CPSES-200300788, Additional Information Concerning CPSES Ninth Refueling Outage Steam Generator Tube Conditions

Additional Information Concerning CPSES Ninth Refueling Outage Steam Generator Tube Conditions

ML031060044
Person / Time
Site:	Comanche Peak
Issue date:	04/09/2003
From:	Walker R TXU Energy
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CPSES-200300788, TXX-03072
Download: ML031060044 (134)

Text

k t 4lP TX U Bier50 TXU Energy Comanche Peak Steam Electric Station PO Box 1002 (E01)

Glen Rose,TX 76043 Tel. 254 897 8920 Fax 254 897 6652 lance terry@txu corn C. Lance Terry Senior Vice President &

Principal Nuclear Officer Ref.: 10 CFR 50.55a CPSES-200300788 Log # TXX-03072 April 9, 2003 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555

SUBJECT:

COMANCHE PEAK STEAM ELECTRIC STATION (CPSES),

UNIT 1, DOCKET NO. 50-445 ADDITIONAL INFORMATION CONCERNING CPSES NINTH REFUELING OUTAGE (IRF09) STEAM GENERATOR TUBE CONDITIONS REF: 1)

NRC Inspection Report No. 50-445/02-09; dated 9 January, 2003.

2)

TXU Energy letter, logged TXX-03024, from C. L. Terry to the NRC; dated March 5, 2003.

Gentlemen:

TXU Generation Company LP (TXU Energy) has performed further examination related to the CPSES Unit 1 steam generators and additional analysis of the steam generator tube leak that occurred in September 2002. TXU Energy wishes to provide this information to the NRC Staff for consideration during their Significance Determination Process (SDP) Phase 3 analysis of the Apparent Violation (APV 50-445/0209-01) contained within Reference 1. to this letter contains an additional TXU Energy analysis of the risk significance of a through-wall defect responsible for the Unit 1 steam generator tube leak that occurred in September 2002. This new analysis is meant to provide further information on the postulated thermally-induced tube rupture subsequent to core uncovery in severe accident scenarios. This new information supplements the Phase 3 PRA analysis previously submitted by TXU Energy via Reference 2.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Comanche Peak

• Diablo Canyon

• Palo Verde

• South Texas Project Wolf Creek

3 TXU TXX-03072 Page 2 of 3 The analysis in Enclosure 1 is a retrospective, best-estimate evaluation of the risk of a specific steam generator tube defect. The analysis utilizes state-of-the-art techniques recently developed by both NRC and the industry. While the application of these techniques is performed in a fashion similar to that used in typical assessments (e.g.,

evaluating whether eddy current indications should remain in service), there are key differences. For example, this analysis takes into account the specific, as-found condition and location of the defect, as-measured materials properties of the tube, leakage behavior of the defect, and the operating procedures that were in use during the period the plant operated with the defect.

The comprehensive analysis and evaluation of the tube defect reveal that its presence added very little risk to plant operation. This new analysis continues to support the conclusion of TXU Energy in the letter dated March 5, 2003 (Reference 2) that the SDP Phase 3 finding is very low risk (i.e., ALERF less than lE-07) and therefore it should be categorized as a Green finding. This conclusion is strongly supported by recent research results, plant specific considerations, the characteristics of the as-found tube condition, and the results of sensitivity studies on the important assumptions. to this letter contains the summary and conclusions of a proprietary vendor report documenting the laboratory examination of the steam generator tubes removed during IRF09. The full proprietary version of this vendor report is available onsite for review upon request.

Should you require any other additional information please contact Mr. Bob Kidwell at (254) 897-5310.

This communication contains the no new licensing basis commitments for CPSES Unit 1.

A) TXUJ TXX-03072 Page 3 of 3 Sincerely, TXU Generation Company LP By:

TXU Generation Management Company LLC, Its General Partner C. L. Terry Senior Vice President and Principal Nuclear Officer By:

Roger.

Walker Regulatory Affairs Manager RJK/rk Enclosures c -

E.W. Merschoff, Region IV T. P. Gwynn, Region IV W. D. Johnson, Region IV D. H. Jaffe, NRR Resident Inspectors, CPSES

ENCLOSURE 1 TXU ENERGY LETTER (TXX-03072)

COMANCHE PEAK STEAM ELECTRIC STATION ENGINEERING REPORT ERX-03-003, REVISION 0 ESTIMATED LERF RISK FROM A THERMALLY-INDUCED RUPTURE OF A THROUGH-WALL STEAM GENERATOR TUBE DEFECT AT CPSES

TXU ENERGY COMANCHE PEAK STEAM ELECTRIC STATION ENGINEERING REPORT ESTIMATED LERF RISK FROM A THERMALLY-INDUCED RUPTURE OF A THROUGH-WALL STEAM GENERATOR TUBE DEFECT AT CPSES ERX 003 REVISION 0 April 3, 2003 By J. R. Green R. H. Lichtenstein H. C. da Silva, Jr.

D. M. Tirsun And G. W. Hannaman - Data Systems & Solutions M. A. Kenton - Creare, Inc.

Reviewed by:

Signature on record S. D. Karpyak, Supervisor Risk and Reliability Approved by:

Signature on record J. W. Meyer, Manager Engineering Analysis

DISCLAIMER This information contained in this report was prepared for the specific requirements of TXU Energy and may not be appropriate for use in situations other than those for which it was specifically prepared. TXU Energy PROVIDES NO WARRANTY HEREUNDER, EXPRESS OR IMPLIED, OR STATUTORY, OF ANY KIND OR NATURE WHATSOEVER, REGARDING THIS REPORT OR ITS USE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES ON MERCHANTABILITY FOR FITNESS FOR A PARTICULAR PURPOSE.

By making this report available, TXU Energy does not authorize its use by others, and any such use is forbidden except with the prior written approval of TXU Energy. Any such written approval should itself be deemed to incorporate the disclaimers of liability and disclaimers of warranties provided herein. In no event should TXU Energy have any liability for any incidental or consequential damages of any type in connection with the use, authorized or unauthorized, of this report of the information in it.

Table of Contents Executive Summary...............................................................

4 I. Purpose..............................................................

7 II. Background..............................................................

8 III. Evaluation...............................................................

9 A. Severe Accident Challenges to Tube Integrity.......................................................

9 B. Severe Accident Phenomena.............................................................

10 Thermo-fluid behavior.............................................................

10 Effect of Cleared Intermediate Legs on Natural Circulation Flow Patterns........... 16 Behavior of Tube Defects at High Temperatures................................................... 17 Characterization of defect in tube SG2 R41 C71.................................................... 18 Quantification of Tube Rupture Probability........................................................... 20 C. Accident Progression Event Tree.............................................................

