Text

Draft LER No. 247/99-015, Accident Sequence Precursor Analysis for IP3 LOSP Event on 08/31/99 with Handwritten Marginal Comments by S. Long, NRR
	ML020850146
Person / Time
Site:	Indian Point
Issue date:	02/26/2002
From:	; Office of Nuclear Reactor Regulation
To:	;
References
	FOIA/PA-2001-0256
	Download: ML020850146 (27)
	v • d • e

LER No. 247/99-015 LER No. 247/99-015 Event

Description:

Loss of offsite power to safety-related buses following a reactor trip and tripping of an EDG ou ut breaker Date of Event:

August 31, 1999 Plant:

Indian Point No. 2 Event Summary On August 31, 1999, while the licensee was replacing a defective bi-stable in a pressurizer low pressure instrument channel, the reactor tripped (Refs. 1,2). After the reactor trip, the station blackout logic matrix generated a blackout signal as a result of a sustained under-voltage condition at the safety-related 480-V buses. The station blackout signal stripped the 480-V buses and reloaded them onto the emergency diesel generators (EDGs). The EDG output breaker to the 480-V bus 6A tripped within 14 seconds after closing due to an over-current condition on the bus.

The conditional core damage probability (CCDP) for this event is 6.4x 10-. Core damage sequences where the all safety-related batteries deplete, and reactor coolant pump (RCP) seals fail are the dominant contributors to the CCDP.

Event Description On August 31, 1999, while the licensee was replacing a defective bi-stable in a pressurizer low pressure instrument channel, a spurious electrical spike occurred in an overtemperature delta-temperature (OTDT) channel. In order to support replacing of the defective bi-stable in the pressurizer low pressure channel, the operators had already set a different OTDT channel to tripped condition. The spurious electrical spike in one OTDT channel, together with the tripped condition of the second OTDT channel satisfied the logic required to trip the reactor and caused a reactor trip.

After the reactor tripped, the main generator tripped and the generator output breakers opened as designed. (See Figure 1 for details of the electrical distribution system.) The 6.9-kV service buses fast transferred to the external 138-kV supply via the station auxiliary transformer (SlAUX). During the fast transfer, while power was supplied via STAUX, an under-voltage (voltage dropping below the degraded voltage set point of 421-V +/- 6V) condition was detected on all safety-related 480-V buses.

When the voltage degraded, if the Tap changer of STAUX was operating in its automatic mode, it would have moved automatically to restore the voltage within one minute. Howeveg due to a defective voltage control relay, the Tap changer was in manual mode. As a result, the under-voltage condition sustained over a period which exceeds its allowable value (180 sec +/- 30 seconds). Consequently, the station blackout logic matrix generated a blackout signal. The station blackout signal stripped the 480-V buses and reloaded them onto the emergency diesel generators (EDGs).

1 X:

LER No. 247199-015 Bus 6A loaded onto its EDG (EDG 23). Eight seconds after starting EDG 23, the output breaker from the EDG to bus 6A closed. Approximately 14 seconds later, the breaker tripped to its open position due to an over-current condition. Consequently, Bus 6A lost power from both the EDG and offsite power supply.

The other 480-V buses were energized by their respective EDGs.

The blackout logic did not allow the transfer of safety-related 480-V buses 2A, 3A, 5A, and 6A back to their 6.9-kV buses until the blackout logic signal was reset. Wth Bus 6A de-energized, the under-voltage interlock prevented the reset of the blackout logic. Consequently Bus 6A remained de-energized.

Battery Charger 24 is powered from Bus 6A. After approximately 7.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Instrument Bus 24 was lost when the voltage on DC Bus 24 became low. Offsite power was restored to the 480-V Bus 5A approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months following event initiation.

Additional Event Related Information Loss of 480-V Bus 6A and consequences During this event, the reactor trip was followed by a loss of offsite power to 480-V buses. Due to tripping of the output breaker of EDG 23, emergency onsite power from EDG 23 was unavailable to 480 V Bus 6A. That is, both offsite and onsite power was unavailable to Bus 6A. De-energization of Bus 6A caused the unavailability of power to following risk-important equipment:

0 Motor-driven auxiliary feedwater pump P-23; a

High-pressure safety injection pump P-23; Charging pump P-23; Sump recirculating pump P-22; Residual heat removal pump P-22; 0

Block valve for one of the two pressurizer power-operated relief valve; and 0

Battery charger 24.

Even though power was unavailable to loads powered from Bus 6A, offsite power was available to non safet-related loads powered from the 6.9 kV buses. Further, buses 2A, and 3A were powered from EDG

22. Bus 5A was powered from EDG 21.

Loss of DC bus 24 and consequences DC Bus 24 is fed from two power sources. One of these sources is Battery Charger 24, which is powered from Bus 6A. When power supply to Bus 6A failed, there was no power supply to Battery Charger 24.

The second power supply to the DC Bus 24 is Battery 24. This battery is designed to supply its shutdown loads for a period of two hours following a plant trip and loss of all AC power However, during this event, the battery supported the DC loads for approximately 7.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months without any power to the battery charger. During that period of time, power was not restored to Battery Charger 24. As a result, Battery 24 continued to drain and the DC Bus 24 voltage continued to drop. Instrument Bus 24 was lost when the voltage on the DC Bus 24 became too low for Inverter 24 to provide AC power to the instrument bus.

When the Instrument Bus 24 lost power, the auxiliary feedwater (AFW) flow control to the Steam Generator 24 lost power. As a result, the flow control valve assumed its fully open position. In 2

LER No. 247/99-015 response, the operators secured the AFW Pump 22 (the turbine-driven AFW pump). Water levels in steam generators were maintained by starting and stopping the turbine-driven AFW pump three times (in lieu of running the pump continuously while taking local-manual control of the flow control valves).

Potential for steam generator tube rupture The event analyzed in this report occurred on August 31, 1999. On February 15'" of 2000, (i.e.,

approximately six months later) a steam generator tube leak occurred at Indian Point 2 (LER 247-00 001). Therefore, a degraded steam generator tube existed when the reactor tripped and offsite power was lost on August 31 of 1999.

Modeling Details and Key Assumptions Several changes were made to the Revision 2QA of the SPAR model (Ref. 3) in order incorporate the increased risk significance due to loss of Bus 6A. Other changes were made to incorporate reduction in the risk since power was available to balance-of-plant loads on 6.9-kV buses. Additional changes were made to incorporate sequence specific non-recovery factors appropriate for this event. Table B.X. 1 summarizes changes made to the SPAR model. The discussion below provide the basis for significant changes:

Loss of offsite power - The loss of offsite power initiator was chosen'.

Probability offailing mainfeedwater (AMFW) - During this event, MFW and the main condenser which are powered from the 6.9-kV buses remained available to remove decay heat (Ref. 2). The SPAR model was modified to credit MFW2.

