven Fire pump fail to start Beta 4.77(E-2)/d 2.23(E-4) fail to run Gamma 7 97(E-4)/hr 3.85(E-6) Motor Driven Fire pump [ j fail to start Beta 1.13(E-3)/d 7.11(E-7) fail to run Gamma 7.99(E-5)/hr 3.89(E-8) 4.16KV breakers fail to operate Beta 1 34(E-4)/d 3 74(E-9) 480V breakers fail to operate Beta 6.14(E-4)/d 4.85(E-8) Diesel Generator fail to start Beta 5.59(E-3)/d 6.63(E-6) fail to run Gamma 9.53(E-4)/hr 7.80(E-7 ) Gas Turbine Generator fail to start Point Estimate 3 34(E-2)/d N/A fail to run Point Estimate 1.49(E-3)/hr N/A Battery Charger fail to operate Gamma 1.02(E-5)/hr 1.88(E-11)
'O O
AMENDMENT 2 3 1-13 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
L f 7 is the test intervs1 of the gtneral populatien used in thn d%ta base. h' t' For Non-Restorable Operating Components the unavailability is estimated using the following relationship: I
< o..o = i - (*I" W < A > T. (23)
Voro,ETdVorA (24) l
-where:< A> is the failure rate per .in-service hour, and T. is the mission time for operation of the component.
This relationship assumes that it is not possible to repair or restore the failed' component on-line.
.For the case of Restorable Operating Components the unavailability is estinated by the following relationship:
< o.,,, ) = % < A>rn (25) vor o.., E r'nvar A -(26)
-where:7n is the mean restoration time (in hours).
These basic relationships are used throughout the systems reliability analysis to estimate the unavailability.of specific Millstone Unit 1 components due to '; failures occurring either prior to or during safety related demands. l l O 3 1-B AMENDMENT 2 MILI TONE UNIT 1 PROBABILISTIC SAFETY STUDY
TABLE 3 1.4-1 MADITDIANCE UNAVAILABILITIES FOR MILLSTUIRE UNIT 1 SYSTBtS
%/
System Mean Variance Service Water train 6.54(E-3) 1.03(E-4) C.R.D. pump train 1.09(E-2) 1.98(E-4) L.P.C.S. pump train 8.22(E-4) 2.45(E-6) L.P.C.I. pump train 5.16(E-5) 1 95(E-7) Isolation Condenser 8.39(E-4) 2.46(E-6)
. Shutdown Cooling train 2.97(E-3) 2.08(E-5)
E.S.W. train 4.69(E-4) 1.32(E-6) Fire Protection System diesel pump train- 5 73(E-3) 3 28(E-5) ; electric pump train 1.41(E-3) 1 98(E-6) Diesel Generator 1 31(E-3) 5.44(E-6) Gas Turbine Generator 1.08(E-2) 1.87(E-4) R.B.C.C.W. pump train 6.14(E-3) 1.49(E-4) T.B.S.C.C.W System V heat exchanger 9 47(E-3) 3 07(E-4) pump train 6.57(E-4) 2.59(E-6) Condensate pump train 6.50(E-4) 1.16(E-6) Cond. Booster train 3 55(E-3) 8.70(E-6) Feedwater pump train 2.59(E-3) 1.18(E-5) Feedwater Reg. valves 1.02(E-3) 2.14(E-6) Emer. Cond. Transfer pump train 1.19(E-3) 8.55(E-6)
' Note: All maintenance unavailabilities assumed to be Beta-distributed.
O AMENDMENT 2 3 1-17 l MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
3 1.5 Collection and Analy21s cf Common Cause Failura Data o .q, Previous sections have addressed the' unavailability of systems and components b due to single random failures and maintenance on trains of standby systems. In these areas there is an extensive reliance on plant specific reliability. j experience. Comon cause' failure of redundant components is known to bt; an ) important and in some cases the domitiant contributor to overall' system unavailability estimates. Comon cause failure due ' to support system failure is addressed explicitly either in the support state event trees or plant system event trees. Common cause failure due to actuation logic failure is addressed explicitly in the fault tree models. Comon cause failure due to like components subject to common environmental conditions (heat, moisture, radiation, dust, vibration, etc.) and common maintenance activities are addressed directly in the fault tree models via the statistical model described in this section. Comon cause failure of like components are modeled at a high level of the reliability. models developed for each plant system. Unavailability due to l common cause failure events was quantified using the Binomial Common Cause Failure Rate model. The data base for this model was developed by.' Atwood (References 1, 2, 3) based on limited industry wide experience and was updated using Millstone Unit 1 plant specific reliability experience. Table 3.1.5-1 summarizes all observed Millstone Unit 1 plant specific common cause failure events. The plant specific common cause failure data from 115,320 hours of experience was used to update the Gama distributed Binomial Common Cause Failure Rates. The failure rates R k,m f r "k" or more, out of "m" redundant components are distributed with the following probability density function.
~
F ( R,n,. l a,$) = ( a R.,. ) e The existing tabulated mean values of Rk,m an be expressed in terms of the two parameters a,# as follows. AMENDMENT 2 3.1-18 HILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
These expressions were utilized l to ' define common cause failure rate C'i distributions and update for Millstone Unit 1 plant specific experience. ' Q) . The unavailability contribution due to common cause failure is calculated as follows:
=12 R - (38) cc k,m
- Where e is the test interval. Similarly the updated variance is expressed:
2 (39) Var Qcc = O /4 Var Rk,m These basic expressions are used for all common cause failure quantifications. References
- 1. Atwood, C. L., and Stevenson, J. A., " Common Cause Fault Rates for Diesel Generators: Estimates Based on Licensee Event Reports at U.S. Commercial Nuclear Power Plants 1976-1978," NUREG/CR-2099, Rev. 01, June, 1982.
( ) RJ
- 2. Atwood, C. L., " Common Cause Fault Rates for Pumps: Estimates Based on Licensee Event Reports at U. S. Commercial Nuclear Power Plants, January 1, 1972 through September 30,1980, " EGG-EA-5289, Rev. 01, August,1982.
3 Atwood, C. L., and Stevenson, J. A., " Common Cause Fault Rates for Valves: Estimates Based on Licensee Event Reports at U. S. Commercial Nuclear Power Plants, 1976-1980," EGG-EA-5485, Rev. 01, September,1982.
- 4. Jahnke, E., and Emde, F., " Tables of Functions," Fourth Edition, Copyright Dover Publications, 1945 AMMMUT 2 3 1-21 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
32 PLANT SYSTDt3 RELIABILITY ANALYSIS
. (S Using the component reliability and maintenance data developed in Section 3 1, U system reliability models were developed for each of the systems whose successful operation or failure was modeled in the Event Tree L Analysis in Section 2.0. Two types of reliability models are used. In some cases sufficient operating experience allows a direct statistical estimate to be used in understanding the reliability of a system. Examples include the ability of the main feedwater system and condenser to remain on line following a reactor trip. In cases wher+ there is insufficient operating experience or where abnormal support system o. figurations exist (i.e., partially failed support systems) fault tree reisbility models have been utilized.- ' Examples include.
the automatic operation ci the Low Pressure Coolant Injection System or the manual operation of the aus and Core Spray following a loss of normal power event. The following sections summarize the basic . safety functions of the various Millstone Unit 1 systems, how the reliability models were developed, and what l the current results indicate. The intent of these sections is not to provide Q the full scope of the models for the purposes of peer review, but to summarize O key assumptions and findings. 1 i l I l o ! ( AMENDMENT 2 3.2-1 MILI. STONE UNIT 1 1 PROBABILISTIC SAFETY STUDY l
3.2.1 D.C. Power System p Systen Description V The D.C. Power System is a support system which is designed to provide a highly reliable, uninterruptible source of D.C. power to control circuits, motor-control centers, radiation monitoring systems, and trip auxiliaries whether or not A.C. electric power is available. The system thus provides two primary functions: the distribution of power to uninterruptible loads during normal operation, and 0 provide the sole source of control power to start critical safety related systems following a loss of offsite power. Figure 3.2.1-1 shows a simplified one line diagram of the vital D.C. Power System. The system consists of: 60 V two redundant 125 VDC Storage Batteries (101A and 101B) and associated A.C. powered Battery Chargers two redundant 125 VDC uninterruptible buses (101A and 101B) connected to the batteries via 1600A circuit breakers and to the battery-chargers via two circuit breakers in series. These buses are denoted as D.C. Switchboards 101A and 101B respectively. two redundant 125' VDC uninterruptible switchboards are connected to each of the continuous buses via a 250A circuit 'oreaker and normally closed transfer switch. The normal alignment is: DC SWBD 101AB-1 connected to DC SWBD 101A DC SWBD 101AB-2 connected to DC SWBD 101B O V 1 AMENDMENT 2 3 2-2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
t-0- a' 125 VDC motor control crntir bus is connected to DC SWBD 101B which supplies power' to a number of interruptible, non-vital turbine p- auxiliaries and is designated as SWBD'101AB-3 ?: Q) During normal' operation, the D.C. Power System'is continuously charged via two trickle chargers (101A and 1018) powered from 480V AC power' from the following - A.C. Motor Control Centers (MCC): A.C. MCC F-4 supplies Battery Charger 101A on Battery 101A' U A.C. MCC F-5 supplies the Swing Charger 101C ' capable of charging Battery 101A or 101B via a mechanically interlocked transfer switch 0 A.C. MCC E-5 supplies Battery Charger 101B on Battery 101B These buses are ultimately powered via 4160V AC buses 14E or 14F. It is also important to note that battery chargers 101A and 101C are ultimately powered by AC Bus 14F. During loss of normal power (LNP) the battery chargers are designed to shed and lockout for 30 min. The D.C. Power Systen can maintain D.C. power for at least eight hours without operation of the chargers . The two main D.C. switchboard buses 101A and 101B provide control power to all control circuits used in the plant for actuation logic, breaker control logic, diesel generator field flashing, and LNP detection. Loss of one or both D.C. switchboard buses thus implies inability to actuate safeguards logic, inability to automatically or manually open or close breakers from the control room, and loss of certain local LNP logic. The following D.C. Power Systen faults are directly annunciated in the control i room: Battery Charger Trouble - loss of A.C. input, A.C./D.C. failure or D.C. high voltage Bus 101A&B Failure - loss of voltage or ground fault on the bus O AMENDMENT 2 3 2-3 PROBABILISTIC SAFETY STUDY
'Batt:ry Trouble - high voltage or ground O Bus Tie Breakers Closed - any one of the D.C. bus tie breakers closed -
f~N U 0 Loss of D.C. Power on SWBD 101AB-1,-2,-3 Reliability Model The success criteria for the D.C. Power System is time dependent. During LNP conditions, the batteries are capable of providing power for at least eight hours. For time periods greater than eight hours, A.C. power must be restored in order to operate the battery chargers. Since the D.C. Power System is assumed to be independent of A.C. Power for time intervals of less than eight hours, one fault tree is developed for this case. Seven fault trees are developed to model those cases where the times of accident sequences exceed eight hours. The following list describes the fault tree top events and their respective ( support states: I Tree DC-1 (Figure 3.2.1-2)) - loss of D.C.101A or 101B given no LNP or an LNP less than eight hours. Tree DC-2 (Figure 3.2.1-3) - loss of D.C. 101B given A.C. buses 14E and 14F-are available following an LNP greater than eight hours Tree DC-3 (Figure 3.2.1-4) - loss of D.C. 101B given A.C. Bus 14E is failed following an LNP greater than eight hours Tree DC-4 (Figure 3 2.1-5) - loss of D.C.101B given A.C. Bus 14F is failed following an LNP greater than eight hours Tree DC-5 (Figure 3 2.1-6) - loss of DC 101B given A.C. Buses 14E and 14F are available (No LNP) AMENDMENT 2 3 2-4 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
.____-___-_w
_r Tree DC (Figura 3.2.1-7) - loss of_ DC 1018 giv:n A.C. Bus 14F is failed-(No LNP) (h) Tree DC-7 (Figure 3.2.1-8) - loss of DC101A given A.C. BusI14F is available
'(No LNP)
Tree DC-8_ (Figure 3.2.1-9) - loss of DC 101A given LNP and A.C. Bus 14F ~ available The following cases for sequence times greater than eight hours were found to have simple solutions not requiring fault trees: O Loss of D.C. 101B given A.C. bus 14F is failed with no LNP reduces down to Battery Charger 101B unavailability 0 Loss of D.C. 101A given A.C. bus 14F is failed is assured because Battery Charger 101A and the swing charger 101C are both ultimately powered by AC bus 14F (Q:1) 0 c Loss of D.C.101A or 101B given A.C. buses 14E and 14F are failed is assured because there is no long term recharging of either bus (Q=1) Figure 3.2.1-10 summarizes the applicable fault trees for each combination of A.C. Bus availability for both LNP and non-LNP cases, time greater than eight hours. i Battery unavailability was calculated based on a weekly detection interval. This interval was felt to be a reasonable best-estimate for detecting battery failure because of the acute awareness of battery condition exibited by plant operating and engineering staff and the required weekly test (Reference 3) that calls for visual inspection of the cells with a flashlight in addition to the normal pilot cell checks of temperature, specific gravity, and electrolyte level. Industry experience has indicated such tests are sufficient to detect better than 95% of all failure modes capable of failing the entire battery. The only significant human action considered in this analysis is failure of the operator to recover a failed charger either by closing its A.C. breaker if the O V AMENDMENT 2 3.2-5 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
load sequencing timer ' failed . or by retivating th: swing (cpara) ch;rg:r. At ) least eight hours are available to complete this action, thus a minimal human
- c. error probability is used to quantify this action. No other human actions are
() considered for the following reasons:
]
l critical breakers and parameters are annunciated, O periodic tests assure battery availability prior to an accident, and no routine operator actions are performed on the D.C. System, f Results The results from quantifying the D.C. Power System fault trees are summarized in Table 3 2.1-2. The support state quantifications are shown in Figure l 3 2.1-11. The following engineering insights were gained from this reliability analysis:
- 1. The batteries will last at least eight hours in the absence of A.C.
S V Power to the battery chargers.
- 2. The design of D.C. buses 101A and 101B is not symmetrical due to the fact that the spare battery charger can be powered only by A.C. bus ,
14F. D.C. bus 101B is normally powered by A.C. bus 14E. If bus 14E fails, D.C. bus 101B can be powered by A.C. bus 14F through the spare charger. Therefore, the A.C. power sources for D.C. 101B are truly redundant. 3 However, D.C.101A is normally powered by A.C. bus 14F (the same bus as the spare battery charger is powered from), making the A.C. power source for D.C. bus 101A not redundant. The auxiliary transformer 12F and related circuitry are common for both the normal and spare battery chargers for D.C. 101A. O O AMENDMENT 2 3.2-6 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
3 2.2 A.C. Power System g7 Systen Description ! )
\ _,/
The onsite A.C. power system is designed to support nearly all other plant systems by satisfying their electric load requirements under both normal and emergency conditions. The onsite A.C. Power Systen acts as a distribution system to feed A.C. Ioads in the plant by using power from the main generator via the Normal Station Service Transformer (N.S.S.T.) during normal plant operation, or power from the 345kV grid through the Reserve Station Service Transformer (R.S.S.T.) following plant trip. Electrical distribution is accomplished through a network of buses, motor control centers, and the l required stepdown transformers. In the event that offsite power is lost (LNP), the onsite A.C. system has the ability to separate itself from the grid and subsequently restore power to pre-selected loads via its own emergency generator units. Figure 3.2.2-1 shows the onsite electrical network along with its interconnections to the 345 kV grid and the two emergency onsite power l generators. i
,/~] When the plant is operating with the main generator on line, the onsite A.C.
V system receives its power through the N.S.S.T. which is located between the output side of the main generator and the low side of the main step-up transformer. After a reactor scram or turbine trip, circuit breakers in the 345 kV switchyard are automatically opened in order to isolate the main generator from the grid and prevent it from becoming an eventual notor load. The main generator would continue to feed the N.S.S.T. while it is coasting j down from the trip but the onsite A.C. transfer logic immediately shifts the ! bus network over to an alternate power supply. This fast transfer over to the R.S.S.T. occurs before voltage can decay on the N.S.S.T. , sufficient to cause problems with plant electrical equipment. Since the fast transfer is a "make before break" operation, electrical service is effectively undisturbed during . the process. After experiencing a loss of offsite power the onsite A.C. network is again separated from the N.S.S.T., although this time without a fast transfer taking place. This course of action causes the onsite A.C. network to become o AMENDMENT 2 3.2-21 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
Reliability Model b-bJ The reliability model for the onsite A.C. power system consists of a series of fault trees that were developed by using the earlier described success criteria as top events in the individual trees. Accordingly, two sets of fault trees were constructed so that system response to plant trip and LNP events could be-modeled separately. Using the established success criteria, there are only . four system end configurations that are possible after a system response to either type of event. These states can be expressed in Boolean terns as shown . below:
- 1. 14E
- 14F (complete success)
- 2. 14E 8 14F (partial success) 3.. 14E # 14F (partial success)
- 4. 14E
- 14F (total failure)-
In the above nomenclature, 14E represents the failure (or fault tree) of 4160V bus 14E and 14F represents the analogous situation for 4160V bus 14F. Note that the compliments represent success for buses 14E and 14F. s The four states of the A.C. power system were modeled and quantified for each of the two events (i.e.. plant trip-and LNP) by combining the 14E and 14F fault trees according to the above Boolean expressions. The fault trees were developed in accordance with how the onsite A.C. power system responds,, following each of the particular events, as explained earlier in the System Description section. As a practical approach to quantifying the different states of the A.C. power system, just three fault trees were constructed for each of the two events. These fault trees represent system states 2 through
- 4. State 1 was quantified without a tree, based on the fact that the sum of the probabilities of all four states must be equal to 1.0 and the following Boolean relationship.
Prob [14E
- 14F] = 1.0 - Prob [(14E
- 14F)+(14E
- 14F)+(14E
- 14F)]
O V AMENDMENT 2 3.2-23 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
f The mods 1 for system etsto 2 (i.e.14E # 14F) w:s dsysloped by constructing a tree' for loss of A.C. power on bus 14F. By asstning that 1 - Prob [14E] is 1 O approximately 1.0 the use of compliments was avoided and thus V Prob (14F]= Prob [14E'14F] for system state 2. The. fault tree for 4160V bus 14E in system state 3 was treated in the same way j that 14F was in state 2. By similarly asstning that 1 - Prob (14F] is. l approximately 1.0, compliments were again avoided such that Prob (14E]= Prob (14E'14F]. For aystem state 4 where both 4160V buses fail, the fault trees for system states 2 and 3 were combined through an 'AND' gate. The resultant tree for state 4 includes the individual faults of 14E and 14F along with comon cause faults of both buses. These latter faults had to be
. considered since they fail both buses and produce total system failure (station blackout.)
Because the onsite A.C. power system response is different for plant trip and LNP events, the corresponding fault trees that were developed for each set of system states are likewise different. This is primarily due to the varying degree of dependence between buses 14E and #4F during the two separate 14E and 14F system response actions. After a plant trip, buses 14E and 14F are both fast transferred to the R.S.S.T. Because of this, both buses can fail due to their common dependence on the power source and the transfer logic. In the case of a Loss of Normal Power (LNP) event, the buses are isolated from the grid and their respective emergency generators are started. Although the Icgic that performs these functions is common to both 14E and 14F, the two emergency generators are separate from each other and are of different design. Bus 14E is powered by a gas turbine generator and 14F receives its source from a diesel generator. When compared to the unavailability of the common logic, that of either emergency generator is much higher. This relatively high emergency generator unavailability makes 14E and 14F less dependent on the control logic than they are for the response to plant trip event and because of this, the two buses appear to be quite independent of each other in terms of comon cause failure. This independence can be further seen by examining the fault trees for 14E, 14F and 14E # 14F shown as Figures 3 2.2-20 through 3 2.2-22, respectively. Conversely, the dependence of buses 14E and 14F for the plant trip event can be seen by examining the fault tree shown in Figure 3 2.2-19. 1 AMENDMENT 2 3 2-24 MILLSTONE UNIT 1 PROBABILISTIC SA'ETY F STUDY
, l In examining the fault trees, it will be noted that there are no . human j . /q equipment interfaces. This is because there are no credible human errors that- q could lead to active component unavailability in the onsite A.C. system. The .j I
system is'in continuous operation while the plant is at power and maintenance on critical components can only be performed when the plant is in shutdown conditions. All system responses to plant trips or LNP events are performed automatically without the need for human intervention. Results Earlier it was mentioned that fault trees were developed to model the four system states of the onsite A.C. power system and to show how the system would respond following each of the two types of initiating events that were considered. System states 2 through 4 were modeled directly by using fault - trees, while state 1 was modeled indirectly by means of a Boolean expression - that made use of the quantification results from the system state fault trees. Quantification was performed using the WAMCUT/NSPASM computer code which computes a mean unavailability and variance for each fault tree. P The quantification results were adjusted for different recovery times and used as a source of input to the Millstone #1 support state model, described in - section number 2.3 The intermediate results for the actual fault trees are described below and are also tabulated in Table 3 2.2-1 for each of the two types of initiating events. The adjustment for recovery is described after the Results Section. , i Fault Trees for A.C. System Response Following Plant Trio System State 2: unavailability of bus 14E, given 14F is available. The total mean unavailability for 14E is 1.62 x , 10-3 Approximately 58% of this ntunber can be attributed to faults that produce either a loss of the normal offsite power supply or cause bus 14F to become isolated from the normal supply. The dominant contributors are listed below by their l percentage contribution to unavailability of bus 14F: ( AMENDMENT 2 3.2-25 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- 1. loss of normal power or switchyard faults during the 24hr d-L,j' period following plant trip. . (20%)' l
- 2. faults which cause'. closing failure of .the circuit- breaker between bus 14D and the R.S.S.T. (14%) .l
- 3. failure of'the breaker connecting bus 14D with the N.S.S.T..
to open (14%)z F 4. ' the tie, breaker between - buses 14D and 14F fails to remain closed (3%) l Another '36% of bus 14F's unavailability is due to faults that prevent a fast transfer from the N.S.S.T. to the R.S.S.T. These; are as follows:
- 1. common cause failure of the main generator lockouts to initiate fast transfer (9%) )
O 2. failure of any one contact pair (4 total) in series to close
., on the breaker auto-closing logic for the 14D/R.S.S.T.
circuit breaker. (39%) j The remaining 1% is due to random failures that are not readily ] identifiable. System State 3: unavailability of bus 14F, given 14E is available. The fault tree for bus 14F is nearly identical to that for 14E in system state 2 because of symmetry in the onsite A.C. power system. Hence the total mean unavailability, 1.62 x- f 10-3 is the same and all of the faults are of the same type, except that bus 14C and its associated breakers are replaced by bus 14D and its breakers. l
- r
( AMENDMENT 2 3 2-26 PROBABILISTIC SAFETY STUDY
r- System State 4: unavailability of bus 14E 'AND' 14F. This system -state merges the fault trees that were previously
} developed for 14E and 14F and has a total mean unavailability of
~'
6.51 x 10-4. Faults which cause a loss of normal power supply are responsible for 66% of the total unavailability and are as follows:
- 1. loss of the normal offsite power during the 24 hr. period following plant trip (52%)
- 2. failures in the Unit 1 switchyard that cause ' the offsite power source to become separated from the onsite distribution network (14%)
Approximately 34% of the bus 14E and 14F unavailability is due to failures in the fast transfer logic that prevent the onsite distribution network from automatically connecting to the R.S.S.T. power supply. These are: (,3) 1. failure of the generator lockouts to initiate a fast transfer signal (33%)
- 2. failure of time delay relays in the bus 14E and 14F breaker closing logic (1%)
The remaining unavailability is less than 1% and is attributable to contributors that are not readily identifiable. Fault Trees for A.C. System Resr>onse Following LNP System State 2 : unavailability of bus 14E, given that 14F is successfully restored via the diesel generator. The overwhelming majority of bus 14E unavailability is due to gas turbine generator failure subsequent to the LNP with the faults being I l nearly equally divided between failures to start and run. This l 1 [L j' l AMENDMENT 2 3 2-2'T MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY E_ -
amounts. to approximately 67% of the total mean unavailability.
.. ~w hich is 1.20 x 10-l . Failure of the tie breaker - to close n() between the gas turbine. bus and 14C Laccounts for another 315 of
.the total and control- logic faults. compose less than 2% 'of the residual.
System State 3: unavailability of bus 14F, given that 14E is successfully restored; by. the gas turbine. The- total mean , unavailability for bus 14F is 312 x 10-2, of which some %% is 1 related to some type of failure on the diesel generator. Broken down by category and percent contribution, these are: failure of the diesel to continue running for 24 hours (735),. failure of the f diesel to start (18%), unavailability due to being in maintenance l (4%), and faults on the diesel output breaker (15). The residual ) unavailability is due to different combinations'of relay failures that prevent the diesel generator output breaker from closing. 0- System State 4': unavailability of bus 14E 'AND' bus 14F.. This state produces a station A.C. blackout and has a mean . unavailability of 4.20 x 10-3 The- dominant contributor to { unavailability is coincident failure of both the gas turbine and diesel generators which ' makes up 54% of . the total. This is followed by a 24% contribution from combined failures of the 14CT-2 tie breaker to close and the diesel generator to start or run. The only remaining identifiable contributor is caused by failure of the two master LNP relays to send a start signal to the diesel and gas turbine generators (8%). l Recovery Onsite AC power is a very important support system for successful plant operation in all modes. Accordingly, it was recognized early on that operators would assign a very high priority to the recovery of AC failures that could prevent key plant systems from performing their intended fbnction. Recognizing f- this, the original unavailabilities that were calculated from the AC system l AMENDMENT 2 3 2-28 MILLSTONE UNIT 1 mc6f!MFfLR2PFfd BAFM5FW BEfiBM
- fault trees were cdjusted to rzflect the types of recovsry thtt tre part of an operator's. training and are re-inforced by procedures (See procedures ONP 502 i_O- and ONP 503B in Appendix 2-B).
QJ The first type of recovery that was considered involves the restoration of one or ' more 4160V buses following a' plant trip with the offsite power supply initially available. For these cases, recovery is limited to autanatic restoration and manual actions that the operator can procedurally perform within the control room in a 5 - 10 minute time frame after reactor trip. The recovery actions that were applied to a loss of buses 14E or 14F consisted of: Operator recovery of a fast transfer failure which was caused by faults in the automatic transfer logic. ONP 502 requires the operator' to ensure that all 4160V buses have transferred over to the R.S.S.T.' as part of the immediate operator action following scram. Automatic / manual recovery. of onsite power via the emergency generators, following loss of the offsite AC power supply subsequent to plant trip. A loss of the offsite power supply would autoinatically produce an LNP signal which would shed loads, start ~ the emergency generators, and cause the required loads to be picked up. Procedure 503B requires the operator to verify the start or initiate the start of the emergency generators as a backup to the automatic logic. By reviewing the cutsets for the system state fault trees (14E, _ 14F, and-14E#14F), it was possible to group them according to the_ types of recovery that could be applied. When this was done and the appropriate recovery factors were applied, the unavailabilities including recovery actions became:
-4 o
Q14E = 3 97 x 10 o d l Q14F = 1.11 x 10 4 o Q14F#14E = 6. 3 x 10 O AMENDMENT 2 3 2-29 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
It thould b3 noted th t thm un:v;;ilability of bus 14F is significantly high:r than that of bus 14E. This is because the diesel generator was not considered (~N for recovery of 14F due to its Service Water dependency. A consequential loss of Service Water during the fraction of time available between loss of the-offsite source and diesel generator cooling failure cannot be recovered. Following implementation of the above recovery actions, there may be some AC buses that still remain de-energized. In order to properly credit the actions of the Millstone Unit 1 operations staff, a second set of recovery actions was considered in the time range of 4 to 5 hours after the initial scram. The purpose of recovering electric power at this point is to restore long tem decay heat removal systems that might otherwise be unavailable without recovery. Although there are no special emergency procedures or off-normal procedures to specifically address such recovery actions, the following discussion should provide the rationale for including them in the analysis. After a major plant transient, approximately 42 qualified people will be called onto the site to support the on-shift operations personnel. All personnel are required to be on-site within 1 hour of the call-in and they include: i [] complete shift of operations personnel (7 total including a shift supervisor), I&C technicians, mechanics, and electricians as well as the on-call engineer and responsible department head. Since the call-in personnel will have approximately 2 - 3 hours available to diagnose and recover electrical failures, it was considered appropriate to include their recovery actions. The basic premise behind recovery at 4 to 5 hours is the fact that plant personnel would use cross connections to restore power to buses that were affected by a loss of power. Furthermore it is assumed that cross-connections would take place on the lowest possible voltage level with the minimum amount of effort expended. For example, 480V bus 12E is required for normal shutdown cooling but might not be available due to a loss of power on 4160V bus 14E. By , i procedure, 480V bus 12E can be cross-connected to bus 12F by opening the normal l supply breaker from the bus 14E stepdown transformer and closing the cross-tie ! breaker to 12F. The unavailability of 480V bus 12E is consequently determined by the unavailability of 4160V bus 14F. This unavailability, which is ) l l (~ l V) j
)
AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY ; L_______ - . - - )
1.11x10-3, does not include ' operator error since human error _ probabilities (HEP's) are addressed in the event trees. i Restoring power on the 480V bus level avoice the convoluted process of feeding 4160V bus 14E from bus 14D/14F via bus 14C. A similar set of actions can also be performed to restore power to bus 12F which is the mirror image of 12E. Applying the above recovery actions for losses of power on either 14E or 14F, the unavailability of power on the 480V level becomes: o Q 12E = 1.11 x 10-3 (unavailability of bus 14F) o Q 12F = 3 97 x 10-4 (unavailability of bus 14E) In cases where a loss of DC control power causes a loss of AC power on the associated bus, the principle of cross-connecting buses can also be applied. As an example, a loss of DC bus 101A would prevent the fast transfer of its associated bus 14F over to the R.S.S.T. However, by opening the control power breaker from DC 101A and closing the breaker from DC 101B, control power can be restored to bus 14F and its unavailability remains the same as if DC 101A were never failed. Again this does not include operator error which is addressed in {) the event trees. The same cross-connection principle can be applied to bus 14E whose control power a capplied by DC bus 101B. A111gning 14E's control power supply to DC 101A after 101B is disconnected, allows 14E to fast transfer and retain the same unavellability it had without the failure of DC 101B. ) In the preceeding descriptions, all of the recovery actions have been focused on the restoration of bus failures when the offsite power supply is initially available. The following description addresses the types of recovery that can be applied to restore AC power to the onsita bus network when the initiating event is Loss of Offsite Power. l After a loss of offsite power, the onsite power system may experience a consequential loss of one or more buses due to emergency generator failure. In q u - AMENDMENT 2 3 2-31 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY I
order to mitigate the effects of partial onsite AC system failure or total station AC blackout, there are two viable options for recovery: 1 ) o Recovery of offsite power with subsequent restoration of power to buses whose onsite AC supply has failed. o Restoration of power to de-energized buses by cross-connecting them to buses that have AC power available. The probability of recovering offsite AC power at a given time is based on actual data for restoration of offsite power at ten nuclear power plant sites within the same geographical region as the Millstone site. The data was gathered from NUREG/CR-3992 for plant sites in the Northeast Power Coordinating Council region and it spans a period of approximately 150 site years. For the 20 actual loss of offsite power events that were recorded, the mean recovery time is 1.6 hours. The probability of recovering offsite power at a specific point in time was obtained based on an assumption of an exponential distribution with an average rate of recovery independent of plant conditions (see Figure 2A-1 in Appendix 2-A). In addition to offsite power recovery, which can occur at any point in time, the principle of cross-connecting buses can be applied as a restoration measure in the 4 to 5 hour time range following the original loss of power event. As explained earlier, there will be a sufficient number of qualified personnel on-site who can perform recovery actions independent of the control roca operators. The basic principle of cross-connecting buses for a loss of offsite power event is the same as it is for a transient event with offsite power initially available. The actual recovery actions are somewhat different for the loss of offsite power event because the diesel generator is now credited. It may be recalled that the diesel was not considered to be available for transient events with offsite power initially available. Following a failure of bus 14E due to unavailability of the gas turbine, the diesel generator can be used to restore power to 14E via the normally open and racked out breaker which connects the diesel with 14E. This recovery can be performed by following the operating procedure for the 4160V electrical system which describes how the V AMENDMENT 2 3 2-52 MILLSTONE UKli 1 ( Padg e fLVsWc 2 Arm 67 MRUrm7
cros -connection is to be mada. Simil:rly, but 14F c:n ba powered from the gis turbine by cross-connecting its feeder bus (14D) to the gas turbine bus (14G). Applying these types of restoration actions, the unavailabilites for recoverable failed buses are: o 4 Q14E = 312 x 10 o Q$47 = 1.20 x 10 These values do not include operator errors for restoration since all HEP's are included in the event tree models. For cases where a loss of the preferred DC control power source produces a loss of AC power on the associated bus, the principle of cross-connection can be applied just the way it was for transient events. Successfully cross-connecting the backup DC control power source to the affected AC bus restores it to the original status that it had prior to failure of the preferred DC source.