21 D. MAAP Calculations.............................................................

26 APET Branches with No RCP Seal Leakage or Leakage Less Than 60 gpm/pmp 27 APET Branches with RCP Seal Leakage Greater Than 60 gpm/pmp And Less Than 250 gpm/pmp.............................................................

32 E. Probability of Tube Rupture and Large Fission Product Release.....................

33 F. APET/Fault Tree Development and Quantification............................................

35 Description of APET Branches..............................................................

35 Description of APET Branch Fault Trees.............................................................. 37 G. Discussion of Initiators.............................................................

45 H. Quantification..............................................................

46 APET Conversion to a Fault Tree..............................................................

46 Additional Logic Considerations.............................................................

46 Quantification using PRA Quant..............................................................

46 IV Results.............................................................

47 A. Base Case Results.............................................................

47 B. Sensitivity Studies..............................................................

48 V. Conclusions.............................................................

49 VI. References..............................................................

53 Appendix 1 Plant Damage State Descriptions.............................................................

54 Appendix 2 Changes to Rule Based Recovery File and Mutually Exclusive File.... 57 Appendix 3 B RA Calculator Output..............................................................

60 Appendix 4 Accident Progression Event Tree (APET)..............................................

69 Appendix 5 Top 50 Cutsets - Dominant Sequence (ISGTR-4)..................................

71 Appendix 6 Primary Safety Valve (PSV) Reliability Assessment for Station Blackout (SBO) Scenario Evaluations at Comanche Peak................... 88 Appendix 7 Plots of Key Pressures and Temperatures From MAAP Calcs......... 106 Appendix 8 Sensitivity Case Results..............................................................

116 Page 3 of 121

Executive Summary This report documents an evaluation of the risk significance of a through-wall defect responsible for the Unit 1 steam generator tube leak that occurred in September 2002.

This work constitutes a portion of a Significance Determination Process (SDP) Phase 3 evaluation to assess the change in Large Early Release Frequency (LERF) due to induced steam generator tube rupture (ISGTR). A previous report [17] addressed the impact of the defect on the likelihood of spontaneous tube rupture and pressure-induced rupture during MSLB. This effort focuses on the analysis of thermally-induced tube rupture after the core uncovers in postulated severe accidents.

This work is a retrospective, best-estimate evaluation of the risk of a specific defect. The analysis utilizes state-of-the-art techniques recently developed by both NRC and the industry. While the application of these techniques is done in a fashion similar to that used in typical assessments, e.g. evaluating whether eddy current indications should remain in service, there are key differences. For example, this analysis takes into account the specific, as-found condition and location of the defect, as-measured materials properties of the tube, leakage behavior of the defect, and the operating procedures that were in use during the period the plant operated with the defect.

Severe accident conditions beyond the design basis are addressed in this analysis, using a framework based on techniques outlined in NUREG-1570 [1] and EPRI's Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture [2, 11]. The analysis also takes advantage of insights from these previous works and more recent research conducted at Argonne National Laboratory [7]. The overall analysis consisted of five major steps:

• Quantification of the frequency of sequences with high RCS pressure and dry steam generators ("high/dry" sequences) using PRA techniques.

• Thermal-hydraulic analysis of selected accident sequences using MAAP 4.0 to calculate the pressure and temperature response of the reactor coolant system (RCS)

• Characterization of the defect as a function of time by combining information from observed leak rates, eddy current and visual inspection data, and defect growth models

• Analysis of the defect's response to the calculated temperatures and pressures using the EPRI PROBFAIL code

• Quantification of the change in the frequency of large, early release of fission products using an accident progression event tree (APET)

The APET treats the key issues that impact the response of the defect during a severe accident:

• Auxiliary Feedwater Availability

• Seal LOCA Magnitude c

Loop Seal Clearing and the Development of Whole-loop Through-flow

• RCS Depressurization Page4 of 121

Steam Generator Pressure

• ISTGR Occurring Prior to Hot Leg or Surge Line Creep Rupture

• Fission Product Release given ISGTR (treated qualitatively)

These events were quantified by performing a series of calculations that address accident initiators, subsequent equipment failures, operator actions, and tube performance during severe accidents.

The analysis reveals that the vast majority of high/dry sequences in CPSES are Loss of Offsite Power which lead to early core damage. This is because in the late sequences, offsite power is more likely to be recovered. This implies that batteries are usually available during core damage, which has the important implication that the pressurizer PORVs are nearly always available for RCS depressurization. In this case, emergency drill results strongly suggest that the operators will follow the SAMGs and depressurize the RCS in a timely fashion. Calculations reveal that opening one or more PORVs essentially eliminates thermal challenge. This conclusion is quite robust to phenomenological uncertainties associated with severe accident behavior. In fact, the challenge to the affected tube's integrity in sequences where the steam generator is fully depressurized and the RCS is depressurized in accordance with SAMGs is essentially the same as that faced under design basis conditions in MSLB sequences.

Secondary side pressure control is also important. For high/dry sequences in CPSES, the operators will depressurize the affected steam generator in an attempt to achieve accumulator discharge. Operators are expected to perform this action by depressurizing all the steam generators simultaneously, then isolating the steam generators when the wide range water level reaches 5 percent. In this situation, calculations indicate that the affected unit will substantially repressurize prior to core uncovering. However, the operators have procedural flexibility to delay the depressurization of one or more of the steam generators (assumed to be those that supply steam to the turbine-driven AFW pump; the affected steam generator is not one of those units). In this case, the affected steam generator will completely depressurize and dry out. All of the steam generators will be isolated again later per procedures. Under these conditions, tube rupture is relatively likely if no action is taken to depressurize the RCS. However, if tube rupture does occur, it will be into a depressurized, dry, isolated secondary. In many cases, the repressurization rate of the steam generator due to the ruptured tube is sufficiently slow that the hot leg would likely rupture prior to the first lifting of a secondary safety or relief valve. This would prevent fission product release from the ruptured tube.

In view of the dominant importance of RCS pressure and steam generator pressure, another significant contribution to LERF arises from late core melt sequences involving battery depletion. While the initiating frequency of such sequences is lower than the early core melt cases, battery depletion leads to both the unavailability of the PORVs for depressurizing the RCS and to loss of steam generator level instrumentation and potentially to overfill. It is assumed that if overfill occurs, it inevitably leads to a stuck open steam generator safety valve. However, CPSES Plant Operations staff believes it is highly likely that the time to overfill can be extended significantly beyond battery Page 5 of 121

depletion (-16 hours [11]). Consistent with [11], this means it is highly likely that the eventual steam generator dry out might not take place, or even if it does, it would occur very late, beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and well after protective and recovery actions will have been implemented. Therefore, it is assumed that 50% of these potential overfill cases will not result in ISTGR/LERF. As noted in previous analyses [11], overfill in reality is not inevitable and even if it does occur, fission product releases will tend to be very late, allowing ample time for recovery of safety systems.