Probability offailing the turbine-driven AFW pump - The failure probability of the turbine-driven AFW train to start and run (basic event AFW-TDP-FC-22) is changed from 0.033 to 0.093

{ = 0.003 (fail to run) + 3x0.03 (fail to start)}. Since the operators cycled the turbine-driven AFW pump three times in order to compensate for the failed-open flow control valve, the failure probability of the turbine-driven feedwater pump includes probability of failure in three start attempts.

Probability offailing feed-and-bleed cooling - Indian Point 2 operates with both block valves to the pressurizer PORVs in closed position (basic events PPR-MOV-FC-BLK1 and PPR-MOV FC-BLK2). Indian Point-2 has two PORVs and it requires both of them to feed-and-bleed. With the power supply via 480 Bus 6A unavailable, that block valve cannot be opened to bleed the 1

Even though the loss of power to Bus 6A did not fail due to extreme severe weather, in order examine and adjust probabilities of offsite non-recovery probabilities by individual sequences, the extremely severe weather loss of offsite power category in the SPAR model was used in the analysis.

2 MFW was credited by creating an external tranfer to the MFW fault tree from the AFW fault tree used for loss of offsite power analysis.

3

LER No. 247/99-015

.RCS in support of feed-and-bleed cooling. Therefore, the probability of failure of the feed-and bleed cooling function is 1.0.

Probability offailing to recover tripped output breaker of EDG 23 - During this event, the power on Bus 6A failed because the EDG 23 output breaker tripped on over-current. The operators did not attempt to re-close the breaker since the other two EDGs functioned properly If the other two EDGs failed, the operators would attempt to recover Bus 6A by closing the EDG output breaker. The fault tree for EDG 23 was modified by adding a new basic event, EPS-DGN-FC 23-OB, to model the capability to re-close the output breaker The probability of failing to re close the output breaker of EDG 23 after it trips open (basic event EPS-DGN-FC-23-OB) is 0.11. Section 1 of Attachment 1 provides additional details of the calculation.

Probability of EDG failures - For this event, the probability of EDGs failures is 0.07. For the three EDGs, common-cause failure (CCF) probability is 7.7x 10'. References 4 and 5 provides the basis for these probabilities.

Probability offailing to recover offsite power to 480-V buses from 6.9-kV buses - During this event, the power on bus 6A failed because the EDG 23 output breaker tripped on over-current.

AC power was available in the switchyard. The operators did not rush to bypass the interlock and re-close the breakers from the switchyard (6.9-kV) buses to safety-related 480-V buses (2A, 3A, 5A, and 6A) since two of the three EDGs functioned properly If EDG 21 and 21 failed, operators would have attempted to recover power to the 480-V buses from the 6.9-kV buses.

Two types of parameters involving recovery of offsite power via the 6.9-kV buses were modified to reflect the actual condition: basic events probabilities in fault trees and sequence-specific non recovery probabilities in event trees. The SPAR model includes in the model offsite power recovery times of 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and prior to core uncovery from reactor coolant pump seal LOCA (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) and battery depletion (7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months for Indian Point 2). The probabilities for failure to recover offsite power to the 480-V safety-related buses (via the 6.9-kV buses) are 0.51 (when time available for recovery is within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) and 0.06 (when time available for recovery is greater than or equal to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ). These non-recovery probabilities are based on human reliability analysis methods used in the ASP Program. Section 2 of Attachment 1 provides additional details for these calculations.

Changes to basic events failure probabilities (OEP-XHE-NOREC-2H, OEP-XHE-NOREC-6H, OEP-XHE-NOREC-BD, OEP-XHE-NOREC-SL, and OEP-XHE-NOREC-ST) and sequence specific non-recovery probabilities are summarized in Tables B.X.1 and B.X.2, respectively. The probabilities of failing to recover the 480-V buses from the 6.9-kV buses are 0.51 (when time available for recovery is less than fours) and 0.06 (when time available for recovery is greater than or equal to four hours). Table B.X.2 gives the nominal failure probabilities and the performance shaping factors (PSFs) used in the analysis. Section 2 of Attachment I provides additional details.

Probability offailure to recover offsite power by starting and aligning gas turbines - Throughout the event, the 6.9-kV buses were powered from the offsite power supply. The capability to 4

LER No. 247199-015 supply power to the 6.9-kV buses from gas turbines (basic events OEP-XHE-XM-GTSL, OEP XHE-XM-GTST, OEP-XHE-XM-GT2, OEP-XHE-XM-GT6, OEP-XHE-XM-GTBD) do not provide an additional benefit. Therefore, recovery actions associated with the gas turbines are not credited in the analysis.

Probability offailing RCP seals when seal cooling is lost - Based on the Rhodes model (Ref. 4),

the probability of failing the seals for RCPs with improved Westinghouse seal assemblies (basic event RCP-MDP-LK-SEALS) is 0.22.

Probability of opening PORVs/SRVs during transient - Power to balance-of-plant systems used for condenser heat removal was available throughout the event. Therefore, the probability of challenges to the pressurizer PORVs and SRVs is less than that expected during a typical loss of offsite power or station blackout event where secondary system is lost. The probability that pressurizer safety valves open (PPR-SRV-CO-L, PPR-SRV-CO-SBO) was reduced to 0.04-the valve used in the SPAR model for general transients.

Non-recovery probabilities for individual sequences - Table B.X.1 shows the sequence specific non-recovery probabilities. Table B.X.3 provide the basis for those probabilities.

Analysis Results The conditional core damage probability (CCDP) for this event is 6.4x 10'. Tables B.X.4 and B.X.5 gives details on the dominant sequences. CCDP is dominated by sequences in which all EDGs failed and power could not be restored to the emergency buses before battery depletion (Sequence Nos. 18-02, 48.4% of CCDP), RCP seal failure (Sequence No. 18-08, 23.4% of CCDP). A third dominant sequence involved loss of auxiliary feedwater (Sequence No. 17, 17.2% of CCDP). The impact of the degraded steam generator tube in Steam Generator 24 on CCDP is negligible. The basis for this conclusion is included in Section 3 of Attachment 1.

Figures 2 and 3 shows the event trees with dominant sequences highlighted.

Acronyms AC alternating current AFW auxiliary feedwater CCDP conditional core damage probability CCF common-cause failure DC direct current EDG emergency diesel generator LOCA loss of coolant accident LOOP loss of offsite power MFW main feedwater OTDT over-temperature delta-temperature PORV power-operated relief valve 5

LER No. 247/99-015 RCP reactor coolant pump SBO station blackout SRV safety relief valve STAUX station auxiliary transformer References

1.

LER 247/99-015, "Reactor Trip, ESF Actuation, Entry into TS 3.0.1, and Notification of Unusual Event," August 31, 1999.

2.

U.S. Nuclear Regulatory Commission, "NRC Augmented Inspection Team - Reactor Trip with Complications," Report No. 50-247/99-08, October 19, 1999.

3.

Idaho National Engineering and Environmental Laboratory, Simplified Plant Analysis Risk Model for Indian Point Unit 2, Revision 2QA, April 1998.