~s
( ) v._) ,/ y b# j l AMENDMENT 2 3 2-33 ! MILLSTONE UNIT 1 i PROBABILISTIC SAFETY STUDY ! i
TABLE 3 2.2-1
'l AC Power Syste Unavailability Results Unavailabilities System State Description Mean Variance 2 Plant Trip: 14E
- 14F 1.62 x 10-3 6.67 x.10-8 3 Plant Trip: 14E # 14F 1.62 x 10-3 6.67 x 10-8 4 Plant Trip: 14E
- 14F 6.51 x 10-" 3 49 x 10-8 2' LNP: 14E # 14F 1.20 x 10-1 1 96 x 10-3 3' LNP: 14E
- 14F 3 12 x 10 4.41 X 10-4 4' LNP: 14E
- 14F 4.20 X 10-3 8.29 x 10-6 Key to Description 14E = failure of bus 14E 14E = success of bus 14E 14F = failure of bus 14F 14F = success of bus 14F j i
O v i l t
"""2 MILLSTONE UNIT 1 ,
PROBABILISTIC SAFETY SRIDY j
- - - - - - - - ~
l i !' .. ..I
- ., LOSS Or EMERC.
%C POL'ER ON OUS i4E 806 LOWING A t- 6059 0F NORMA 6-80WE' 'LMPS k
-(
, 000;
[h LOCA6 F AUL TS ON' ' NO EMERCENC' AC 4160V BUSES 44E FEE 0 FROM 4160V OR 14C BUS 14C 000 0010
- C a
I. I TIE 9REAKER NO SiCNA6 TO NO AC POWER ' ROM 14C'-2 FROM BUS CLOSE f!E SRKR. ENERCENC' CAS l' .ide 70'14C FA:LS' FROM SUS 14C 'O TUR81NE (C/ff - i' TO CLCSE 140 f 4Cf-2) CENERATOR SOURCE i
'f .
M- 0013 0015
~
0002 H9K80048 NSCBF.RCC O 2 9400E J.J'00E-02. i.8100E-06
! ! l EMERGENC' C'T EMERGENC' C/T NO SiCNA6 TO EMtPCENC' C
CENERAfCR FAILS CENERATOR FA;LS SfARf EMERCENCY CENERATOR 0 0 e
'O START ON 'O RUN ArfER 3/f CENERATOR FOR fEST CP y DEMA40 STARilNG MA;NTENANCE t
003 0004 006 0005. NCfF0200 MCfEC201 [N HCfM0202 3 3400E-02 1.4900E-03 1.0000E-02 1 8700E-04 i l l L/0 DC 004 TROL NO STARf SIGNAL POWER ON C/f FRCM LOSS OF CEN. BAffiRf PJS NORMAL POWER (L NP) RELAYS 07 0008 NBf0C100 NSC.NPRi
.5.'600E-04 (
6.d400E-08 FIE RE 3.2.2-20
.cqgg;ges a SIM_PLIFIID_TA_ ULT _D_EZ_FtR I_IMES OF
l i LOSS OF EMERG. ~ AC POWER ON BUS 14F FOLLOWING A- I LOSS OF NORMAL POWER (L NP) i
/\ 0001 l
f n i l LOCAL FAULTS ON N0 AC POWER FROM ALL ECCS MOTOR 4160V BUS 14F EMERCEWCY DIESEL LOADS ON BUS 14F CENERATOR (D/C) HAVE A TRIP SOURCE SICNAL ON THEIR BREAKERS 0004 0164 0005 HBSU0023 [\ ECIBKRG6 2.5300E-04 I l EMERGENCY D/G EMERGENCY D/G EMERGENCY D/G. FAILS TO START FAILS TO RUN 0 0.S. FOR TEST ON DEMAND AFTER STARilNG OR MAINTENANCE 0007 0294 0008 HDGF0210 HDGE0211 hDGM0212 5.5900E-03 9 5500E-04 1 3100E-03 6.6300E-06 7.8000E-07 5.4400E-06 FIGURE 3.2.2-21 MMMT 2 SIMPLIFIED FAUM TREE FOR IOSS & AC PCHER CN RJS 14F AFIER A L.N.P. L___-_____-_____.___-.- '
l The back-up scram valves provide an alternate means for removing instrument air from the scram inlet and outlet valves. These solenoid-operated valves are n ( ) normally deenergized. When both reactor channels are tripped, DC power \ 8.s ! energizes these solenoids which in turn allow the instrument air to be vented. l The A'IWS scram valves are a third means for removing instrumeit air to the scram valves. These valves operate in the same manner as the back-up scram valves, however, they are controlled by sensors and logic which are independent from the RPS. Figure 3.2 7-2 is a simplified schematic of one RPS trip channel. During normal operation, all of the sensors and contacts are closed and the relays are energized. When a setpoint of any of the monitored parameters is reached, (the reactor high pressure parameter is shown here for illustrative purposes), relays deenergize and contacts open interrupting power to the scram pilot valves. When the solenoid in the scram pilot valve deenergizes, instrument air is vented and the scram valves open. Table 3 2.7-1 gives the parameters which are monitored by the RPS and the () setpoints at which a scram is initiated. Reliability Model The RPS at Millstone I is similar to the reactor protection systems in other BWRs and has been designed to meet the single failure criterion. It is a fail safe system in that failure of a single component in a trip channel will trip the channel and loss of instrument air or AC power will result in a reactor scram. A probability of 1.0 x 10-5 (mean value) was assessed for the failure of the RPS automatic logic and the Control Rod Drive System. This probability was taken from the Rentor Safety Study (Reference 1). In the study, failure to scram was defined as failure of five adjacent control rods to be inserted into the core on demand. b] AMENDMENT 2 3 2-97 PROBABILISTIC SAFETY STUDY .
e
.F
- 1. Wash-1400 '(NURE-75/014f Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants,-USNRC, October 1975.
O O AMENDMENT 2 3 2-98 MILLSTONE UNIT 1 FMGM2fLf2He @ Arm 67 gwns7 .i
From - the above, it is evident that drywell cooler unavailability is most strongly related to the particular support system configuration that the_ plant '(,,/ happens to be in. For example, in support system configurations where service water is unavailable, drywell cooler unavailability is 1.0. This type of support state dependency leads to a natural groupir.g of all the support states
'into just four categories, based on minimal failures required to cause drywell cooling failure. These four categories are:
- 1. No support system failures (i.e. all systems initially available).
- 2. Emergency bus 14E or 14F failed, but not both together.
3 Both emergency buses failed.
- 4. Service water failed.
For category 1 with all support systems available and no loss of offsite power, total drywell cooler failure can occur in either of two ways; RBCCW can fail or l A the coolers themselves can fail. Failure of the single RBCCW ptmip, without i .V operator recovery, -dominates drywell cooler unavailability since the probability of multiple cooler unit failure is negligible. Thus drywell cooler unavailability is simply the probability that the running RBCCW pump fail; to continue running over the 24 hour mission time or: Q = p(RBCCW fails to run)
= (9 71 x 10-6/hr) x 24 hr.
= 2 33 x 10-4 for category 1 support states Category 2 represents a partial loss of offsite power since either one of the two emergency buses can be failed. With no loss of offsite power present and a failure of bus 14E, there is a 50-50 chance that the running pump is on 14E.
The same is true for the failure of 14F. Hence, drywell cooler unavailability ] for the second category is: f
)
Q = p(RBCCW pump on failed bus) + p(RBCCW fails to run) {
= 0.5 + 2.33 x 10-4 AMENDMENT 2 3 2-105 mmvMm2%hTe Erfrm7 sT6ms7 i
o Target Rock Corporation (TRC); 95th percentile =2.13x10-3, 50th [-v ) percentile =2.53x10-4, best estimate =1.00x10-3 In comparing the results obtained, it is clear that the proposed NREP screening value is too conservative an estimate. The NREP value differs substantially from actual, limited data in IPRDS and from the test data based on valve qualification from TRC. The WNTD data source is not known but it is most likely from steam generator safety valves on PWRs, which have much smaller populations than BWR S/RV's in terms of demands. Based on engineering judgement, it was assumed that the manufacturers suggested value of 1.00x10-3 is a best estimate. Results Assuming the best estimate, failure to reseat on demand value of: l p = 1.00x10-3
,7
() and using the formula derived for one of six S/RV's failing to reseat, Prob [FRC/N] = [1 - (1 - 2p)N] + [4p x (1 - 2p)N-1 3 values of Prob [FRC/N] versus "N" are shown in Figure 3 2 9-1. rh b AMENDMENT 2 3 2-113
/
MILLSTONE UNIT 1 remmyL18?fe sermndt 219 fog [
TABLE 3 2.10-1 p.
.g Quantification of Vapor Suppression Syst a Faults Fault A - represents an " undetected" rupture in any one of these items: 96 downcomer lines,10 vacutu breakers, 8 vent lines and the single vent header.
Since all of the items have the same fault rate and detection interval they have been lumped together under a single event. Normally, the detection interval for the above items is inmediate since a rupture in any one of them produces a drywell to torus " delta pressure low" alarm. Should the dp instrumentation fail (Fault B), the rupture would not be detected until the next 6 month instrument calibration. The failure is assumed to cause the dp I recorders to record the normal 1.0 psid value, regardless of any chrage in delta pressure. The unavailability of A is calculated below: QA = 96 x p (downcomer rupture)
+ 10 x p (vacuum bkr. rupture)
+ 8 x p (vent line rupture) p (vent header rupture)
Since each individual item has the same probability of rupture (e.g.1/2 AT, where A = 8.48 x 10-10/hr and T = 6 mo. ) . The value 1.857 x 10-6 can be substituted for each p (rupture) and: j Qg = 96 x (1.857 x 10-6)
+ 10 x (1.857 x 10-6)
+ 8 x (1.857 x 10-6)
+ x (1.857 x 10-6)
= 2.14 x 10" l Fault B is the failure of both dp instruments to detect the failure (rupture) where of the fault A items. Thus QB Odp1 + Odp2 + Occ AMENDMENT 2 3 2-120 MILLSTONE UNIT 1FETY STUDY reri m H 3297c s wrew s%craY
l n j TABLE 3 2.16-3. .)
. %.)
ECCS Logic Unavailability Results VARIANCE ' l CASE MEAN l 4.04 x 10-16' j Neither Type Failed 2 36 x 10-8 1 Level Sensors Failed 1.55 x 10-4 7 19 x'10-9 Pressure Sensors Failed 1.55 x 10-4 7 19 x 10-9 Both Types Failed 9 99 x 10-1 1.44 x'10-8 Level or Pressure Sensors Failed 3 11 x 10-4 1.44 x 10-8 3
.. O
.j
(_ /- 1 i s l O AMENDMENT 2 3 2-203 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
of operation without reliance on offsite powsr or station air. The four dual purpose S/R valves have control power to the air operator solenoid supplied by redundant 125V DC power (battery) sources and sufficient nitrogen stored in the v redundant emergency accumulators for several valve cycling operations. Automatic actuation of the ADS requires coincident indication of reactor water low-low level and high drywell pressure, as well as 'a two minute persistance of the low-low water level signal. There is a two minute delay in the event that the Feedwater Coolant Injection (FWCI) system successfully recovers water level in the reactor vessel. In addition to reactor low-low water level for two minutes and high drywell pressure, the actuation of the ADS further requires the discharge pressure of at least one Low Pressure Coolant Injection (LPCI)-or one Low Pressure Core Spray (LPCS) pump to exceed 100 p;1g. This ensures that the system will not depressurize the reactor until the low pressure Emergency Core Cooling System (ECCS) pumps are running. The four ADS valves and the two non-ADS, S/R valves are provided with redundant power supplies to each valve and auto blowdown trip system. Upon loss of the primary DC power supply (bus 101A) to these circuits, automatic transfer to an alternate DC power supply (bus 101B) will be accomplished. Hence, the pressure relief system will be maintained for both manual and automatic operaton in the event that a station battery is lost. Reliability Model Successful operation of the ADS involves opening of at least 2/4 S/R valves in the automatic mode. In the manual mode there are two additional valves which [ may be utilized to achieve depressurization hence the success criteria becomes 2/6 S/R valves opening. In the automatic mode of operation four fault tree models were constructed and quantified to investigate system unavailability under the following scenarios: o Automatic actuation given both DC Buses available o Automatic actuation given only DC Bus 101B available o Automatic actuation given only DC Bus 101A available. 3 J l 3 2-220 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
cc = <R3,4> = 7.6 x 10-4= (R S ,6> = 6.7 x 10
(, Var Q =. Var R Var oce =VrR 5,6 = 5.14.x.10-7 cc 3.4 = 6.1 x 10-7 Results The mean unavailability and associated variance for each is listed in Table 3 2.18-1. The dominant failure mechanism for the automatic mode is common cause failure of 3/4 S/RVs with the remainder due to various combinations of relay failures. Table 3 2.18-1 also highlights- the impacts of DC dependency.. Because DC bus 101A is the primary power source for the ADS, failures of this bus necessitate a transfer to bus 101B in order for ADS operation. Failure of DC bus 101B has no impact on~ ADS unavailability unless there is an additional failure of DC bus 101A. O 1 l O A6DMT2 3 2-223 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY , l l m _ __ _ - _ _ _ __
?
Table 3 2.18-1 g' 1 Automatic Depressurization Systen Unavailability Results ; Case Mggn Variance Automatic actuation with 2.57 x 10-3 8.01 x 10-7 both DC buses available Automatic actuation with 3.46 x 10-1 3 23 x 10-3 DC bus 101A unavailable , Automatic actuation with 3 22 x 10-l~ 3 26 x 10-3 DC bus 101B unavailable Manual actuation with 6.70 x 10 4.96 x 10-7 3
-(g both DC buses available Manual actuation with 1.28 x 10-3 7.64 x 10-7 DC bus 101A unavailable Manual actuation with 6.81 x 10- 5.18 x 10-7 DC bus 101B unavailable AMENDMENT 2 3 2-224 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
1 Figures 3 2.23-2 and 3.2.23-3 show the simplified contro1' wiring for the major ' components in the SDCS, O Both SDCS loops are required to cool the reactor from 280 F to 125 F in 24 hours. Based on the sizing of the SDCS heat exchangers, if one SDC loop is lost prior to 24 hours, the other SDC loop will be able to cool the reactor although not at the same rate. In addition, only one SDC train is required to maintain
.the reactor in cold shutdown. Based on this the success criteria for the SDCS is defined as success of one of two cooling loops.
Reliability Model Unlike the ' emergency safeguards systems at Millstone Unit 1, the SDCS has been used on a routine basis to take the plant to cold shutdown and maintain it in cold shutdown for refueling and maintenance outages. Because the system has been operated many times, system unavailability was statistically calculated based on plant operating experience. The Shift Supervisor's log for those periods when the reactor was in cold shutdown was examined to determine the number of times the SDCS was used to take the plant to cold shutdown and for notations of any problems with the system. In addition, the BEARDS data system was checked for any failures of SDCS components. The component failures and other problems with the SDCS (e.g., leaks) were analyzed to determine their effect on SDCS availability. - Those failures which did not disable the whole system or affected only one SDCS loop were not counted as system failures. A point estimate demand unavailability, Q , was calculated by dividing the D number of total system failures, F, by the number of demands, D: QD* The demand unavailability may be slightly conservative because the number of-demands made on the system was taken from a 15 year period of operation and multiple uses of the system during short periods of time were not credited. (For example, the SDCS is placed in service and secured several times during AMENDMENT 2 3 2-301 MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY
t ? i
. refueling . outages. Only the initial use of the system was credited in these ]
7.- situations).- Also, all system failures which occurred after the first year of . i i
). plant operating history were credited, not only.those which occurred during the 15 year period from which the number of demands w'as taken.
A maintenance unavailability for the SDCS, 'Q,, was calculated by dividing the number of hours that - the system was in - maintenance, T,, by the number of hours of plant operating history, Tg (104,261 hours): T O *T m Tg This maintenance unavailability was added to the demand unavailability to obtain the total system unavailability, QSDCS QSDCS
- OD+0m The Shift Supervisor's Log was not detailed enough to determine whether or not-the SDCS MOVs had to be locally operated to place the system in service.
(/ Therefore, the unavailability calculated based on plant history . is only applicable for event sequences in which there has been no significant fuel failure and local operation of the valves is possible. Also, because the SDCS is dependent on RBCCW and RBCCW is dependent on the Service Water System, the SDCS is unavailable if either of these support systems has failed. The SDCS is also unavailable if 4160V AC Bus 14F has failed because MOV 1-SD-1 can only be operated if power is available on this bus. MOV 1-SD-1 is locatai in the drywell and, hence, cannot be opened locally. Results The unavailability of the SDCS based on plant operating experience is predicted' to be 2.27E-2. There was one non-restorable failure and approximately 44 demands made on the system. This data was used to calculate a point estimate demand unavailability for the SDCS of 1/44 or 2.27E-2. A second failure was also found but was discounted. The SDCS inlet MOV 1-SD-1 was hot-seated and declared inoperable for approximately 240 days between December 1981 and August
.O AMENDMENT 2 3 2-302 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
1982 with the. reactor at full power. However, since the MOV'did open when the reactor was brought down for refueling this failure was discounted as was the [ maintenance unavailability associated with this period of "inoperability". Additional justification for. discounting this failure are the extenuating circumstances which led to hot-seating the valve in the first place. The unavailability of the SDCS for the case in which no fuel failure has occurred but 4160V AC Bus 14E has failed was calculated by counting the number of failures of SDC Train B. This unavailability is only applicable for sequences in which Bus 14E has failed and the reactor building is accessible for local operation of the valves (i.e., no fuel failure has occurred). If 14E is lost and fuel failure has occurred then the SDCS unavailability. is equal to 1.0. The analysis of the operating history of the SDCS indicates three major areas which have a significant. impact on the unavailability of the SDCS:
- 1) There are . six MOVs in the SDCS which, according to surveillance -
g procedures, are only tested during cold shutdowns. On the average d reactor cold shutdowns occur 3 times /yr (taken over the last 10 yrs. of MP1 operation). Especially important are the inlet and outlet MOVs, 1-SD-1 ' and 1-SD-5, which are single failure "cutsets". Given that operating history shows that one of these valves has failed, and MOVs in general have a high failure rate, the MOVs in the SDCS would be expected to have high failure rates.
- 2) Because the SDCS may be needed after an incident in which high levels of radiation are released into the reactor building, it is important to ensure that the system can be placed in service from the control room. Currently, local operation of certain equipment is required to initiate the SDCS. Therefore the SDCS is unavailable for long term cooling if a fuel failure has occurred. ,
- 3) Because SDCS is not a safety related system, there are no procedural controls which limit maintenance on the SDCS to one train at a time or limiting the length of time the system can be entirely unavailable AMENDMENT 2 3 2-303 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
'a ' while the1 reactor is : at power. The MOVs in' this ; system are 'under surveillance as containment -isolation valves and, based on the: .
[ ' incident in which . MOV 1-SD-1: was " inoperable" for nine . months, iti appears that the major _ concern about these valves is limited to this'
.fbnction. Although the 'SDCS is . not - a safety grade system it 'is -
important for long-term core cooling.
. Table3 .2.23-1 sumarizes 'the SDCS unavailabilities.
l O AMENDMENT 2 3 2-304
. MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
, .i
.1 r TABLE 3.2.23 l
; Shutdown Cooling Systen Unavailability Resulta l
l Support State Mean Unavailability All support systems available and 2.27E-2 local recovery l of MOVs possible All support systems available - no 1.0 local. recovery of MOVs possible Service Water unavailable 1.0 AC Bus 14F unavailable 1.0 AC Bus 14E unavailable and 4.68E-2 local recovery of MOVs possible AC Bus 14E unavailable and 1.0 no local recovery of MOVs possible. O O
. AMENDMENT 2 3 2-305 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY _ _ _ _ _ _ _ _ -
O a l I samannannamneuemenmaanneenemaanammameneennemanenamenmaanamnemenenessammannemann 1HIS PAGE INTDfrI0ltAILY IET BUUK annemannannemannennenneennemananneannemananenesessenseneenaaneumannenemaneamene O i O AMENDMENT 2 3 2-310 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
3 2.24- Alternate Shutdown Cooling / Containment Cooling g(~T Systen Description Alternate Shutdown Cooling is a procedure used to remove long term core decay heat following an event in which the normal shutdown cooling systems (e.g.: Main Condenser, Isolation Condenser, and Shutdown Cooling System) are all unavailable. Alternate Shutdown Cooling . requires proper operation of one LPCI pump subsystem, including a containment cooling heat exchanger, and both Emergency Service Water (ESW) pumps. It is accomplished by flooding the vessel up to the main steam lines with LPCI pump flow and then opening one or more S/R valves to establish a flow path to the torus. Next, the ESW pumps in each train are started to provide cooling flow to the containment cooling heat exchangers. By closing the bypass valves on these heat exchangers, the LPCI flow is forced through the heat exchangers where it is cooled and then injected into the vessel. The containment cooling procedure is used following a LOCA to cool the torus and remove long term decay heat. In this procedure, the S/R valves are not needed to be opened as the LPCI flow spills back to the torus via the break. Otherwise, the containment cooling is identical to the Alternate Shutdown cooling procedure. The success criteria for Alternate Shutdown Cooling or Containment Cooling are described below: o Availability of one containment cooling heat exchangers o One of two LPCI pumps in one subsystem must start and run l o Two of two ESW pumps in one subsystem must start and run. o At least 2 Safety / Relief valves must open (needed only for the Alternate SDC). ! , O < 3.2-311 l MILLSTONE UNIT 1 maanxme m.m um )
Figure 3.2.24-1, in this section, shows a simplified diagram of the integrated systems which are used for alternate shutdown cooling and containment cooling. J Reliability Model The unavailability calculations do not include the unavailabili'y of c the S/R valves failing to open. For the Alternate Shutdown cooling, the S/R unavailability is separately accounted for-in the event trees. Therefore, only one fault tree is developed without the S/R valve faults. This fault tree is applicable to both the Containment Cooling and the Alternate Shutdown Cooling procedures. Therefore, all further references to th Alternate Shutdown cooling are also applicable to the containment cooling. The alternate shutdown cooling system was modeled by constructing a simple fault tree that made use of component and system unavailability results from the original LPCI and ESW system analyses. Since each train of the LPCI system can be used only with the corresponding ESW train, ' the alternate SDC unavailability was calculated as shown below: rm OALT.SDC * (0ESW-A + OLPCI-A) ' (OESW-B + OLPCI-B) Figure 3.2.24-2 shows the fault tree model for system initiation during LOCA and non-LOCA events in which everything is available. It should be noted that ESW system faults are treated as undeveloped events whose unavailabilities are based on the previous ESW system quantification results. Faults in the LPCI portion of alternate shutdown cooling are taken directly from the LPCI system fault tree and placed into the new tree where appropriate. 1 Failure of a single AC or DC bus will cause a failure of 1 train of ASDC. For these support states the applicable portion of the tree was eliminated. The fault trees were subsequently quantified to obtain a mean system unavailability for each support state. r"% AMENDMENT 2 3 2-312 MILLSTONE UNIT 1 - PROBABILISTIC SAFETY STUDY _
i i./ 1 Rzults (~'% The results of the unavailability quantification are shown in Table 3 2.24-1. The quantification results for the ASDC System are described below by category:
+
o All ASDC Support Systems Available The total system unavailability is 2.13 E-3 and is primarily due to pump failures. The dominant failures are es follows:
- 1. Common cause failure of 3 or more ESW pumps failing to start. 23%
4
- 2. Combinations of one ESW train out-of-service for maintenance and random failures in the other LPCI Train. 22%
- 3. Failure of both MOV 1-LP-10A and 1-LP-10B to open. 14%
- 4. Random failures in both ESW Trains. 11%
- 5. Combinations of random failures in 1 ESW Train"
.and random failures in the'other LPCI Train. 8%
- 6. Common cause failure of all 4 LPCI pumps to start. 7%
o f_ailure of BUS 14E The total unavailability is 7.50E-2 and is primarily due to failure of the Instrument AC system. The dominant failures are as follows:
- 1. Failure of IAC 59% ,
l
- 2. EWS Train A out-of-service for maintenance 21%
i
- 3. Random failure of ESW Train A 12%
l l l . AMENDMENT 2 3.2-313 MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY
I o: o Epilure of BUS 14F or a DC BUS The total unavailability is 3.19E-2 and is primarily'due to. random failures.of.a ESW train. The dominant failures are as follows:
- 1. Random ESW Train Failures 49%
- 2. ESW Train out of service for maintenance 29%'
3.-MOV 1-LP-7A(B) Fails to close 9%
- 4. Failure of motor bearing cooling to LPCI pumps 4%
- n..
V L O AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STU UD
_. _ _ _ _ _ _ - _ _ _ _ _ = _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ - _ __
,i ..
TABLE 3 2.24-1
- O Altemate Shutdown Cooling System thiavailability Results
, ? Case Mean Unavailability ASDC with all support 2.13E-3 systems available ASDC with failure 7 50E-2 of Bus 14E ASDC with failure of 3 19E-2 Bus 14F or a DC Bus O O AMENDMENT 2 3 2-313b MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
l-l purpose of this valva ~ modulator is to maintain the ESW side pressure at a i o pre-selected value which is higher than the torus side pressure in the heat [T exchangers. The higher ESW pressure ensures leakage, if any, inward, i.e. , into the torus. 0 Each LPCI heat exchanger is rated for a heat removal rate of 40' x 10
~
BTU /hr. The rated conditions are as follows: 1 Torus temperature = 165 F. ESW Water temperature = 75 F. ESW flow = 5000 gpm. LPCI flow = 5000 gpm. AC motive power is supplied by two separate buses (14E and 14F), one.for each of the two ESW trains. Bus 14E is powered by the gas turbine while bus 14F is powered by the diesel generator. The success criteria for the ESW system requires one LPCI heat exchanger with two ESW pump per heat exchanger removing the torus heat. r3 U Reliability Model One fault tree was developed to calculate the unavailability of ESW train A (Figure 3 2.25-9)and one for ESW train B (Figure 3 2.25-10). It was assumed that AC bus 14F and DC bus 101A are available for train A and AC bus 14 and DC bus 101B are available for train B. The faults associated with instrument AC and the maintenance unavailability of the ESW ptnps are modeled in the fault tree. All human errors used in this analysis were judged to be miscalibration errors of the D/P transmitters. This type of behavior may be classified as skill based because the operator is well trained and experienced in performing the task with no ambiguity. Recalibration of the ECCS sensors was considered in a separate analysis on failure of the ECCS Actuation Logic, (Section 3 2.16). , O AMENDMENT 2 3 2-317 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
i . Results L/ The mean unavailability of an ESW train is calculated to be 1.56E-2. - Failure of MOV 1-LPC IIA to open contributes 29% of the system unavailibity. The other
. dominant cutsets are failure of 1 pinp to start.(27%) and failure of 1 pump'.to run (25%).
Table 3 2.25-1 summarizes the. unavailability results. O AMENDMENT 2 3 2-318 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- n. . _ _ _ _ _ _ - _ _ _ _ _ _ - - _ _ _ _ _ - -
TABIE 3 2.25-1 O E3W SYSTEM UNAVAILABILITY RERLTS Case Support State Mean Train A The Support States where 1.56E-2 (2/2 ESW Pumps) . 14F and 101A are available All other Support States 1.0 Train B The Support States where 1.56E-2 (2/2 ESW Pumps) 14E and 101B are available All other Support States 1.0' O V l l 1-I i -> amDs 2 3.2-319 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
3 2.26 MP2 AC CROSS-TIE n Systen Description yf. For the purpose of this study the MP2-MP1 AC Cross-tie is designed to supply emergency AC power to either AC Buses 14E or 14F from the MP2 emergency diesel generators in the event that Normal Power is not available and both of the MP1 emergency generators have failed. After experiencing a loss of normal power and failure of both generators at MP1, power can be supplied to either Bus 14E or.14F by manually cross-tying one emergency bus (14E or 14F) to an MP2 emergency bus thru buses 14D (or E), 24F, and 24E. (See Figures 3 2.2-1 and 3 2.26-1.) Success criteria for the cross-tie is defined as both of the MP2 emergency buses energized (24C or D) and one bus cross-tied to either bus 14E or 14F. Figures 3 2.26-2 thru 3 2.26-6 show the simplified schenatics for the support syatams required for auto start of the MP2 diesels, diesel cooling, and circuit O
;g controls.
Reliability Mo_ del The reliability model for the MP2 AC cross-tie consists of a fault tree for the supply of power from MP2. The assumption that both MP2 diesels were required in order to cross-tie showed that non-recoverable bus faults and circuit breaker failures of the MP1 AC System were insignificant contributors to the overall unavailability of the cross-tie. The fault tree is shown in Figure 3 2.26-7 and includes a HEP for the operator successfully aligning the cross-tie. No credit was given for manually starting a MP2 diesel if it failed to auto start. O AMENDMENT 2 3 2-328 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
(. l'- l' e ' AW!ultat p The fault tree was quantified using ' HEPs associated with three different ! U' operator. response times based on the time to ' core uncovery (dependent on S/R ' valve and IC failures)., The results are listed below: '!
- Available Operator Unavailabilities Response Time Mean Variance 90 min. 2.27E-1' 1.63E-3 45 min. 2.50E 1.52Ed3 25 min. 4.15E-1 9 30E-4 The dominant failure mechanism for all three cases was the unavailability of either diesel at MP2.
A
;t O
AMENDMENT 2 3 2-329 l MILLSTONE UNIT 1 ! PROBABILISTIC SAFETY STUDY !