The comprehensive analysis and evaluation of the tube defect reveal that its presence added very little risk to plant operation. This work supports a conclusion that the SDP Phase 3 finding is very low risk, i.e., delta LERF less than 1E-07, and therefore it should be categorized as green. This conclusion is strongly supported by recent research results, plant specific considerations, the characteristics of the as-found tube condition, and the results of sensitivity studies on the important assumptions.

Page 6 of 121

I. Purpose The purpose of this work is to evaluate the risk significance of a defect responsible for the Unit 1 steam generator tube leak that occurred in September 2002. This work constitutes a Significance Determination Process (SDP) phase 3 evaluation that specifically addresses the change in Large Early Release Frequency (LERF) due to induced steam generator tube rupture (ISGTR). The work reported here takes into account recent research in severe accident phenomena. The other aspects of the SDP, namely spontaneous tube rupture and pressure-induced rupture during MSLB, were treated in a previous evaluation [17], and those conclusions remain unchanged by this analysis.

As discussed below, this work is a retrospective, best-estimate evaluation of the risk increment due to a particular defect. While similarities exist with the more familiar forward-looking assessment of whether various conjectured defects could remain in service, there are key differences. Specifically, this analysis takes into account the as-found condition of the steam generator tube, as-measured materials properties, and the operating procedures that were in use during the period of time the plant was operated with the defect.

Page 7 of 121

II. Background On September 26, 2002, Unit 1 was in coastdown to lRF09, which was scheduled to start October 5, 2002, when indication of a Primary-to-Secondary Steam Generator Tube Leak (SGTL) was observed. Plant Management decided to shutdown the unit due to increased spiking of the SGTL on the morning of 09/28/2002 (Saturday). At no time during the event did plant personnel have indication that the leak exceeded 55 gpd, which is well below the Technical Specification 3.4.13.e shutdown requirement of 150 gpd.

In earlier work to address the risk significance of the steam generator tube leak, TXU analyzed the situation using a framework similar to that used in the CPSES IPE. That analysis addressed the three important aspects of risk: spontaneous tube rupture, rupture induced by MSLB steam side depressurization, and severe-accident thermally induced tube rupture. Whereas that approach is adequate to address the retrospective risk significance of the stream generator tube leak, TXU recognizes there have been advances in the area of severe accident thermally induce tube rupture that warrant addressing.

TXU understands that the behavior of steam generator tubes under severe accident conditions is the subject of current NRC research programs. These activities, initiated by the NRC under both the Risk Informed Regulation Implementation Plan (RIRIP) and the Steam Generator Action Plan (SGAP), will provide added insights into the performance of steam generator tubes under severe accident conditions well beyond those presently incorporated in the licensing basis of most plants, including CPSES. The framework of these activities was outlined in NUREG-1570 [1]. The industry has also built upon that framework in EPRI's Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture [2, 11]. Severe accident conditions beyond design basis are addressed in this analysis, using a framework that is similar to, but also takes advantage of insights from, these previous works.

For this evaluation, a simplified Accident Progression Event Tree (APET) was developed to assess the probability of Induced Steam Generator Tube Rupture (ISGTR) during severe accidents. The events in the APET were quantified by performing a series of calculations that address accident initiators, subsequent equipment failures, operator actions, and tube performance during severe accidents. Details of the APET are provided in later sections of this report.

Page 8 of 121

III. Evaluation This section addresses the evaluation of the risk significance of the degraded steam generator tube SG2 R41 C71 that was responsible for the leak. It describes the Accident Progression Event Tree (APET), the phenomenological studies that form the basis for the APET, descriptions of the APET Top Gates and descriptions of the APET Branch Fault Trees. This evaluation describes the assumptions and method for identifying the accident initiators and associated accident sequences that lead to plant damage states characterized by high primary system pressure with dry steam generators (High/Dry sequences) that are of concern. The process used to quantify the APET is described, including conversion of the APET to a fault tree and its quantification.

A. Severe Accident Challenges to Tube Integrity During design basis accidents, the integrity of a flawed tube can be threatened by differential pressures that exceed those experienced during normal operation. High temperatures in severe accidents that involve dry steam generators can also challenge tube integrity. Severe accidents with dry steam generators may involve elevated reactor coolant system pressures that in turn lead to natural circulation of hot gasses. The flow of hot gasses from an uncovered core to the steam generators heats the tubes and other locations of the reactor coolant system. If sufficiently severe, the combination of high temperature and pressure can lead to tube failure, unless another location such as a hot leg or the surge line fails first. The thermo-fluid and structural aspects of accidents involving high reactor coolant system (RCS) pressure and dry steam generators (High/Dry accident sequences) have been extensively studied by industry and the NRC since the mid-1990s [1,2].

An analysis of the response of the defect in tube SG2 R41 C71 during postulated High/Dry sequences was carried out by TXU and its contractors. This analysis consisted of five major steps:

• Quantification of the frequency of the High/Dry sequences using PRA techniques.

• Thermal-hydraulic analysis of selected accident sequences using MAAP 4.0 to calculate the pressure and temperature response of the reactor coolant system (RCS)

• Characterization of the defect as a function of time by combining information from observed leak rates, eddy current and visual inspection data, and defect growth models

• Analysis of the defect's response to the calculated temperatures and pressures using the EPRI PROBFAIL code

• Quantification of the change in the frequency of large, early release of fission products using an accident progression event tree (APET)

The methodology used in this analysis is described in more detail below. This section discusses the similarities and differences to recent industry work on induced steam generator tube rupture, severe accident phenomena and accident sequence progress.

Page 9 of 121

This analysis differs in several important respects from recent studies of thermally induced tube rupture performed by industry and the NRC [1,2]. First, this analysis concentrates on assessing the impact on risk of a single, relatively well-characterized defect. This focus allows us to perform a more realistic assessment than is possible when a large number of different defects must be considered. Also, the analysis is "backward-looking", and thus involves consideration of accident frequencies and operating procedures applicable during the period when the defect was present. This means that no credit can be taken for changes in equipment or procedures that could mitigate such risks in the future. Nevertheless, it is considered appropriate in such an assessment to analyze defect performance in a best-estimate fashion. For example, operator actions to open one or more pressurizer PORVs in accordance with the severe accident management guidelines (SAMGS) is credited based on observations of emergency drills conducted at the plant. Also, the occurrence of a stuck-open pressurizer relief or safety valve due to damage incurred by high pressure subcooled water is quantified using relevant test data.

Finally, as-measured material properties for the tube in question are used in the evaluation of burst pressure.

Another unusual aspect of the analysis is that in most High/Dry sequences in CPSES, the operators will depressurize the affected unit containing the defect in an attempt to achieve accumulator discharge. Operators are expected to perform this action by depressurizing all the steam generators simultaneously, then isolating the steam generators when the wide range water level reaches 5 percent. In this situation, calculations indicate that the affected unit will substantially repressurize prior to core uncovering.