4.

R.G. Neve and H.W. Heiselmann, "Cost/Benefit Analysis for Generic Issue 23: Reactor Coolant Pump Seal Failure," NIUREG/CR-5167, April 1991.

5.

G. M. Grant, et al., "Reliability Study: Emergency Diesel Generator Power System, 1987-1993,"

NUREG/CR-5500, Vol. 5, September 1999.

6.

F.M. Marshall, D.M. Rasmusson, and A. Mosleh, "Common-Cause Failure Parameter Estimations," NUREG/CR-5497, October 1998.

7.

Personal communication between Sunil Weerakkody (U.S. NRC, Office of Nuclear Regulatory Research), James Trapp (U.S., NRC, RGN-I) and Licensee (Tony Reese, Phil Griffith), Nov. 20, 2000.

6

LER No. 247/99-015 Table B.X.I: Definitions and Probabilities for Selected Basic Events for LER No. 247/99-015 Modified Event Base Current for this name Description probability probability Type event IE-LOOP Initiating Event-LOOP 3.1 E-005 1.0 Yes IE-SGTR Initiating Event-Steam 1.6 E-006 0.0 E+000 Yes Generator Tube Rupture IE-SLOCA Initiating Event-Small Loss-2.3 E-006 0.0 E+000 Yes of-Coolant Accident (SLOCA)

IE-TRANS Initiating Event-Transients 2.7 E-004 0.0 E+000 Yes AFW-TDP-FC-22 AFW turbine-driven pump 22 3.3E-002 9.3E-002 Yes fails EPS-DGN-CF-ALL Common-cause failure of 8.5E-004 7.7E-004 Yes' diesels EPS-DGN-FC-21 Diesel generator 21 fails 3.3E-002 7.0E-002 Yes' EPS-DGN-DC-22 Diesel generator 22 fails 3.3E-002 7.OE-002 Yes' EPS-DGN-FC-23 Diesel generator 23 fails 3.3E-002 7.OE-002 Yes" EPS-DGN-FC-23-OB Operator fail to close output 0.11 New breaker of EDG 23 LOOP-05-NREC LOOP Sequence 5 non-1.0 3.OE-002 Yes2 recovery LOOP-09-NREC LOOP Sequence 9 non-1.0 5.9E-002 Yes2 recovery LOOP-17-NREC LOOP Sequence 17 non-

.22 9.OE-002 Yes' recovery LOOP-18-02-NREC LOOP Sequence 18-02 non-0.8 0.3 Yes2 recovery LOOP-18-05-NREC LOOP Sequence 18-05 non-0.8 3.OE-002 Yes2 recovery LOOP-18-07-NREC LOOP Sequence 18-07 non-0.8 3.OE-002 Yes' recovery LOOP-18-08-NREC LOOP Sequence 18-08 non-0.67 3.0E-002 Yes2 recovery LOOP-18-11 -NREC LOOP Sequence 18-11 non-0.8 0.3 Yes' recovery 7

LER No. 247199-015 LOOP-18-14-NREC LOOP Sequence 18-14 non-0.8 3.OE-002 Yes2 recovery LOOP-18-17-NREC LOOP Sequence 18-17 non-0.67 3.OE-002 Yes recovery LOOP-18-20-NREC LOOP Sequence 18-20 non-0.8 0.7 Yes recovery LOOP-18-22-NREC LOOP Sequence 18-22 non-0.27 0.18 Yes recovery OEP-XHE-NOREC-Operator fails to recover offsite 3.2E-002 0.51 Yes 2H power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OEP-XHE-NOREC-Operator fails to recover offsite 1.4E-002 0.06 Yes 6H power within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OEP-XHE-NOREC-Operator fails to recover offsite 8.6E-004 6.OE-002 Yes BD power before battery depletion (within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months )

OEP-XHE-NOREC-Operator fails to recover offsite 0.66 0

False Yes SL power (seal LOCA) (within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months )

OEP-XHE-NOREC-Operator fails to recover offsite 0.17 0.51 Yes ST power in short-term (within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months )

OEP-XHE-XM-GTSL Operator fails to start and align 0.34 0

False Yes gas turbines during seal LOCA OEP-XHE-XM-GT2 Operator fails to start and align 0.34 Ignore Yes gas turbines in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OEP-XHE-XM-GT6 Operator fails to start and align 0.34 Ignore Yes gas turbines in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OEP-XHE-XM-Operator fails to start and align 0.34 Ignore Yes GTBD gas turbines before battery depletion OEP-XHE-XM-GTST Operator fails to start and align 0.34 Ignore Yes gas turbines in short-term PPR-MOV-FC-BLKI PORV block valve is in open True No position PPR-MOV-FC-BLK2 PORV block valve is in open True No position PPR-SRV-CO-L PORVs/SRVs open during 0.16 4.OE-002 Yes LOOP PPR-SRV-CO-SBO PORVs/SRVs open during 0.37 4.OE-002 Yes station blackout 8

LER No. 247/99-015 RCP-MDP-LK-RCP seals fail w/o seal cooling 3.4E-002 0.22 Yes SEALSII Note 1: Updated using data from Refs. 5 and 6. Time dependent EDG non-recovery probabilities are included in the sequence specific non-recovery probabilities. Refer to table B.x.2.

Note 2: Refer to table B.X.2.

9

LER No. 247199-015 Table B.X.2: Summary of human error probabilities Time Time PSF2 for PSF for PSF for PSF for HEP1 available required available stress procedu complexity (minutes)

(minutes) time level

-res of task Operator fails to close EDG output breaker when it trips due to over current basic event EPS-DGN-FC-23-OB Diagnostic

= 120 few 0.1 5

1 2

0.01 error minutes Manipulation

= 120 120 10 5

1 2

0.1 error Operator fails to clear SBO signal and close 6.9-kV/480-V breakers within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Diagnostic

= 120 few 0.1 5

1 2

0.01 minutes Action z 120

= 120 10 5

5 2

.5 Operator fails to clear SBO signal and close 6.9-kV/480-V breakers within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Diagnostic

=240 few 0.1 5

1 2

0.01 minutes Action

=240

= 180 1

5 5

2 0.05 Operator fails to clear SBO signal and close 6.9-kV/480-V breakers before battery depletion (7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months )

Diagnostic z450 few 0.1 5

1 2

0.01 minutes Action

=450 z 180 1

5 5

2 0.05 Operator fails to clear SBO signal and close 6.9-kV/480-V breakers before core uncovery following a seal LOCA (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months )

1.

The human error probability uses a base value of I x 10.2 for cognitive error and I x 10-' for the action failure probability.

Performance shaping factor 10

LER No. 247199-015 Table B.X.3: Basis for the probabilities of sequence recovery actions Seq. No. and Failed systems and Probability of Combine failure probability and basic event recovery time (Note 1) failing to remarks recover 5

EDGs (4hours) 0.5 (Note 2) 0.03 LOOP-05-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06 9

EDGs (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.5 0.059 (Event tree top event OP-2H LOOP-09-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06/0.51 includes offsite power non recovery within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months - basic event OEP-XHE-NOREC-2H.