O V K 6 V K 6 - 1 1 4 4 8 0 4 A-2 5 1 ,) 1 4 D A- 4 2 1 0 2 S 4 5 U A- U B l 2 3 _ _ 1 5 - _ _ V G K 5 6 1 d 1 7 G n 4 0 / a 4 l D A- C 5- m 2 5 P t e P s y M 2 U P S 0 1 3 A-5 0
- C 6
2 5 3 A- 2 .A 2 5 2 3 6
.V 0
O - _ 1 C 2 4 2 e r S 1 3 u 2 U A-g PP B U d FM i 2 l 2 e 1 s V 5 - o K G lc 6 5 1 1 r e 4 6 G ht 0 l
/
D o 3 e A- ht A 2 5- , 5 P n e p P 0 M d e o U n ly s e P lo p la C O m r ly ly o la la N 6 0 s 0 1 m m r 2 B 4 r o o r e k A- 4 2 A- N N a 2 2 r e S r r 5 U 5 e e B k k tB K 6 1 B it e a r B it a e r 2 h f t e 2 4 4 u u o 0 0 c r c r e 1 A 3 i i n A- 4 A- C C O 2 2 2 - - - S O 5 5 U K 6 1 4 a "
O >
^ kleer t
r iA t
. ca oo s
I n JC r o C D f o s s s li oe L s Or e nlo 2-oC dt bel oo 6 era ) ' u 2 st B LC loS Cl e ( A 1 2 3 0 lss ie ) 2 ai FD B S e O ( r U
>- A 1
B r e u g h 3 C l i S_[ d /2 - _ S __ D
)
B I o o F W A Ac r S- / I 3 e 8t 2 - f
)
XA B A
/
( A 1 1 0 2 S U B ) r B J C ( A D A t 9 s 8 I n r W o S- C
)
C 2pDoss s f ( A l o n e p g( S P
- nO o
nra et t pS Ol e s s lie ai FD O
$ g" ,
) llii'i I 1' O s
)
n) 2 eBp( 4 3 OA 1 6 d 3 ( 1 e2 4i z -
- 3 gWr R 6 eS Yn s S FE2 H i c
t d a
\ nm a e 2
t h 1 l e c u S t O d Xi e
/ f i Hl p r
ei m 3 t aS
) s 6
2 gl v We 8e ni V a O 7 s 9 lo) 3C( 6 B 2. 3 o l os ( d A eCs a r Be 9 z89 uGp . 8i - g/ y _
- 3 gW r
i FDB R 6 eS S Yn - _. H FE2 -
\ - _
5 s n e p n U O2
$58 man 8 c
t r at y _ t l i Sc l a eF s ie - D)
* (
O _ g0*es " _
, lfl
_ l _ ) _ d de _ a 7 _ o h 0 L S 4 ( p6 i0 r T3 r A- ec t i 2 at 5 W eh cc 4 v iS r 6 el 2.S
- 2. d 3 eC i f
) elp p r
i 2 u ( 1 i gmiu
- 1 S -
) FSP A O I E 7
0 S S 4 e s (6 lo0 3 C A 2 5 f h l i~<"oN $m 8 i l sse N l
O o he sS e _ sd . lo ao _ CL 1 e0 s4 l oA - _ C2 5 M P R w0 s1 R S r S 8 H e k ah ec r B -
)
t r ed ie taez es 5- Ti lo2 S# Siglo r 6 dn r eC 2 a O r SiAn iAA( E o t 2. rt 3 a t eSr r
)
u igGn 4 d ae es /o lo1 Sizgl t FDC o S# r r r eC iSi A A (A neto
)
2 ( 1 P 4 L
\~_
h U _" 5oN $m oO O w9. x,0 m l l
)
2 ) v r A 1 _C ep 4 3 3 A-5 1 Sm t u 6 r 6 2 aP C R _( ( R 5 t O- A 4 3 8, 5 Ser 8, a t 5 0 7 1 5 7W K K
)
r 5 e 1 c B6 n 1 ( e S 51 u q A5 e I SM S A t r r e ac t n Se u dq ie DS e 6i c 8, 6, g )0 - g 75 a3 6 o 6E l t o(6 2. L R v0 r 2. P 3s e 53 3N d L O A) 0 A 3 5 0 3 UA nM e r S uA gS K (6 i
' FE
)1 01 1 4 4A e"
A (2 ( W 40 4 03 / 3A 2 A 2 - 25 5 e )' 0 g8 ta2 6, 1, 54 lo( 6 _ 6E l1 v8 r e 52 R , 3s d nM 8 )8 UA , 2 5 2 K (6 la n l a n la n l a n y g g _ ig ig i i it il S S S S c a e e e e F g g g g ) t l a l t a l t a l t a ( o o ) o ) o ) v r )0 v r 0 v r 0 v r 0 e 1 e e 3 e 4 O 2 d A n d n A d n V A d n A V V U V U U ( U ( ( ( Ein w
j> 3 0' 4 n NT O O A0 0 RS EL KI cO r y o a
]
I l AA T l EF ? n n CA R 9
! AF R
I N ii 0O iI P2 C
- c
'4 4 4 3 r T
FG E i FN o U t 3
/ 0M l 4E i
( T D I 0O 2 u1 P C - O 1 LRN RU - PCU ~ R 1. M. T I l O SFR F60 Cl T
/ ~ r '
b~ 4 0 S . - L E I 0 AY 0 FL 7 6 l RE i ' 0 P 2 REI 0 R CPT
/0( E ? -
TO - P ARS i s RPS E r POR CT C 4 3 RC 0 0 ET - - K E E AS 6 C EL 0 C k RI BA F TF0G 2 4 4 3 7 T
~ n T
F i 3 i 2 4 U - E I CTS RFO _ I 4 L C1 C 4 9 R 0 0 E E - - T K 5 E F O A O ? 0 0
~
( J t N EE I L N10 N i E R2C B - Do L T0n 5 1' 4 2 7 3 s 0 0 0 . 3 T P
- A SL
/t /
f T4T l f tc3L 1
- S 0 S 4 3 1
2 SI rA E V P5I
;1 A E R.
e A C2F R T M R 3 6 U E n 0 A KO E E F AT E 0 0 E k RS PL I T4 C C , 0 0 5 3 8 1 I T S T A O 0 2 1 S I F U C3N 5 A 7O 6 I R0E I 6P
- 2. C CAO C
- 2. A 3
1 EP R 4 9 0 0 RM ES - - E-KL AI E E RP2 EA 0 n FM l RF B 2E T3 0 0 2 4 4 5 0 n 3 7 T - S 0 S 1 3 _ I 1 O : _ U - L 2 C3C R5 I 1 O C2T l ._
/
2 r E I TE T N
- L 2 E k SB 0 M SA 0 D OL 0 N RI CA E V M 2A A PN t U _
>l t
.I ,
A i ] AM g: E
- i i
!- R i
. ~
a 1 2 ! g 3 o s; q i g.
, a s ~
I. = ~ .
~
, m -
I , h, l<l - i t I
-!!c 1
! l' U hg,i! b
.:t ul g
8 [ $4 = i :si I _ !:- , 8 el I sal e I
~
b , lls l _ l
, h@ .
, !.E lil lo!
lii i k l' O 1.1 = b l,i, @ , AMENDMENT 2
i
,* il lIl liIiJ 3
e g
.j e
P f l 8 8 C / I T' 3 G CS 0 O~ 1 AL 1
/
L S 1 TI 0 1 NA Ai 1 6 1 i 2LI 0 OF' C 0 1 0 0 LA 4 5R S A E F G I S N i FA I N A 0P H 1 C 7 6 2 2 3 S C- L E I I G O R O 1 C I U L S 0 G 1 YS 9 I 1 L AL 5 F 1 I 0 LI 0 A 0 0 A EA LF E S RF A G 3 N 1 3 I 0 N - A F C S E H 0 I 1 C GL 7 1 OI I L A F 0 1 l E 3 LN AO G0 6 X I A 3 NI T 6 'T GT LM O I C OA I L SNU 2 Y A 0 E RT I e PF N
'0 GL EN I i O AI LTO A TA OU P
t e G LF U s R O I
., ESL l
VS 8
~
s NI RT 5 o T EI 0 r I A i E F ON 0 c PU A U G 3 c C I 0 a
\ 2I -
G C S E FO I 1 y 0L GL 7 c O IA I n 1 L F 8 1 e 2 g E r G8 6 X e 3 A 2 'T T6 D m e 3 LM 0 DA U A
- V 2 N E RT I p
1A 5 E IN m S VEE 1 2 OU P D- 4 U HI 1 CVT 0 TOU 0 i IRP X NPT T S U S OD S l CT A I I L TS A AL N S TI G SA I L 1 F S IA 9 0 i PF N 0 0 L R E A G 3 RW O I 0 E - HP 2A N E T 5 I S 2 E VE ' D 4 HI - 2 CVT 0 TOU 0 I IRP x MPT T S U S OD S CT A I TS I AL TI SA F _ 2OZ$H M l li I _
i i! .il;1; . l!l,J 4 e g
't
- a P
1 8 8
/
3 4 0 0 /
- 1 E E 1 2S 5O 6 l L 9 RC l 7
E 2 KO 0 AT 5 E h I RS B BL 2 4 I 4 TA B - IF A 0 6
- 2 U l P E C2 M G 7 2 S R0 U N 6 L I5 I I
A I CA PONT l 1 3 F 7 R NU 8 5 E R B 0 4 3 ESR TL P U AI E h G 5 '0 F I P A 4 WA FU 2 F G E NI P P 0 A CBT I M - P TR E I5 I U N P M A 7 1 VPO R C U T E P S l 9 S RO B S ET T P l I A S X
'E WL 2 E AI P C F A ,
I l V B e i RS t
)., E P -
S s h s Ws Q o I c 3 3 c 0 0 a E T E y 8 6 CO 6 c
.E 4 AT 4 n A7 O S 1 T e 2 NS I
2 g 0 3RL 6I C 4 0 OL CI E 9 0 r e MA O 0 A 0 m f AP T k I AF S O 'X e B 4 B YT P 38 L P 2 ACS R 6 .C R ' p LA L k K7 A m - ET IA [ YR l RN F AI 6
- O '
T C LA .E CS EP A5 S O I AL l R 0 TI 3R L 3 NA 0 6 6I C 0 l OF C 5R FA S I 0
'0 A
G I Q 3 0 3 0 MA AP O YT AC S LAL T 0 X B P R A O 0P E E E T.AI I 6 0 6 Rf 1 6
.E 4 1E 4 OF A5 S O I
2 A 9O .S l 2 C 8 8 2R 6I C L i O 2 RCL 2 O O 6 I O MA O _ M A AO - I AP T X I X
'B PT B P P YT S R Y TS R ACL LA A A CL L AI A ET IA I ETA l RN F R NF O O C C h _
Nao N lll ,ll
' ! l I j 5
e s e P
%'u r
l 8 8
/
3 0
/
1 1 l 4
'0 E
TD 4 CT 4 7 Y A l 1 - TS ANL L i A 6 2 - T OIE E CAS H I R FOL X 2
'S Y)U2C P 3 A 21 R L L A E E (1 R A
N R RIR I U G G SA I I HP F S I E 9 S 4 i O O L O C A 4
/ G 0 N l E E l
P d O E 4
)S S O U O I
i N 2R L 2 1I ( A C A ' H e I RP S O X i HT T 'B t C P - 5 0 YA S R s A s
*O/ E V
EO VT E 5
- AT LN IA EOF L
I o r c L L 1 RC - A AS 1 c V 1 VL 3 a S I A RE 6 DAE 1 y ER 4 EFS 3 c TU 0 T O X n AL 'OA AAL 'B V e WI R1C g A G E3 A r EF l P2 A e C O- I m I V W e R RS 2 E I - A2 p S m
\
5 0
- l E
E O 5 _ V T 1 L . A S I 3 V IL A D AN 9 E FE 8 1 T h A P A R AO V E 9 A P 8 A _ O-W I _ S R-I A 2 _ O
!y?:g As lL '
jl llII !! 1;1 6 e g _ a P
.O 1 8
8
/
3 4 0 0 / 1 E E 1 2S 1 5O- 6 L 9 RC I 7 L 2 KO 0 AT 5 E X I RS 'B BL 2 7 I- 4 TA B 0 IF A 6
- 2 U I P E C2 M G 7 2 S R0 U N 6 L I5 PO4 I 3 I CA l 1
A l TOP B F 7 R U 5 E ES R B 4 0 TLR AI P X U G 5 0 A WA E E2 I P- 4 F U P F P Q 0 E C5 I N A M U PT E I5T VPN I 8 MR 7 O UA T 1 R E C PS I 9 S R O B E 5 l A I T T A S W L-E IA C F N P E 2 P A I I V e RB E P5 i t S O s o r c s 3 3 c 0 0 a E T- E y 8 6 CO 6 c
.E 4 AT 4 n A7 S I T I e
g 0 O 2 NS 2 3R L 4 OL 9 r C 0 CI 0 e 6I MA 0 AE 0 m AP O X AF S 'X e I T 'B I 4 O 38L B 2 YT S F 6 .C r 3 p ACL LA f A K7- A f 0 m ET I I YR I E RNA OF AI 6'E 6 T C LA 4 CS EP A5 .S O 1 2 AL I R- 0 TI NA 0 3RL 6I C 3 0 l OF 6 MA O 0 C 0 AP T X S 0 A 1
'B P
5R G 3 3 YT S R FA I I 0 0 ACL LA A 0P E E ET I I 6 6 0 6 RN AF 1
.E 4 1E 4 O A5 O S I A .S C S 9O 8
2R L 6I C 1 0 2 P RC 6 I L E2 0 A 0 MA O 0 M AO I AP T X I A PT N YT S I Y TS B F AC ~ A CL F LA IL A L AI A ET i A I E TA I FNF O R NF O
. C C O -
!sx IL-H N i( Il lll
I l 1j' 1 .l' ! 1 111l!lj!l1 l: 7 e g
/ a
- P
+.,
1 8 8
/
3 0
/
1 1 l 7 , 4 - 0 6
- 2 E
O
- 5 2 T
HS i 2 1 3 TCL I A S E I A E S M I WO S FS X G L L 'B I P F D )UC S E2 E A P (1 I S W S _ S l 4 0 L - A E e N 5 i R G
) O 2 t EDI UT' -
KTS I 2 I 1 s A 1S E A s
., ESE 9 (
L Z S o RLS 3 RI I H r BIO 0 SA G X c
'H I
AL 0 R TFC A HFE C c I U2E G YY N R a E C1V I AA E A y S R3E LL l EE c R O IAI RR $ r ELC C C E e g K I R A O r E T 8 e R 3 m BS '0 e L O T I A 2 I G 4 4 p U A 0 0 m C F i R 2 2 E E RE E I 1 5 S O 6 9 I S 4 4 C 3 L )A O A RC I 7 UP L I 1 E D 2 K ON 2 1 1T C A S A A (C O l ET M 3 X RA T H X _ i R SE B 1 ST 'B B LD 2 HNS P _ I B O R T AN A YC IL A I O A UF I LYFA I C 2 EA R 1 RL8 I E C 3 A R O kQgEH M Ilclll l ' l
)l i 1 j i1 .
i -
}
5 1 a g
')'
/ a
'g P s j
- .k . Q. 4 0
)
8 E 8 O S T 2 / HS 3 C 0 T IL / I AE 1 WFE 1 D h1 I S L l DIC' U E3 E 1 W(WS S-7 4' 6 0 2 L - A E 2 N S R E O E. 3 EOI )UT I KTS 1 3 1 A 1S E E ESELS 1 4 ( LZI F f SIO 0 RI E EA U G NF R N i AL '0 TFC A E I I U1E 5 YYD A F E C0Y I AA E 1 S R4E LL EE O IAI RR-RL E C C C K 1 E I A O ET R 0 4 I BS 0
'0 T IL l
A 4 4 I S UA I 0 0 C F - E R 2 E E RE I 1 S SO 5 9 I S 4 4 C40 RL 1 A
)UP O 1 A C 7 3 L 1 EKOP O 1 0 1T C B e A T A 4 (CO S i E N h RAT ET O
J t r RSE I B B - l' 2 BLD E HNS O r S I T AN B YC IL f g_ EE 0 E
- I UF O A I A A LYF A
I S 0 C e C 1 EA r RCN 0 R0 8L8 C OIA TV l I CA4 E R' AR N E 0 1 C RE T 3 a ESN D I h 1 y I EF A e c GO N G D n LTO EU A e g S SO T 1 E r R E EU IU e U D3O m L 1 I i e A 7 F 3 2 U h p 3 0 m 1 A 2 S L I 4 E E S G 2 E I R O N I 2 TO 1 O ATNP 0 3 R ESR U 3 1 I NL h d I EIE GAU F G F D L EU I N A T S3NO E1 I I C D 3 0 T E - RR OA 3 8 T T I A S U 9 . RO E 3 1 NT h I ES GL E G L A I D E A S F i
. E I U D 3 _
1
$1
.s ,P,!
Ch a A Z i, ) , w* d 2 - f r t - j I ' 1
, . gum l 9
-g 1
g
!iI' ib!i l= !!h iii s
3. n I ie E o q. h 1 ll... s{
- n. _
<j -
!! @ III c
I ~ . 8 I f 8
; e 3
i i i=
~
!i
-t I Ee i
I ! 4 ig id cl jO } 4 u 2 hi 2l @ , i i1 i-e V. li t i 11 2 ,Q o i= E p si j AMENDMENT 2
i!' . },. . 0
~ 1 e
s e P 1 8
~
8
/
3 0
/
1 1 l 4 0 E TO 4 CT 4 _ 7 YA i 1 - TS ANL LOIE i A 6 2 ECAS H i R FOL X 2
'B Y)U2C P 3 A21 R L A E L E (1 R A R RIR l
U N G G SA I I HP F S I E 9 S 4 I O .0 L 0 C A 4
/ G 0 N I E E l
P 4 O
) 5 E S
4 O U O l 1 N' 2RL 1I 2 (A C A e l RP O S T MB i t HT P - 5 C S R s 0 YA L A s
- AT I o E EO E LN A I
r V VT 5 EO F c L L 1 RC A t. S i c V I VL 3 o S I A RE 6 DAE 1 y ER 4 EFS 3 c TU 0 T O X n AL 'O AAL .B V e WI A R1C g A G E3 A r EF I P2 A e C O- l m I W e V RS R I - 2 E A2 p S s i
,I 5 0
- I E O E VT 5 1
L A S l 3 VLI A 9 D AN 8 E I TFE A AOP X
.A R 9 V E 8 A A
P-OW I R-S I A 2 I
,osE "i ll lL
. l g i v ; g lle h- ii 'l-4 !:
I e a pu l ll
> ll t
!!!D 2
l k
!! ll1 E
I 2 m <J # ! ! ed p E ! s'l, 8 h!
)'
llRfb ! jd i, I- i 1 la ~ e d.l n-h! i h 'l i
-!l fb '
Ii U l
~l l
l 11 : 9 O-1-O
~
- a M
l ll inesonsur 2 l l
iI 2 1 gi e s
,m /
,- \
P e . p 'N l l 8 8 .
/ _.
3 _ 0
/
1 1 l 4 0_ .
- m E
TO 4 CT 4 A I 7 Y TS 1 - A i 6 L NL 2 EOIE M I R CASFOL 'BX 2 Y)U2C P 3 A 31 R L L A E A E (1 R l R N R RI U G SA G I HP I S 1 F - E 4 S 5 O 0 I L C
'O -
A 4
/ G 0 N l -
E - . l P E O T O 4 CT 4 O Y TA l i N S AN L OL E 5 E C IS 9 0 e R A i FO 3 I L B t Y P - 5 A )U 5 C R s 0 L 3 A s y#( E E
- E [1R i o V EO 5 R RI -
r VT S A c _ L L 1 P A AS l
. H c V I VL 3 a S I B RE 2 DAE 1 y
ER 5 EFS 3 c TU 0 T O X n AL '0 ABL B e WI A R1C V g A G E3 A - EF I P2 A r e C O-I 1 m V W e R RS E I - 2 _ S A2 p _ m
\
5 0
- l E O 6 V 5 L T 1
;A I V S L B 3
DI 9 _ I EAN T FE 8 X A 9G P 'A . V R9 E A P 8 A O-W I S R-2 I A ef s hn$6H r h
.l! ,
.i1E) i!
~
J I _ e g a s
~ ~
P S
. s -
O
- l E 8 DLF tat 0
3 8 IWd
/
S. EN ai t 3 RM1 0 A T A / F 1 E.V s tIA 1 W tTt 1 T A E l E d0 D A Si IL. I WNS F ( P TA h O N E - 7 S - T O 6 Ik - I
- r E Ee E 2 E Sn S 0 4 lf Rs r 1 2
C E HD 3 AT E I 4E E 5LI R TA U IF 3 G 1 t5 I t0 f F IS CA S O SN E _ UE 5 l 4 RC F 3 1 3 E D MOM 1 ATA t . E I WLE Ss '"^ ._ I TA4 N IFE = e i . U I - C0 t .
, R1 - ~
IM C s
#, o s
o r c 2 c 0
- a EN W SE 4 y P c RC I 1
E n fOfC 4 e ATA g I E N RSE N A r SLD I e . D TA03 IF(
- m e
E U I C4 D R0 2 I3 p D I CA m A - O 5 - 5 L O T 4 0 0 4 5 I 9 - 3 0 5 tN E 1 SE G l R P 3 . A RO I E F E G ROP i t ATA 4 E M C I RSE 3 A ELD I E TA4 2 B IF( A J I tCt Rt I4 CA ~ 3 9-
- E 2N e 5E P s.
RO I a EKOP G E 0 ATA 3 E G X I RSO A BLD I R TAN B A IFO U I C2 R0 I3 CA D
- l-C
=
Ml;r
r t e y n o ad C d a I l er r c ee e sh o r cs .rer er o o a e h roNr udt h t hemrW. et pt n enK r a r t r t t h o in d e ob uuntogeaaL
# se o eF sp -
'h i
t gt atyd id n o d 0 e1 r einn t ne cv ogmk c in r t s k eiairP a mr dn oEe pe eit S ( w , oN c ain b r io ut eb es r up u I m0 pv ir aH 5 od eeW T N s e pbsCn e i 4 . lpth t s o as hwed uh su t r r ye r t s eE E bewe s. m1 e r Cl laby phL t i
, u dn ho Cwnb u i
.d I t
ot u oun n E t g u n oa o f y M h in. n r g Ni m0d53 0d ed 4 u 1 t s c uiv u at e t s d oe8 et xo Ap oitelb er r e les s v e h 8 oed teh ndi iod t t ebesO O " 5 oi n a O mr e in loro et stef sl al p t s itaao ynl r t uou 0 " n r L-CsmCri ofie - vPaV w a
,,MtoP r ct n 2 ' og e l Ro aRl o f
pt oe cl ai t
=
, atat r aUi0 1 I
D l l ts d ece arp0 m5 r peE 3 e eh s e - r r E 2 RbTio50 eHo - - - 3- 2- 4- 2 2 - P E - E E E E 3 E 3 0 5 H 1 5 3 1 3 3
)
C yR i (T t l i b ia no le let i C u Rlae le R R u T I err R mro iTC 1 3 4 p n - u E i 0 - L r s e5 0 e B ) o n v 5roak e 0 r A T eW r is ei r r s it o st 0 tam oF( n o a c r t s Or p a eeC ee r t r et ou - e c er d pI oo e a d ae t ou ow t d or k Nep a d ia t defia l N t ant laor e om e o s def e. t a m e n nie it r3 N e ,s laI C n e iod L O nCp nn i m sv sno t e I I m ooe . s eg i ic e cydt o T s egu isi it r iz i o o1 m d aiN P iiznp idt c Ks r o n s, ge l denco ree R r ,b ns e f r oi ot an C S gur c ys u o r o at o No d e p . C cre et r t t a r errerod cb i e E eb s e t a r 5 a pmpd D r t t,yn rb r ler ecli i to0 o our u ovp r t ale w peb d orr a i e a3 r eP t a r o n eiod r s r n r i r d pN ei t h i e t is he co ob u eVlo pa pP OO Ot s f I ORo r f t inr pn d i 1 RO ON 0 T AN 5 3 RIO ET 9 , O O PC O K OA r Mew N fo Po P s s N L bAC
' i !' ,1l) jl 1. }% ' -.r S s e
- s. .
s T e s e e s N t c t u t u t u e E n n n i n t u 4 im im m in h im m O 0 0 0 . O 2 2 0 2 2 0
- = - 2 t t
- 't -
t t 3- 3- 3-3~ 3-E E E E P E 3 3 3 3 E 3 1 1 H 1' 1 1 S I l l l S l l l l i i l i , A k k i k i g S S k B S S 3 r r o o e ' 2 eot r t ar eot r t ar r s s e s s s r s o '""'FtW e p o e p o e p o e p eWp eWpo t t t t s s s r s r rF o m u rF m u eWi. rFq p us c m u e rFW q u ip s. m u P P em for e P em P t f t ooce err e r u ooerce t f t e r u t ooRu f s p *eo r u c r e r u t ooRu f s p e r u d r r N d r ou c l o W F s s eu l oc C WsFe s d s eoWu el
.er b e ah W
F s s e d s~.e Cs s eoWr el u I e Cer I oi a ei nfa e f O I nf e h f o I P h f f r o oP naSs s *g T :er oI Cr f P naSs s oP r f T sg f sg s egor f e *n .a s egor f enw P enT n o ow enT n nw n p nf ow n R iziw in ooL iziw. n o oo d sL zis n imsw
*im "w
9og a r sion o i zis nwswt p io L o n g go m. gl o n r s nL goo o r fa t C a r it r a srf gkl oo co e of S o roa o it ao f oloa r o oo ol c l
- fosi od o a ogl l oo -
e oar c oar t E cf : cf r : t t c t t s ese t e ce sr es ins e e ce se sees f yo ' t sa s eis d e ef y o D r s r r leo r r r o eo let vs s aRiU r let a RRU o vs s r leb C '"e vpr o R inU r lebC RU tovd I ovd e I OO eopnOOO t al o nOOO n aOO0 m ale ef 'l t t t - al t o al eft o r eV io r eV io r eVa "Vrur e r eVa ppis it e PP e p . pP n t ORr a u c pPnt ORr u a c ORiun Rt oo ppis it oRiun mm RO ON T 1 2 1 A N 0 4 2 1 O 1 RIO 1 1 O O r ET O O yt e PC r a OA e ic er se edaW n ng s t W v r ) SeW RCW ed loa t ion b cl r eo i 2 F r n S f g g TuSoC e N oi e t: s f o f ( o r onn sdR i f g e a n s s se sR o ond sdi se N s o a t ouo e r o LBC si l RT L LW oulo N LBC N M m l(l ll!i
.(v s
)
ip
. t n
a n id nl e o t r ic d ala v m u n isn. h o t s t s
- f u n ga r
s s. s i t it e o r r l n i a u p r o c t cu et n it s is erren o
. keaco la m err is n l i
a v a r es W F vo ac e o c f h si o bh t r h h it h a e gn o f i . ot W W l l i t u r aH s l t r F wcit s e t u d p ei r iweve l f F f r r orohe es l ah er m t e e n r t et - r mo i( i ( t h e s S i d s io t oic t e s e s act r t he T N m s np at r t e eo erv r oi gh E h 0 o c n r epcend n u n .nu t pt o f ht r 0 0 4 lyr u of ai im t)e im ememo hit r Ps Eef o h no inr Hmi eu O 2 t Ot he igo r 0 1 r a 2 T et O - Ts e < ep < h0 la t 1 2
. t o t 1
. T1 vbh 1
3- 4- 2 2- 1 3-P E E 3- - E E 3 0 E E E 5 H E 5 3 3 1 7 3 1 1 1 1 1 eg d S le I S l l C l C w l A i k R i l R o l i le S T k T n k u B S K S R
./U r r e t o fofes e h p d n N y V P
V P 3 r a t r n t r e a o m ah un Rs Rs t s* e r aar p t r u gw ni e e e*op r tst d e nt P m u t ap sr n ee e r sVP IPR d V as mp m ds o lo a . d oh lo ace . o t c e a as e f os w o R s o peul f or er e f or er no t t t r t r r Wn e u det ah t d e v t eu t eu d e o Fd s s r deloc oh dP e ell eu ar d r t eu d r ar t e c e eh e ef aer.e nr ape n e e etae et n ntr V oco nr p r nt e f P a t nd h s sn r tu aP spm e s pm e s e T ny w e ni a s n aea st esR e e e e z oc o izet e r r l zmt zmt mi.in . zl ue id n g t ae L nd n gni iet nva p n n in gat a ie n g t n ien g t n o m r o rg p f o a ger m o en eomyo mc m a n mei l ol mle i ewra m ol e e ce l it t ce: s ez a ewra r t e r s r emus . cd pt eem r im r yut r yu r a ten ct y r a Rep U r t r t r n r o r r u r r r r t o s os o oc o tos st o tod a od as pnO eet a n s t t a O t agd n t dl l it a rere r a r n r e io r r r e ee o v a r e i wu n e ar r epd eeV eeV p nt u ca pm per phP phP O r Oeii nn peyt Oh dr sa t Od o owr owr R On T 5 5 0 A 0 1 3 2 E 3 O 3 3 O 2 O 2 o Rm P O 0 O k l a -* E la A dr e E R mC S O B B r T lLk eA T nA aC gC N laa aO r E mer mO S L L L V SB E
, g . r e0 Sl eefr o n r 0 i
tu5 F p Au lo o Cvwd L e a rP l o c .S leo eO r Tn a n V plla n. p E sn po t e vl e w SoPe
) r r c o m en a
mc oc b r dtoR. C Ll l Rocic f st i t i Sed cnaeyj e tyd ud pi ae t u H c r n i t e nq u l e vwa hs D r o6 uei c e ca it ol i y le oe rd r o of r l ( 7 )nd v 5 or eco o n sel
.po s d it e r e csis .
S T se la
. ud cn b Vt Pai cn t
o rd e s e s te ua et nc orleg ab t ut nae 2 N un t r Ree rl nu n j 1 n= vn imhevrudix ct eSmiom n e d er i2i* m75 n leiw Mim h O 0 mia i r pa tsi r t t r eta-ue yany n st s na o cm 3 Poro=Vloo ObMPl 5 1 s cn e
= romp uip t hTSsMEs Rs Tl A i O 2 ina s e
t t E( t
- a y . . . .