However, the operators have procedural flexibility to delay the depressurization of one or more of the steam generators (assumed to be those that supply steam to the turbine-driven AFW pump, SG2 is not one of those SGs). In this case, the affected steam generator will completely depressurize and dry out. All of the steam generators will be isolated again later per procedures, so if tube rupture occurred, it will be into a depressurized, dry, isolated secondary. If repressurization of the steam generator due to the ruptured tube is sufficiently slow, the hot leg could rupture prior to the first lifting of a secondary safety or relief valve, preventing fission product release.

Finally, the defect that is the subject of this study was quite deep. In most severe accident studies, attention has been focussed on creep rupture of the remaining tube ligament. In this case, the analysis of the most limiting sequences involves an assessment of whether a through-wall defect will lead to tube rupture or merely leakage through a relatively tight crack, which is not considered here to meet the threshold for LERF.

B. Severe Accident Phenomena Thermo-fluid behavior The phenomena that govern the response of the tubes during High/Dry severe accidents form the underlying basis for the quantification of the plant behavior using the accident Page 10 of 121

progression event tree (APET) (shown in Figure 7). These phenomena have been extensively surveyed elsewhere, and only a brief summary will be provided here.

Most accidents that lead to High/Dry conditions in CPSES are SBO sequences or closely resemble such sequences in terms of the phenomena that would occur. If the core becomes uncovered in a high pressure sequence such as SBO, the exposed portions of the fuel will begin to heat. As the steam in the center of the core becomes hot relative to the steam at the periphery of the core and in the upper plenum of the reactor vessel, calculations and experiments in scale model facilities indicate that natural circulation will develop between these two regions.

In most sequences, the intermediate legs in the coolant loops will remain full of liquid during the core damage process, blocking the flow of gas through the cold legs, and this situation is considered first. After a short period, the core-upper plenum natural circulation process will begin to increase the temperature of the steam in the upper plenum relative to that contained in the hot legs. Based on theory as well as experimental results, the creation of a density difference between the upper plenum and the inlet plenum of the steam generators will give rise to a countercurrent flow of steam in the hot legs: hot gas will proceed out the top of the hot leg and enter the steam generator inlet plenum, and cooler gas will be displaced from the inlet plenum back to the upper plenum of the RPV. The latter effect is a consequence of the blocked cold legs, since there can be essentially no net flow to the coolant loop. This flow pattern is schematically illustrated in Figure 1 [3].

As the hot leg countercurrent flow process proceeds, the inlet plenum of the steam generator will become hot relative to the outlet plenum of the unit. Since in U-tube steam generators the two plena are at the same elevation and are connected only via the vertically-oriented tubes, it is not obvious that this condition will give rise to natural circulation. Nevertheless, it is observed in experiments that hot gasses will begin to enter some of the tubes on the inlet side of the steam generator, creating a slight hydrostatic head imbalance across these tubes. This situation is initially unstable: the head imbalance gives rise to additional flow that creates a larger pressure imbalance. Very quickly it is observed in transient scale-model experiments that roughly half the tubes begin to carry flow from the inlet plenum to the outlet plenum. Again assuming that the cold leg is blocked, an essentially equal flow rate must return from the outlet plenum through the remaining half of the tubes.

Thus, when the intermediate legs remain full of water, energy is transferred from the core to the steam generator tubes by three coupled, but largely independent natural circulation processes. These processes were the subject of an extensive set of experiments conducted at 1/7 scale at the Westinghouse R&D center, jointly sponsored by EPRI and USNRC [4]. Motivated by the flow patterns observed in these experiments, a model was constructed for the MAAP code that solves for the flow rates in terms of gas and heat sink temperatures, which are computed separately. This model calculates the flow rates observed in the experiments rather accurately. The NRC-sponsored code Page 11 of 121

SCDAP/RELAP5 also models this phenomenon, but using a somewhat different technique.

Steam generator Reactor vessel Inlet plenum Outlet plenum Hot leg Figure 1. Schematic Depiction of Hot Leg and Steam Generator Countercurrent Flow [3]

Hot gas leaving the upper plenum of the reactor vessel in an SBO sequence will flow along the top of the hot leg, transferring heat to the pipe, and then enter the inlet plenum of the steam generators. There the hot gas forms a plume that rises toward the tube sheet.

Simultaneously, colder gas enters the inlet plenum from the tubes carrying the return flow from the outlet plenum. As the gas from the hot leg rises toward the tube sheet, the plume will entrain and mix with the colder return gas. This implies that whenever the countercurrent flow pattern shown in Figure 1 exists, the gas temperatures experienced by the inner surface of the upper half of the hot leg will inevitably be substantially higher than that experienced by the tubes.

The inlet plenum mixing phenomenon, depicted schematically in Figure 2 [5], reduces the temperatures seen by the tubes. If mixing was perfect, the gas entering the tubes would be at the "mixing cup" temperature, which is the flow rate-weighted average of the temperature of the gas entering the plenum from the hot leg and that of the gas returning back to the inlet plenum through the U-tubes. Theory and the data from the Westinghouse experiments indicate that the inlet plenum mixing is very effective, but not complete, and a temperature gradient exists across the rising plume. For this reason, some of the tubes carrying flow away from the inlet plenum would experience higher temperatures than other tubes. MAAP models the overall inlet plenum mixing process and separately calculates the temperatures of tubes receiving gas from the center of the plume, where it is hottest, those receiving gas with plume-average properties, and those which transport fluid returning from the outlet plenum.

Page 12 of 121

The location of the tube containing the defect is shown in Figure 3. When the location of the inlet of this tube is compared to data from the Westinghouse experiments, it becomes clear that there is virtually no chance that the affected tube will be exposed to fluid from the center of the rising plume, since such tubes are located much closer to the divider plate. Further, there is a modest chance that this tube will transport cold fluid from the outlet plenum back to the inlet plenum, and a very good chance that the tube will experience the average temperature conditions characteristic of the relatively well-mixed fluid leaving the inlet plenum. The latter assumption was made in the quantification effort, and this represents a slight conservatism.

As shown in Figure 4, the axial location of the defect is near the top of the U-bend. This means that the defect will be exposed to gas temperatures that are considerably cooler than those seen near the top of the tubesheet, especially in sequences with an elevated secondary pressure.

Figure 2. Illustration of Inlet Plenum Mixing and its Modeling in MAAP [5]

Page 13 of 121

Column

'C Downward 0

10 20 30 40 50 s0 70 80 s0 100 110 View S

w Cold leg Comanche Peak Unit 1 SG's 2 IR41C71 Figure 3: Location of tube containing defect on tubesheet Page 14 of 121

\\

kdcabon ~n cohorI C7, A4V

(

"a2.