Since injection was succesful, additional time is available to recover AC power) 17 EDG (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) 0.7 0.09 LOOP-17-NREC AFW 0.26 (Note 3)

Offsite power (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) 0.51 18-02 EDG (7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ) 0.3 0.3 (Top event OP-BD includes LOOP-18-02-NREC offsite power non-recovery prior to battery depletion - basic event OEP-XHE-NOREC-BD) 18-05 EDGs (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.5 0.03 LOOP-18-05-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06 18-08 EDGs (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.5 0.03 LOOP-18-08-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06 18-07 EDGs (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.5 0.03 LOOP-I 8-07-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06 18-11 EDG (7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ) 0.3 0.3 (Top event OP-BD includes LOOP-18-11-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) offsite power non-recovery prior to battery depletion - basic event OEP-XHE-NOREC-BD) 18-14 EDG (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.5 0.03 LOOP-18-14-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06 18-16 EDG (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.5 0.03 LOOP-18-16-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06 II

LER No. 247/99-015 Seq. No. and Failed systems and Probability of Combine failure probability and basic event recovery time (Note 1) failing to remarks recover 18-17 EDG (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.5 0.03 LOOP-18-17-NREC Offsite power (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 0.06 18-20 EDG (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) 0.7 0.7 (basic event OEP-XHE LOOP-18-20-NREC NOREC-ST credits offsite power recovery) 18-22 EDG (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) 0.7 0.18 (basic event OEP-XHE LOOP-18-22-NREC AFW 0.26 (Note 3)

NOREC-ST credits offsite power recovery)

Note 1: Recovery times used in the SPAR model are as follows: core uncovery due to loss of heat removal - 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ; core uncovery due to RCP seal LOCA - 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ; battery depletion - 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months (based on observed failure during event)

Note 2: Based on SPAR model, the median recovery time for EDGs is 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Even when multiple EDGs are failed, since operators would attempt to recover only one EDG, only one EDG is considered for recovery.

Note 3: From SPAR model 12

LER No. 247/99-015 Table B.X.4. Sequence Conditional Probabilities for LER No. 247/99-015 Conditional Event tree Sequence core damage Percent name number probability contribution (CCDP)

LOOP 18-02 3.IE-005 48.4 LOOP 18-08 1.5E-005 23.4 LOOP 17 1.IE-005 17.2 LOOP 09 1.7E-006 2.7 LOOP 18-20 1.6E-006 2.5 LOOP 18-22 1.6E-006 2.5 LOOP 18-11 1.3E-006 2.0 LOOP 10

, /

L 4

Total (all sequences) 6.7E-007 1.1 6.4E-005 13

'I Ye 5

LER No. 247199-015 Table B.X.5. Sequence Logic for Dominant Sequences for LER No. 247/99-015 Event tree name Sequence Logic number LOOP 18-02

/RT-L, EP, /AFW-L, /PORV-SBO,

/SEALLOCA, OP-BD LOOP 18-08

/RT-L, EP, /AFW-L, /PORV-SBO, SEALLOCA, /OP-SL, HPI LOOP 17

/RT-L, /EP, AFW-L, F&B-L LOOP 09

/RT-L, /EP, PORV-L, PRVL-RES, /HPI-L, OP-2H, HPR-L LOOP 18-20

/RT-L, EP, /AFW-L, PORV-SBO, /PRVL RES, /SEALLOCA, OP-BD LOOP 18-22

/RT-L, EP, AFW-L, ACP-ST LOOP 18-11

/RT-L, EP, /AFW-L, PORV-SBO,

/PRVL-RES, /SEALLOCA, OP-BD LOOP 10

/RT-L, /EP, /AFW-L, PORV-L, PRVL-RES, HPI-L 14

LER No. 247/99-015 Table B.X4. System Names for LER No. 247/99-015 System name Logic ACP-ST Offsite power recovery in short-term AFW-L No or Insufficient EFW Flow During a LOOP COOLDOWN Rcs Cooldown to RHR Pressure Using TBVs, Etc.

EP Emergency Power Fails F&B-L Failure to Provide Feed And Bleed Cooling - LOOP OP-BD Operator Fails to Recover Offsite Power Before Battery Depletion OP-SL Operator Fails to Offsite Power Before a Seal LOCA Occurs OP-2H Operator Fails to Recover Offsite Power Within 2 Hrs BPI No or Insufficient Flow from the HPI System HPI-L No or Insufficient Flow from HPI System - LOOP HPR No or Insufficient Flow from the HPR System HPR-L No or Insufficient Flow from HPR System - LOOP PORV-L PORVs/Safety Relief Valves Open During a LOOP PORV-SBO PORVs/SRVs Open During Station Blackout PRVL-RES PORVs and Block Valves and SRVs Fail to Reseat RT-L Reactor Fails to Trip During a LOOP RHR No or Insufficient Flow from the Rhr System SEALLOCA Reactor Coolant Pump Seals Fail During a LOOP 15

LER No. 247199-015 Section 1: Additional details on the probability of failing to close the output breaker of EDG 23 to emergency Bus 6A Recovery of Bus 6A by re-closing the EDG 23 output breaker entail the following tasks:

Recognize the need to re-close output breaker to bus 6A.

Close output breaker Recognize the need to re-close output breaker The operators will recognize that the EDG 23 output breaker tripped because of multiple alarms and annunciators. Compared to the time available for recovery (approximately 120 minutes), the time needed to recognize that EDG 23 is available and the output breaker must be closed is small. Therefore, the performance shaping factor (PSF) associated with available time is 0.1. Since all emergency 480-V buses have lost AC power, PSF level of stress is "extreme" (PSF factor is 5). In consideration of ambiguities on the part of the operators to close breakers to buses, the PSF factor for complexity is 2 (moderately complex) Therefore, the probability of cognitive error is 0.01 (= 5x 2 x 0.1 x 0.01).

Close output breaker During the event, when EDG 23 output breaker tripped, to find the cause of that failure the operators tagged out Bus 6A. Subsequently, if the operators decided to recover Bus 6A, they must clear the tag placed on bus. Based on discussions with the licensee (Ref. 7), this activity requires about two hours.

Since "available time" is approximately equal to the "time required" the PSF for available time is 10.

Since all emergency 480-V buses have lost AC power, PSF level of stress is "extreme" (PSF factor is 5).

When the operators decide to close the output breaker, that action can be implemented from the control room (Ref. 7). This action does not require a detailed procedure. In consideration of ambiguities on the part of the operators to close breakers to buses, the PSF factor for complexity is 2 (moderately complex).

Therefore, the probability of human error to implement task is 0.1 (= 10 x 5 x 2 x.001).

Therefore, the total probability of failure is 0.11 (=0.01 + 0.1).