TOO O0 Ms t 1 2 3 1 2
^
P 3- 2 2- 1 1 EE 5 E E 3 E 3 E 3 3 1 1 1 1 e g eg S I d d S C e e e A R lu l w l w B T R o o n n K K 4 . e V r m eo w o n e u r ct r u o s t g up pt y eWr s r r u f oca ev f e l. de u ei c r F o ee s P d a r s t b i pr u oor a k f t r e msse v v oo o ea oeo epe t t r d r Ws u Wn r pme d h t ct euo F e o T de o r es d eeh t e eu l ei at nf c r An o t t nr eet nh s a f e oP gc o f sgr n w n e e e st se e o N iwc enr zio o o iw w zh z e r izt it h O n gl oe it L o iny in fo n I a r lol ga ge gwi m T oloh o o f lo f o n oc ce ob olol P er T :e s e cf t r ed c ere c eer eb u R C r i .aRU e r e s e se wo r r r w r or m r e a r t S o vp r ol c oo or r eisOO at e a ue t t t E t p a pF al r t n s r - r r sp D eVt - o eV eg ee0 es pem pP ocst i r pn po1 r ORpa oB Ol o Oc1 Opt r e cT RO ON 0 3 T N 1 MO 3 7 7 7 BT O O 0 I 0 0 PC CA ) e t lb ) d u la t u e o ia o t a h v ht E f e it lo i WinA i WinI s Et ar O nf l e d ar Msen d _ T eor tet a n( et n Ms e pi e t t r g/ T eny a e( n N E d efne vit e v ic ina s mden pi isme d V apaa l tnr ar co ic ar t na n E InOSV ATSC nr co _ ATSC
O g r . l od a n r n in i t na n dr limr m o ia a ios c s nht r 0 noid t o b rC eA 2 i asiwn aO - mcs a l e t o r sL n S ndiws r t no e , T nie o oigt d N oivt cacl raS e r a s E dder erf sat nptef a idni aW b-a M aoios an 0 Bb Miol t A t i d i _ 0 . . S 1 2 3-E P 3 1 N M. l l S I i k S - S A B O r lade y eW rF 5 t r d iv oa olu f f nt e t ia o ois - dfe ip st oi s egr niln t sca loau er eq ewan h o ul t l ht e a o a h sf m sprint el izer n vo m m eio zt r icnt go an mn e s ear r eh r ot e p od po t eo r i t glep mVt e rPt s rRo o arWsp t e i r p t ad e r o r et ps F m e aee kt Orefopu pC a OAtots
)_
mK T P 1 wNO R o 8 sDC mA V E 0 7 E T 2 1 f C 2 T oA T N sl N E sa oi t E V LV M E D N E M A l!ll l
5.0 MODEL QUAhTIFICATIONS AND RESULTS addressed the identification and. frequency Previous sections have
%./ quantification of potential init'iating events (Section 1), the. delineation of different types of accident sequences and their outcomes (Section 2). These accident sequences are quantified using the system unavailabilities calculated in Section 3 and human error probabilities provided in Section 4. The l
quantification effort required three basic steps as discussed below: o First step was the quantification of the support state event tree described in Section 2 3 The results of this quantification were the split fractions for various support states. A split fraction is the weight that could be assigned to the corresponding support state. o Second step was the quantification of the system event trees described in Section 2.4 These trees were quantified for each support state. Then these individual quantification results were combined to calculate the core melt and plant damage states frequences. o Additional core melt frequencies were added to the results of the second step for those sequencas which were not quantified using event trees (e.g., Station Blackout, Interfacing Systems LOCAS, etc.). Section 5 1 summarized the method used in quantification. Section 5.2 provides the results of support state quantification. Section 5.3 the results of the system event tree quantifications and discussed the dominant core melt sequences. O V j i 5.0-1 . AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY i .. _ _ _ _ . _ _ _ - -
5.2 SUPPORT STATE QUANTIFICATIONS ['] The support state event tree, described in Section 2 3, was quantified with the
~~' unavailabilities for the AC power, DC power and SW system calculated in Section 3.0. The quantification was performed by using the "ARBRE" computer code. The results of the quantification are the split fractons, which are presented in Table 5.2-1.
The event tree model was evaluated for the Normal Power available, Loss of Normal Power, and Loss of Service Water cases. The sWit fractions for the Normal Power available case are used in quantifying alz- plant system event trees except the Loss of Normal Power (LNP) event tree, the Station AC Blackout event tree and the Loss of Service Water (LSW) event tree. The split fractions for the Loss of Normal Power case (Support State Case #2) j are used in the LNP event tree. The support state categories 4,7,9,10,13 and l 14 for the Loss of Normal Power Case represent loss of all AC power events which 5:ere evaluated using a time dependent station blackout analysis. l Category 14 for 'the Loss of Normal Power case also represents a Loss of all DC A
) power as well as a Loss of all AC power.
The split fractions for the Loss of Service Water case (support State Case #3) are used in quantifying the Loss of Service Water initiator event tree (Section f 2.4.6). Service Water failure as an initiator has the effect of eliminating Support System categories 1,3,5,8 and 11, because these categories require operability of the Service Water system. I i l l l O O 5.2-1 AMEND C;T 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY L_-__-____--_____ _ _ _ _ _ . _ _ _ _
TABLE 5.2-1 M.v SuePonT sun spur Fucrims SPLIT FRACTION' SUPPORT STATE NORMAL POWER LNP LOSS OF SERVICE. DEFINITION AVAILABLE WATER FAILED (Support Case #1) (Support Case #2) (Support Case-#3) EQUIPMENTS Nothing- 998 E+00 .8492 E+00 0.0 1.
- 2. SW .2435 E-04 .2974.E-02 998 E+00 3845 E-03 .1060 E+00 0.0 3 AC 14E
- 4. AC 14E
- SW .1189 E-04 .1024 E-01 3964 E-03
.1055 E-02 .2347 E-01 0.0
- 5. AC 14F 3263 E-04 35CTT E-02 .1088 E-02
- 6. AC14F
- SW
.2175 E-04 .4210 E-02 .2175 E-04
- 7. AC14E
- AC14F
.2267 E-03 .2067 E-03 0.0
- 8. .DC 101B DC1018
- SW .7011 E-05 .1997 E-04 .2337 E-03 jm. 9
.2597 E-06 b 10. DC101B #AC14F .2597 E-06 .7299 E-05
.1792 E-03 0.0
- 11. DC 101A .2268 E-03 7016 E-05 .2676 E-04 .2339 E-03
- 12. DC101A
- SW
.9288 E-07 .2807 E-04 9288 E-07
- 13. DC101A
- 14E
- 14. DC101A*DC101B .5476 E-07 .5476 E-07 .5476 E-07 NOTES
- 1. Boolean Notation Used 1.e. # implies "and"
- 2. For LNP Cases, Loss of SW implies Loss of 14F l
- 3. Loss of DC 101B implies Loss of AC 14E
- 4. Loss of DC 101A implies Loss of AC 14F i
i e2 5.2-2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY L. _ ___-______-____-_
i 5 3 SYSTDI EVENT TREE QUANTIFICATION RESULTS The study has calculated the frequencies of the core melt and damage. The ore melt frequency is the sum of various Plant Damage State frequencies. The damage frequency is the sum of the frequencies of the scenarioc which resulted in either partial core uncovery for short duration or an over. ower condition prior to the scram (see Section 2.2' for the criteria of core r .'t and core damage). The following values of core melt and core damage frescencies are calculated: i Internal Events Internal Events plus Fire & Flood
- Core Melt Frequency (Mean Value) = 6.20 E-5/ year 8.81 E-5/ year Damage Frequency (Mean Value) = 7.22 E-3/ year 7 30 E-3/ year
- See Sections 6.0 & 7.0 Core' Melt Grouping By Core Melt Timing Table 5 3-1 provides contribution of various Plant Damage States for internal
initiating events. These Plant Damage States can be grouped into 3 categories according to the timing of the Core Melt. The three core melt times: Early Core Melt - time <2 hrs. Intermediate Core Melt - 2 hr < time <7 hrs. Late Core Melt - time >24 hrs. Table 5 3 2 provides the frequencies grouped according to the core melt times. More than 90% of early core melts are due to failure to maintain an adequate l j l RPV inventory resulting in core uncovery, subsequent core heat-up and l initiation of core melt within 2 hours. The remaining 10% of early core melts l are mainly from the AWS sequences where failure to control and reduce the core power resulted in overheating the torus and failing the containment. A core melt is highly likely due to consequential failures of various systems AMENDMENT 2 5 3-1 I MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY
]
- =- _ __ - _ . .__ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ________
l L following containment failure. Therefore, in all sequences it is assumed that core melt is inevitable following containment failure. Both intermediate and late core melts occur due to failure to remove long term decay. heat. In both cases, the RPV inventory is recovered and maintained by the pumps (Feedwater or Low Pressure Pumps). In .these sequences the main condenser and the Isolation Condenser are not available either due to random-failures or due to failures of their support systems. Steam produced by the core decay heat is condensed into the torus, thus heating it up. If the FW system is being used to maintain the RPV level, continuous heat-up of the torus begins to pressurize the. containment. The expected ultimate pressure capability of the Millstone Containment is 138 psig. The containment pressure of 138 psig is reached in about 28 hours due to the torus boiling. It is assumed that a subsequent containment failure will initiate the " late" core melt. If the Low Pressure (LPCI or Core Spray) Pumps are being used to maintain the RPV level, they (pumps) begin to cavitate when the torus heats up to a temperature .where the available Net Positive Suction Head (NPSH) is not sufficient. The Loss of Low Pressure pump injection due to inadequate NPSH results in core melt in less than 7 hours which is the " Intermediate" core melt time. As discussed in Section 2.0, the analysis does not take credit for the Control Rod Drive (CRD) Pump or the alternate injection systems listed in the Emergency Operating Procedure, E0P-576 (see Appendix 2-B). Some of these alternate injection systems (e.g. Fire pump, ESW pumps) and the CRD pumps take suction j from water sources other than torus. In the sequences with intermediate core melt times, after the low pressure pumps begin to cavitate due to the torus heat-up, the injection source could be switched to the CRD or some other pump which does not take suction from the torus. This will result in delaying the core melt until after 24 hours (i.e., into the " Late" category) following the containment failure due to over pressure. Therefore, almost all " Intermediate" core melts can be delayed to the " Late" category. Although not calculated, i delaying the core melt will allow a longer evacuation time and therefore will reduce risk to the public. AMENDMENT 2 5 3-2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
Core Melt Grouping by Initiators and Support States i ( ; Table 5 3-3 provides the contribution to core melt of the various initiators. ' Fires are the largest contributor providing about 29% of total core melt (See Section 6.0 for a detailed development of fire sequences). A Large Break LOCA is the largest contributor to core melt from internal initiating events (13%) of which approximately 90% is due to plugging of the torus strainers. A Loss ' of Normal Power contributes 11% of which less than 2% is due to Station Blackout. Section 1.2-4 provides the frequencies of the potential interfacing systems LOCAs. In this analysis, it is conservatively assumed that these interfacing systens LOCAs can not be further mitigated and therefore will result in a core melt. Table 5 3-4 provides contribution of various support states to the total core melt. About 70% of the contribution is from the support state #1 (i.e. both AC l buses, both DC buses and the Service Water fully operational). Loss of AC bus 14E (support state 3) is also a significant contributor to the total core melt frequency. Over 90% of this support state's contribution to the total core melt l
! I frequency occurs under LNP conditions. Following an LNP, AC bus 14E relies on l V
the gas turbine for power. Failure of the gas turbine under LNP conditions implies that only the Diesel Generator is operating which powers bus 14F. With failure of 14E (or the Gas Turbine), the Feedwater and the main condenser completely fail and only one train of the Alternate SDC can be powered. ! l On the other hand, the Gas Turbine could power not only the FW and the main condenser systems, but also both trains of the alternate SDC. The latter can be achieved by powering bus 14F by the Gas Turbine. This is possible due to the excess e hetrical capacity of the Gas Turbine. Note, the Diesel Generator does not possess similarly high capacity to power both trains of the alternate SDC. Hence the iraportance of the Gas Turbine under the LNP condition is self evident. Three other important support states are loss of AC buses 14E & 14F and Service Wster (support state 7), loss of AC bus 14F (support state 5), and loss of DC Bus 101A and Service Water (Support State 12). Approximately 80% of support
, s
(_,/ AMENDMENT 2 5.3-3 MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY l l
1 state 7's contribution to the total core melt frequency occurs .following a L .j ; Reactor Transient 'or Trip as is 90% of support State 12's contribution.- Over ( ;60% of support State 5's contribution' occurs under LNP conditions.. i Table 5 3-5 provides the description of the dominant. coro melt sequences (see i Sections 6 and 7 for Fire and Internal Flood Sequences). Similar sequences are-grouped together. The last column in the table lists the path number' of the event tree that particular entry in the table represents. The sequences in the table are grouped-by the core melt times. O O
-AMENDMENT 2 5 3-4 MILLSTONE UNIT 1
#@GMrafL22Tfc mrrffM 2THW
k TABLE 5 3-1 '( . CORE MELT FREQUENCIES BY PuhNT DAMAGE STATES Symbol Initiator Core Melt Containment Frequency / Percent Time Status year- Contri-bution AE1 Large LOCA Early (t<2 hrs) Intact 1.14E-5 18.47 2 (>0.2ft ) AE2 Large LOCA Early Failed 2 30E-9 <0.01 2 (>0.2ft ) , AI1 Large LOCA Intermediate Intact 2.17E-7 0 35 2 (>0.2ft ) (2 hrs <t<7 hrs)
'SE1 Small or Early Intact 3 27E-6 5 30 Small Small 2
LOCA (<0.2ft ) SE2 Small or Early Failed 2.54E-7 0.41 Small Small 2 () LOCA (<0.2ft ) SI1 Small or Intermediate Intact 4.86E-6 7.88 Small Small 2 LOCA (<.2ft ) SL2 Small or Late (t>24 hrs) Failed 4.59E-7 0.74 .I Small Small i LOCA (<.2ft2 ) ] TE1+ Transients Early Intact 2 90E-5 47.00 TE2 Transients Early Failed 2.40E-6 3.89 i TI1+ Transients Intennediate Intact 4.17E-6 6.76 TL2+ Transients Late Failed 5.69E-6 9.22 TOTAL 6.17E-5' 100.0
- Does not include interfacing systems LOCA.
+ Includes Fires in the Diesel Generator Room and Gas Turbine Generator Building.
O AMENDMENT 2 5 3-5 MILLSTONE UNIT 1
)
l TABLE 5 3-2 i l CORE MELT FREQUENCIE3 BY CORE MELT TIMES
' Core Melt Time Freauency/ year Percent Contribution Early (t < 2 hrs) 4.63E-5 75 04 Intermediate (2 hrs < t < 7 hrs) 9 25E-6 14.99 Late (t > 24 hrs) 6.15E-6 9.97 6.17E-5 100 0
AMENDMENT 2 5 3-6 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
. _ _ - - = - - - _ . _ _ _ _ _ - - _ - _ - _ . _ _ _ _ _ - - - _ _ _ - _ _ _ _ -
i TABLE 5.3-3 ID CORE MELT FREQUENCIES BY INITIATORS U
. Symbol Description CM Frequencies / Percent year Contribution _
T+3 Loss of Normal Power 1.01E 11.46 T Reactor, Transients 2
-with Main Condenser Available 6.94E-6 7.88
-with Main Condenser Isolated 1 95E-6 2.21-
-Reactor Trips 4.03E-6 4.57 T L ss f Feedwater 6.72E-6 7.63 3
T 4 Loss of Service Water 1.86E-5 2.11 T ss of Reactor Building close 5 Cooling System 4 96E-9 <0.01 T ss of Turbine Building Secondary 6 Closed Cooling System 7.08E-7 0.80 T Loss of 120V Vital AC 7.68E-6 8.72 SSB Small Small Break LOCA 3 01E-6 3 42 2 (Area < 0.01 ft ) SB Small Break LOCA 5.85E-6 6.64 (0.01 ft 2< Area < 0.2 ft2) LB Large Break LOCA 1.16E-5 13 17 2 (Area > 0.2 ft ) IORV Inadvertent opening of a Safety / Relief Valve 1.27E-6 1.44 Unmitigated IC Tube Rupture 1 50E-7 0.17 Unisolated LOCA in the RWCU 1 39E-8 0.02 Interfacing System LOCA in the LPCI System 1.61E-8 0.02 Unisolated LOCA in the Core Spray System 1.10E-7 0.12 AMEIGMENT 2 5.3-7 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
TABE 5 3-3 "(continued)" t 1 9 CORE MELT FRENDICIES BY INITIAftES Symbol Description CM Frequencies / Percent year Contribution e F Fires 2.58E-5 29.28 na IF Internal Floods 2.51E-7 0.28 TOTAL 8.81E-5. 100
+ Includes fires in the Diesel Generator Room and Gas Turbine Generator Building.
# See Section 6.0 for development of fire sequences.
(
## See Section 7.0 for development of Internal Flood Sequences.
f~D f V ; i AMENDMENT 2 5 3-8 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
l TABE 5 3-4
../3 V
CORE MELT FREQUENCY BY SUPPORT STATES Support State Description CM Frequency / Percent
# Systems Failed year Contribution-1 Nothing 4 37E-5 70.48-2 SW 1.93E-6 3 11 3 AC 14E 5.63E-6 9.08 4 AC 14E
- SW 4 39E-8 0.07 5 AC 14F 3 12E 5.03 6 AC 14F
- SW 4.72E-7 0.76 7 AC 14E
- AC 14F 3 43E-6 5.53 8 DC 101B 3.89E-7 0.63 9 DC 101B
- SW 2 93E-8 0.05
/~N V 10 DC 101B
- AC 14F 3 99E-8 0.06 11 DC 101A 5.45E-7 0.88 12 DC 101A
- SW 2 31E-6 3 73 13 DC 101A
- 14E 3.14E-8 0.05 14 DC 101A
- DC 101B 2.66E-7 0.43 TOTAL 6.20E-5 100 i
Note: Boolean notation is used ,1.e.,
- implied "AND".
Does not include Fire and Internal Floods. O AMENDMENT 2 5 3-9 MILLSTONE UNIT 1 PROBABILISTIC SAFETY SHIDY
O E SIN N L*. O I T AO TE A OR 1 1 C TF I 2 ~ F I FM 6 1 1 1 9 T N OC A %- U Q E R C Y/ 5 6 6 N Q E E E E E 0 9 U R 0 8 1 7 O F 6 5 E 1 S E TG NAI E T 1 1 1 E E E AWA L T A T T PDS : T L IEEM ly r ly r ly r EI a a a RT E E E 5 O _
- C 3 g n lsn i N i
- r O5E L
O D r F s roonm u s' f o sd lte t r o c a e iawo f d id 1 a f ae pm t ome ai n d n s al efia n e p o V P R o )e inretub l I R s B C Rlyt npe sr toh L on s oaa A S Tl gta e nr s pevum t cemm il a r ea m lciok et aRi c r o r t s rd e e v E sgi n epa t rh T r t D eo ir r f ae t R i O. se t e oo a r t Tr oc ngW hr swS sn i E lou smc pt e ei v e t oi s C c ain isF e vgn vC l a vnn n cuq e ot io( m l l N t uo pa t ani a aI it E itosn e u q a r eh oniw gt r ViwM Vo V R insl i et e gcvs U aeSe pi iat Rlo e Ru t oeey Q lu r eCsb Owdt oC / l
/a S
/
CdL s E s cCus I Sfoh t S S InSE o o- o o S Y S _ T _ R O P A e e P n n
/ o o U N N N S
D _ E _ L I _ A F - T _ R # _ OE l _ PT lA 1 1 _ PA _ UT SS m R r e O C t a T ow _ f f A ek oA - I T ga r e sl s a sd se I ar oi t oe NI LB LV LF
, ; ; l ;i j ,!
.. j!>
~ = J_
S E rER 4 5 6 ET d 3 CT n d NN E E a n a U V 4 O 0 QE E 4 7 3 SI N 1
..N ~-
.L*.
.O
- T I
A
.C M
i i h _% AO TE OR TF FM OC 6 8 9 3
~
P K C E R 6-C Y 6-N V E E C E 2 U E 0 4 Q R 3. ~ F 5 2 E S - E TGE N#T 1 1 E E A L NT A T T PDS _ _ T L EE ly - y
) . l t
. l EI M r a
r a
- n. RT E E o O c C C p
( I C C u n n I t A n e e nm3
)
P o r uf io s N io o L s o bo k a s o O5. / e is O is CtiaiS lu# Sv i C lus is l: 3- I T c I a Ca l c e 'l I f s c mia l 5 P ei d c
,i eior i
t f n S f v d ev e
, so) sl 3 d ve el eCf R eb s lolaef t
o oR inel s e o# ct el e s I I orc il s C v n/ lo c ) v lc oPLRila fa E S iV cuuE oS rV o c e ueS sus n e iV t L. E t iPn end r a(4 aub nRrP it t e r ls d v iP ngR eC/Of IC rI S B D gR o smls 1 is_ it pO er R sia la( r o ig o sf e oC - sP e E ce e vdnfa Bu inso ere ef nsf gl ( ce r v nd vL A v p iaE i r C o i d e vo s t o lao n laS
/
er laveu N t la l a it sf 4 l ct T t s u eo a i ct s v aWC i s 'Sl 1 e r e via t vC - E e r re r n ct ne gr k C Cs f r r Ris a Rd U o RisFA l a ui cl o Ra CWu W o Ct o SI naf l it i / n Ct o Msf a Ct o
/
- Q / af f Sf oo
/
Sm EFB F Sa E
- S o o o o o o o o o o -
S Y S t s T df a R n aot 0 E a 4 El f e 1 4ias t R n r s 1 f a S t N o ouB sh et p r D C so ubf em E A B s L Fn r a I A C4 ac tr s F A1 T R# OE 3 PT r o 7 PA UT 1 SS ip r O R O T roi t s T
/
t n e 2 T N A c E I a n T I
)
N era M D N I. RT N I E M _ A (llL l j'
SIN - N L *.
)
X T ATEO A OR % % C TF I 5 9 F I FM 3 2 T N OC A % U Q E R C Y 6 6 N y E E ( E U E 5 1 Q R 1 8 E F 2 1 S E TG NFT E 1 1 E E A%AT L T S PDS T. l
)
t.
. EE M ly r
ly r EI a a n RT E E a O - c C ( p s n m a n o e s mn ao n m t ape r 5- N r i s e n ri oup t O c ic d s o e d e cs is so 3 I T s-el nC aI l c d s sic it cu so P t s d ev e n o t el e eb pt 5 o eo r oml c sd o v mls r p.d I R p s c u e p C ine l on o un pnl
- iem r ui a E S n r V lci o -
t mci aa n i rVR Tv u pf u oP evma i p t it ee l E et Ri a uoP R Osn r a r v L r r r rr e R r D it isOfe l t ss er oe o gT ul B E o si ei na - v na s poC s a sv ere e t t A ls er f C s vo v wsr vo s cE e r R T N l i a it t laCp u l a ouek i it nt u cr . p/ S t E i s v I e v d r aist ea f n gr e oa f ne r swt U W o o Rt ok ua R lo wTe Wo gr o r t Wor sl ou Q E F Ct
/
Sam S
/
Bi nb r FCt FCtofiaLb S - o o o o o o _ S Y S _ T R _ O _ P P e e U n n S o o N N D _ E L I A F _ T _ R # OE PT 1 1 PA UT SS _ ip _ r l R T
/
l a t _ O r n S m T oie c s AI t l k T a n a l a ae I N e r mr I RT SB
. > l
O ~ E SI N 0 4 a(
.d T nA
_ 1 N L'.* . O ATEO I T A OR % % C TF I 8 3 F I FM 1 1 T N OC A %- U Q E R 7-C Y 6-N y E E E (E 3 2 U R 1 0 Q F 8 E 1 S E - TG NA E T 2 E 1 AMA LA T E T S PDS T L t .
)
E h E ly ly EI M
. r r t a a n RT E E s l) a o O -
C p u c ( e ,V m n a r s it Pu pL e nR o p
) u n n - l m
S s s io i a s ie l e ( N e s n d t n ev isnr n
- O W T
u . nt e r i s c , in t e e d ul ica i u s e 3 doml - oc I p s e p de pm sa n T A) ia l etns P t ne t a nl u e di e o 5 I ( 1
- oh V m c u r r w ar R lsS c y P e ud un e ooh t emp v t o
C iaW r a R vpn mci n lsO E S f T e c sn e in i t a n uR aa evm a e g t s it inno d w L E ipa a in cr S r t ssa er ew ga l ia D o O s l e d t gi o cC a uo or g f B E r Tt o d e nv in a c ell t n s n inln cei n e v A C RSe v s il a wsr ig t n o c v s eceou rh oo oue s t l a T N E oc t Cm m t cpel e ntaV e l i a f S d oa r k S o csp l v c a n ne s f nr ev U a r i r a V r r t o oiP i t W C lo wTe r C C Wi r o R/ Q eb B L Ctoe Mt o Bi nb S t E R( T Ct inR F S - E F l S o o o o o o -o o o o o S Y S T R O P e P e n U n o S o N N D E I A F T _ R # OE PT 1 1 PA UT SS "O O R t n k a e r r B T o e A tc is l l a I TI a e a n m r N I RT S
D N E N SI L*. 6 ( 58 1 O I T AOTE - A OR % % % C TF I 0 6 4 F I FM 1 0 0 T N OC . A % U Q E R C Y 7- 7- 7 N y E E ( E E U E 9 7 1 R 3 4 3 Q F 6 3 2 E S : E TG NIA TE 1 2 2 E E E ANA LAT T T S PDS T L
) E N E ly ly ly EI M
. r r r t a a a n RT E E E o O C
.c
(
) t N S o 5
W) t c n s O G5 e t u T3 s e 3 D b s A - o j n V es v P S P oaa l li ( i 5 I R ea t l e o o R d s v sf op o tole lsW l v ur a mr a oke i t e C t v iT e t aA r l f E S cu l r ol e f l o r h E eek - ia r po s s r - - ot r eta e L D r aR f r e PV it p n r e R Rreiz e t sn r B s s r i E emOe m )o a OsO n i Tr e e b r eR ut t e eu A C N v lac
- v la v
e rf osn Pu ia n v l i - a vs ws m ne on e(A i T I it it f i its e d e up v vb nn ir t E r no ca ar r m go S nr wd cu o U Ro R gt o se icp C gp o or SmCr oe lo on ai l Q SI C
/ / eT R( Rt ei r W F CB L Cd Bc v a E S '
f S o o o o o o o S Y S T R O P e _ P e e n U n n S o o o N N N D E L I A F T' R# _ OE PT 1 1 1 PA UT SS _O R W. l l a _ O T f C. S m A o C. l k _ I s S. la a _ T I N s B. o P N. SB mre I LT I t I ii i
rJs E SI N - 4 1 N L . O ATEO I T A OR % % C TF I 3 3 F 1 FM 0 0 1 N OC A %- U Q E R C Y 7- 7-N y E E E (E 8 6 U R 0 9 Q F 2 1 E S E - TG NA T E 1 1 E E AMA LA T T T PDS T L E
) M E ly ly EI M
. r r t a a n RT E E a O c C d
( n n at n n o u 5 N s io ep s is eb s O i
- is l
c ,od r 3 I T il a c s o e ia el l ect e P s f el e ls p r f d vea 5 l i a e d v e i a g n e r r e I R i el e s f m o inl o n f T o p u t i l C p s iv V ic u p s o o - rVt e E S E u e s t iP n e r e e l iaRC Rr oPil g r a L o gR k r O O Rf la B D k a m C r o c er s e v a m u s s f e . v m.eere esngils r e vovi a A C C A t o ct l a C ls e r l a T it t s a sf l T I e s e v I r i a p t v g ine gr vSl r r f wa r n RCC NI o 2 r r R o R o o/CW P o o / W ot s / o C M Ct S I C F L S L Ct SEF o o o o o o o o o S Y n S io T Et a R 4 t F y O 1 S 4 b) P s( ) t 1 e P eF u s defir U s4 u o u s S B 1 kc Bu D E Cnld a CaG A(C/D L AaB IA F T R # OE PT 7 5 PA UT _ SS _ R O T A I T I P N p N y I L t l l
( E d e SI N 7 nr 2 aT N L ". O I T ATEO A OR % % C TF I 2 1 F I T FM C 0 0 C. N% A U Q E R 8 C Y/ 7- - N O E E E E 9 4 U R 2 9 Q F 1 8 E S E TG E _ 2 N#T 1 E E A A A T L PDS NT T L E E ly
) M ly r EI M
. r t a a n RT E E o O c C
( s e e Ve r
)
s r u p e P u S t 5 N n s v Rt a e W c e
- O e d e s d m is r r T j
3 D d s e e u s dope u A) d e n n- o r P i t 's i 5 P oml Pta y m lo m a r ( 2- p r e o cu c r I eVp e r R t n e a e f lsS m v o t E C S mun aaci a e e mg n r p S p t ot Pm iaW f T P u c e r o e lsel Re r l L E D tevm inl t nto
) r u iawo t ipa n -
o)o R r e B ss er a an eu s f y t n Tt o r it r e e E na s t ng m (a s s e no r r so latu t A C N wsr ouek ois n s r o t d ei t s a r h o cn ua a w iv it T C S pi a eeunar c( nn ca t E d r oa iatr t r r d go U wTe hC t na wc eh r t r icip e oro O lo r g iC ot s Lfo un O pwc n sa eb R( er RT F e CB E Bi nb HE C i S o o o o o o o o o S Y S T R O P e P e n U n o S o N N D E IL A F T R # OE 1 PT 1 PA UT SS k r R a e e O B r t a ow f T A I e sd g s e TI r a oe NI L LF i!
O QE E SI N N L*. K T AO TE A OR % C TF 4 FI I FM 7 T N OC A % U Q E R C Y 6 N V - E C E U E 8 Q R 5 F 4 E S E TG N AWA E 1 l LAT S PDS t e T L i a d
) E-E N e EI M m t r n RT t e
o O n c C I s n o e ao t ya t N s t c
.O(5 3
- OI T d n
e d e s f r s op r or r r u e cV e jPt r n iReh n et ei n oc a g j io e n 5 P IR n oml c u c o nt ut ir ess e e ssmt pnn e aml ot d wlo t s s e pl v l r ile v r - miae mun i C olitv ip maaiour t t Nqefo - uf l E S E aaci a evme t s ne i t nw u pi ann(o etd ga) l
- RprV e u l
L D t s s r uee l l go ol ym clsi an vkOytoP o oa . a raR B E n a s nmw co a r t a pobr uf isl me r r pen A C wsr t i St a ,ngmd eebr S pia t i t t oue nt o ch T N r k ot rh e icps rlel i teivt l e Ot n r oso a a l E d oa c o r t e e r t i U wTe Whsl wo owm opv r e oyr em o ua Q lo Bi nb r F Csu p col cs ph s Cbm E S o o o o o S Y S T R O P P e n U o S N D E L IA F T R# OE PT 1 PA UT SS O R O k a e r T B A l a l I T I m N _ I S l
E N SI 7 - N
.L .
O I T ATEO -. A OR % C TF I 0 F I FM 3 T N OC A %
- U Q
E R . C Y 6 N y E E ( U E 5 Q R 8 E F 1 S E TG Ne E 1 AgA T 1 T La T PDS ' t e T L i a d
).
EEM I e m t EI r n RT e t o O n C I - ( c r e t n a h s e N o - w o os t s s isn d o O5 O d d Bl iica e n ) n lc e d ( a 3 I T - e abo e n e P t s et di n F i i r e e ims 5 I a eat pn p c l R o e sf ar o mo o c a< C p em v r lopo t i u f l i E S n it t o cut s l ut pce e s Cf a L E u r id nn s e eea era rk r O i f ICn j r a i T-e DC D ga o r s e P i s SD B E t o )n e c el r e o emd n v
. v L se ey vl s
s eS A t C l t ls v t ov Ca a r laa l o ad) N e laI v oi d r n T E iag f i ( ct sl e r e e lu r v r to R So v vun C e a S r nW U r rV RoC (a u Ra lA Wf Wipr o oP i a S I Cp r C t Sm
/
Q E Ft Ct R F
/
SI 1 D Fo S o o o o o o o o S Y S d T n R ar e O At a P 1 P 20W U se S uc D Bi v E Ce r L I A DS F T R # OE 2 PT PA 1 UT SS ip O O R T r oi T
/
t r n e A t c s a n I T I e a r N I RT l!