H10-P CIO OrO H9-C6 HP I

Ca up, co H

I 1-8V

-f -.1 -

Note Dimensions re triken from the center ie ofthe support structure except from the tubesheetwach i taken from the edge Figure 4: Axial location of the defect The high temperature of the gas flowing in the upper half of the hot leg and through the surge line is not mitigated by the steam generator inlet plenum mixing process described above. By itself, this favors failure of the hot leg or surge line over the steam generator tube. The principal opposing influence is the thickness of the hot leg. If the core heat-up rate is high, the time required for heat to conduct into the interior of the hot leg will delay hot leg rupture even though the inner surface of the hot leg may be very hot and thus weakened. Since the steam generator tubes are much thinner and have a negligible thermal transport time, the delay imposed by the thickness of the hot leg can partially compensate for the higher gas temperatures experienced by the hot leg. To a lesser extent, the same consideration applies to the surge line.

Page 15 of 121

Effect of Cleared Intermediate Legs on Natural Circulation Flow Patterns The preceding discussion assumed that the intermediate legs remain filled with water. In this case, countercurrent flow develops in the hot leg and steam generators, since unidirectional gas flow out the hot leg and back to the core through the steam generators, cold leg, and downcomer is blocked. Detailed SCDAP/RELAP5 code calculations and small break LOCA experiments in small-scale facilities indicate that if LOCAs exist in the cold legs (e.g. pump seal LOCAs in SBO sequences), one of these "loop seals" may become cleared. This occurs because boiling in the core and gas flow through the break(s) causes the pressure in the cold leg to drop below that, which exists above the core. This creates a pressure imbalance across the U-shaped column of water in the intermediate leg, that potentially can displace this water into the cold leg and then into the downcomer. Since the differential pressure between the cold leg and hot leg is responsible for this behavior, clearing of one intermediate leg loop seal will vent the core and hot legs into the cold legs. This should prevent the clearing of any other intermediate legs.

The same reasoning implies that if the flow area through the core barrel is sufficiently large relative to the total flow area of break(s) in the cold legs, the maximum attainable differential pressure would be limited and loop seal clearing would be prevented. Greater flow area is provided across the core barrel in so-called "T-cold plants". In this regard it is of interest that SCDAP/RELAP5 calculations for Zion (a T-cold plant) did not predict loop seal clearing whereas those performed for Surry did [1,6]. CPSES is also a T-cold plant, so this feature should suppress loop seal clearing in it as well.

Even if a single loop seal should clear, this does not by itself change matters significantly, because a continuous path would still not exist for gas to flow from the core through the loops and return back to the core. -However, if the water level in the downcomer drops below the bottom of the core barrel, then unidirectional flow could be set up. The flow pattern in this case is depicted schematically on the left side of Figure 5

[3] and is as follows: core, affected loop hot leg, steam generator, cleared intermediate leg, cold leg, downcomer, and back to the bottom of the core. This scenario would lead to much higher flow rates than can develop using the countercurrent flow mechanism.

Furthermore, the inlet plenum mixing process, which otherwise reduces gas temperatures seen by the tubes relative to those experienced by the hot legs, will no longer develop.

Thus, we can expect that the tube and hot leg surface temperatures will be similar. These expectations have been previously confirmed by the results of SCDAP/RELAP5 and MAAP calculations.

One slightly mitigating effect is that heat-up rates are much slower in cases with high unidirectional flows. This is not surprising since the core must now heat essentially the entire structure contained in the cleared loop. The slowed heat-up rate largely eliminates the effect of the thermal transport time through the hot leg thickness, which otherwise favors tube rupture.

Page 16 of 121

Figure 5 Possible Natural Circulation Flows in a Severe Accident: Countercurrent Flow in Right Loop (Full Loop Seal) and Whole-loop Flow in Left Loop (Cleared Loop Seal and Uncovered Core Barrel) [3]

Whether unidirectional flow develops in a given sequence therefore depends on whether a loop seal clears and the bottom of the core barrel becomes uncovered. Aside from its presumed dependence on seal LOCA size and the lack of a large flow area through the core barrel, the likelihood of the former process is not well understood. MAAP does not model the loop seal clearing phenomenon, although one may impose this via input to see what the effects are. MAAP does model the water level in the reactor vessel, and thus can be used to help evaluate the possibility that the core barrel will become uncovered.

MAAP calculations performed for CPSES and other plants indicate that the water level drops very slowly once the active fuel becomes uncovered. While the water level will drop rapidly when core relocation begins, one or more of the hot legs, surge line, and possibly the steam generator tubes usually will have failed by this time.

SCDAP/RELAP5 calculations are available that show the water level continuing to drop rapidly even after the level is below the fuel. It is believed that this behavior is probably erroneous, and in this regard it is of interest that recent comparisons of SCDAP/RELAP5 and MELCOR results indicate that the water level drops much slower in the latter, in agreement with MAAP results.

For all these reasons, the probability of achieving whole-loop circulation in CPSES due to loop seal clearing in combination with uncovering of the core barrel is assessed to be very small.

Behavior of Tube Defects at High Temperatures The behavior of tubes containing axial cracks at normal and elevated temperatures has been extensively studied by Argonne National Laboratory [7], and their work forms the basis for the CPSES analysis.

At normal operating temperature, the pressure required to break the remaining ligament of a part-through wall defect is characterized by a quantity mp, defined by:

Page 17 of 121

pristine tube burst pressure P

pressure required to fail ligament Following ligament failure, the now through-wall defect may be stable or unstable, depending on its length. The pressure required to cause a through-wall defect to grow in an unstable fashion, causing a tube burst, is similarly defined by a quantity denoted m:

pristine tube burst pressure (2) defected tube burst pressure The quantity m has been correlated to defect length, and mp has been correlated to the length and depth of the defect.

Note that two situations can occur:

Im < mP: In this case, typical of short but deep defects, the ligament will fail at a lower pressure than is required for burst. Thus, the defect will "pop-through" and leak at a relatively low rate. A further increase in pressure is required to cause the pop-through to burst.

• m> mP: In this case, typical of relatively long but shallow defects, ligament failure will immediately lead to burst.

ANL has demonstrated that these quantities can also be used to characterize the performance at elevated temperatures during severe accidents. For part-through wall defects, ligament failure can be predicted by performing a creep-rupture analysis in which the nominal stress is increased by mp. For through-wall defects, ANL also showed that the pressure Pb required to cause burst can be calculated from the parameter m using:

o-Ct (3) mrm where a is a material property called the flow stress, given by cs=k(S. + SY)

(4)

In these equations, So is the temperature-dependent ultimate stress, Sy is the yield stress, k is a constant in the range from 0.5 to 0.6, t is the nominal tube thickness, and rm is the average tube wall radius.