Output breaker does not trip open again due to over-current During the event that occurred on August 31, 1999, due to an anomaly associated with the automatic sequencer, three large loads (an auxiliary feedwater pump, a service water pump, and a component cooling water pump) loaded onto Bus 6A within 4 seconds (see Page 8 of NRC inspection report for details.) During manual loading, this anomaly does not occur The 3000- AMP range (over-current set point in the "as-found" condition) is sufficient to power an AFW pump, a CCW pump, and a SW pump and their auxiliaries. Therefore, even though the breaker tripped due to over-current when loads were sequenced automatically, if Bus 6A was recovered and essential loads (e.g., AFW pumps) were loaded on the bus manually, the output breaker would not trip.

16

LER No. 247/99-015 Section 2: Additional details on the probability of failing to recover power to 480-V buses from 6.9 kV buses If EDGs 21 and 22 failed, the operators would attempt to recover buses by closing the breakers between the 6.9-kV buses and the safety-related 480-V buses 2A, 3A, 4A, and 5A. The probabilities of failing to recover power to 480-V emergency buses from 6.9-kV buses are 0.51 (recovery within two hours) and 0.06 (recovery within four or more hours). The basis of these probabilities are as follows. To recover 480-V buses using power from 6.9-kV buses, the operators must (a) recognize the need to bypass the under-voltage interlock that prevents closing breakers between 6.9-kV and 480-V buses, (b) determine a method to bypass the interlock and generate a procedure to bypass that interlock, (c) bypass the interlock using the procedure, and (d) close breakers.

Recognize the need to bypass the under-voltage interlock Based on communications with the licensee (Ref. 7), as a result of training received by reactor operators, it is common knowledge on the part of the operator that once the SBO signal occurs, the under-voltage signal must be reset before the 6.9-kV buses can be reconnected to the 480-V buses. The nominal failure probability for this cognitive error is.01. Since there is more than adequate time, the PSF factor for time available is 0.1. Since there is a SBO condition, the PSF factor for stress is 5. In consideration of ambiguities on the part of the operators to close breakers to buses, the PSF factor for complexity is 2 (moderately complex). Therefore, the probability of failure is.01 (=.01 x.1 x 5 x 2)

Determine a method to bypass the interlock and generate a procedure to bypass the interlock, generate procedure, and byvass interlock, and close breakers The following information was provided by the licensee during a telephone call (Ref. 7). During the operating history of Indian Point-2, the operators have used a temporary facility change (TFC) to bypass the under-voltage interlock. To bypass the interlock, the operators must locate and retrieve this TFC. All TFCs are located in a computer database Bypass the under-voltage interlock. This computer database will not lose power even if power all emegency 480-V buses fail. During the actual event, it took operators approximately eight hours to locate and review this TFC (Page 8, Attachment I to NRC Inspection Report, Ref. 2). Howeve4 there was no urgency on the part of the operators to bypass the interlock since power was available from two out of three EDGs. Based on discussions with operations and PRA personnel at Indian Point-2, during a SBO, it may take 1/22 to three hours to retrieve the TFC and review and prepare it to implement the bypass. Therefore, in human reliability analysis (HRA) calculations, the PSF factor for time available was 1 (if time available is greater than four hours) and 10 (if time available was less than four hours). Since an SBO has occurred, the PSF factor for stress is 5.

Since the TFC has to be reviewed and prepared during the event, PSF factor for procedure is 5 (i.e., procedure available but poor). In consideration of ambiguities on the part of the operators to close breakers to buses, the PSF factor for complexity is 2 (moderately complex). Consequently the probability of operators error is.05 (=.001 x I x 5 x 5 x 2) if time available to recover is greater or than or equal to four hours and.5 (=.001 x 10 x 5 x 5 x 2) if time available is less than four hours.

Therefore the total failure potabilities are 0.06 (=0.01+0.05) and 0.51 (=.01 + 0.5).

17

LER No. 247/99-015 Bypassing the interlock (making a connection using a wire that has crocodile clips at its two ends) and closing breakers are relatively simple tasks. Once a decision is made to bypass the interlock, it can be accomplished within minutes. Therefore, the probability of failure of these actions are negligible in comparison to the probability of failure to retrieve, review and prepare the TFC (discussed above).

Section 3: Potential for steam generator tube rupture The event analyzed in this report occurred on August 31 9

. On February 15k" of 2000, (i.e.,

approximately six months later) a steam generator tube leaoccurred at Indian Point 2 (LER 247 00-001). Therefore, a degraded steam generator tube existed when the reactor tripped and offsite power was lost on August 31 of 1999. Therefore, when the loss of offsite power event occurred on August 31, if a subsequent accident scenario lead to sequences in which the differential pressure between the tube and the reactor coolant system (AP) increased significantly, then a tube rupture could have occurred. The potential impact of this condition on the core damage frequency was considered negligible due to the following:

The tube degradation is a time dependent function. Therefore, on August 31 (six months before the tube leak event), the degraded condition was less than the condition of that tube in F e b ru a ry.

(

X i, -

7.rt,

, * -.c -

2 In order to increase AP, either the RCS pressure should increase, or the secondary side pressure should decrease.

On August 31, when power was lost to the emergency buses, the power remained available to the balance of plant systems used for condenser heat removal.

Therefore, the likelihood of a RCS pressure increase, even if the emergency electric power from EDGS failed was low.

The frequency sequence where AFW is failed with electric power available may pose a challenge to the degraded steam generator tube. However, since feed and bleed cooling was unavailable, this sequence is already treated as a core damage frequency sequence. Therefore, the degraded tube would not have increased the CDP.

The frequency of the sequence in which electric power fails and RCS pressure increase to challenge PORVs is approximately 2.1 x 10'. Therefore, even if the tube fails on this sequence, unless all follow up mitigation capabilities (e.g, depressurization and faulted steam generator isolation) failed, this change in CDP will be small compared to the CDP of this event (6.4 x 10'). Since power was available to the balance of plant events, the operators had some capbility to mitigate a consequential steam generator tube rupture.

18

LER No. 247199-015 The tube could have failed as a result of a drop in the secondary side pressure.

The likelihood of a random independent event (e.g., spurious opening of a steam generator relief valve or a steam line break) occurring within the mission time of this accident is low. Therefore, contribution to CDP is low.

A steam generator relief valve could open as a result of a pressure rise in the secondary. If this were to occur, since the AP across tubes reduce (rather than increase) the tube will not rupture. {

j 7..

cP r 4SC j

ek I-~~4 P

P#5'0-19 I

.:)

t*

,,.. *./"

f.