E N SI N L*. O I T AO TE A OR % C TF 2 FI I FM 1 T N OC A % U Q E R C Y 7-N y E ( E U E 6 Q R 2 E F 7 S E TG NA E T l AMA LAT iT PDS - e T L t a E id
)
. MM E e
.t EI m n '
F T r e o O - C t n ( c I n e h s o n N s n 5 o o s t t
- O is uios l lc o Bl o 3 I T ic btaa i e it a s (
a el d ve rf r 5 P e,o p z p s n I R s t su o ir l o el e oee u m n ia C iV v l c r k t s s s
. upi o f l ia E S l e Cf r c t t E
i nP edn amRf a r i el L D gR sa r pf u e uj n DC B E o ce e C Oev es d s si s S D eS A C N t r o lvnI aio or - a l l a c e ee r d t ad) T E ct s e e v iCa t v u c u pi v nnW r U r r r RiI t R n s a wo e a S Q Ct o o / nf Sio S
/
Mis L op r lt A F o Wf E - S o o o o o S Y S r T e R t t pa O e cW P x P eec U ei S nv D or E NeS L I A _ F T - R # OE PT 2 _ PA _ UT SS r _ t e a R W O _ T f e A o c I s i v T I N I LS s r oe
- SN N=L*. 0 1 1 AO TE A OR % C TF I 6 F I T FM OO 0 _ N A %- U Q - E R _ C Y 7-N Q E _ E E 2 U Q R 4 E F 3 S E TG NMT E t A%AT L I
'T PDS e
T L i t a
) EE d e
t nM m n o ET O I t r e c C In ( . n 5 N is oe or a O3
- O i
)
n S I T ct s e l a C e s d ls pan D P d e v n 5 r e i a ig m io S R ed s f ( m r o t e E C S ivn lc o p ls u n pi o n c e t a it a r e u n E e i a t f o n m L D nCew gI r k f ec r s n o o B E o cep o s e a r e ug ne nsl c- h a A C t v m t sip s ioi a s N t al l a C a eeo t a f s d T E cia t v I w r pi ds r r oe o r n a U eim r n r o d e v e t sw c s Q ri r o oo R/ e wov oplar eo l Ci a Cl Daf i E Ct n S C I F L v RP Af S S o o o o o o o o S Y S T R O E P 4 1 P s U u S B D C E A LI A F T R # OE PT 3 PA UT SS R O O T A I T NI I P N L
O N SN L*. 5 O AQTE I T _ A OR % . C I TF 6 % _ F I FM 2 3 _ T OC 2 N% A U Q E R C Y 6 6-N / Q E E E U E 9 1 Q R 5 4 E F 1 1 S _ E TG N E '- 2 A2AT L 8 T L T L T 2 PDS T L
) E h E e e EI M
. t t a t a
n RT L L o O c ( C l n e d u - N s e f s i a t s e 5 ioer o r o s f ip o IC le s
- O is o t ic e C r
p o O53 D u t s c t
- db lc ct s e b ls e e c D t s ls na e F d re eia r
o d e r u s S o p i a al a ev r t R ed sf t r t o e f sa o o n C iv n lop o n s t o t a, s r onu t E S t a r c u eek l ia t s r r u n n m e s lc N
- fa r
e L E igC n ew r f e eo r n n e upR s e D aRs e r wh e e e r n B E o cep o I s r e o5 it - t l a r e d e o dd A C t al t e m O. avl v t a p 4 s s d t a n o sek v ea O. vl ne T N lac l o n lam . av ore E cit a eim r n v r I v w d a mi n r c a d w C v Cv U ri r Ro R e r h C e n C R no iaipr Ct on o Q o / e oit C D e RI ic E
/
SC S F Nw A F Mt / r S
/
ae S I S So Mr o o o o o o o o o o S Y S T R O F 4 P 1 P s e U u n o S B N D C E A L I A F T R# OE PT 5 1 PA UT SS ip r R T
/
O r t n T O A I T I N I P N L oie c s t a n era RT
SN N L*. O AO TI TE A OR % % C TF 1 I 5 F I FM 1 0 T OC N% A U Q E R C Y 7- 7-N E F C E E U E 6 1 Q R 6 4 E F 6 3 S E TG N#T E 2
~
2 A A L L - L T T P [W ST T L EE
) e e t
EI M t a t a n RT L L o 0 . c ( 0 l u l i l e f s a iay 5 N ip r s s f f a
- O t d
n o e C Cc 3 I T t s as l c c c D Ded 5 P o ls l i e u S io S R p ia ea r s e b n e o r C s f r sf op t o t o t a ai e t a f E S E n u e s l cu~l eeRa i n n r laMls i v i a nt r n) L D r n e r k e h e atuf eela B r s n i hi cv era O. e A le vf t E e d rb r Af o e i np s e A C t a oi r v C l a s d n t pe ainr b la d ur nse f n T N w Ct t - laI v v o r a wt o ia anr K d e ns Ro r R c C dtd e sn v a C Ca i t t e io C Fe pC oo a P O E F M /C SI S
/
A D S DI m IC S( t S o o o o o o o o S Y S T R F O 4 1 P s P u e U B n o S C N D A E IL A F T R # OE PT 5 1 PA UT SS p ir R T
/
t t nf e O r n teo lv T oie r ga A t c s enV vi a n I T da neR I e ra np/ IN RT I oS
, l
0 SN N L *. O I T AO TE A OR ~% % C TF I 5 2 F FM 0 0 T OC N% A U Q E R C Y 7- 7-N F C E E E E 7 6 U R 8 3 Q F 2 E 1 S E G MTE 2 2 L
%T A S t
S DS T L EE
) h e e EI M
. t t t a a n HT L L o O C
( c s le l s e n b ia e n 5 N s n o a t f s n ip o s i i d r
- O e d d la C e e t s O3 I e a v D
- i c
T P d n s o e c e vo a S d n s o t s o e s nm 5 oml d oml d my l c uun c p ls R c u c b a p ue t e p ar C mciun l em v r r a mci s e v m t o ia E S aa i a u et a n aa a n it u nt f evma it s L E D v a ip n gT n u s n eh e t r e t evme u r ip n gT e n mven i e B tss e r r oC r l A ssr r oC T-E na s te p . p d y n na s e pi s o a A C wsr cE m c d wsr t a cE m: : s o N oue ai r t n our ke t uo T wtt - ct ea r u Ce a w ct ea r pw r E d or ka d s p n dr d oa d C U Q wTe lo nb r o o oP r t r o s T C ia o C D owTe r e e r t r o s To Ch t C E Bi F Co t E Mf S Bi nB l F Co t E A S o o o o o o o o o o o S Y S T F R 4 O e 1 s P n P o u U N B S C D A E L I A F T R # OE PT 1 5 PA UT SS l l l R la a O m m T S S O A _ l k l k a a l _ I T la a I N SB mre SB mre I
6.1 FIRE EVENT TREE MODEL Event trees were constructed to model the chain of events that would - occur following the start of a fire in each of the critical fire areas. The endpoints of these event tree models lead to conditions where:- there is no damage and plant operation would continue, there is limited damage and a controlled shutdown. is commenced or there is major damage and a transient is induced by the fire. The mitigation of such transients is modeled by using the basic structure of the transient event trees that were developed in Section 2.0 for internal events. However, the event trees were quantified using system unavailabilities that reflect the effects of the fire on system components and their associated power and control cables. In the event ' trees, all fires are assumed to grow in size and none are assmed to self extinguish. The growth of fire is modeled as being wholly dependent upon the various stages of detection, suppression, and propagation as described below. i Detection Detection encompasses the' first stage of fire development for the event tree models that were used in the study. The length of time between the onset of fire and its successful detection determines the extent of damage that could occur within a critical area prior to suppression. The fire detection model considers: plant personnel who occupy an area, early warning area smoke I detectors, and eutectic heat sensing wires if they are installed-near critical area equipment and cabling. Early discovery of a fire by personnel (within 3 minutes) is only credited in the model for control room fires because this area l is continuously occupied by trained operators. Otherwise the models assune early warning can only be accomplished within 5 minutes by area smoke detectors. In the event that detectors fail, the fire model assunes that the fire would grow in size for approximately 15 minutes until eutectic heat sensing wires could be activiated in areas where they are installed. A fire at this particular stage of development is modeled to damage equipment and spread to other cables or cable trays, producing either control room alarms or some type of transient event. Any of these off normal occurrences would cause operations personnel to respond and, therefore, both personnel and' heat sensir:g wires are credited for late detection in the fire models. 6.:-1 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
x with the; associated support state conditions. For two of the eight' critical fire areas, no event tree models were constructed because a fire in either area would not result in a plant transient condition. The occurrence of a fi're in-these areas would, however, cause a total loss of the associated emergency systems that are housed within. Both the Diesel Generator - Room and ' the Gas Turbine Generator Building are ' critical plant areas that fall into this l category as discussed below. Diesel Generator Room The Diesel Generator (D/G) Room contains an emergency diesel powered generator which is used to supply AC electric power to safe shutdown Joads, following a loss of the normal offsite supply. Since the room is totally enclosed on all sides by a structure whose materials have a fire rating that exceeds the maximum credible burn time for a postulated fire, no propagation to adjacent areas is assumed. The D/G room is also protected by its own fire detection and suppression systems. In the event of a fire in the room, it is assumed that there will always be a total loss of the- emergency generator: although steady state operation of the plant is not affected. p u To determine how a fire in this area could contribute to a core melt accident, it was necessary to postulate a loss of normal power event (LNP) followed by a fire ' induced failure of the generator.- The internal event tree analysis addresses a similar scenario which involves a LNP with subsequent D/G failure and results in a core melt frequency (C.M.F.) of 1.78 x 10-0/ year. This l value of C.M.F. is obtained by quantifying the loss of normal power event tree for support state 5 (which addresses random failure of the diesel) as shown below. C.M.F.LNP-5' *
- LNP 'OSS5 *P LNF-5 where A LNP is the frequency for loss of offsite power (Section 1.0), QSSS
- 2 35 x 10-2 is the LNP split fraction for D/G failure in support state 5 l (Section 5.0), and P is the probability of core melt given LNP and LNP-5 Support State 5 To obtain this value the LNP event tree (Section 2.0) is AMENDMENT 2
. -3 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
-quantified for all plant damage states'by using system unavailability' data for support state 5 (Appendix 2-A)..
'l .
' As noted earlier in Section 6.0, the frequency of a D/G fire is estimated to be 3 4 x 10-2/ year. This talue can be converted to a split fraction for being in support state 5 by assuming that the fire will only occur after a start demand on the diesel. Although the Millstone Unit 1 D/G is tested (demanded) approximately 50 times per year, it is conservatively assumed that there are only 12 tests per year. (This is conservative because it increases the predicted chance of fire given any demand.) Thus, the Support State 5 split fraction due to fire is computed to be:
Q'SS5 12 Demands / year
= 2.83 x 10-3 To determine the contribution of D/G room fires to core melt, the above split fraction is substituted for its counterpart in the internal event tree analysis
/ . as follows:
b C.M.F.LNP-5 g, O
- C.M.F.D/G FIRE
- SS5 SSS where C.M.F. D/G FIRE is the core melt frequency due to LNP followed by a fire induced failure of the D/G and C.M.F.LNP-5 is the core melt frequency due to LNP followed by random failure of the D/G. Substituting the previously defined values into the above equation:
1.78 x 10/~0 vr. 2 35 x 10-2 , 2.83 x 10-3 C.M.F.D/G FIRE =
= 2.14 x 10~7/yr.
This core melt contribution was therefore added to the internal core melt frequency since the initiating event is a loss of offsite power. O AMENDMENT 2 6,1 4 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
Gas Turbine Generator-Building -l 7 V The emergency gas turbine ,(G/T) generator, which provides a redundant backup to the D/G, is located in a reinforced concrete " blockhouse" that is located away from the plant proper. If the G/T generator were to catch on fire, the damage
]
would be confined to the unit itself with6ut having any-effect on steady state operation of the plant. Consequently, a G/T generator fire would produce the same effect that was just discussed for a fire in the D/G room. The internal event tree ~ analysis for loss of normal power (LNP) events quantified a scenario for LNP with subsequent G/T generator failure that-produces a core melt frequency of 5.08 x 10-6/yr. This can be expressed by:
^LNP *OSS3
*P C.M.F.LNP-3 LNP-3 where A LNP is the frequency of LNP (Section 1.0), QSS3 = 0.106 is the split l' fraction for G/T Failure in support state 3 (Section 5.0), and P LNP-3 is the probability of core melt given LNP and support state 3 To obtain this value p the LNP event tree (Section 2.0) is quantified for all plant damage states by V using system unavailability data for support state 3 (Appendix 2-A). A similar split fraction for G/T generator failure due to. fire can be obtained by treating the fire as.if it were in a D/G. This is a conservative assumption since most D/G fires are caused by carryover of lube oil into the turbocharger and exhaust sections of the unit. Gas turbine generators do not have this type of apparatus since they use the exhaust gases from an airt: raft jet engine to spin a turbine which then drives the AC generator.
The contribution of G/T Generator Building fires to core melt can be computed in the same manner as were D/G room fires. This involvea substituting the G/T generator fire split fraction, which is asstraed to be the same as that for diesels, for the equivalent value used in the internal events analysis: I C.M.F.LNP-3 , q, Ob83 C.M.F.G/T FIRE
- SS3 l
O AMENDMENT 2 6.1-5 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY \ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ -
Substituting the previously d: fin:d. valuss, where it is assumed that Q'SS3 O'SS5 M
-d' 5.08 x 10-6/vr.
0.106 C.M.F.G/T FIRE = e - 1.36 x 10-7/ reactor yr. Again, it . is more appropriate to add this . core melt contribution to . the
-internal core melt frequency since the initiating event is loss of. offsite power rather than fire. This core melt contribution was therefore added to the internal core me)U frequency since the initiating' event was a' loss of offsite power.
Fires : which damage equipment in the plant without inducing transients could potentially have an effect on the unavailability of such equipment before the plant is shutdown. However, as noted in Section 3 0, plant specific data was used to compute equipment unavailability based on actual failure histories and maintenance experience. Data collected for Millstone Unit #1 equipment already includes any unavailability due to fire and further consideration of that due to hypothetical fires would amount to overcounting. Accordingly, equipment damage from fire is not considered unless transient events are also induced. The ab'ove represents an exception to the way in which fires in critical areas were treated. For the remaining six fire areas, event tree models were developed as described below. l O AMENDMENT 2 6.1-6 MILLSTONE UNIT 1 t'ROPABILISTIC SAFETY STUDY l
Zone 4 includes the row #4 control panels and MCB "B" (sections 906, 907 and ,m , 908) with overlapping into section 905 which is also part of MCB "A". A fire ( in row #4 would not cause a transient by itself but could spread to MCB "B" and involve those sections. If a fire occurred in or spread to sections 906 and 907, a loss of feedwater event would be initiated. Since MCB section 908 houses controls for the onsite AC power distribution network, a fire in this location could cause a station blackout if it produced certain worst case wire-to-wire hot shorts. If a fire in any om (f the panels or sections is detected and suppressed within three minutes, c.nly minimal damage is assumed since all panels are readily accessible. If the fire is not extinguished, then propagation from one panel to the adjacent panels is postulated even for sections of the MCB which have barriers between them. Fire spreading between zones is only possible as the result of some gross human error such as transporting a sufficient quantity of flammable liquid into the Control Room to allow the fire to propagate across the zone spacing. The total fire loading in the Control Room is such that it can only support a d fire for approximately 7.5 minutes. Fire protection consists of early warning smoke detectors, an automatic Halon system, one 20 lb. CO portable l 2 extinguisher, two 10 lb. CO2 portable extinguishers, two 17 lb. Halon portable extinguishers and a hose station. No credit is given for the hose station since water would probably cause as much damage as the fire itself if the hose station were used. The fire event tree model that is used to determine the resultant fire damage states for a Control Room fire is shown in Figure 6.1.1-2. As mentioned earlier, each fire damage state determines the associated plant support state conditions. Definition of Top Events:
- 1. Frequency of Fire - Iaitiator FR O
%J
- 6. M mm 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
As d: scribed' ini tha ' following writtup, this- valus wIs incrcastd from 4.0L x :10-3/ year to 5.0' x 10-3/ year. L in order to account" for kitchtn
. fires which.are felt to be unique to Millstone Unit 1.
L. 2 Smoke Detection Fails - Mode SD
-l SD- is the probability that both the early warning smoke detectors and ,the-
;< control room operators fail to detect.the fire early. j SD = Q ' N#Det-SD where QSD .=. 0.22 for failure of the smoke detectors and HEPDet = 1
.10-2 is the human error probability for two control room operators failing to detect the fire. Both of these values are taken from ~ Table '
2-K-1 in Reference 2. Substituting these values into the above equation: SD =.0.22
- 1 x 10-2
= 2.2 x 10-3 3 Early Suppression Fails - Mode ES Node ES represents the probability that both the portable extinguishers and~
the automatic Halon system fail to suppress the fire. From Table ' 4 in Reference 3, the mean value for success of portable extinguishers is 0.928-
' based on a response time of 1 to 3 minutes. The probability 'of extinguisher failure is thus:
Q PE = (1.0 - 0.928) = 7.2 x 10-2 l Although automatic actuation of the Halon system requires smoke detector ' success, the system could still be operated manually after smoke detector failure if there were successful early detection by other means (i.e. control room operators). Consequently, the system was treated as though it was totally manual in order to properly credit actuation by the operators O m2 0*l-9 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- in the control room. Tha probability of automatic Halon supression system L
failure.is given in Reference 2 as: QHALON,= 0.20 u i It should be noted that using the above value for Halon-system failure in the manual mode is conservative. 'Ihis is because automatic smoke detection failure is already included in the number for Halon system unavailability. Combining portable extinguishers and Halon as a single means of manual suppression, Node ES is given by: ES = QPE
- OHALON Substituting from above for terms on the right side of the equation yields:
ES = (7 2 x 10-2) * (0.20)
= 1.44 x-10-2
- 4. Propagation Due to Human Error - Node P The probability that a large quantity of flammable liquid will be-improper'ly stored in the Control Room and remain there for more than 30 days is P = 3.3 x 10-5 (Reference 4).
- 5. Zone Split Fractions - Nodes SZ1, SZ2, SZ3 These split fractions are conditional probabilities that are used to distribute the frequency of Control Room fire between the four zones shown in Figure 6.1.1-1. The zones consists of four rows of control panels and two groups of MCB sections as described earlier. Initially, each of the j four rows and two groups was assigned an equal weight of 1/6 in order to j distribute the frequency of Control Room Fire which is 4.0 x 10-3/yr. as shown in Section 6.0. The total zone weights were determined as follows:
Zone 1 (row #1) = 1/6 weight ) AliENDMENT 2 6.1-10 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY e______-_-.
Zone 2 (row #2) = 1/6 wzight' [' = 2/6 weight Zone 3 (row #3 and MCB "An) U) Zone 4 (row #4 and MCB "B") = 2/6 weight Because row #1 contains ECCS actuation logic in control panels 932/933 and is in close proximity L to the kitchen, Zone 1 was assigned an ' additional weight to account for a kitchen fire spreading-. to the ECCS panels. The frequency of such an event was estimated to be 1 x 10-3/yr. which 3
. increased the total frequency of Control Room fires to 5.0 x 10 /yr.
Inclusion of the kitchen fire caused an additional 1/5 weight to be- added to Zone #1 and all ' initial weights then had to be multiplied by 4/5 to ensure that the total stan did not exceed 1.0. This is shown below: Zone 1 = 1/6
- 4/5 + 1/5 = 0 333 Zone 2 = 1/6
- 4/5 = 0.133
= 2/6
- 4/5 = 0.266 i Zone 3 Zone 4 = 2/6
- 4/5 = 0.266 Based on the above weighting factors, zone split fractions were calculated to properly distribute the fire frequency in the event tree. The split fractions are conditional nodal probabilities that will yield the proper zone weights when the nodes for different paths in the event tree are multiplied together. The conditional probabilities used to obtain the correct zone split fractions are:
S gg = 0.667 S = 0.800 Z2 S = 0.500 Z3 I AMENDMENT 2 6.1-11 MILLSTONE UNIT 1 PBABILISTIC SAFETY STUDY
Use of these values in the event tree shown in Figure 6.1.1-2, will result in splitting the total frequency of control rocm fire (i.e., 5 x ( '4 /3/yr) as follows: (./ Zone 1 = 1-S = 0 333 Z1 Zone 2 = = 0.133 S)7 * (1-SZ2) Zone 3 = S g3 *S Z2 0.266
* (1-3Z3) =
Zone 4 = S *S Z2 b = 0.266 73 Z3
- 6. Interzonal Split Fraction - Node PC Node PC addresses the split fraction for fire damage within each row of control panels that make up Zones 1 and 2. For Zone 1, it is estimated that 0.8 of the fires would be in panels 932 and 933 because of their proximity to the kitchen and the remaining 0.2 would be in reactor protection system (RPS) panels 915 and 917 Zone 2 includes both a vital
[' ~ ' ) AC (VAC) and instrument AC (IAC) panel along with other panels for feedwater and LNP load shed circuitry. Two of the ten psnels in Zone 2 contain either VAC or IAC which are both located on one end of the zone. Consequently 0.2 of the fires in this zone are expected to be in VAC or IAC with the remaining 0.8 in the Feedwater or LNP circuitry. These interzonal split fractions can be summarized as follows: o Zone 1 Split Fractions PC = 0.8 for fires in ECCS actuation 1-PC = 0.2 for fires in the RPS o Zone 2 Split Fractions l PC = 0.8 for fires in feedwater or LNP circuitry L.) AMENDMENT 2 0'l-l2 gg g g PROBABILISTIC SAFETY STUDY
t L' 1-PC = 0.2 for fires in VAC or-IAC A b 7 Interzonal Split Fraction for Zone 2 - Node PC1
. Fires in ' Zone 2 can be further divided by PC1 f r the VAC/IAC and Feedwater/LNP panels. Given a fire in the VAC/IAC panels, there is a 0.50 probability that the damage could occur to either panel. Similarly, a fire in Feedwater/LNP panels could' damage either set of circuits with equal-probability. Therefore, PC1 = 0.5 for all of Zcne 2
- 8. Safety / Relief Valve Opens - Node SRV Control logic for the safety / relief valves (S/RV's) is located in both of the ECCS panels that are in Zone 1 and the MCB sections of Zone 3 Fire damage to these circuits can result either in open circuits due to through wire burning or wire-to-wire hot shorts. In the latter case, shorts could cause an S/RV solenoid to energize, admitting air to the valve operator and U causing it to fail open. From Reference 5, a mean value of 7.x 10-2 13 obtained for the probability of a hot.short in a single circuit and hence, the probability of any one of six S/RV's failing open due to a hot short is:
p(S/RV opens) = 1 - p (no S/RV opens) where l p(no S/RV opens) = p (S/RV1 not open) x p(S/RV2 not open) x . .... ] x p (S/RV6 not open) i Substituting the probability of no hot short (1-7 x 10-2) for each S/RV results in the following probability for top event SRV: i I p(S/RV opens) = 1-(1-7 x 10-2)6 l AMENDMEM 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY l I 1
= 3.53 x 10-1 For top cytnt SRV Load Shedding Occurs - Node IE
(] LJ 9 Although there are two load'shed circuits in the LNP logic o'f Zone 2, only. one of them is required to strip all of the 4160V buses ' if it becomes
~
energized due ' to a hot short. Using the probability of a hot short from l r Node SRV, the probability of load shedding is: p(hot short either circuit) = 1 - p(no hot short either circuit)
'where p(no hot short either circuit) = p(no short circuit 1) x p(no short circuit 2)
= 1.35 x 10-1 for top event LS
- 10. Operator Action tc. Restore AC -Node OA C\ '
If the hot short that is described above did occur, the control room operator could restore AC power. The load shed circuits send a " pulsed" signal for 0 3 second and then 'their circuits open as either one of two time delsy 62-relays energize. Postulating failure of the load shed signal would require the double failure of both time delay relays which is less than 1 x 10- per occurrence as noted in the AC power fault tree analysis (Section 3 2.2). Since a load shed would cause total loss of AC power, Procedure ONP-503B would be implemented (See Appendix 2-B). This procedure directs the operator to the AC bus control panel (908 in the Control F,oom) to re-energize buses using the control switches. Because this is rule based behavior, an operator error of 13 x 10-2 was assumed. The failure of the time delay relays would produce the same effect as an operator error but the probability is more than two orders of magnitude lower and is, 1 therefore, a negligible contributor. 0A = 1 3 x 10-2 O AMENDMENT 2 6,1_14 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- 11. Isolation Condenser Fails - Node IC t A fire in Zone 3 would fail both the automatic and remote manual actuation capability of the IC and operators would have to operate the IC by opening MOV IC-3 locally. If the same fire produced wire-to-wire hot shorts, then there is also a possiblity that the three normally open IC steamline and condensate isolation MOV's would be cotananded shut. Since MOV IC-1 and 10-4 are located inside the drywell, they could not be opened and the IC would fail even though IC-2 and IC-3 could be opened. locally. The probability that either IC-1 and IC-4 fails closed due to hot shorts is:
p(hot short in IC-1 or 4) = 1 - p(no hot short in IC-1 or 4) where p(no hot short in IC-1 or 4) = p(no short in IC-1) x p(no short in IC-4) n
) Substituting (1-7 x 10-2) for no hot short (See Node SRV) p(hot short in IC-1 or 4) = 1 - (1-7 x 10-2)2
= 1 35 x 10-1 for IC
- 12. Zone 4 Split Fractioa - Node SZ4 i
I SZ4 is the interzonal split fraction that divides fire damage in Zone 4 between control circuits for Feedwater and AC power that are contained in i three MCB sections. Section 906 and part of 907 contain feedwater control 1 circuitry while section 908 houses controls for the onsite AC power f j network. A fire in section 908 would not necessarily lead to a loss of onsite AC power unless there were additional wire-to-wire hot shorts present. in more than one circuit. To simplify the analysis, it was l Oi G 6.1-15 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
1 conservatively asstned that one third of ths fire ' damage could be in j section 908 which would always cause a station AC blackout. 'Accordingly .!
).
-/
l -(' T
'- }i P SZj 0 333 for damage to MCB section 908 l.
'd j
- 13. Operator Action to Close S/RV's - Node OA1 In the event or a wire-to-wire hot short in the S/RV circuits, at least one -
S/RV would fail open as discussed in Node SRV. The S/RV would remain open -l until the short was removed, either by operator action or the control fuse blowing. However, fuse failure is not credited in this analysis. Since Feedwater would continue to run, the operator has many hours to remove the short by opening circuit breakers in DC control room panels DC-11A1 or DC-11A2. . Accordingly, an operator error (OA1) of 13 x 10-3 was assigned based on the fact that additional personnel who are familiar with the electrical system would be called in within two hours of the fire.
,V MDW 2 6.1-15a MILLSTONE UNIT 1 PROBABILISTIC SAFETI STUDY
- Fire protection for the cable ' vault consists of carly warning ionization detectors, . heat sensing' wire in the cable trays, Halon Suppression System and portable extinguishers, as well as hose stations, at both entrances.
.Q(~]
~ Definition of Top Events j l
Figure 6.'1.2-1 is the cable vault fire event tree model with top events defined as follows:
- 1. Frequency of Fire - FR Section 6.0 gives the frequency of Cable Vault Fire per reactor year as:
AFR = 7 0 x 10-3
- 2. Smoke Detection Fails - Node SD Node SD addresses failure of the Smoke Detectors. Table 2-K-1 in Reference 2 gives a mean value for probability of smoke detector failure at:
P SD = 2.2 x 10~l 3 Heat Sensing Wire Fails = Node HHL Node HHL addresses the probability that both the eutectic heat sensing wires and plant operators fail to detect the fire at approximately - 15 minutes. x HEP PHHL
- OHS DET where QHS = 0.7 for the probability that heat sensing wires fail and HEPDET = 0.1 is the human error probability for plant operators failing to notice and respond to abnormal occurrences as the result of fire. Both values are from Table 2-K-1 in Reference 2. Substituting these values in the above equation yields:
n l AMENDMENT 2- 6.1-19 f MILLSTONE UNIT 1 '- PROBABILISTIC SAFETY STUDY
PHHL = 0.7 x.0.1 T = 7 x 10 l (V
- 4. Early Suppression Fails - Node ES Section 6.1.1 notes that early suppression failure is given by:
*0 PE O HALON For the case where .both portable extinguishers and a Halon suppression system are available. Based on an arrival time of greater than 5 minutes, Reference 2 (Table 2-K-1) gives a probability of 0.512 for portable extinguisher failure. Section 6.1.1 gives Halon suppression system failure as 0.20. Substituting these values into the right side of the above equation yields:
ES = 0.512
- 0.20 m)
(V -
= 0.102 5 Split Fraction for Cable Trays - Node THS Node THS splits the fire damage between one tray and multiple trays, based on failure of the hose stations to suppress the fire within one hour. As
- mentioned earlier, hose stations would have to be used if either t,he early
$ warning ionization detectors or early suppression failed. The probability l of hose stations failing such that more than one cable tray is damaged is defined by PTHS = HEP + Qg3 + (PFB 5PBR) , where THS is the sum of the paths on the Figure 6.1.2-2 event tree that lead to damage in more than one cable tray and fm ammmT 2 6 20 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
o HEP is th: prob bility that plant personnel would improperly store a sufficient quantity of flammable liquid to spread the fire to all cable trays, regardless of barrier protection or e'N
'v/ separation.
HEP = 1.6 x 10-" (Reference 4), o Qg is the probability that the water supply to the hose stations is unavailable based on failure of the fire protection r failure of the hose station valve to - open system (QFPS) (0 valve
- where:
0WS
- OFPS + Ovalve
-4 from section 3.2.15 of this study and Opp 3 = 3 23 x 10 10-* from Reference 6. It should be noted Q
valve = 1.25 x that - only one hose statJon is credited although two are available. t
,~,)
" Substituting the above values into the equation, yields:
Qg = 4.48 x 10-o P FB is the probability that the fire brigade does not put the fire out in one hour before it has a chance to spread to more than one tray PFB = 0.5 (Reference 7). o P BR is the probability that barrier protection is breached before one hour based on early and later detection times (Reference 7). PBR (early) = 0.15 for detection within 5 minutes 3 w,) I AMENDMENT 2 6.1-21
. MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
PBR (late) = 0.25 for detection at 15 minutes 1 7-- . Substituting . the above values into the ec,uation for P andi 4 THS _ assuming early detection:~ ) l J PTHS = 1.6 x 10" + 4.48 x 10~ + (0.5
- 0.15) j
= 7.56 x 10-2 l
Assuming later detection:.-
~
PTHS = 1.6 x 10~ + 4.48 x 10 + (0.5
- 0.25)-
= 1.26 x 10-1
- 6. Split Fraction'for More than One Cable Tray - Node PF Node PF further splits the fire damage between multiple trays in one stack and all trays in the Cable Vault. Since Node THS simply represents fire-damage to inore than one tray, the fraction of damage to all trays in the .