Characterization of defect in tube SG2 R41 C71 Westinghouse has calculated median burst pressures for the tube SG2 R41 C71 at various points in the cycle leading up to the outage. These were calculated by combining Page 18 of 121

information from post-shutdown leak rates, eddy current inspection data from the previous outage as well as post-shutdown, and defect growth models. The analysis is described more fully in Reference [12] and the key results are shown in Table 1.

Table 1: Calculated Median Burst Pressure for Defected Tube at Various Points in Operating Cycle Approximate time in Median burst pressure of Stress multiplication cycle (EFPY) defected tube (psi) factor m 0.7 3212 3.38 1.05 3068 3.54 1.57 2812 3.86 1.58 2727 3.98 The third column was obtained using the Westinghouse-calculated burst pressure for a pristine tube of 10860 psi at operating temperature. The values shown in this table do not include an allowance for "relational error". As noted by Westinghouse, comparisons of the results of the model to measured burst pressure of pulled tubes having nearly through-wall defects show that the model provides accurate predictions of burst pressure without adding this conservatism.

Real defects have a complex geometry and often consist of multiple crack segments. To evaluate tube behavior, severe accident analysts typically define an equivalent crack geometry that is expected to behave similarly to the actual geometry. For a given burst pressure, one could define either (relatively speaking) a deep but short crack or a shallow but long crack. If the temperatures are relatively low, so that the behavior of the crack is expected to be qualitatively similar to that which would occur under DBA conditions (but with somewhat reduced material properties), this may not matter very much.

The maximum depth at the preceding outage was estimated by Westinghouse analysts from eddy current data to be 80 percent. For such a deep defect, the m and mp correlations indicate that mp will be greater than m whenever m is larger than 3.3. As indicated in Table 1, this is expected to be true for the entire last half of the cycle, implying that ligament failure will not immediately lead to tube burst. Thus, if we conservatively assume that the defect configuration at 0.75 EFPY also represents how the defect would have behaved over the initial half of the cycle, we can characterize the defect over the entire cycle as an equivalent crack that is through-wall with a length that increases with time to explain the change in burst pressure. The calculated effective crack length using these assumptions is shown in Figure 6. The actual crack was observed by a video inspection to consist of two segments, the upper end of one segment being separated from the lower end of the next by a ligament approximately one tube thickness in width. In view of uncertainties in the width of this segment, both segments are assumed joined in this assessment. Depending on the actual width of the ligament, this could represent a considerable conservatism since a separation equal to twice the nominal thickness of the tube is typically regarded as sufficient to ensure that each crack would act independently. As noted in Reference [12], the burst pressure would be much higher in such a case.

Page 19 of 121

The leakage through the crack at shutdown was measured to be 2.6 gpm at 2150 psid. As noted in Reference [12], the Westinghouse models calculate a through-wall length of 0.5 inch to explain this leakage. Similarly, the models in PROBFAIL calculate that a length of 0.54 inch would be required. The Westinghouse burst pressure results combined with the ANL correlation for m predicts that this length would grow to the -0.95 inch shown in Figure 6 if exposed to high pressure. The total crack length measured at shutdown using an eddy current probe is about -0.91 inch (see Figure 1 of Reference [12]). Since a portion of the 0.91 inch crack was fairly shallow, the eddy current results, taken at face value, imply that the calculated final defect length is somewhat conservative.

Effective Crack Length

-. 0.95

~0.9 h0.85 C,

~0.8 0.75 0.50 0.70 0.90 1.10 1.30 1.50 1.70 Time (EFPY)

Figure 6: Calculated crack length of a through-wall defect exhibiting the same burst pressure behavior expected of the actual defect.

Quantification of Tube Rupture Probability The quantification of the tube rupture probability for a given accident sequence begins with the MAAP-calculated temperatures and pressures. These are input into the EPRI PROBFAIL code [9] to calculate a range of hot leg and surge line rupture times. The calculated range in failure times reflect the scatter in the Larson-Miller creep rupture correlations that reflect variations in material properties, but for most high pressure sequences, this range in failure times is fairly small.

To quantify the performance of the defect over the operating cycle, a range of defect lengths are also input to PROBFAIL. From the analysis of the calculated times of burst for each assumed defect length, the minimum through-wall defect length necessary for tube burst to occur prior to hot leg or surge line creep rupture is calculated. The probability that the defect would actually have this length can then be estimated from Figure 6 by determining the fraction of the cycle for which the defect would be at least this long.

Page 20 of 121

A key part of the analysis is assessing the flow strength, Equation (4), used in the burst pressure calculation, Equation (3). An effective flow stress was indirectly estimated by ANL in their high temperature testing by noting which defects lead to tube rupture as opposed to a small leak [7]. At the relatively high temperatures used in the ANL testing, the flow stress determined in this way was higher than that obtained using conventional testing techniques. ANL explained this by noting that the strain rate experienced in their testing was higher than is typically used in materials testing.

Unfortunately, the ANL tests were stopped as soon as ligament failure occurred. Thus, for a given tube, direct use of their correlation may be slightly non-conservative, since in the reactor case the through-wall defect could be exposed to high temperatures for several hundred seconds during the period between ligament failure and hot leg or surge line rupture.

In another respect, the use of the ANL correlation could be conservative. At normal operating temperature, the ANL correlation yields a flow stress that is lower than that which would be calculated from the sum of the measured yield and ultimate stress for the tube in question. Thus, the direct use of the ANL correlation would yield a burst pressure much lower than the Westinghouse results. For both of these reasons, in this analysis we utilized a flow stress correlation developed from conventional, low strain rate testing performed at INEL [8]. This was multiplied by 1.1 so that the sum of the yield and ultimate strength at operating temperature would agree with the measured properties of the tube (149 ksi measured versus 133 ksi obtained by the INEL correlation). When used with the recommended value of k of 0.598 appropriate for low temperatures [9], this yields the Westinghouse-calculated operating temperature burst pressure of 10860 psi for a pristine tube.

At higher temperatures, the value of k is expected to drop somewhat due to reduced strain hardening. ANL recommends that a value of k of 0.5 be used at very high temperatures (above 1000K) [7]. As discussed earlier, the defect location is such that the temperatures it would experience are relatively low in most cases, so a value for k of 0.55 that is intermediate between the values appropriate for these two temperature regimes is considered reasonable. To summarize, the flow stress used in the burst pressure equation at elevated temperatures was obtained by multiplying the INEL-developed correlation for the sum of yield and ultimate stress of Alloy 600 tubing by the product of 0.55 and 1.1.

C. Accident Progression Event Tree Based on the discussion provided above and experience gained from previous analyses, an accident progression event tree (APET) was developed to aid in the quantification of the likelihood of induced tube rupture and the potential for a large release of fission products. The APET is shown in Figure 7. The top events of the APET and their phenomenological and systemic bases are discussed below.