LER No. 247199-015 Figure 1 Figure 2 Figure 3 20

INITIATING EVENT ASSESSMENT Fam

IPT2_2QA User Ev ID: FINAL-LOSP-ESW Desc : Initiating Event Assessment Code Ver 6:57 Model Ver 1998/04/14 Init Event: IE-LOOP Total CCDP:

6.9E-005 Event Name AFW-TDP-FC-22 EPS-DGN-CF-ALL EPS-DGN-FC-21 EPS-DGN-FC-22 EPS-DGN-FC-23 IE-LOOP IE-SGTR IE-SLOCA IE-TRANS LOOP-05-NREC LOOP-09-NREC LOOP-17-NREC LOOP-18-02-NREC LOOP-18-05-NREC LOOP-18-07-NREC LOOP-18-08-NREC LOOP-18-11-NREC LOOP-18-14-NREC LOOP-18-16-NREC LOOP-18-17-NREC LOOP-18-20-NREC LOOP-18-22-NREC OEP-XHE-NOREC-2H OEP-XHE-NOREC-6H OEP-XHE-NOREC-BD OEP-XHE-NOREC-SL OEP-XHE-NOREC-ST OEP-XHE-XM-GT2 OEP-XHE-XM-GT6 OEP-XHE-XM-GTBD OEP-XHE-XM-GTSL OEP-XHE-XM-GTST PPR-SRV-CO-L PPR-SRV-CO-SBO RCS-MDP-LK-SEALS BASIC EVENT CHANGES Description AFW TURBINE DRIVEN PUMP 22 F COMMON CAUSE FAILURE OF DIES DIESEL GENERATOR 21 FAILS DIESEL GENERATOR 22 FAILS DIESEL GENERATOR 23 FAILS LOSS OF OFFSITE POWER INITIA STEAM GENERATOR TUBE RUPTURE SMALL LOCA INITIATING EVENT TRANSIENT INITIATING EVENT LOOP LOOP LOOP LOOP LOOP LOOP LOOP LOOP LOOP LOOP LOOP LOOP LOOP SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE SEQUENCE OPERATOR OPERATOR OPERATOR OPERATOR OPERATOR OPERATOR OPERATOR OPERATOR OPERATOR OPERATOR FAILS FAILS FAILS FAILS FAILS FAILS FAILS FAILS FAILS FAILS 05 08 17 NONRECOVERY NONRECOVERY NONRECOVERY NONRECOV NONRECOV NONRECOV NONRECOV NONRECOV NONRECOV NONRECOV NONRECOV NONRECOV NONRECOV RECOVER OF RECOVER OF RECOVER OF RECOVER OF RECOVER OF START AND START AND START AND START AND START AND 18-02 18-05 18-07 18-08 18-11 18-14 18-16 18-17 18-20 18-22 TO TO TO TO TO TO TO TO TO TO PORVs/SRVs OPEN DURING LOOP PORVs/SRVs OPEN DURING STATI RCP SEALS FAIL W/O COOLING A Base Prob Curr Prob

3. 3E-002

8. 5E-004

3. 3E-002

3. 1E-005

1. 6E-006 2.3E-006

2. 7E-004 1.OE+000 1.OE+000 2.2E-001 8.OE-001 8.OE-001

8. OE-0 01

6. 7E-001 8.OE-001

8. OE-001 8

. OE-001 6.7E-001 8.OE-001 2.7E-001 3.2E-002 1.4E-002 8.6E-004

6. 6E-001 1.7E-001 3.4E-001 3.4E-001 3.4E-001 3.4E-001 3.4E-001 1.6E-001 3.7E-001 3.4E-002 Type 9.3E-002

1. OE-003 8.2E-002 8.2E-002 8.2E-002

1. OE+000

+0.0E+000

+0. OE+000

3. OE-002

5. 9E-002

9. OE-002

3. OE-001

3. OE-002

3. OE-001

3. OE-002

7. OE-001

1. 8E-001 1.OE+000 6.OE-002 6.OE-002

+0.OE+000 FALSE 1.OE+000

+0.OE+000 IGNORE

+0.OE+000 FALSE

+0.OE+000 IGNORE 4.OE-002 4.OE-002 2.2E-001 page 1

2001/01/22 08:17:42

SEQUENCE PROBABILITIES Truncation :

Cummulative : 100.0% Individual :

Event Tree Name LOOP LOOP LOOP LOOP LOOP LOOP LOOP SEQUENCE LOGIC Event Tree Sequence Name LOOP 09 Sequence Name 09 17 18-02 18-08 18-11 18-20 18-22 CCDP 3.2E-006 1.1E-005 3.1E-005 1.5E-005 1.3E-006 3.1E-006 3.1E-006 Logic

/RT-L

/EP

/AFW-L PORV-L PRVL-RES

/HPI-L OP-2H HPR-L

/RT-L AFW-L

/RT-L

/AFW-L

/ SEALLOCA

/RT-L

/AFW-L SEALLOCA HPI

/RT-L

/AFW-L

/PRVL-RES OP-BD

/RT-L

/AFW-L PRVL-RES

/RT-L AFW-L

/EP FB-L EP

/PORV-SBO OP-BD EP

/PORV-SBO

/OP-SL EP PORV-SBO

/SEALLOCA EP PORV-SBO ACP-ST EP ACP-ST Fault Tree Name ACP-ST AFW-L EP Description OFFSITE POWER RECOVERY IN SHORT TERM NO OR INSUFFICIENT AFW FLOW DURING LOOP EMERGENCY POWER SYSTEM FAILS page 2

1.0%

%Cont 4.6 15.9 44.9 21.7 1.9 4.5 4.5 LOOP LOOP 17 18-02 LOOP 18-08 LOOP 18-11 LOOP 18-20 LOOP 18-22 2001/01/22 08 :17 :42

FB-L HPI HPI-L HPR-L OP-2H OP-BD OP-SL PORV-L PORV-SBO PRVL-RE S RT-L SEALLOCA SEQUENCE CUT SETS Truncation:

Event Tree: LOOP Sequence:

09

% Cut Set 10.6 10.6 10.6 7.9 7.9 7.9 7.9 7.9 7.9

3.5 Cummulative

100.0% Individual:

1.0%

CCDP:

3.2E-006 Cut Set Events EPS-DGN-FC-21 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SR3 EPS-DGN-FC-23-OB LOOP-09-NREC EPS-DGN-FC-21 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SR2 EPS-DGN-FC-23-OB LOOP-09-NREC EPS-DGN-FC-21 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SRI EPS-DGN-FC-23-OB LOOP-09-NREC EPS-DGN-FC-21 EPS-DGN-FC-23 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SR3 LOOP-09-NREC EPS-DGN-FC-21 EPS-DGN-FC-22 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SR2 LOOP-09-NREC EPS-DGN-FC-21 EPS-DGN-FC-23 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SR2 LOOP-09-NREC EPS-DGN-FC-21 EPS-DGN-FC-22 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SRI LOOP-09-NREC EPS-DGN-FC-21 EPS-DGN-FC-23 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SRl LOOP-09-NREC EPS-DGN-FC-21 EPS-DGN-FC-22 OEP-XHE-NOREC-2H PPR-SRV-CO-L PPR-SRV-OO-SR3 LOOP-09-NREC OEP-XHE-NOREC-2H PPR-SRV-CO-L page 3