Cable Vault can be represented by HEP +0 Pp= WS where P THS HEP and Q are the paths in the Figure 6.1.2-2 event tree for damage to WS all trays. Substituting values for HEP, %3 and PTHS as defined in Node THS,y P for early detection within 5 minutes is: Pp = 1.6 x-10~ + 4.48 x 10~ 7.56 x 10-2
= 8.04 x 10-3 Similarly, the fraction of damage to more than one tray within a stack is defined as t.J A
i r AMENDMENT 2 6.1-22 MILLSTONE UNIT 1 PardfMrsRfsTyc 2MrdN 2M01f
(1 Pp,
) = PFB.' PBR
. j~. p .Q THS where P FB P BR is the path in Figure 6'.1.2-2 for damage - to more than
' one cable . tray within a stack. Substituting. for PFB, P and . P TH3 BR from Node THS, (1-P p ) for early detection is:
(1 - Pp) = 0.5
- 0.15 7 56 x 10-2
=.0 9921 For later detection at 15 minutes with PBR = 0.25 and PTHS = 0.126, the fnaction of damage to all trays is given by:
Pp = 1.6 x 10-1 .i. 4.48'x 10-3 0.126
= 4.83 / 10-3 and the fraction of damage to more than one tray within a stack is (1 - Pp) = 0.5
- 0.25 0.126
= 0 992 In the event that both early detection within 5 minutes and later detection at 15 minutes fail (i.e. P SD # Pggg), it is assumed that personnel will ;
detect the fire after multiple trays in one stack become involved and that ! they will have the opportunity to suppress the fire before all trays in the ! cable vault are damaged. Therefore, PF is the split between all trays in one stack and all trays in the cable vault based ~on propagation due to human error (HEP) and availability of water to the hose stations (WS). No credit is given for fire barriers on trays since it is assumed that they have been breached at this point. l i (
%J AMENDMENT 2 6.1-23 MILLSTONE UNIT 1 l PROBABILISTIC SAFETY STUDY
PF = HEP + Qg3 7 Y'^f~ Substituting.from above: P F = 1.6 x 10~N +-4.48.x 10~
= 6.08 x 10-4 for all cable trays in the vault
-(1 - P ) = 0 9994 for all trays in one stack p
- 7. Split Fraction For Reactor Building and 'nnrbine Building Cables - Node PR Approximately 2/3 of all cable trays in the cable vault are routed to the Turbine Building while the remainder lead to the Reactor Building.
PR = 0.667 for cable trays to the Turbine Building and (1 - P g) = 0.333 for cable trays to the Reactor Building -O V 8 .' Partitioning Split Fractions - Nodes PC, PC1 and PC2 The above split fractions are used to partition fire damage between cable trays that-contain control / power cables for different types of components. Figures 6.1.2-2 and 3 show how the split fractions are applied in the event tree to obtain the consequences of fire damege for different cable trays. The estimated values for'each split fraction are as follows: P C
= 0.5 PC1 = 0.5 PC2 = 0.5 9 Safety / Relief Valve Opens - Node SRV l
/~' t M1ENDMENT 2 6.1-24 MILLSTONE UNIT 1 j PROBABILISTIC SAFETY STUDY !
t p Fire damage to the S/RV circuits.can result eith2r in open circuits due to f- . through" wire burning'or closed circuits from wire-to-wire hot shorts. Open
"/7 circuits would cause- a -total ' loss of the remote and auto S/RV fbnctions I while hot shorts :could: cause the spurious opening of< one or more S/RVs.
The . probability that any one of. six S/RVs could 'have a hot short in its l; circuitry was computed in-Section 6.1.1 as: P SRV = 3 53 x 10-1
- 10. Load Shedding Occurs - Node LS l
Fires in the safety - related cables routed to the Turbine Building could cause the LNP load 'shed. logic to become energized due to hot shorting. . . Since each tray of S1 and S2 control cables also contains-a LNP circuit, .a wire-to-wire hot short in- the circuit would ' eause, the associated S1 or S2 4160V. buses to be stripped of- their loads. For S1 and S2, the probability.. of a single hot short in one of their LNP circuits is: P g = 7.0 x 10-2 (See Section 6.1.1) 4
- 11. Isolation Condenser Fails - Node IC
= The Isolation Condenser's motor-operated valve control circuits are located' in a cable tray that does not contain safety-related cables or other cables L that could cause a reactor trip. Therefore, a - fire in this tray alone would only disable the IC but a fire that spread to more than one tray-could produce a . transient and cause the IC to become disabled. The probability of IC failure due to wire-to-wire hot shorts was computed to be:
P IC = 1 35 x 10-1 (See Section 6.1.1) l
- 12. Operator Action to Close S/RV's - Node OA1 P
OA1 = 1 3 x 10-3 (See Section 6.1.1) O d i AMENDMENT 2 6.1-25 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
4 TABLE 6.2-1 FREQUENCY OF FIRE PER YEAR IN THE AFFECTED FIRE AREA x
- FIRE DAMAGE RB -TOTAL CV MZ FW SWGR STATE CR 5 21E-4 5.42E-6 f F-1A' 2.06E-5 2.42E-5 1.05E-4 2.49E-4 F-1B 1.20E-4 7.76E-7. 5.70E-4 5 71E-4 F-1C 8.45E-5 ;
6.81E-5 8.99E-6 F-1D 7 37E-6 ! 1.08E-4.' F-2A 1.07E-4 7 76E-7 1.04E-3 1.04E-3 2.19E-3 F-2B 2.08E-5 8.59E-5 5.02E-4 5.02E-4 F-2C 8.09E-3 8.09E-3 F-2D 1.14E-4 F-3A 1.91E-5 9 48E-5 1.50E-5 'i.71E-4 ; F-3B 3 56E-4
}
2.42E-5 2.51E-4 2 98E-4 j F-4A 2.31E-5
. g~s
-t
')- F-4B 7 35E-5 1.26E-3 3 62E-4 1.70E-3; 2.56E-4 3 73E-7 2.56E-4 F-4C 4.42E-4 3.47E-4 8.21E-3 9 30E-4 6.97E-3 1.69E-2 F-5A 5 52E-6 1.21E-4 1.21E-4 F-5B l i
8.47E-4 3 22E-4 1.17E-3 F-5C 1.06E-5 1.06E-5 F-5D 2.64E-6 6.23E-5 F-6 7 79E-6 5.19E-5 1.62E-5 F-7 2.98E-6 1.20E-5 1.26 E-6
" 6 34E-6 6.18E-7 1.11E-5 CM 1.15E-8 4.15E-6 CR - Control Room CV - Cable Vault MZ -
Mezzanine FW - Feedwater Area SWGR - Switchgear Area i Reactor Building
- Assuned to be direct, early core melt RB -
O 6.2-3 j MIENDMENT 2 PROBABILISTIC SAFETY STUDY
j 6.2.1 FIRE DAMAGE STATE F-1A 1
'l
' This damage state represents a fire induced loss of feedwater with failure of S1 Bus.14E due to load shedding or loss of the AC source from Bus 14C. Since the S2 power train is unaffected, both Feedwater and the main condenser can be recovered through operator action in the control room. The total frequency of fire damage state F-1 A is 5 42 x 10-4/yr and is due to fires in the Cable j)
Vault and Switchgear Area as shown in Table 6.2-1. l The internal event tree for loss of feedwater (Section 2.0) was quantified for All support state 3, using the frequency of damage state F-1A as noted above. top events are the same as those defined for support state 3 in the internal analysis except for the following.
- 1. Feedwater Restoration - Node C 3 i Node C repre ents restoration of Feedwater flow, following the loss of 3
feedwater strings A and B due to fire induced loss of 4160V Bus 14C. Success is defined as operator manual start of feedwater string C which j includes Feedwater Pump 1C, Condensate Booster Pump 1C and Condensate Pump 1C. The unavailability of Node C is de m ed by: 3 OC3
- OW+OHEP where Q represents the unavailability of feedwater string C due to any FW of the following:
o FW Pump 1 C fails to start = 9 48 x 10-4 o FW Pump 1C fails to run 24 hours = 3 51 x 10-5 o FW Pump 1C in maintenance = 2.60 x 10-3 o CB Pump 1C fails to start = 1.66 x 10-3 o CB Pump 1C fails to run 24 hours = 1.21 x 10-3 o CB Pump 1C in maintenance = 3 55 x 10-3 o C Pump 1C fails to start = 1.07 x 10-3 o C Pump 1C fails to run 24 hours = 2.06 x 10-5 o C Pump 1C in maintenance = 6.5 x 10-4 i
.Y AMENDMENT 2 g,p_4 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
T r o Check valves on strings A or B fail to close which diverts flow = 4.56 x 10-3 Thus, O g is the Boolean sum of the above unavailabilities which were obtained from Section 3 0 or og = 1.63 x 10-2, g HEP represents the failure of the operator to start feedwater string C or QHEP = 13x 10-3 for skill based behavior (Section 4.0). Substituting values for Qg, QHEP into the right side of the equation yields: Q C3 = 1.63 x 10-2 + 1 3 x 10-3
= 1.76 x 10-2
- 2. Restoration of AC Power - Node U 4 Node U 4 addresses the restoration of power to 4160V Bus 14E (S1 power train) by having an operator align it to the emergency diesel generator (Reference 9) at approximately four hours after the transient. The development of Node U4 is described below:
b 0U4
- 014E + 0 HEP where Q 14E represents the unavailability of Bus 14E due to any of the following:
o Diesel generator fails to start = 5.59 x 10-3 o Diesel generator fails to run 24 hours = 2.29 x 10-2 o Diesel generator in maintenance = 1.31 x 10-3 o Breaker between diesel and Bus 14E fails to close = 1.34 x 10-4 l Thus, Q14E = 2.99 x 10-2 . The failure of an operator to start the d emergency diesel generator and align it to Bus 14E is QHEP = 3x O i for skill based behavior (Section 4.2). Substituting the above into the equation for QU4 gives: l l f) l G' 6.2-5 MILLSTONE UNIT 1 AM MDMENT 2 PROBABILISTIC SAFETY STUDY
O gg = 2.99 x 10-2 + 1 3 xl10-3 1
= 3 12'x 10-2 A)- '5.
- 3. : SDS and Alternate SDC Systeam - Node M As defined in Section 2.0, the equation used for calculating the failure probability for Node M is:
OM * (OSDC + OHEP1) * (0 ALT-SDC + OHEP2)
+O2S/RV where: QSDC = unavailability of the SDC system, assuming manual restart of RBCCW (i.e. partial LNP asstned) t-QALT-SDC = unavailability of the Alternate SDC system Q = probability of the operator failing to open 2 S/RVs 2S/RV to depressurize the reactor (i.e. Feedwater (7
\ succeeds) e Q = error of commission to place SDC in service HEP 1 a
Q .= error of commission to place Alternate SDC in , HEP 2 service
- asstnes an error of commission to open 2 S/RVs as well Depending on the success of feedwater (C3 ) and AC power restoration (U ), there are four possible values for Node M as described below. l 4
a) If Feedwater succeeds and power is restored to Bus 14E, then it is assumed that the operator must manually depressurize the reactor and support state 1 unavailabilities (Appendix 2-A) can be used. l O. AMENDMENT 2 6.2-6 MILLSTONE UNIT 1 ) PROBABILISTIC SAFFTY STUDY
. i
i Q M = (3 21'x 10-2-+ 1 3 x 10-3)- , ry V -
* (2.13 x 10-3 .3 3 x 10-3) + (6.'7 x 10-4)
= 7.85 x 10-4' j b) If feedwater fails . and power is : restored to Bus 14E,' then. it is -
i assumed that reactor depressurization has already occurred (1~e., . success of Node I) and support state 1 unavailabilities are used.. .i
-2 -
Og = (3 21 x 10 . 3 3 x 10-3) .
* (2.13 x 10-3 + 1 3 x 10-3)
= 1.15 x 10-4 c) If feedwater and power restoration fail, then support state 3 unavailabilities are used with the further assumption that' alternate shutdown cooling is unavailable as there is. no A(fl procedure in place ~ for adding water from the CST to the torus before LPSI pump cavitation occurs.
-3 Q
M = 5.61 x 10-2 + 1 3 x 10
= 5 74 x 10-2 <
d) If feedwater succeeds and power restoration fails, then support state 3 unavailabilities are used as in c) and the operator must manually depressurize as in a). Og = (5.61 x 10-2 + 1 3 x 10-3) * (1.0)
+ (6.7 x 10-N)
= 5 81 x 10-2 MILLSTONE UNIT 1 AMENDMENT 2 PROBABILISTIC SAFETY STUDY
- _x-_____
O -l (d 6.2.2 FIRE DAMAGE STATE F-1B Damage state F-1B produces the same transient that F-1A does (i.e. loss of feedwater in support state 3) with the exception that S1 power cannot - be restored. This is because the S1 power / control cables that are routed from the Turbine Building to the Cable Vault are affected .by the fire. Consequently, the S1 train of LPCI and Emergency Service Water Pumps cannot be used, causing the loss of - Alternate SDC. The total frequency of F-1B is 2.49 x 10-4/yr and is due to fire damage in the Cable Vault, Mezzanine and Feedwater Area. The internal event tree for loss of feedwater in support state 3 was used in its entirety except for the following top event which is described below. SDC and Alternate SDC Systems - Node M Because the S1 power train cannot be recovered, only the SDC system is i available for long term cooling and the success of this system is totally dependent on the successful restoration of feedwater. Accordingly, Node M has only two values: a) If feedwater fails,then fuel damage is postulated and SDC cannot be used which implies that Qg = 1.0 (Section 6.3 1) b) If feedwater restoration succeeds, then SDC can be used and the value of the M node is identical to part d) of 6.2.1.
-2 Og = 5.81 x 10 l
l O
- 6. M AMEDMET 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
7 6.2.3 FIRE DAMAGE STATE F-1C f
,~ Fire damage stste F-1C results from a fire in the Feedwater Area or Mezzanine f
[ \ l-L which causes a total loss of feedwater and the main condenser along with power ! to S1 ECCS equipment. However, the S1 power train can be recovered for long The total frequency term cooling at approximately four hours after the fire. of. F-1C is 5.71 x 10~4/yr as shown in Table 6.2-1. The loss of feedwater event tree for support state 3 was used to quantify the effects of damage state F-1C on the plant. All top events are the same as those defined for the loss of feedwater event tree that was used in the internal analysis (Section 2.0) except for the following:
- 1. Feedwater Restoration - Node C3 A total loss of feedwater implies that QC3 = 1.0
- 2. Restoration of AC Power - Node U4
. p AC power can be restored to S1 ECCS equipment in either of two ways, depending on the cause of its loss. If S1 power were lost because V
wire-to-wire hot shorts caused load shedding, restorative would involve de-energizing the load shed circuit by opening a breaker in the control room. In the event that S1 AC power were unavailable due to fire damage in control cables, recovery could be effected by operating the AC breakers locally at the switchgear. Both forms of recovery only require operator action at four hours and thus: O'J4
- OHEP where Q HEP = 1 3 x 10-3 for a skill based behavior (Section 4 3 Restoration of Main Condenser - Node H3 Given a total loss of feedwater with no recovery, O
V 6.2-9 MILLSTONE UNIT 1 AMENDMENT 2 PROBABILISTIC SAFETY STUDY
. .,- i
.)
d l Q
. H3 = 1.0 1
,-gp -
SDC and Alternate SDC Systems.- Node M if ,4. l l Thereis a total loss of feedwater 'in damage' state F-1C, and' the combinations of long term cooling systems are as described for the M node in Section 6.2.1..
.j a) For successful restoration of S1 AC power, both trains of SDC and~
Alternate SDC are available as described in part b).
. Qg = 1.15 x 10-4 (Section 6.2.1) b) If: S1 AC power cannot be restored, then only 1 train of SDC is available as described in part c).
Og = 5.81 x'10-2 O AMENDMENT 2 6.2-10 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
6 . 2 . 28 FIRE DAMAGE STATE F-1D l 1 Damage state F-1D represents a total loss of feedwater event with no AC power l' available due to fire induced-loss of both the S1 and S2 power trains. Fires
'in the Feedwater Area, Switchgear Area, and Control Room contribute to this y damage state (see Table 6.2-1) whose total frequency is 8.45 x 10-5/yr. l The core melt frequency resulting from fire damage state F-1D was quantified by developing an event tree model for loss of feedwater combined with a total loss of AC power. This model is shown in Figure 6.2.4-1 and is based on the loss of Feedwater (LOF) event tree for internal events.
l l Definition of Top Events
- 1. Loss of Feedwater - Node T 3
Node T represents the frequency of losing all feedwater due to fire 3 damage state F-1D. A A T3
- F-1D = 8.45 x 10-5/yr ,
- 2. Reactor Trip - Node R This node is assumed to have the same value as Node .R for all LOF internal event trees (Section 2.0)
Qg = 1.0 x 10-5 3 Safety /Relier Valve Reclose - Node J Node J represents the same node as described in the LOF event trees (Section 2.0) Q3 = 1.0M x 10
- 4. IC Automatic Actuation - Node K2 AMENDMENT 2 6,p_11 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
l } l Node K r pr:s:nts the cutomatic initiation of the IC on high RPV 2 pressure and the manual cycling of one S/RV to remove non-condensible gases i
, N from the IC tube area if required. Since the radiolytic decomposition of I'
C water in the vessel could generate sufficient quantities of hydrogen and oxygen to impair IC heat removal, it may be necessary to manually cycle one S/RV several hours into IC operation. The following equation is used to calculate the failure probability for Node K
- 2 O
K2
- IC-AUTO + OSRV-FTO + OSRV-FTC where QIC-AUTO = 2.19 x 10-2 for failure of IC automatic initiation, QSRV-FTO = 7.0 x 10~ for failure of one S/RV to open, and QSRV-FTC 1.0 x 10-3 for failure of the S/RV to subsequently close (all values in Appendix 2-1A). Substituting the above values into the right side of the equation yields:
Q K2 = 2.19 x 10-2 + 7.0 x 10~4 + 1.0 x 10-3
= 2.36 x 10-2
- 5. Operator Action to Actuate IC - Node 0 34 Node 0 represents a cognitive operator error for failure to manually 34 operate the IC from the control room, given that auto actuation has failed. As noted in Section 2.0, the HEP for such a cognitive error is 1.3 x 10-3 The final value for Node 0 is based on a weighted average of l 34 fire damage frequencies for the Control Room and other areas outside the control room as shown below:
I 0 014
- HEP 1 A R+QHEP2 ' A 0THER
^F-1D where Q HEP 1 is based on a Control Room fire that produces a stress level factor of five times the HEP for cognitive error or Q = 5 (13 x HEP 1 10-3), ! , q LJ N MENT 2 6.2-12 PROBABILISTIC SAFETY STUDY
k 1, t 4 b The frequency of..~ fire damage state F-1D due to Control- Room fire is ACR
- L 7 37 x 10 4 /yr c;,
QHEP2 = 1 3 x 10-3 for cognitive error, following a fire outside the- , control room. AOTHER = 7 71 x 10-5/yr for the frequency of fire damage state F-1D due to Switchgear and Feedwater Area fires. A F-1D = 8.45 x 10-5/yr for the total frequency of fire damage state F-1D. Substituting the'above values into the equation for Q014 EIY'8 0014 = (6.5 x 10-3)*(7.37 x 10-6) c3,3 x 30-3),(7,7 x 39-5) 8.45 x 10-5
= 1.75 x 10-3
- p-Q. 6. IC Recovery From Control Room - Node K4 Node K 4
addresses operator remote / local manual recovery of the IC from both the Control Room and the local valve station, given that automatic actuation of the IC has failed. K4
- 0IC-HAN O
K2 where Ogg = 2 36 x 10-2 as defined earlier in this section and Q is remote / local manual IC recovery defined by.: IC-MAN O IC-MAN
- IC-CR *OIC-LCL + 0SRV-FTO + SRV-FTC O
AMENDMENT 2 6.2-13 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
where Q IC-CR = 5 55 x 10-3 for. recovery .of the IC from . the Control Roam I and - QIC-LCL = 5 56 x 10-1 for local recovery, . given that controlI room X restoration has failed (both values from Section. 2.0). The . remaining (d terms, Q SRV-FTO and QSRV-FTC, were defined earlier in this section. Substituting for the right side of the above equation yields: I I Q IC-MAN = (5.55 x 10-3) . (5 56 x 10-1) + 1.7 x 10-3
= 4.79 x 10-3 The above value can now be substituted, along with QK2, into the equation- i for Qgg which gives Qgy = 4.79 x 10-3 2 36 y 10-2
= 2.03 x 10-1 l
7 IC Make-up Automatic Acutation With Operator Recovery - Node Lg O' Node L represents the probability - that both the automatic actuation and 3 restoration of IC make-up have failed as defined by: 4 OL3
- OICM-AUTO * (OICM-REST + 0 HEP}
where QICM-AUTO. = 2.78 x 10-2 for failure of automatic make-up, QICM-REST = 0.406 for the failure to restore make-up (given automatic 4 for operator error of make-up has failed) and Q HEP
= 13 x 10 i omission. Using the above values (as defined in Section 2.0) and i substituting them into the above equation yields:
Q L3 = (2.78 x 10-2) * (0.406 + 1 3 x 10-2) l
= 1.16 x 10-2 l
AMENDMENT 2 6,2-14 ' i MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY _ _ _ . _ _j
6.2.5 FIRE DAMAGE STATE F-2A-fm Fire = damage state F-2A is identical to F-1C except that power ~ to S2 ECCS-fs :
. equipment is lost instead of S1 power (i.e. total LOF with no S2 AC power).
l, Consequently, the same event tree was used with a new value for the frequency l of fire damage ' which is 1.08 x 10~ /yr for F-2A. The contribution to fire [ damage comes from fires that occur in .the Cable Vault and Mezzanine. All top events remain the same as those which were defined earlier for damage state F-10, except for the case where where S2 power is not restored.
~
SDC and Alternate SDC Systems - Node M If S2 AC Power cannot be restored, then SDC fails since the inlet valve (i.e. , MOV SD-1) is located inside the drywell. Therefore, as Alternate - SDC is unavailable for the reasons identified in case c). Og = 1.0
'%s O
6.2-16 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
'6.2.6 ' FIRE DAMAGE SfATE F-2B
( This damage state represents a total loss of feedwater event with all support
' systems available (i.e. LOF-support state 1). Accordingly, the internal event tree for loss of feedwater was used with a total fire damage state frequency of 2.19 x 10-3/yr as the initiating event frequency. Fires in the Ccntrol Room, l Cable Vault, Mezzanine, and Feedwater Area are the sole contributors to fire.
damage state F-2B as shown in Table 6.2-1. Because there is a total failure of feedwater in F-2B, the following top events were re-evaluated prior to event tree qu'antification.
- 1. Feedwater Restoration - Node C 3
Total feedwater failure corresponds to: QC3 = 1.0
- 2. Operator Action to Restore RPV Level - Node 0 34 Node 0 34 represents the cognitive operator error to restore RPV level, i l
following a loss of feedwater event with subsequent failure of IC automatic initiation as described in Section 2.0. Because a Control Room fire would increase the level of stress for successful operator action, the final value for Node 0 34 is expressed as a weighted average which is based on the frequency of fire damage from areas that are both inside and outside , the Control Room. As shown in Section 6.4.2, 0 014 an be expressed as: 0 HEP 1 AR+Q HEP 2 "A 0THER i
-B Q014 =
where A CR = 2,08 x 10-5/yr for the frequency of fire damage state F-2B due to Control Room fire, A0THER = 2.17 x 10-3/yr for the frequency of F-2B in other areas which are outside the control room, and A F-2B = 2.19 AMENDMENT 2 6.2-17 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
.1 x 10-3/yr for. ths . total frequ:ncy of . F-2B. All othar values are as defined in Section 6.2.4. Substituting for the right side of the above -
./ 7 equation gives V
(6.5 x 10-3),(2.08 x 10-5)+(1.3 x 10-3)*(2.17 x 10-3) 014 = 2.19 x 104
= 1 35 x 10-3 3 Restoration of Main Condenser - Mode H 3
Given a total failure of Feedwater: QH3 = 1.0
- 4. SDC and Alternate SDC - Node M The unavailability for Node M is identical to that for part b)'in section 6.2.1 Og = 1.15 x 10~N ou- i
. l M1ENDMENT'2 6.2-18 MILLSTONE UNIT 1 j L PROBABILISTIC SAFETY STUDY l L -
6 6.2.7 FIRE DAMAGE STATE F-2C i: Fire damage sta'te F-2C represents a partial or full loss of feedwater with AC available to power both the S1 and S2 trains of ECCS equipment (i.e. buses 14E and 14F available). The initiating event is due to a Switchgear Area fire that causes the loss of Feedwater Pumps 1A and 1B because 'of fire damage to 4160V
~
Bus 14A. Although feedwater could continue to run, it was conservatively ! assumed that- feedwater string C would have to be started in order to restore-feed. The total frequency of fire damage state F-2C is 5.02 x 10-4/yr and'is due to a fire in the Switchgear Area. The effects of damage state F-2C on core melt frequency were quantified by-using the lors of feedwater internal event tree for support state 1. All top events are the same as those defined for the internal event tree except for feedwater restoration (which is based on manual start of the C feed string) and Node M. As noted in Section 6.2.1, Node 3C f r feedwater restoration via the C string is defined as: Q C3 = 1.76 x 10-2 U As noted in Section 6.2.1, Node M for successful Feedwater restoration (i.e. part a) is: Q M = 7.85 x 10-4 and Node M for failure of feedwater restoration (i.e. part b) is: l 1 Q M = 1.15 x 10-4 AMENDMENT 2 6.2-19 MILISTONE UNIT 1 PROBABILISTIC SAFETY STUDY
'].,
- 6'.2.8 . FIRE DAMAGE STATE F-2D' Fire damage state F-2D - represents a partial loss of feedwater ' due ~ to a:
f'V O 'Feedwater Area fire'that could-disable any one of the following components:
.p I
o Main Feedwater Pump o' Condensate Booster Pump. o Condensate Pump Following the partial loss of feedwater, a reactor trip would occur on low level with subsequent MSIV closure. All support systems are assumed to be in the available post' trip since the fire only damages one - of the ptanps Feedwater system. The cause of such a transient is entirely due' to Feedwater Area fire damage state F-2D which is estimated to occur with a frequency of 8.09.x'10-3/yr as shown in Table 6.2-1. The core melt frequency that can be attributed to fire damage state F-2D was quantified by using the reactor transient internal event tree for support state C)
- 1. Since MSIV closure is postulated to occur following reactor trip, Node H 3
F We Malue for for main condenser recovery was given a value of Qg3 - 1.0. Node M. is based on whether or not feedwater is recovered as noted 6.2.7 All other nodes remain unchanged and are described in Section 2.0 for the reactor transient event tree.
~
MILLSTONE UNIT 1 AMENDMENT 2 PROBABILISTIC SAFETY STUDY
6.2.9 FIRE DAMAGE STATE F-3A 1
.Da.tage state F-3A is attributable ' to fires in the Cable Vault and Control Rocal 73 1,,) . which cause'a reactor trip along with the following:
o MSIV closure l o Loss of the remote S/RV opening function in 'both the automatic and L manual modes of operation g o Total loss of all ECCS functions o Total loss of SDC and Alternate SDC systems o Loss of IC remote / automatic actuation from the Control Room. ! Consequently, only the running Feedwater System, IC (in local control mode), and IC Make-up System are available for mitigation. The IC Hake-up System is essentially unaffected by the fire since both the diesel driven fire pump and A. the motor driven fire pump (from Unit 2) are available for duty. The total k)' frequency of F-3A is estimated to be 1.14 x.10-N/yr as noted in Table 6.2-1. In order to quantify the effect of damage state F-3A on core melt frequency, a special event tree model was constructed using the reactor transient internal event tree as the basis for development. The event tree for fire damage state F-3A is shown as Figure 6.2 9-1 and the top events are described below. Definition of Top Events
- 1. Reactor Transient Initiator - Node T 3 Node T) represents the frequency of fire damage state F-3A. Therefore, A
- 4
= 1. M x 10 /yr T1 F-3A
- 2. Reactor Trip - Node R ;
O ! 1 I 6.2-21 AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY l
1 The success criteria for. automatic. reactor- trip is similar to that for the-
~
reactor transient internal event tree (Section 2.0). if Q R = 5.4 x 10-5 3 Feedwater Operates Post Trip - Node C 4 i Node '.3 C represents the availability of the feedwater system after. reactor trip Q C1 = 1.03 x 10-2 (Section 2.0)
- 4. Operator Action to Restore RPV - Node 0 10 i Node 0 10 represents the cognitive operator decisions that have to be made following reactor trip and feedwater failure as described for the reactor; transient internal event tree in Section 2.0. Since part of damage state
'F-3A is caused by Control Room fire, a weighted average was used to determine the final value of Node 010 (Se tion 6.4.2)
O 0
- HEP 1 *ACR + OHEP2 OTHER 010
- F-3A where A CR
= 1 91 x 10-5 for Control Room fire, A 0THER
- 9' O
- 10-5 for Cable Vault fire and A F-3A = 1.14 x 10- for the total frequency of damage state F-3A. Substituting for the right side of the equation yields !
5 (6.5x10-3)*(1.91x10-5)+(1.3x10-3)*(9.48x107) 0 010 = 1. x 10
= 2.17 x 10-3
- 5. Restore Feedwater - Node C 3
AMENDMENT 2 6.2-22 HILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
- m. , ' Nodai C3 repres:nts restoration of - feedwater, following its failure to continue running post trip as described in Section 2.0.
b,q S
'0C3 =-1.3 x 10-1
- 6. Safety Relief Valves Reclose - Node J Node J- represents cycling- of the S/RV's, following both the failure of feedwater and - its restoration:. As noted in Section 2.0 - for the LNP -
internal event tree, the S/RV's will cycle ten times before the' operator can initiate the IC locally. Og = 2 37 x 10-2 7 IC'and IC Make-up - Node K Node K represents the failure probability of IC local initiation and the - failure probability of automatic IC Make-up with restoration. This can be. expressed by O
' %) O
- IO + (O " IO K IC-MAN + OHEP1) ICM-AUTO ICM-REST + OHEP2)}'
+OSRV-FTO + OSRV-FTC where Q 3 x 10-3 for failure of local IC initiation, Q
=13x IC-mag 10- f =or .01 HEP) operator error of omission, QICM-AUTO = 2 78 x 10-for failure of automatic IC make-up, QICM-REST = 0.406 for. failure to restore make-up (given automatic failure), Q HEP 2 = 13 x 10-2 for d,
operator error of omission, and QSRV-FTO + OSRV-FTC = 1.7 x 10 for failure of a S/RV to manually cycle once (see Section 6.2.4). The above terms are defined in more detail in Section 2.0 for the LNP internal event tree model. Substituting for the right side of the equation, it becomes: Og = (3 01 x 10-3 + 1.2 x 10-2) + (2.78 x 10-2 * (0.406 + 1... f x10-2) + 1.7 x 10-3 ;
= 2 93 x 10-2 AMENDMENT 2 6.2-23 i MILLSTONE UNIT 1 ,
s PROBABILISTIC SAFETY STUDY
- 1. .
j
'6.2.10- FIRE DAMAGE STATE F-3B 4
This damage state represents fire induced MSIV closure', which is p- - non-recoverable, with all other support systems ! available (i.e. reactor- ! trip' in support state 1). The transient is attributable to damage resulting from Cable . Vault and Reactor Building fires- and is estimated to
-have a total frequency of 3.71 x 10-4/yr as noted in Table 6.2-1.
The reactor transient internal event tree for support state 1 (Section 2.0) ~ was used.to quantify the frequency of core melt resulting from fire damage f' state F-38. All top events ranain unchanged from the internal event tree except for the following:
- 1. Main Condenser Post Trip - Node H)
Since the MSIV's fail closed, the main condenser is unavailable and Q 1.0 H1
- 2. Restoration of Main Condenser - Node H3 .
.]