Page 21 of 121

t.FORY 1

15O3 RI SODRESS NONE I

sar Rz

^_

0.PORY ISt RI CDIM4 E!htRY O-TOECOP 4 SOP RESS I

ES, 4 l.2PORYSO I

Tsa R SO' RESS 1

tSaTRW i

I PAJCOAVA IL 1-PORY EO MRTK IOSEALCLEAR2 I

sEOr RS I

O-PORY I

Oau R2 I

SOPRESS SOETO_2sOO 4

ECTarRIO IFORY EirRI I SGO RESS I

SEA ICLEA R2 I

15U R12 I

I S~r RI S

.__I Figure 7 CPSES Accident Progression Event Tree Page 22 of 121 SO RESS 1

EO rRi4

CDB3/4 Entry-The entry states for the APET were from plant damage states defined in the IPE backend analysis whose end states were identified as those that could lead to ISGTR (i.e., High/Dry plant damage states). Most of these sequences are phenomenologicaly similar to early station blackout sequences, in which the battery is still available to operate instrumentation and the primary and secondary relief valves. As contrasted to the analysis in Reference [12], station blackout sequences in which core damage occurs relatively late following battery depletion are not as dominant for Comanche Peak, based on the offsite power recovery methodology implemented at CPSES. The plant damage states (PDSs) that have the potential to induce a SGTR are: 3H, 3F, 4H, 4F, 3SBO, and 4SBO.

See Appendix 1 for a detailed discussion of the plant damage states used in the analysis.

FW AVAIL/SAMG-This event defines whether auxiliary feedwater is available after core damage. If this occurs, the steam generator tubes will be cooled and thermally-induced steam generator tube rupture will be virtually impossible. It was also considered reasonable in these sequences to neglect the slight possibility of pressure-induced tube rupture, since the RCS pressure will rapidly decline if the steam generators contain water on the secondary side and are subsequently depressurized. Also, maintaining water in the secondary would make fission product releases, if any, very low due to the effect of scrubbing.

Seal LOCA size-Seal LOCAs were classified using broad categories based on previous detailed analysis of seal performance given loss of cooling as defined in the CPSES IPE. The cases with little or no seal damage were assumed to have a leak rate less than 60 gpm per pump (all four reactor coolant pumps were assumed to have the same leakage rate for simplicity). The next category of seal LOCAs included cases with leakage between 60 gpm and 250 gpm per pump, evaluated at the initial cold leg conditions. Larger seal LOCAs, e.g. of 250 gpm to 480 gpm per pump, are considered in the CPSES PRA model. These larger seal LOCAs progress in an analogous manner to a Small Break LOCA and therefore do not lead to conditions conducive to ISGTR (i.e., the RCS pressure at core damage is low). The seal LOCA sizing top event is used in the APET solely to distinguish cases that have a nontrivial chance of loop seal clearing. Based on the calculations summarized in Reference [11], sequences with seal LOCAs up to 250 gpm per pump were considered to act in a similar fashion absent loop seal clearing, primarily because the RCS pressure at the time of hot leg rupture is still relatively high. Stuck open PORVs were included under this event. However, it should be noted they are binned with the 0 to 60 GMP/pump seal LOCAs. This was done since the purpose of this event is to establish likelihood for loop seal clearing. As previously explained, there is little likelihood of loop seal clearing for the smaller LOCAs. Stuck open PORVs also reduce or eliminate the likelihood of loop clearing since they create a hot leg relief path precluding a high delta pressure across the loop seal.

Page 23 of 121

Loop Seal and Core Barrel Not Clear-This event quantifies the probability that a loop seal will clear and the core barrel will uncover prior to hot leg rupture. Note that this would only be of concern if the cleared loop seal was in the affected loop. Based on previously published SCDAP/RELAP5 analyses, it was assumed that leakage rates of less than 60 gpm would be too small to develop enough differential pressure to clear the loop seals. The 60 to 250 gpm cases were assumed to have a small probability of causing loop seal clearing in the affected loop. However, this was assessed to be very unlikely (0.01 percent) [15] because, as discussed previously:

1) It was considered very unlikely that in these sequences the core barrel would uncover prior to the occurrence of hot leg or surge line rupture.

This conclusion is based on the low rate at which the water level drops in both MAAP and MELCOR calculations once the active fuel is completely uncovered.

2) The presence of substantial flow area through the core barrel in Comanche Peak tends to limit the pressure differential that could develop across the core barrel. As discussed above, an analysis of a 250 gpm seal LOCA case in Zion, another T-cold plant, apparently did not result in loop seal clearing [6]. This absence of loop seal clearing with seal LOCAs of this size is noteworthy: as discussed in previous EPRI presentations to the staff, the LOCA sizes assumed in NRC-sponsored SCDAP/RELAP calculations are consistently about 50 percent larger than calculated in [10]

due to a systematic misinterpretation of the thermal conditions used to evaluate the flow rate through the seals. The same reference also documents a "480 gpm" seal LOCA case in which no mention is made of loop seal clearing.

Even in the unlikely event that a loop seal and the core barrel were cleared prior to hot leg rupture, this is three times more likely to occur in one of the other loops. The development of unidirectional through-flow in one of the other loops would not increase the thermal challenge on the defect. Finally, based on results discussed in Reference [11], if the loop seal did clear in the affected loop and if, as is fairly likely, the steam generator was depressurized, even undamaged tubes could fail. Thus, the defect would not add appreciably'to the risk posed by these very unlikely sequences.

At least One Power Operated Relief Valve Stuck-This event pertains to the probability of a pressurizer power operated relief valve (PORV) being stuck open due to repeated challenges before or after core damage. This and the next event are intended to quantify the likelihood that the reactor coolant system will be depressurized due to open PORVs.

At least 1 PORV Available-On the basis of emergency drills conducted at Comanche Peak (see next section) and the Severe Accident Management Guidelines, the operators are expected to promptly open one or more available Page 24 of 121

PORVs when the core exit thermocouples exceed 1200 F. For sequences where the PORV(s) are available, the likelihood that this action will be successful was quantified using the CPSES PRA human reliability model based on existing plant procedures. [Appendix 3]

Steam Generator Remains at Pressure-As mentioned previously and discussed in more detail below, the operators are very likely to manually depressurize the steam generators in an attempt to achieve accumulator discharge. The operators are expected to depressurize all units simultaneously, and then to isolate the steam generators by closing the atmospheric relief valves when their water levels reach 5 percent. Based on MAAP calculations summarized in the next section, this is sufficient water to largely repressurize the units, reducing the challenge to tube integrity. However, the procedures provide the operators with the flexibility to delay depressurization of one of the steam generators. In this case, if the lag is sufficiently long, it would cause the affected steam generator to be fully dried out and depressurized prior to its being isolated. In this case, the unit will be at low pressure and dry when the core becomes uncovered. The quantification of this event also considers relatively low frequency sequences in which the atmospheric valves are not available, e.g. due to battery depletion, but a stuck open secondary safety valve causes depressurization. For this portion of the evaluation the assessment of safety valve reliability documented in reference

[11 ] was adapted. Using vendor test data, that study concluded that secondary safety valves would be expected to reliably cycle for a long period of time if steam was flowing through the valve. However, flowing water would rapidly damage the valves, as is the case on the primary side. Thus, for late overfill cases in which the turbine driven auxiliary feedwater system remains operative after loss of secondary level indication, one or more secondary safety valves is assumed to always stick open.