FAILURE TO PROVIDE FEED AND BLEED COOLING -

LOOP NO OR INSUFFICIENT FLOW FROM THE HPI SYSTEM NO OR INSUFFICIENT FLOW FROM HPI SYSTEM -

LOOP NO OR INSUFFICIENT FLOW FROM HPR SYSTEM -

LOOP OPERATOR FAILS TO RECOVER OFFSITE POWER WITHIN 2 HRS OPERATOR FAILS TO RECOVER OFFSITE POWER BEFORE BATTER OPERATOR FAILS TO RECOVER OFFSITE POWER (SEAL LOCA)

PORVs/SRVs OPEN DURING LOOP PORVs/SRVs OPEN DURING STATION BLACKOUT PORVs AND BLOCK VALVES AND SRVs FAIL TO RECLOSE REACTOR FAILS TO TRIP DURING LOOP RCP SEALS FAIL DURING LOOP CCDP 3.4E-007

3. 4E-007 3.4E-007 2.5E-007

2. 5E-007 2.5E-007

2. 5E-007 2.5E-007 2.5E-007 1.1E-007 08 :17 :42 2001/01/22

PPR-SRV-OO-SR1 LOOP-09-NREC OEP-XHE-NOREC-2H PPR-SRV-OO-SR2 LOOP-09-NREC OEP-XHE-NOREC-2H PPR-SRV-OO-SR3 LOOP-09-NREC OEP-XHE-NOREC-2H PPR-SRV-OO-SR1 LOOP-09-NREC OEP-XHE-NOREC-2H PPR-SRV-OO-SR2 LOOP-09-NREC OEP-XHE-NOREC-2H PPR-SRV-OO-SR3 LOOP-09-NREC HPR-MOV-OO-RWST PPR-SRV-CO-L HPR-MOV-OO-RWST PPR-SRV-CO-L HPR-MOV-OO-RWST PPR-SRV-CO-L HPR-XHE-XM-L PPR-SRV-CO-L HPR-XHE-XM-L PPR-SRV-CO-L HPR-XHE-XM-L Event Tree: LOOP CCDP:

1.1E-005 Sequence:

17

% Cut Set 26.7 26.7 19.9 19.9 1.3 1.3 Cut Set Events AFW-TDP-FC-22 EPS-DGN-FC-22 MFW-SYS-UNAVAIL MFW-XHE-NOREC EPS-DGN-FC-23-OB LOOP-17-NREC AFW-TDP-FC-22 EPS-DGN-FC-22 MFW-XHE-ERROR MFW-SYS-TRIP EPS-DGN-FC-23-OB LOOP-17-NREC AFW-TDP-FC-22 EPS-DGN-FC-22 EPS-DGN-FC-23 MFW-XHE-ERROR MFW-SYS-TRIP LOOP-17-NREC AFW-TDP-FC-22 EPS-DGN-FC-22 EPS-DGN-FC-23 MFW-SYS-UNAVAIL MFW-XHE-NOREC LOOP-17-NREC AFW-MDP-FC-21 AFW-TDP-FC-22 MFW-XHE-ERROR MFW-SYS-TRIP EPS-DGN-FC-23-OB LOOP-17-NREC AFW-MDP-FC-21 AFW-TDP-FC-22 MFW-SYS-UNAVAIL MFW-XHE-NOREC EPS-DGN-FC-23-OB LOOP-17-NREC Event Tree: LOOP CCDP:

3.1E-005 Sequence:

18-02

% Cut Set Cut Set Events EPS-DGN-CF-ALL

/PPR-SRV-CO-SBO LOOP-18-02-NREC EPS-DGN-FC-21 OEP-XHE-NOREC-BD OEP-XHE-NOREC-BD

/RCS-MDP-LK-SEALS EPS-DGN-FC-22

/PPR-SRV-CO-SBO page 1.1E-007 1.1E-007 3.8E-008 3.8E-008 3.8E-008 3.5 3.5 1.2 1.2 1.2 CCDP 3.OE-006 3.OE-006 2.3E-006 2.3E-006 1.4E-007 1.4E-007 CCDP 1.4E-005 1.0E-005 43.6 32.2 4

2001/01/22 0 8: 17: 42

/RCS-MDP-LK-SEALS LOOP-18-02-NREC EPS-DGN-FC-21 EPS-DGN-FC-23

/PPR-SRV-CO-SBO LOOP-18-02-NREC EPS-DGN-FC-23-OB EPS-DGN-FC-22 OEP-XHE-NOREC-BD

/RCS-MDP-LK-SEALS Event Tree: LOOP CCDP:

1.5E-005 Sequence:

18-08

% Cut Set Cut Set Events EPS-DGN-CF-ALL RCS-MDP-LK-SEALS EPS-DGN-FC-21

/PPR-SRV-CO-SBO EPS-DGN-FC-23-OB EPS-DGN-FC-21 EPS-DGN-FC-23 RCS-MDP-LK-SEALS

/PPR-SRV-CO-SBO LOOP-18-08-NREC EPS-DGN-FC-22 RCS-MDP-LK-SEALS LOOP-18-08-NREC EPS-DGN-FC-22

/PPR-SRV-CO-SBO LOOP-18-08-NREC Event Tree: LOOP CCDP:

1.3E-006 Sequence:

18-11

% Cut Set Cut Set Events EPS-DGN-CF-ALL PPR-SRV-CO-SBO LOOP-18-11-NREC EPS-DGN-FC-21 OEP-XHE-NOREC-BD

/RCS-MDP-LK-SEALS LOOP-18-11-NREC EPS-DGN-FC-21 EPS-DGN-FC-23 PPR-SRV-CO-SBO LOOP-18-11-NREC OEP-XHE-NOREC-BD

/RCS-MDP-LK-SEALS EPS-DGN-FC-22 PPR-SRV-CO-SBO EPS-DGN-FC-23-OB EPS-DGN-FC-22 OEP-XHE-NOREC-BD

/RCS-MDP-LK-SEALS Event Tree: LOOP CCDP:

3.1E-006 Sequence:

18-20

% Cut Set Cut Set Events OEP-XHE-NOREC-ST PPR-SRV-OO-SR1 LOOP-18-20-NREC OEP-XHE-NOREC-ST PPR-SRV-OO-SR3 LOOP-18-20-NREC OEP-XHE-NOREC-ST PPR-SRV-OO-SR2 LOOP-18-20-NREC EPS-DGN-CF-ALL PPR-SRV-CO-SBO EPS-DGN-CF-ALL PPR-SRV-CO-SBO EPS-DGN-CF-ALL PPR-SRV-CO-SBO page 5

2001/01/22 7.4E-006 24.0 CCDP 6.3E-006 4.7E-006 3.5E-006 43.6 32.2 24.0 CCDP 5.6E-007 4.2E-007 3.1E-007 43.6 32.2 24.0 CCDP