N Because the MSIV closure is not recoverable, the main condenser cannot be restored and i QH3 = 1.0 3 SDC and Alternate SDC - Node M The unavailability for Node M is defined in Section 6.2 7 ; i i l' l O ! AMENDMENT 2 6.2-25 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY , _ . _ . - - - ~
- - _ - - _ - _ _ _ _____.~---.-.m _ - _ _ . _ _ - _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ __
y y J: 6.2.11 FIRE DAMAGE STATE F-4A -
!(7 Damage state .F-4A results from fires in the Cable Vault, Mezzanine and Switchgear Area that produce a partial loss of feedwater due to fire l
induced -loss of S2 Buses 14D and 14F. The S2 power train fai]ure could result from either hot wire-to-wire shorts in the load shedding circuits or a direct' loss of Bus 14D which feeds 14F. The total frequency of F-4A is estimated to be 2.98 x 10-4/yr as shown in Table 6.2-1. l The frequency of core melt. was determined by using 'the reactor transient internal event tree for support state 5 Top events in the tree remain unchanged from those described in Section 2.0 except for the ones that are noted below.
- 1. Feedwater~ Operates Post Trip - Node C3 Node C) represents the probability that feedwater fails to continue running after the reactor trip. Given a failure of S2 AC power, there is a 2/3 chance that Feedwater Pump C (powered by S2) was running .
since the normal configuration of Feedpumps is A and B, A and C or B and C. Although Feedwater may continue running post trip, it was conservatively assumed that it always fails after a loss of pump' C. Accordingly, Node C) was assigned a 2/3 probability of failure as shown below l l. OC1 = 0.667
- 2. Restore Feedwater - Node C3 l Node C represents rest ration of a single string of feedwater, 3
following its failure to continue running. As noted in Section 6.2.1, the probability of failing to start a single feed string is: 4 QC3 = 1.76 x 10 3 Restoration of AC Power - Node U 4 AMENDMENT 2 6.2-26 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
g 1 l' :
? >
Although S2 AC power can be restored at four hours by either removing
.the load shed signal or aligning the diesel generator to Bus 14F, it ft b , was conservatively assumed that' restoration' would; always take place via the latter method. - Section' 6.2.1 computes a' value for Node U4-based on restoring AC to Bus 14E with the diesel. Since Buses 14E and 14F are symmetrical and can be-individually aligned to the diesel, the probability of failing to restore power to Bus 14F is the same as.
Og4 in Section 6.2.1. O gg.= 3 12 x 10-2 n d'
- 4. SDC and Alternate SDC - Node M For. cases where S2 AC Power is restored, the following values for Node M are taken from Section 6.2.1: l a) Og = 7.85 x 10-4 for feedwater success b) QM for feedwater failure j
/3 = 1.15 x 10-N For case where S2 AC Power is not restored, the following M Node values are taken from Section 6.2.5:
a) Og = 1.0
.v, AMENDMENT 2 6.2-27 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY 5_____-__________________________.___ _ _ _ _ _ __ _ _
L p l' 6.2.12: FIRE DAMAGE STATE F-4B c y7?( Fire damage state F-4B represents a reactor trip which is caused by fire-b . induced loss of 4160V Bus 14F or 480V motor control centers (MCC's) in the-Reactor Building which are powered by Bus 12F. The total frequency of F-4B is estimated to be 170 x 10-3/yr and .is attributable lto ' fires in the. l Cable Vault, Switchgear Area and Reactor Building as noted in Table'6.2-1' . I-The reactor transient internal event tree for support state 5 was used to - quantify the frequency of core melt that results from damage state F-48. All top events remain unchanged from the internal event tree (Section 2.0) except for the following.
- 1. Restoration of AC Power - Node U4 Because the fire can damage either the "F" MCC's or Bus 14F, only partial restoration of S2 power to the Reactor Building:is possible.
If the fire were to damage the "F" MCC's or their power cables, certain motor-operated valves in the SDC and Alternate SDC systems (~} could not have power restored to them. This would result.in a partial failure of Alternate SDC (i.e, one train) and a restorable failure of SDC (if no fuel damagt were postulated). Fire induced failure of Bus 14F could be recovered at four hours by crossd.ying 480V Buses 12E and 12F which would allow the "F" MCC's to receive power. Although this action would allow motor-operated valves that are powered from "F" MCC's to function, Alternate SDC would still have one train failed ~ l since Bus 14F is required to power the pumps. Node U 4 represents the probability of not restoring power to the "F" MCC's via 480V Bus 12F. This probability is computed by adding the fraction of fire in areas where "F" MCC's cannot be recovered (i.e. Cable Vault and Reactor Building) to the HEP for failure to crosstie Buses 12E and 12F at four hours. O v AMENDMENT 2 6.2-28 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
(ACV+kB
! 0 A HE
- 04. F-4B
~
where A CV = 7 35 x 10-5/yr fbr the frequency of F-4A . due to' Cable .l' Vault fires, A RB = 3.62 x'10~4 for Reactor Building fires and lA F-4B = 1 70 x 10 for the - total frequency of F-48. . The value for-QHEP is .1.3: x 10-3 for failure .of .the operator to perform the'
' crosstie, based on the general error' of- omission that was assumed in Section . 6.2.1. - Substituting the above values in the equation for QU4. yields:
(7.35 x 10-5 + 3.62 x 10~4)
-QU4 = 1.70 x 10-3 + 1.3 x 10-3
= 2.57 x 10~l
- 2. Alternate SDC and SDC Systen - Node M As noted in Section 6.2.1, the. equation for the M Node is:
EM *'(OSDC + OHEP1} " (0ASDC + OHEP2) + O2S/RV Based on fire damage state F-4B, there are four possible M Node
-values.
a) Feedwater succeeds and restoration of 480V bus 12F fails. For this combination, the SDC system fails'(i.e. MOV SD-1'is inside the drywell) and Alternate SDC unavailability is based on support state 5 (see Section 6.2 5). Og = (1.0) * (1.0) + 6 7 x 10~
= 1.0 l l \ . MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
% Dig b):' Feedwater1 fails l (i.e.,. no~ S/RV'c' aren required) ~ and
- restoration:of bus 12F fails.
/$
YL/ '4
.o-g=(1,0) .
(1,o);
= 1. 0 ,
g c) Feedwater succeeds :along..with restoration of 480V bus 12F" (i.e.,~SDC support state 1). Og = (3 21 x 10-2 + 1.3 x 10-3) , (7.32 x 10-2 - , + 1.3 x 10-3) 4 6.7 x 10-4
= 3 16 x 10-3 d) Feedwater fails but restoration of 12F succeeds Qg = (3 21 x 10-2 +-1.3 x 10-3) , (7 32 x 10-2 il
^ + 1 3 x 10-2)
= 2.49 x 10-3' 1;
t 1 O AMENDMENT 2. ' 6.2-30 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
l 6.2.13 FIRE DAMAGE STATE F-4C cf g Damage state F-4C represents a reactor trip with a fire induced loss of V .either .4160V Bus 14E or the "E" motor control centers (MCC's) in the L Reactor Building. - The total frequency of F-4C is estimated to be 2.56 x 10 /yr and results from fires in the Switchgear Area and Reactor Building. The internal event tree for reactor transients in support state' 1 was used to quantify ' the core melt frequency due to fire damage state F-4C. It should be noted that support state 1 rather than 3 was used since feedwater I continues to run on just a loiss of Bus 14E. Accordingly, all- top events-remain unchanged from the internal event tree (Section 2.0) except for l those which are affected by a loss of Bus 14E. A description of the changes that were made is given below. 1.- Restoration of AC Power - Node U4 This node is analogous to Node U which is described in previous 4 N Section 6.2.12. Again, the Alternate SDC system is' partially failed (O ' (i.e,.only one train available) due to loss of either the "E" HCC's or Bus 14 E and only the SDC system is fully restorable. Since the motor control centers cannot be restored, the fraction of fires that cause their loss is assumed to result in the failure of AC power ! restoration. Therefore, the total probability that Node Ug fails is j computed by adding the above fraction to the HEP for cross-tie.of Bus l 12E to Bus 12F. I A RB Ogg = A p_gg A 1 where A RB = 3.73 x 10-7 for the frequency of damage state F-4C due to Reactor Building Fire and A = 2.56 x 10-4 is the total F-4C frequency of F-4C. The probability of failure to cross-tie is O HEP AMENDMENT 2 6.2-31 MILLSTONE UNIT 1 , PROBABILISTIC SAFETY STUDY
1 ]
= 3 0 x L 10-3 as. explained in Section' 6.2.12. Substituting these values into the above equation gives , 'rs(j 3.73 x 10~I Qgg = 2.56 x-10-4 + 1 3 x 10 .= 2.76 x 10-3
- 2. -SDC Syste - Node M Node M represents the probability of long term cooling failure which is dependent on the success of feedwater and AC power recovery to Bus 12E as shown bel'ow for the four possibilities, using the definition of-
-Node H as noted in Section 6.2.1.
a) Feedwater runs and restoration of Bus 12E is successful (i.e. support state 1 for SDC but support st. ate 3 for Alternate SDC) 0g= (3 21 x 10-2 + 1 3 x 10-3) 5.(1.0) +.6 7 x 10-4
= 3 41 x 10-2 (Section 6.2.1) b) feedvater. fails but' restoration of Bus 12E succeeds (i.e. , same as above except depressurization is not required).
Og = (3.21 x 10-2 + 1.3 x 10-3)
- 1.0
= 3 34 x 10-2 (Section 6.2.1) i c) Feedwater runs and restoration of Bus 12E fails (i.e., support state 3 for SDC and Alternate SDC).
Og = (5.61 x 10-2 + 1.3 x 10-3) * (1.0) + 6.7 x 10-4 O' GI j AMENDMENT 2 6.2-32 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
= 5.81 x 10-2 (Section 6.2.1) d) Feedwater fails and restoration of Bus 12E fails as well (i.e.,
same as c) without depressurization). Og = (5.61 x 10-3 + 1 3 x 10-3) * (1.0)
= 5.74 x 10-2 O
O . AMENDMENT 2 ~ 6.2-33 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
6.2.16 FIRE DAMAGE STATE F-5C Damage-state F-5C represents a reactor trip combined with the fire induced loss of DC Bus 101A or its power cables in the Reactor Building. Consequently, all S2 ECCS equipment are unavailable and the IC must be operated manually at the j local valve station. This is equivalent to the reactor transient internal event tree for support state 11 (i.e. DC 101A and Bus- 14F failed) which was used to quantify the core melt frequency resulting from F-SC. As shown in Table 6.2-1, fire damage state F-SC results- from Reactor Building and Switchgear Area fires. The total frequency of F-SC is estimated to be 1.17 x ! 10-3/yr and was used as the initiating event frequency for the event tree just described. The value of the M Node is based on Section 6.2.11, depending on the success of feedwater and/or S2 restoration. , pd i l l l O 1 6.2-38 HILLSTONE UNIT 1 M MENT 2 PROBABILISTIC SAFETY STUDY
6.2.17 FIRE DAMAGE STATE F-5D This. damage state represents a reactor trip with a combined loss of RBCCW and
'[\
+
the IC due to a Reactor, Building fire. The total frequency of F-5D is estimated to be 1.06 x 10-5/yr. Since all, ECCS and support systems are available, the core melt frequency attributable to F-5D was computed by using the reactor transient internal event tree for support state 1. The failure of RBCCW and the IC resulted in modifications being made to the following top events in the tree. i
- 1. IC and IC Make-Up - Node K Because the postulated Reactor Building fire is in close proximity to motor-operated valve IC-3, the IC is assumed to be unavailable due to total failure of the valve. Therefore:
Og = 1.0
- 2. SDC and Alternate SDC Systems - Node M Node M represents the probability that both SDC and Alternate SDC fail to operate. As noted in Section 6.2.1, this can be represented by:
OM * (OSDC + 0 HEP 1) * (OALT-SDC + OHEP2) + O2 S/RV Since RBCCW fails as a result of the fire, SDC cannot be used and QSDC
- l 1.0. Substituting this value along with the remaining values from Section !
6.2.1 for the right side of the equation yields: Og = (1.0) * (2.13 x 10-3 + 1 3 x 10-3) + (6.7 x 10-4)
= 4.10 x 10-3 O
AMENDMENT 2 6.2-39 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY l l
6.2.18 FIRE DAMAGE STATE F-6 Damage state F-6 represents a reactor trip with loss of the S/RV remote opening flinction and one S/RV stuck open due to fire induced hot shorts in its opening circuitry. The frequency of F-6 is estimated to be 6.23 x 10-5/yr and is due to fires in the Control Room, Cable Vault and Reactor Building. The resultant core melt frequency from damage state F-6 was quantified by using the intemal event tree for inadvertent opening of a safety / relief valve (IORV) in support state 1. Because the S/RV remote opening function also is lost as a result of the postulated fire, some of the top events in the IORV event tree had to be modified. These are described below.
- 1. Operator Action to Restore RPV Level - Node 03 A portion of fire damage state F-6 is due to Control Room fires which could place a level of stress on operator action. Accordingly, a weighted average was computed for Node 03 based n the the method described in Section 6.2.4.
O 0 03
- O HEP 1 * ^CR + OHEP2 " ^0THER
^F-6 where CR = 7.79 x 10~0/yr for the frequency of damage state F-6 due to Control Room fire' OTHER = 5 45 x 10-5/yr for the frequency of F-6 attributable to other areas, and F-6 = 6.23 x 10-5/yr for the total frequency of F-6. Substituting the above values and QHEP1' OHEP2 from Section 6.2.4 into the right side of the equation yields:
Q 03 = (6.5 x 10-3) (7,7q x 30-6)+(1.3 x 10-3).15 J 5 x 10-5y 6.23 x 10-5
= 1.95 x 10-3 O
MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
i
- 2. Core Spray and LPCI System - Mode E f i
None of the low pressure systems can be. used since the S/RV's cannot be (V) opened to depressurize the RPV. '1herefore: l QE = 1.0 3 Safety / Relief Valve (Manual) - Node I Failure of the S/RV remote opening function implies: Qy = 1.0
- 4. SDC and Alternate SDC Systems - Mode M Since Alternate SDC is part of the LPCI system, it cannot be used for long term coolir.g. This leaves only the SDC system which would be used following the success of feedwater. Consequently, Node M represents the probability of SDC failure.
OM*OSDC + OHEP1 where QSDC and QHEP 1 are defined in Section 6.2.1. Substituting these values into the equation gives: Og = 2.28 x 104 + 1.3 x lod
= 2.41 x 10-2
- 6. M mm 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
)
6.2.19 FIRE DAMAGE STATE F ~f This fire damage state results from fires that simultaneous)y cause reactor trip, MSIV closure, a stuck-open S/RV with loss of the remote opening function, and loss of the IC due to hot shorts in the MOV closing cirruits. In order to assess the contribution of damage state F-7 to core melt requency, it was necessary to develop the special event tree shown in Figure 6.2.19-1. The total frequency of fire damage state F-7 is estimated to be 1,62 x 10-5/yr and is due to Cable Vault, Mezzanine and Control Room Fires. l Definition of Top Events l
- 1. Frequency of Reactor Trip - Node F Node F represents the total frequency of damage state F-7 which is described above. _
A y = 1.62 x 10-5/yr
- 2. Feedwater Continues to Run Post Trip - Mode C j Since the Feedwater System is unaffected by damage state F-7, the probability of Node C) is the same as in the reactor transient event tree for support state 1.
4 QC1 = 1.03 x 10 3 Operator Action - Node OA Node OA represents the following operator actions that would be performed at approximately four hours after the reactor had tripped.
- a. In order to close the stuck open S/RV, an operator would have to deenergize the opening circuit by opening a breaker in the Control Room.
O 0*M mamm2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
6.2.20 FIRE DAMAGE STATE CM Damage state CM represents a total loss of all AC and DC power which is conservatively assumed to result in an early core melt due to the lack of a detailed consequence analysis. The frequency of core melt due to CM is estimated to be 1.11 x 10-5/yr and is caused by fires in the Control Rom, Cable Vault, Switchgear Area, and Reactor Building. l l l l O l l l l l. O AMENDMENT 2 6.2-46
6.3 QUANTIFICATION RESULTS FOR ACCIDDITS CAUSED BY FIRE
-p Quantification of the internal event trees for fire induced transients resulted I d in frequencies being calculated for both core melt and core damage. As defined in Section 2.2 for internal events, the total core melt frequency is equal to the sum of the individual frequencies for the various plant damage states (i.e.
endpoints on the system event trees), while the total core damage frequency is the sum of the frequencies for scenarios which result from partial core uncovery (over a short time interval) or overpower conditions prior to reactor trip. The quantification of fire initiated accidents resulted in calculating the following values for frequency of core melt and core damage due to fire: Core Melt Frequency = 2 58 x 10-5/ year (mean value) 4 Core Damage Frequency = 8.10 x 10-5/ year (mean value) Core Melt Grouping By Core Melt Timing Table 6.3-1 provides a summary of the core melt frequencies that are attributable to fire induced transients, according to the time of core melt. O Since the consequences of different core melt times are independent of the initiating event, the earlier discussion on core melt timing (Section 5 3) for internal events is applicable here as well. Core Melt Grouping By Fire Damage State Initiator And Critical Plant Area Table 6.3-2 provides the core melt contribution from various fire damage state initiators. Damage state CM is the largest contributor and accounts for 43% of the total core melt, of which 95% is due to propagating fires in the Cable Vault and Switchgear Areas. Table 6.3-3 shows the contribution to core melt by critical plant area. Approximately 39% of the total is due to fi? es in the Switchgear Area, followed by Cable Vault fires which account for another 32% of the total core melt frequency. The link between Fire Damage State and Critical Plant Area is shown in Table 6.3-4 which shows the core melt frequency in each plant state, resulting from fire. AMENDMENT 2 6.3-1 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUD'l w______________________--__ . _ _ _ _ __ .__ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ -
.TABLP p1 CORE MELT FREQUENCIES BY CORE MELT 1. 3
-CORE MELT TIME FREQUENCY / YEAH PERCENT CONTRIBUTION Early ('T < 2 hours) 1.60E-5 62.02
. Intermediate.
'(2 hours < T < 7 hours) 2 73E-8 0.01 Late'(T > 24 hours)_. 9.80E-6 37.97 TOTAL 2.58E-5 100 O
AMENDMENT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
TABE 6 3-2 CORE MELT FREQUENCIES BY CORE MELT TDES 'v(~} . . FIRE DAMAGE STATE FREQUENCY / YEAR PERCENT CONTRIBUTION F-1A- 7 71E-8 0 30 F-1B 3.99E-7 1.55 F-1C 1.13E-7 0.44 F-1D 2.24E-6 8.68 F-2A 2.49E-8 0.10 F-2B '4 30E-7 1.67 F-2C 6.79E-8 0.26 F-2D 4.49E-7 1.74 F-3A 3 35E-6 12.98 F-3B 2.81E-8 0.11 F-4A 2.20E-7 0.85 F-4B '3.82E-6 14.81 F-4C 1.44E-8 0.06
- F-5A 9.29E-7 3.60 F-5B 1.14E-6 4.42 F-SC 4.19E-7 1.62 F-SD 1 35E-9 0.01 F-6 1.48E-7 0.57
-F-7 8.31E-7 3 22 CM 1.11E-5 43.02 TOTAL 2 58E-5 100 O
i AWMMT 2 MILLSTONE UNIT 1 PROBABILISTIC SAFETY STUDY
TAB E 6 3-3 CORE MELT FREQUENCIES BY CRITICAL Puuff AREAS. FIRE DAMAGE STATE. FREQUENCY / YEAR PERCENT CONTRIBUTION Control Room '7 3E-7 2.83 Cable Vault 8.15E-6 31.59 Mezzanine 3.45E-7 1 34 Feedwater Area 3 20E-6 12.40 Switchgear Area 1.01E-5 39.15 Reactor Building 3.08E-6 11.94 TOTAL -2 58E-5 100 i i O
-AMENDMENT 2 6 3-5 MILLSTONE UNIT 1
TABLE 6.3-4 y{ CORE MELT FREQUENCIES BY CRITICAL PLANT AREA i;l AM) FIRE DAMAGE STATE INITIATOR FIRE DAMAGE CRITICAL PLANT AREA (FREQUENCY / YEAR) STATE INITIATOR CR CVJ MZ' FW SWGR RB F-1A' 2.93E-9 7 41E-8 F-1B 1 92E-7 3 88E-8 1.68E-7 F-1C 1.54E-10 1.13E-7 F-1D 1 95E-7 1.81E-6 2 38E-7
'F-2A' 2.47E-8 1.79E-10 F-2B '4.08E-9 1.69E-8 2.04E-7 2.04E-7 F-2C 6.79E-8 F-2D 4.49E-7 F-3A 5.61E-7 2.79E-4
.F-38 2.67E-8 1.13E F-4A 1.71E-8 1'.79E-8 1.85E-7 F-4B 1.65E-7 2.83E-6 8.13E-7 Y F-4C 1.44E-8 F-5A 3 03E-10 2.43E-8 1.91E-8 4.51E-7 5.11E-8 3.83E F-5B 1.14E-6 F-5C 3 03E-7 1.15E-7 F-5D 1 35E-9 F-6 1.85E-8' 1.23E-7 6.27E-9 F-7 1.53E-7 6.16E-7 6.46E-8 CM 1.15E-8 4.15E-6 6.34E-6 6.18E-7 CR - Control Room FW -
Feedwater Area CV - Cable Vault SWGR - Switchgear Area MZ - Mezzanine RB Reactor Building O u l AMENDMENT 2 6.3-6 MILLSTONE UNIT 1 PROBABILISTIC SAFETY S'DP"
5,on 5. i aruC QE E t
, , gr SI N 0340 1 3566S 1 w 77i 1 4Ff o L .
. AO T _ E OR 7 9 _ 5 0 T F F. 4 6 _ O M. 2 1
%C S
E _ C _ N E TR LA U E E 6- 6-MY Q Ey C E 4 E 5 _ E 3 S RE 1 - OR 6 4 _ T CF _ L E M - T 5- E L 3 R EE h ly r ly r a 6 OC M a EI F T E E O E D O L E B C d A U sd r e eh c C gV i
- e r T. D n -
d e ar t f o DnRw se lt a d aa el N et o lealb t n di / - man h dl So I t aa r p s sr e y s ni t b na o E N 0 e er C sd r db a lt ge cnr aBer une - a cimo ei r t in am oAA: h i u ee eiu r l Cr pi t od i R m f r r r i Aoo w ga cd I E mrah oicq t h i l pa s s i d iua qf t ck o s af l ea y p l F R oeol gb t uwle d et l a act og s r t h r ar n eu e - a u o T C S eh f s ea b Rci nre letum e f oRsu t R tr pi r n af c d e c o er ir m r N E r i t Oh a oop soa d O eetoa oer u f i wb f wss at e n elmae a h e
- t ht i A D f st - lbi r s a r t el E oSos ee dewqi u lodt eiu r a f f d ni fa N C nnll a nf r ir i f f r e dt wl i coot e e e I
N oiar oo a ee ml ue t la eu codf a s l laelut t h mh n t M E ieoept e t ant sm nio ur e t r u sn ut e goso wmeh dn smICo sum lb n st O l out ao c z s a et h f o d ei aop D Q azepcd p s in i leb s t r id _ E o e uC er d ir od iebaomd ahnt o sl o ah ueu ht i ieiqu Lo vt
)
S r n caD )a r Po b F ca r i cc F - iq l F we o o o o o D AE r a l t u E T R e g a C A T h V E c e FW F i t w lb a AU P S C R EO GT AA I MT I A DI N M M C E E R AT I C C FT 1 2 S ll
E ig r o6 ca _O UV QE E E F 1- ot n 9 c o2 e a 7 d nuL agr eO r F 5 d r nu agr eR e SIN 46R 2Ffio 3Ffi o _ L . AO _ T E OR 1 8 8 3 2 4 _ T F F. 0 3 4 O M. 1 _ S %C E C N E TR U LA 6 6 6-E E - - Q _ E MWC E E 7 9 E 1 8 E 4 S R E 1 OR 2 1 1 T CF
) L t
E o n M c E T. i ( R EE h e ly r e 5 O EI M L t a E a t a
- C RT L O
3 6 E D C C E U s s Co r e L D OAT E o I t o r l a o w t g B N l dt o t un b e t t op s il a e u n r o e Cd aI C I i N n s u t f d t O ae l nq ue aCA p sgAil u wd R D eb r s u- nf d n I F u r a obu s eh e nio on Br e e a F e c t st k it e so R uw F es i ol s s a n cpst n T C S lc o t r es ui l a cr e e mp R e u oo l ca e
, o el na f Vmg r Vl ir c N E I i f et ir a i ndOo s f
SRaR f sls A D S c in t np ) oa C/o t o o V' fa dd wO f N E M/rei d l oU c t s k c C S t t t i C swoBu e eeB t nk r i t Enrd t n IS p I M N e s r teka s sF( t eS eo s l i o lare ye e emu O E U upr al o aMr e e r f u po o qw u V R i fo f i r t r f ut e quk Q t w u eC / eb a s s i D claca S leue E S ef e dCf eI e k s ca b sI u) sb s cw aio r bsu nsm ir F oR erh F ot n Ul b ol Sa
)
b o L c cp Sr uC I o o o o o o A uE lt u r e t R a t uA T V e a w r on g
- N t i t
- l b
d e cd ai MA l a e eu AL P C F RB R EO GT 2 AA I MT A T N A NI D B O DI E E R AT I FT 3-F 3 1 F 4. 5 F 5. E M D N E M S A
O E UV QE SN d r eT nuR agr 7Ffi o 2,o 1 1 n 6 c 6 1 e 46R t a L A O. T E OR 5 1 0 4 T F F. 3 2 O M. S %C E C N E TR U LA 7- 7-E E Q MYW E E E E C 3 8 S RE 1 1 OR 8 6 T CF
) L t
E n o M : T c E L ( R EE h e ly r 5 O EI M L t a E a
- C RT O
3 D 6 E C C r ,s E U e e ss OLB N A D I N r e w2 oS p c k s c it s 0 2- er e stn3 a s ,o l o p w s le ba a ia r lu l csF or nora o uien anit sy-a oECe SrAn l T E O Cn g C
/
V n u sct R D R o c cFCwl.ieo rel e I l P Ali C i t i a / Z t b I 2 fad uf S gD d Eoocuir r a F ls tonRn2 Pt nef el ea f I R S ,S bC - nf
,i sa t
i cC. r dCaSCoD i C ge : sD 2 T f hl N S E D ont sd n i a l i f enSRuC r u r dor rD ei lue3 dDc eyou i Bh Fn a d2e kt f - mt lahg A si r l o Blue orean - eS f or f t nSospt o N E t t t o o 's S1 a,d ype r h mSut l t C sr A t ap ad nt c I N eod n e wu wn o a2C r t nS satgA M E st uc n ud e d a iagRf t e1/CoenaMf m3 ol f e r r k te pa2 a aa qek e n O Q U ceS e ea ee F p a o ,s e st sl uI unwpn r se eipCl - t n ao D E e RC bsF m o ph ot sibnaqr spf S r inC u) ) r o FiE Sa b Pino l ucefo r eSotoZ o o o A uE: t R r U A I g r T on t i o ng t i t: N
- cd al cd al HA AL P RB eu i
eu i RB R - EO GT . . AA I MT O B I AN DI 4-F M E E C _ RT I A 6 FT 7 S
O QE E SN ' nu agr 2Ffi o
.R n 9 a o2 e 46R c o 3.S 0 4. T 42R 0
o 3. S 42R
- 4. T L .
AO T E OR T 9 3 7 1 5 7 4 7 F F. 2 2 1 1 O M. S %C E C N E TR U LA 7- 7- 7- 7-
' E E Q MY E E E E E EO F E 6
1 1 6 1 5 9 4 S OR 6 5 4 4 T CF
) L E %
t n M %0 02 o T 8 c E L '- ( R EE h el r y e ly r ly r 5 O EIM t LE aa L t a E a E a
- C F T O
3 6 E D O C E U OL D ) .
)
y s Sl B A N r o a-d n C M. M. lt e rl teia W I N I C C sl el a b a af f T T E O I ceVs t ar Ra e ly s uf ga p d wp oVl sS Ae n R t I r e sSl u/ l a r a a onic o ae s a I F Ro ewe l( e csds ug o h eic oM F I R l ( ls - ls leol F ka r l h e ci n oct iht lat ir C t v os ,m f adi en,pn T
- i eaRi nl e wle it i f N
S E sima leS en i f r f yOf a pn iC f r he sm r r a pe r w h e 3 asn o t ocue I A D bMr a io o erv - re oro t t o E et t
# eoV t t co r
aa t N C chit h cn t o t a r i t n oc s w n c eutcR t t I w ns nS nC ed t n M N l l a wfo u f ee d oo u e
/
eI eSa se e E g g ur q e Zlcf ut qu qW u o u e u O U f oinene eC e eb eT t aFe r q Q n ivSto c e bs s r i r F nu D E sl d un lu sI eS i Cm sAs d eis s S siluiei apa b u) ) Ce uu n b una r ao b u sal e r L oBf of Sa b iMEr F Sr iMl c F S o o o o o o o A E lt r r wR I A V u a t e a t a e lo wT N lb e t r m d w d w HA a n o oo e e e e AL P C CR F F R EO GT AA Mm A A 5 D O A N - 2-DI 7- 3- F F E E F F R I A T 8
. . 0. 1 FT 9 1 1 S
.f
QE agr 5 g I E SIN 0 4. T 42R 5Ff o 2F
,i
+ L . AQ T E OR 8 4 7 1 2 9 T F F. 1 1 0 O M.