4. 5E-007 4.5E-007 4.5E-007 14.5 14.5 14.5 08: 17:42

3.3E-007 3.3E-007

3. 3E-007 2.5E-007 2.5E-007 2.5E-007 10.8 10.8 10.8 8.0 8.0 8.0 Event Tree: LOOP CCDP:

3.1E-006 Sequence:

18-22

% Cut Set 21.8 21.8 16.1 16.1 12.0 12.0 Cut Set Events OEP-XHE-NOREC-ST EPS-DGN-CF-ALL MFW-SYS-TRIP OEP-XHE-NOREC-ST EPS-DGN-CF-ALL MFW-XHE-NOREC OEP-XHE-NOREC-ST EPS-DGN-FC-21 MFW-XHE-ERROR EPS-DGN-FC-23-OB OEP-XHE-NOREC-ST EPS-DGN-FC-21 MFW-SYS-UNAVAIL EPS-DGN-FC-23-OB OEP-XHE-NOREC-ST EPS-DGN-FC-21 EPS-DGN-FC-23 MFW-SYS-TRIP OEP-XHE-NOREC-ST EPS-DGN-FC-21 EPS-DGN-FC-23 MFW-XHE-NOREC AFW-TDP-FC-22 MFW-XHE-ERROR LOOP-18-22-NREC AFW-TDP-FC-22 MFW-SYS-UNAVAIL LOOP-18-22-NREC AFW-TDP-FC-22 EPS-DGN-FC-22 MFW-SYS-TRIP LOOP-18-22-NREC AFW-TDP-FC-22 EPS-DGN-FC-22 MFW-XHE-NOREC LOOP-18-22-NREC AFW-TDP-FC-22 EPS-DGN-FC-22 MFW-XHE-ERROR LOOP-18-22-NREC AFW-TDP-FC-22 EPS-DGN-FC-22 MFW-SYS-UNAVAIL LOOP-18-22-NREC page 6

2001/01/22 OEP-XHE-NOREC-ST EPS-DGN-FC-22 PPR-SRV-CO-SBO LOOP-18-20-NREC OEP-XHE-NOREC-ST EPS-DGN-FC-22 PPR-SRV-CO-SBO LOOP-18-20-NREC OEP-XHE-NOREC-ST EPS-DGN-FC-22 PPR-SRV-CO-SBO LOOP-18-20-NREC OEP-XHE-NOREC-ST EPS-DGN-FC-22 PPR-SRV-OO-SR1 LOOP-18-20-NREC OEP-XHE-NOREC-ST EPS-DGN-FC-22 PPR-SRV-OO-SR2 LOOP-18-20-NREC OEP-XHE-NOREC-ST EPS-DGN-FC-22 PPR-SRV-OO-SR3 LOOP-18-20-NREC EPS-DGN-FC-21 PPR-SRV-OO-SR3 EPS-DGN-FC-23-OB EPS-DGN-FC-21 PPR-SRV-OO-SR2 EPS-DGN-FC-23-OB EPS-DGN-FC-21 PPR-SRV-OO-SR1 EPS-DGN-FC-23-OB EPS-DGN-FC-21 EPS-DGN-FC-23 PPR-SRV-CO-SBO EPS-DGN-FC-21 EPS-DGN-FC-23 PPR-SRV-CO-SBO EPS-DGN-FC-21 EPS-DGN-FC-23 PPR-SRV-CO-SBO CCDP 6.7E-007 6.7E-007 5.OE-007 5.OE-007 3.7E-007 3.7E-007 08 :17 :42

BASIC EVENTS (Cut Sets Only)

Event Name Description AFW-MDP-FC-21 AFW-TDP-FC-22 EPS-DGN-CF-ALL EPS-DGN-FC-21 EPS-DGN-FC-22 EPS-DGN-FC-23 EPS-DGN-FC-23-OB HPR-MOV-OO-RWST HPR-XHE-XM-L LOOP-09-NREC LOOP-17-NREC LOOP-18-02-NREC LOOP-18-08-NREC LOOP-18-11-NREC LOOP-18-20-NREC LOOP-18-22-NREC MFW-SYS-TRIP MFW-SYS-UNAVAIL MFW-XHE-ERROR MFW-XHE-NOREC OEP-XHE-NOREC-2H OEP-XHE-NOREC-BD OEP-XHE-NOREC-ST PPR-SRV-CO-L PPR-SRV-CO-SBO PPR-SRV-OO-SR1 PPR-SRV-OO-SR2 PPR-SRV-OO-SR3 RCS-MDP-LK-SEALS AFW MOTOR DRIVEN PUMP 21 FAILS AFW TURBINE DRIVEN PUMP 22 FAILS COMMON CAUSE FAILURE OF DIESEL GENERATORS DIESEL GENERATOR 21 FAILS DIESEL GENERATOR 22 FAILS DIESEL GENERATOR 23 FAILS HPI RWST SUCTION MOV FAILS TO CLOSE OPERATOR FAILS TO INITIATE HPR SYSTEM -

LOOP LOOP SEQUENCE LOOP SEQUENCE LOOP SEQUENCE LOOP SEQUENCE LOOP SEQUENCE LOOP SEQUENCE LOOP SEQUENCE MAIN FEEDWATER MAIN FEEDWATER OPERATOR FAILS OPERATOR FAILS OPERATOR FAILS OPERATOR FAILS OPERATOR FAILS PORVS/SRVS OPE PORVS/SRVS OPE FAILURE OF SRV FAILURE OF SRV FAILURE OF SRV RCP SEALS FAIL 08 NONRECOVERY PROBABILITY 17 NONRECOVERY PROBABILITY 18-02 NONRECOVERY PROBABILITY 18-08 NONRECOVERY PROBABILITY 18-11 NONRECOVERY PROBABILITY 18-20 NONRECOVERY PROBABILITY 18-22 NONRECOVERY PROBABILITY SYSTEM UNAVAILABLE GIVEN RX TR SYSTEM UNAVAILABLE TO RESTORE MFW FLOW TO RECOVER MFW FLOW TO RECOVER OFFSITE POWER WITH TO RECOVER OFFSITE POWER BEFOR TO RECOVER OFFSITE POWER IN SH SDURING LOOP SDURING STATION 1 TO RECLOSE 2 TO RECLOSE 3 TO RECLOSE W/O COOLING AND BLACKOUT INJECTION

'N Curr Prob

3. 9E-003 9.3E-002 1.0E-003 8.2E-002 8.2E-002 8.2E-002 1.1E-001 3.0E-003

1. 0E-003

5. 9E-002 9.OE-002 3.OE-001

3. OE-002 3.0E-001 7.OE-001 1.8E-001 8.OE-001 2.OE-001 5.0E-002 2.0E-001 1.OE+000

6. 0E-002 1.0E+000 4.0E-002 4.OE-002 1.6E-002 1.6E-002 1.6E-002 2.2E-001 2001/01/22 08 :17 :42 page 7

ML020850146

Text

Description:

3.5 Cummulative

Navigation menu

Search