%C S
E C N E TR U LA 7- 7- 7 E E - Q MY E E E 8 E EQ RE 3 8 3 0 3 S OR 3 3 2 T CF
) L t
E n o M T c E L ly ly ( R E W E ly r r r e r a a aot a 5'- O EI M E E L E C RT O 3 6 E D C C E U r e L D t ad B A N s A ad wn e e1a I 1 N ga d a0 ) ) e T E e1 % s O n % r d R I T i e dl r As u m48 r 6 AeS F : t e o lc P l ih e - a 1 r h e a e I u c rB a pfoo t r F I R Bi h Te y i s it r C eC g : gat - st ea r sb f l in o T r w o hD enLRsE sr eia i t N S E t cS t c f i f r o( Ou( Lil a Joo 7l f hf t p b e l s aW io
-o-a i
A D w o df a - cl t e
.laer t oU Ss s f
E eT t n
.W Sm Ctow -
eR t R N R Ale t na g t lsO V nkOi.R t C el o n et o I N enm eCli T e h aPs n eo u a M h a h a uI o qM / Ao r S t E t o f se ns q n scia t O U e eC nc ear eC C A in eo r i ie s T Q bsh sI I D s c eus T A b E S eu r ao r ia u ieud r an2 u) ) b
)
c i ct F Fc S )a
)
b F caS Sa o o o o o A r r a DE Et a e e T F r g g g C E . lA en t i h c h c cd t it F# ali i F eu w w Al RB S S P R EO
. GT AA D A
I MT 5-C 1 5 ANI DI F F F EE RT I A 2 1 3 1 4. 1 FT S
O U QE E SIN V 4 1 9Ff
,i eO r
uL gr o 4 1 9Ff
,i eO r
uL gr o L . AO . T E M. OR 9 7 9 7 C T F F. 0 0 F O M. O
%C %
S 1 8 E C N E TR R U LA 7- 7- Y E E / Q MYY E E 4 5 E E C 4 0 E 0 S RE 1 OR 2 2 1
- T CF 2 ) L t
E S n o M t e t e a E C T a N c E i d oe i d E oe (
. R EE M t
m t m U 5- O EI lyr r e lyr r e Q E
- C RT at at S O EI n EI n 3
6 E D C 6 1 C ] e A I OLE U v r r o O D ee b R s t t aa a F B A N d n enp e d n m g n ww 5 Ct h et L I N ar i o n a s o L dd eo 1 A T E O D r ea ap f nu r ls t'o Ir iwy og s d eo o T R P t aoh ian n FF N O I wt t W f Cngon as l la inr g r o T nt ol I F R d eeCr e I ni a l u lah f C : o r e v t o f l : T S eu ed oC iei r ar ol - t s o ef
- p g oie as e )c r
N F r mS b l s f ,e n i A E D f ostn oTr e B f oc t u eVRsaiCRo r POef mOsho n s o esdn f ond E s t aeR . spr . c o k t a N C ee r d d o t noieit
- v loUe c T iC t lsbo eaC l
t n) I N lu n ar e etun r e s s c n eb M agt o Vm u , O E U ia oret Cpa u q os Wkang Rre ul i aoa q )a e Q f swd eCce r dmo S L ST
/
ctnr M s e D E lain t t aae e b sI e od b s ue S o u) i r F c na
) )
tmh F t Sa b c S[ o o o o A . uE r e t R uA t T t a w h,
- N d e
HA e h AL P F R EO GT 1 AA I 8 MT B 0 A N DI E E RA I I T 2-F S 1 2-F 6 1 FT S
p' ' L I SSE . R -t 'Ct- . C30 e03 031 C4 E. 1 -D33 U4 H3 M
't SUCCESS 2 SUCCESS i J SL2,
, 4 SUCCESS
, i 5 SL2
, 6 DAMAGE i 7 SL 2 '
, 8 DAMAGE i 9 SL2 10 DAMAGE i
11 Sti
- i. , 12 DAMACE i
13 511 14 Sil IS SE1
.i6 SE1' 17 SUCCESS l , la SUCCESS i
19 SL2 -
, 20 SUCCESS 21 SL2
, 22 DAMAGE i i 23 SL2 I
24 SL2 25 SE1 26 $UCCESS
., 27 SUCCESS i
28 SL2 29 SUCCESS: 30 SL2
, -31 DAMAGE i
32 SL2
, '.33 DAMAGE a
34 SL2 35 DAMAGE I 36 511 37 DAMAGE l 38 Sil 39 SII 40 SEI 41 SEl 42 DAMAGE i 43 S11
, 44 DAMACE i
45 S11 46 Sil 47 SE1 48 SEl 49 SE1 50 SE2 51 ATWS-1 M Ent& SatL M(c.01Pr8) i
.ao E.'E.i'.CoJi n m ar =
= == = um. .
O M 031 c CPe.IEED a - - GEDc.
, rigs.FWt 12 VEL
==m i
- .a. u.cr.
. . me we imre E' ""rs".ch
===, rm. s. =
.,-1 m, y am.
-2 ===
. 1 a
l l g S S S S S S S S S S E E E E E E E E E 1 C E E E E E C G C C C G C C C - I G m C C C C C A A A A A A A A A S D W C U UCL 2 CU2L C U L2 AC A2 ML M A L?AM 2M2M2MiAiAiAiEEEET M M 1 l l l l l l l I I U L L A L A S S T S T S T S T D D T D T D T D T D T D T D T D T T T T T A t W P J I -
- mu 5 B 9 0 2 3 4 5 6 7 8 9 0 i 2 3 4 5 6 7 8 9 0 2 3 4 6 T WP o ma 1 1 1 W
1 1 1 1 1 1 1 I I 1 2 2 2 2 2 2 2 2 2 2 3 3 rI t a S aa5 a a1 t L l NN pit mo 1 e E sI JGGgra t E m=T P Lf u m= Fa aa W G I.RBgn s t n. GA _is
.= uwF s. -
N mI 1NC.ea r
-mmvucT M v B -
s 2PSW ol e
,u eAC ia R5T 2
A 3 . mc ii i8 Ii it II ii Is ii ri ii 1 ii 15S _ ea hrWPWF12R_rs nFM M E _ C 7
- I 1 1
0 1533 3mCU0CEIUgim S3c e Y 3 _ H _ 4 - U I N E N' M 1 KZ
- It t E 3
- u. F1 aF 3
4 ssV'E 3 s C 2 eE r s aM m r sM3 2 3 D S U 1 C 2 R M t r a N t v m 2
. 'l
1 i S S S S S S E E E E E E E G G G G C C C A A A A C C C 2 C 2 M t M 1 I l M 2 M 2 I 1 I G N U U L U L A I A 1 E E A L A L E E D t I S S T S T D T D T T T D T D T T T I I C 2 3 4 5 6 7 P D i 2 3 4 5 G 7 8 9 0 1 I N . 1 1 1 1 1 1 1 1 I ND i c D G2(X N AI A LA P N N R I nS MDI iI R O CC LY L D vR SRBWS I v3oC . c R KC T L 1D n1 2 r.1WAWA M 0 v3IS&LD U N wJ wC 1 w I 'V sNaI RTI.GA mPW IRF12 IS:SSC IRS U ED iI Ii II II II iI TRCEIUI 4D i 3 M 3l I 4 U N M B t u W O 1 P C 1 A 5 L 1 S I 4 V 2 E & E G I F g E 3 C _ R _ 2 T U C M D A : V n M A 1
!: i,
12:37*49 1/11/64 NO EMERGEhCY AC P0wtR ON SJSES i4E & 14F AF f ER A 60$10F NORMA 6 0/F 91 f E P%f R 4CES ACM-SIMP
- WE.
... . S.f
. .l N. CM.O.V.S.F..P.R.
. . . OP.R..I E. .f AR..T .e
[ 0002 I I , LOSS be EMERC. LOSS OF EMERC. Af P0wtR DN BVS AC POWER ON Sgt lee FOLLOWING A 14F FOLLOWING A i LOSS OF NORMA 6 LOSS OF NORMAL POWE R fL N*) POWER (L NP)
/\ 0001
/\0003
[% [h i I NO EMERCENCf AC LOC A. F AJL f 5 ON LOCAL F AVLIl CN NO AC POWER FROM FEED FROM 4160W 4160v SV5ES 4160V BUS 44F EMERCENCY DIESEL BUS 14C 14C 04 54E CENERATOR (0/0) SOURCE 0009 0004 0010 0005 [% g g [% I I I I I NO SIGN AL TO NO AC POWER EMERCENCf 0/0 EMERCENCY 0/0 EMERCENCY 0/C F AILURE OF tof M _'IE ORE ARER
.4C f 2 FROM 305 CLOSE flE BRKR. FROM EMERCENff FALLS TO $f ART FAILS TO RUN 0 0.4. FOR IE8f MAlf ER LMP FROM BUS I4C 10 CAS fuRSINE ON DEMAND AFJER ST ARilN0 OR MAINf ENANCE RELAYS TO MAKEUP
.4C TO 14C F ALLS 440 (14Cf *2) (C/f) Ct hER A TOR EFAILS 0/f ANO
'O CLOSE
, SVRCE ,
0/C ST arf) IS 0007 0294 0008 0013 0006 H9480046 NSCCl4CC [h NOCF0210 H00E0211 H00M0212 0016 2.1400E-03 3 1000E-02 5.5900E-03 9.5300E-04 1 3100E-03 4.sn00E-06 6.6300E-04 7 0000E-07 5.4400E 06 i i i l' F A iVRE OF BOTH L/O OC CONTROL EMERCENCf C/t EMERCENCY C/T EMERCENCY G/t MASTER LpF power ON C/f CENERATOR FAILS CENERAf 0R F AILS CENERAf 0R 0 0 5 REL ATS TO P>< tup CEN. 6Af f ERY.8v5 to ST arf CN TO RUN AFfER FOR IElf CR (F AILS C/I ANO DEMAND STARI , MAIN T EN ANCE D /0 9 ' **M 00 4 0010 0067 x 0014 0019 N MCfE0301 MC f N0202 NMn ur C10C MC100203 MC f f 0200 3.5200E-04 5 7600E 04 3 3400E-02 1 490CE-03 1.0800E-02 3 o 6 4400E-Os i.sf00E 04 TREM 3.3.3=G3 EDEDIE FMII' SMR RR IfM & ac Rzen W BWEB 14E AND 14F u. ggy,3.T 2 AFIER A LN.P.
>~
p
%,V W "'l. -
. . + .'A.
m-..._,. . , . _ - _ _ . f. i a I ns
.g l a, f t s -
. ,p
.I.
'**I((t_. !5hA-[N,_._.'f,f. '! Eh o "!'l,-
tin. ... c
+, I a i::;i,_;: :, 1
- t il 4.*
{ s' { - u] ,'- i-v5
;>N' ; g* j 7, Q
l(s?__.2 l :> 1;. L ,
. t, st
!@ . b.^" ,
s_. J.s-u ..;. ; . m ,, t t i 31il l
- V'5
** 8h .$f.L DL -
unu u !;, ;,
*i *lh'a u , ,i 58ll1 l5
!"5
} h'
'!D', :n.I h-_!,!.14L
;1 Iri)-
m ., , : ,u - ,l i. 8 5'I Ilitl iki jj!Ih i a i. i
-db i, h -,
lI. 11 - m. !!,!Ei. .;ici.d.L l a !. l u 3l , as9i lh fEI- :
'~
II ,
.i
. :t.
p!l
'it! 11 "
jjfh- ii!l!- h lill L I /- '!,li e 1 n: n=!!! - Nl ni ir ii!@ u h I!ji!- iiiG-n 'il-. lt a 1 :p ly!.;+l e i ._!
q= i' _( 7_3 ;
+
d.. l r i ' ,- I t; K, p n -lI jljjy!"Sl!! l l1 I g . E ,, . n ll:
" i i!! !lWi m-@l!!
~
rijj!
,h
.I 4 2 li,5 l -l!!,g 2
l
~
' e n
-lllj vi!g-lll!_ -4 I!!
g
. a, I!II, il 4 -<iI [-] n
- ! t;5::-<i)i!!
en s l;I n 1 n
~llffg l!!-l'"Il!!_
.a b I _/=\ ll ig /*' lllgja;j 'V "
illk --/[ 1[il$l"bl ! d!,
! ~ijl! "Di!I t
I
\/l'I5 .a"j'! V',j!!
,j u "
n'ia
.d d!.
'M " g
/ Nil .t: "l._ 'MA til" ,,
!.p! .. ejji L .!
!l -
ff!
- 5
.. al.,
_ = . _ _ - _ - - --
i a
$i. .
e , n 5 b . W l A P P I D A A P D A 5 8 OO 2 1 / *. P . i n A A P P I
/ O I 5 6 ? 3 3 7 1 g 2 6 gF - C - - - - - - - P - - -
I' I M - C - T - - - - - M - - - M E F N F F m F F F r C F F F C F E F N F i - p F F F F C g F F C
, 2 3 a 5 6 F aI O.
I 2 i.4 5 6 7 a J 0 2 2 ?2 12
- t l 1 1 1 1 l I 8 r 8 3 0 y 2 2 2 3 3 3 1 1 3 8 > 3 4 5 U _. 2 G _
1- t
. xs
' l.s x s ._
4 Z a z S a r
,1 i'
C I
,' ' ,1 8l A
C g3 I C - L V - al - R S - - -
,i ,l_
t - C - P _
,' il d
C P '
,i
;l 1 t._
Z _ L _
~
- z
- _. ~
;l! I - _'- ~
3 2 5 ll . P 4l ' , s F t I e 9 l li l - 2 r a r u e m li. l ll le , ,i i , l * ' cs P F
,l ll I1!lii t
3!!j! l 8 A 8 A A A 8 A A B A A B A 8 A A A 8 A A B A A A A B A A T m. 4 5 3 6 l 4 5 2 3 7 3 7 1 2 2 4 5 3 6 I 4 5 3 3 T 3 T 1 2 2 3 T 3 l 2 4 D C - . - C - C - C - - - - - - M - - - - M C - - - C - C - C - - - - - - - N - - - M - - - n - - - - M M E F F F E F F F E F F F F F F C F F F F C E F F F E F E F E F F F F F F F C F F F C F F F cF F F F C . 2 3 4 5 6 T a 9 0 8 2 3 4 5 6 T 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 l 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 4 4 5 5 5 . 2 2 1 1 1 6 1 4 1 I 1 1 i n O II ,a ii C I Ii i Bi i il ii
- S L
i ii ii ii I6 ll ii V R E b ' ' Bi 2 C P il I3l s lr ii d I C P il il ei 1 '! ! C - P - R P F _ F _ u S TH S E
~
s _ H _ H _ i D S H F l li:l . If;iitI l
. ] ; 1 5\ It
(' S S S S S S S S S S S S E E E E S S S E S S S E E e E E E G G G G E E E G E E E G G c
- C C C A A A A C C C A C C C A A ^
C C 2 C 2 M 2 M 2 M 1 M 1 l 1 1 C C 2 C 2 M 2 2 1 C C 2 C 2 M 2 M 2 " U U L U L A L A L A 1 A 1 i E E U U L U L A L L E U U L U L A L A L ^ S S S S S D S D S D S D S S S S S S S S S D S S S S S S S S D S D S a 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 s 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 s M II ii 1i Ii :1 ii I ,I ,i ,i ,1 ii ,I r 3 H 4 U 3 3 0 _ I E 4 C 1 3 0 3 C l 0 3 0 1 C 8 R B S S m14 \ n1, i ll<(I l
i.- inssaassissessas - BARR?700;'0?4?O8G $ [ k100 gba E8E8 BhEE Imad60Esm Ess, l i i SI APERTURE CARD Also Available On Apertrire Card I I 2g il Ii l 9 0997oo4/-ol l N 2
e _. l 03 C3 E I U Icav R C1 US i I SI APERTURE CARD Also Available On Aperture Card h, rmse 2.4.u-1 amontsT2 VAIE EVDC "E . ~ ~ ~
~ - _ _ _ _ .
h"" I L*7U'+ I H3 IC M 1 SUCCESS 2 SUCCESS i 3 TL2 4 SUCCESS I 5 TL2 6 SUCCESS i 7 TL2 8 SUCCESS i 9 TL2 10 DAMAGE 11 DAMAGE I 12 TL2 13 DAMAGE i 14 TL2 15 DAMAGE i 16 TL2 17 DAMAGE i i 18 TL2 19 DAMAGE 1 20 Til 21 DAMAGE i 22 Til 23 DAMAGE i 24 TIl 25 DAMAGE i 26 Til 27 TE1 28 TE1 29 TE1 30 TE1 ] 31 ATWS-1 ICW INhDNCINT CHNING W & 8/RV a Rr uno IncCIxas ARI j C1 FW CRPA123 ICOT TRIP 15 MP2 AC 00GSTIE j C3 CP ACTICH F3 IEVEL C3 FW 3GIINERED E 1 IJCI CR 1CS RMP AND IPP IDCIC I 2 ERV'8 MMCAL OPDI U4 REST. CF AC BY 0088 CDINDRICH ID RESIWATICH CF MhIN CDO. IC IC AMD IC MM3UP(MhlCh14
- l M SDC AMD AIE. EDC 9909mooH-OL -_----%___ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ __________ _ _ _ _ _
;. ,.~
1 i E j VAC R C3 s ) FIGURE 2.4.15-1 IJDSS OF VIIAL AC AMENDMENT 2 s .e e WM
~ ~ ~ - - - - - - - - - - , _ _ _ _ _ _ _ _ _
U4 H3 M 1 SUCCESS 2 SUCCESS _ 3 TL2 4 SUCCESS 5 TL2 6 DAMAGE
~
7 Til 8 DAMAGE 9 TIl 10 TEI 11 TE1 12 DAMAGE 13 TL2 14 DAMAGE 15 TL2 16 TE1 17 TE1 T7 LDSS OF 120V VITAL AC '
- R RP AUID INCWDE:S ARI C3 Mi RECOVERED E 1 LPCI OR 1CS IUfP AND IPP IOGIC I 2 SRV'S HAIRIAL OPDT U4 REST. OF AC BY CROSS CatMECTIQi H3 RtswRATIQi OF HAIN CDND.
M SDC AND AIF. SDC SI APERTURL 4 CARD m:R EVDir M Also Avaitable Or Apertrrre Can' 9909T70000S -
E G / N K O DE - - A
- T 0 U H 0 0 4 P 6 3 1
GPL 4 EO/ CO W 0 N. E H R D N ( B C S 1 B G 4 6 5 T 0 AO 3 C 0 Q T N C C 0 CS 0 1 1 T 4 7 O 1 T O i 1 4 6 2 6 EC N 0 4 5 R/ T 0 C 24 0 0 0 0 G ) 0 0 3 .Y T R E E O E B L - 0 0 U 0 8 4 S 2 DT CE S( C EOEM OGAR t NE U/SO t RT 4 SER C) T H N T RG E G DAAE CR 3 3 0 I F 0 0 1 RT N T OC RY [0 0 0 EB NI EN 4 2 0 0 0 0 E 7 O NFG A/ I I T6 RE A T
- L O S R 0
2 ST G E T OE M A N E RRE R H T UR G H MA E O 0-G 1 T T N 6 5 G 0
. E 0 , AOC F 0 4 0 1 FRY I 6 5 0 0 9 2 8 T 3 9 2 7 0 0 EFC 0 0 1 0 1 RA/ 0 0 0 E I T E E
- L - -
0 S 0 0 3 6 3 Iy MFCE AOEM I RNE N ER H T T RG H G EEAE D 1 1 I 0 NST N 7 9 G 0
. . M 0 AT OC E 2 8 0 0 N RY I
8 5 0 9 7 8 2 CO 0 3 2 4 0 0 0 0 0 2 19x ER0 C/ - 0 0 0 0 1 1 E E 0 I E E 0 0 S 0 0 7 4 AASF 4 2 FCII I MG E' PPU RCLR HIE AE F ; RI3E. H D L. CD2 NH F2 5 4 3 0
.M 1 G 0 0
0 2 8 PWA- 4 1 0 0 1
. D2 0 0 2 E E NU2 t
F - - 0 0 6 3 1M 4! EE D( AR N 5
/ F GAL Dt SLY I
1I T S 4 I 0 A RC FES 0 1 T /
) I 1
O A N F D k<
- i
.l K 4
- . N - 9
. C. S
. H. I
. O. M
. U. P BFN PL1 AL . S. 1 UEO OO4 CO . E. /
SE WSE S . 1 ES PS . P I 1 DE M R OOWO FO . R.
. O.
/
8 . 0/ 0 4 FE CRR OG MEN [0/ 0 0 ( FLEF L NNO LR E I
. P.
. R.
. I .
8 h10N T1 N POWOM . E. .
) RI NE . T
. 4C *
. A 1 Y MN R 6 . R.
0A A L G BU G. . Y. VC AS . .
. a .
I 4L A1 PN 4 1 O 4 OO C6C L EW 0A O EE OVL S&RM R 0 [. S 1 OR E 0 BF O4 NC 0
; 3 4 SU UA I 0
2 FF BN E
, EEL N AUC ST S \. OFSY RT E O MESA N AR C L
4L PL1 AL 1 O OO4 CO 6C WSF S 0A ES PS VL R FO OOWO _ G BF UA SU [0/ 0 0 ( FLEF L NNO LR EI 4 1 T 4S F L O N3\ POWOM
) RI NE MN AGBO.
L U R N AS SCEN OENO UNE RERA CRCC EAE T NP 0 OCO RYW I m0/ 0 5\ ( DI
/ EF CSR DR E
) EO LM G
44NbbM Q5Q
- $ ' pi$ O: 2 4&ts 0 t o @ Yt o
i) i
< l, l
9 . . . . . s - !
.. W , % ' !
I 1 s
- .L l I
+ !
I ~ iI
- ._ i t -i 1
* '(
'i i
^@'
~ ..
' ?
4' ! Mj i l
+l APR StBitn F Atk8 ' 'y se asPasseWitt l
REAtidR #E00EL q l'
.I i
\ i
\
.I j
4 . APA FAILS f 6 50lOWI CAMAE FalLept of WR
',j )
DEPGt90tStIt ' eEAsien ute8EL tALets escasssWi f6---'rt' i .I en Avisiossets . aracram i
'artnaat ta
,l i
;/
i
~**
(ht- . . . . 4.4000t-04 '
. G, 1
s.itant or -l
.a ..- 4 1 _
** H I an Ptow famoveu 8 OF8 IAL95 . .T ,
nc ekov sanoven APG WEWE
- 4*fN-36
;.gqs.3a
.I !
i
.l p' **"J 2 j he air FL8W FanLURE OF APG $
Weft late-3C U ( 41 As8868W fMRBd5M $36 tens P -f a a64UPL Test lefG 3A O' .APft
'TWOUGH BOL8s069 testeek IALys f6 CPEN ik fesf#6L UA6ft ~ to arts 363-3C 6
303-3A l. i l
\' . j
/
'\
/
(2) a-Q .-0, L,i - l ,
, ,, .Ax , s me-sJ l j
a .. ...iar a
%.68 AJ8 99 -..-.
ar,54 er et psuTt 6 97 DC P0Y # A.&Up1 GF f AnLUPt er ) ec enesamt steal 70 i Souest le ina-3F
< 4 gung es" ~ l . Aagung ca * "6 7 fn 'NSI l 4 Sou#CC f0 dod-3c 932/307
- n est 05t#ts**iesc 30J-3C Cest Soli j a* f.wpCL J/teF .se9A 2 curt ( 10 dca 34 CONIACfl 3 Ap0 9 feetAC18 9 Ad6 F }
5168E 84 S32/19'-4P14 5 Colt 10 REH4tN $409t3 - ' d8134 80it eser4cN 7 AND 9 ) 9' CC ell ACt1 t Ahts f Gest 80 REluit $601ED
'S etnAlt C&05tB l fC #t' ult (4 9ff P !
I t
% i
* % f* \.
[ 003A I 3034
/9734 g\ d
" '\
/ pied i
\/
{ 00s F
\ d 00de s ( 0833 b
fPPros a I effenoil h t da DCGCW j h De604&3e P F*r-9 Pf o 9eL14 3. ten 9t-a ,
#fP9tC*4 J. son,ot es ...
trea 3 gennt-94 9 90194-04 . . . ... .. r;-
....... ..0...
( sj I AMENDHENT 2
~f ,
i I 1
**% ==pa . ..
3
l
.)
i l 4 i
- b
.6 i
I
~
. l l
I e l
. . . . . . . . - - - . . - ]
.0 ,6 i=0 l
,,,,,,,,, AP SALTC -]
pg - l-fG-3D I
-a . ,
T . cm ~Q j
, _ F AILUltE 0, AP.._ ;
8 FLOW 5.0 Gd 48. ,40W FOl&WPC.., AP. t,.ALet I-nE 30 Opfs
.ett.0 69 C,ost.SH ct takst SS.C3019 i getf( f.atut 0 SPtst nG=3F 03 30 l
""" J l
'I
.0;$
#'8 OS:t 11 14e6J3 9,<taneJ1 3 1888I*83 J
- 3. ngcat.03 . 4,00E.04 9 0se9f-06 I
I I
. . . , .l . . - .m.,.,., -
. m . .,
..,..... m..~.td..<.
n.m .. .ma.
. . , . . , . , 0....
. . . . . .... ., . . ,..... ..m ;
q s ,
- g ...
.,], .1
...) A, DCPter 2%
ptFF0023 gg3 pt.os&3D .cvp0044 9CP90C J1 pg 3 800et-64 ... 3.. Secci-ce 3. 3000t.
... 05
. - - . . 9e
. 9.tecet .. ...
SI
' APERTURE
**=****
CARD M M MEE. REL PhII13tE W A.D.S. Also Available On Aperture Card 0% OOVI-oS I
.n ,_n,..-. , , . - v , - - ~ ~ - -.---,- - - - - - - - - - - , - - - - - - - -
- - ~ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
.. 4-
'I % [.- M . '
i'
I
( -. I i I E E0fu,Is l
, s.. rosita sissa -
.)
i l
'i y
SAGA
/I '
j kn S18hAL ltelu ] N6 SIGRAL .89U 032/188-804A M g 012/187M01P 932/987 9 00et AC5, 1644 l- C.33/90P*le00 f AS,8 ,, 'l l 6 I
\ . j e1 03 l k-J -
I f 6 I kc 'isnAL ,~espif~ ' me tise a. ,seg me s:s=A. sev ! 03Jf10 A-6PM 932/f87+IPSA 332/2GFN#40 i i
/~.
k-d.,, . p-d p ,,0 L i maan em ee - eswomen ALLUP.E 9F f ALLWL Of 4 AILUPE OF I A1LWC Of ( AILUpt SF OLOLI Shif Gle P &tLWE Cf 033/ TSP *66 933/IS P* a lta ' 032/n43 903#207-303 B32/,18 oh ACf'*81.F se ja 932/,90,'*4fl A 113/,18'-teJS : t,eh1 AC,9 . . AC0h, f0Rf AC,9 9.9
.s C,8 SE AL IN - 0 SEAL 68 3
10 CLDAC,.8 C 48 C,ON AL 83.4 0 CLOSE C.ek 844 0 iO9( AC,0. 064FALL ,0 #EflAlt C, AN 4 39 8. F ' l
, en n 0 Std le
.. i l
. g/
ee <% s01 s) / u?e% ae?e /
,_. . , . . . _ , . ,WA.,.. A .. ,. ..,...
3.970et+03 E . 9600t +03 f.Stretata 3 970et=93 3 9Peet 0 0000t*0d ' 4.es00t-04 4. MOP 4 ate 4 teestans e. geese te 4.geset*ep - 8 81898-97
$.treet]
d.Seest% i Of ' F f.A,m& URL. , .P, F..1 f A;&,W9 f e,,iL,WT... ,0 ~f alL,W( F.A. ;L.ub.t..C.F ,4 0181.,.1.,gse 0m . '~ I A,,SL,IF.E,.O.F I,A,,IL,US(
,.G, F .0 I,A,,BL,U0.C
.m. . . . ., A . ,,,
.e.m,-, S.F.... .
., . ..... .,..0...,
. .m.......A. .. .. . . . . . .. ..... . . 0 ..e...
- i. - -l ...,.,.... 0 .LO. .
,0 ~ .. o 0 , , . . . . . . l...A.I . .
. . - .0
. . - it i.
i t es 04,. j i I ( [ f '*fus te P' Pace te PC*Aas e3 P. pan M pCPf 0644 96d00099 DCPresF0 HPFC h 46 . $CPA0lte J. eFnc4.g3 3 tierg.r3 3 07 pot.e3 3 37 set-eJ 3.Broct.a3 g gocet.34 - 3 97008-93 8 0700E-63 4 9700t 4.4=rng .64 - a.Jecer.e4 c . 3000E -06 4. MOP ( 66 4 9868F*08 4 5tD4f-07 e.Senet+es e.seoet-et e.estatg 9 - i AMENDMENT 2 i j 4 i v(( . 1 4
%w,
~.
.t!
4 w . I u m,s s,.cu,....s.eev 0021 I fm
.ttL,WC,
.. ..e.r . ~' #.41 ., L WE..e. r.) .. F A.IL,WE..D.., .. F A..I,LWL,.O.F RESC test A&f 6 8.8 COkl AC'S 3.4 l . ,4 . m,.I.S..WimtCM w == n CON.IA.CIS
- i. 3.F v. neu ; C.otf i a= A.Cf 3 S.6 408t Ag AC.TSum 3.19 ,
003 803 00J4 ' MJ5 f tPDaa 49 OCPAo.37 PCPA04 4$ , 9CP40183 95A0440 4 0Fent-83 8 9700E 63 8.91448 03 , 9.SFest 4N 9 rAlet-04 i d.seest-Se 4.gsant.M 4. Meat-M . 4. Meet-M 8 8100t=07 e f I l FL1LWS 1.7 _ BESET SellCM 322/ 6 P*lets f334 alL,WE OF te7-It00 303rtgr-Sc3 testACTS 3.4 teafecf8 3.F " I FAlt Scat A&f t 13.84 ' 50 8',891 le Chen IO artAls
- d ) LEM
...w 8 N >
PCP40t&4 PCPA0af t flA0647 S.0P30t*C$ t .9700E-83 0 9n00E 64
- 4.Oscrt*84 4.9898E =M S 8800t+87 FEREE 3.3.33-32 N EMR2 M MIEte RR FATIZEE OF A.D.s. cInsus,3 cage gryg ggg g
,sume mmzZama SI APERTURE !
CARD ; 1 Also Available On Aperture Card
%909970o4 -O
.l OVERSIZE DOCUMENT PAGE PULLED SEE APERTURE CARDS NUMBER OF OVERSIZE PAGES FILMED ON APERTURE CARDS APERTURE CARD /HARD COPY AVAILABLE FROM DECORDS AND REPORTS MANAGEMENT BRANCH i
m.u- c zu - ~m - m _ -
- - - - - - - ~ - - -
' s / ..
f: l' k F P. SP Eb P SZ1' $Z: LZ3 PC PCI l ,. I i , i i I a _. _ J . 1 l l
- l. !
l l ' i i - i t I 1 l l- l i I, i _ l
, ! ! I I l
l i
}
i j . I e i, i . L , i - 1
. l i
l i SI C ^""""' ' APERTURE CARD j Also Available On Aperture Card
-~ _
I N !' i l [SRV LS CA IC SZ4 GA1 , gg l 2 F-5A 3 EC - d F-6 w- 5 NT -- 6 F-2P i 7 F-2D
. 3 MD l ,
__ 9 F-2P I 10 F-'110 11 F-3A i 12 F-7 , I 13 F-3A +- i 14 CM 15 F-/ _ 16 F-2P I 17 F-lp
-- --- 18 CM
. _ . - 13 F-5A
. _ 20 EC e 21 F-S 22 NT
-- 23 F-2P
. _ 21 F '.'P
' 5 M:
26 F-2P I 2/ F-:D 28 F-3A I 23 F-7 30 F-3A I 31 CM 32 F-/ 33 F-2P
' 34 F-10 35 CM FI:23tB 6.1.1-2 CDfIKL 3CCM 04n 9/N7AD4-/ - /O ___ i
~ '
I I l l
),
l J I r L I i i [ i SI APERTURE CARD
4 Also Available On Aperture Card gory, TNT 2
* ~ s%
SRV: LS-I LIC' 10A1 .1, MD ' ~ -
. L 2' ' E C .
3 F-4B. ] 4 F.-5A' l l
-5 F-3B. !
6 EC 7 F-6 .] 8 EC
! 9 F-1A.
10 EC
.!- 11 F-4A 12 F-5A 13 F-2B 14 F-3A
,! 15 F
I 16 F-3A i 17 CM l 18 F-7 ,
.j 19 F-1B j 20 F-2A ;
i. i .21 F-2A ;q 22 CM 23 EC < j
~24 F-48 l 25.F-5A , .i 26 F-3B 1 27 EC l 28 F-6 1 4
29 EC ' I i . 30 F-1A' 31 EC
! 32 F-4A ', .
33 F-5A 34 F-38 35 F-3A .
! 36 F-7 37 F.-3A 1 38 F-7 39 CM )
40 F-18 41 F-2A i l' 42 F-2A 43 CM 44 F-3A
! 45 F-7 46 F-3A I
I 47 CM 48 F-7 49 F-18 50 F-2A i 51 F-4A 52 CM $90927004/-Il
- . FMM 6.L3-1
_. _ __ I_________.____.._________._____.__._.____________1&. 9}}