ISGTR-This event quantifies the likelihood that a rupture will be induced in the steam generator tube containing the defect by a combination of increased temperature and/or differential pressure. The quantification of this event is described in the Fault Tree Development and Quantification section of this report.

Large Release of Fission Products-A large fraction of the High/Dry sequences that do result in tube rupture occurs into an intentionally depressurized, but isolated secondary. In these cases, there is a chance that the time required to repressurize the unit to the secondary relief valve setpoint (about 15 minutes) will be less than the extra time required for the hot leg or surge line to rupture.

This consideration increases the critical crack length required for a large release of fission products, since the crack needs to be long enough not only to rupture, but to rupture early enough that the secondary side fully repressurizes before another part of the RCS fails. This in turn reduces the duration of the operating cycle over which the defect had sufficient length to be of concern. The Page 25 of 121

quantification of this top event is also discussed in the Fault Tree Development and Quantification section of this report.

D. MAAP Calculations In general, MAAP runs were made for three purposes: (1) to guide the construction of the APET (Figure 7), i.e. to simplify the tree by eliminating unneeded paths, (2) to generate relevant information for probability assignments in the various underlying fault trees and (3) to obtain boundary conditions of pressure and temperature for use in the PROBFAIL code. The PROBFAIL analyses were used to calculate the relative failure times of hot leg, surge line and of the flawed steam generator tube, which are ultimately used to assign split fractions to the ISGTR and large fission product release events on the APET.

The MAAP runs are labeled with the same name as the corresponding path along the APET. In some cases, an extra letter is appended to denote variations in MAAP runs within the same APET path. Making reference to Figure 7, run ISGTRO4, for example, is for an early core melt station blackout (from PDS 3SBO), where the RCS remained at high pressure and a steam generator safety valve is assumed to stick open after its first challenge, e.g. because of an error made during maintenance of the valve. In this run there was little or no RCP seal leakage, so the loop seal remained plugged, resulting in the usual High/Dry/low natural circulation path shown in Figure 1. Run ISGTR04a is for a different variation of High/Dry/low sequence, namely a late core melt in which the TDAFW operated for 4 hrs (from PDS 4SBO). Following loss of level instrumentation, the SG is assumed to overfill, causing a SG safety valve to stick open. This results in a depressurized steam generator with the RCS remaining at high pressure. No RCP seal LOCA occurs in run ISGTR04a either, so Figure 1 for the natural circulation pattern also applies. Both cases (ISGTRO4 and ISGTR04a) result in the High/Dry/ low scenario (APET path ISGTR04) and yield similar relative failure times for hot leg, surge line and flawed tube, but the variation was investigated for the sake of completeness. This section provides a complete discussion of all runs, corresponding APET paths as well as the reasons for and conclusions derived from the variations performed.

Consistent with the organization of the APET, the MAAP runs are divided into two broad categories for purposes of presentation: (a) no RCP seal leakage or leakage less than 60 gpm/pmp and (b) RCP seal leakage between 60 gpm/pmp and 250 gpm/pmp. There are no seal leaks greater than 250 gpm/pmp in the present study because those result in sequences which are binned into PDSs defined by low vessel failure pressures (i.e. lower than 400 psia, the threshold for DCH/HPME in the IPE) and therefore were not considered candidates for ISGTR. (MAAP run ISGTRO2, discussed below, shows that RCS pressures lower than 400 psia preclude a SG tube (for the flaw under consideration in this work) from rupturing prior to the hot leg or the surge line, even with the steam generator at low pressure.) The MAAP runs for APET end states ISGTR01-ISGTRO6 correspond to cases where there are no seal LOCAs (or they are less than 60 gpm/pmp) and therefore it is assumed that the loop seal and/or the core barrel remain blocked so that the post core damage natural circulation path shown on the right side of Figure 5 applies.

The same applies to APET end states ISGTR07-ISGTRI 0, which correspond to cases Page 26 of 121

where there were seal LOCAs between 60 gpm/pmp and 250 gpm/pmp but, nevertheless, the loop seal / core barrel remained blocked for through flow. APET end states ISGTR1 l-ISGTR14 also involved seal LOCAs between 60 gpm/pmp and 250 gpm/pmp and in this case the loop seal / core barrel cleared for through flow so a natural circulation loop through the core was established as shown on the left side of Figure 5.

Not all APET paths have a MAAP run because the boundary conditions to calculate relative pipe failure times might be similar or bounded by other paths. For example, based on the work summarized in Reference [11], the cases with 0 to 60 gpm/pmp seal LOCA are judged to be sufficiently similar to those with seal LOCAs in the 60 to 250 gpm/pmp range (assuming no loop seal clearing) that no MAAP runs were made of the latter. This represents a small conservatism, since the RCS pressure is slightly lower in the latter.

Therefore, there are three key APET paths for which there are MAAP runs where either the loop seal or the core barrel remain obstructed to through steam flow, and where the usual severe accident natural circulation path of Figure 1 applies. These runs are labeled:

ISGTRO2, ISGTRO3, and ISGTRO4. However, as previously explained some APET paths have more than one run and receive an extra letter to their name in addition to the APET path name. Thus, there are also variations a, b, c, and d for some of these runs.

All are discussed in detail in what follows.

APET Branches with No RCP Seal Leakage or Leakage Less Than 60 gpm/pmp The candidate high/dry sequences for ISGTR are drawn from following PDSs: 3H, 3F, 4H, 4F, 3SBO and 4SBO. As seen in Reference [17], based on their relative frequencies, the majority of these sequences are from PDS 3SBO. The 3SBO sequences have loss of RCS inventory, including RCP seal leakage of less than 60 gpm/pmp. These sequences are early core melt station blackouts, where the TDAFW either failed to start, was unavailable, or was damaged in the initiating event. RCP seal performance in these sequences is based on the CPSES PRA seal LOCA model. Given the small seal LOCA size, it is assumed that a negligible fraction of these sequences will result in simultaneous loop seal and core barrel clearing, and this is assumed in the construction of the APET.

These cases (RCS inventory leakage or RCP seal leakage less than 60 gpm/pmp - loop seal and/or core barrel blocked) are subdivided into four types to characterized, the pressure and thermal challenge to the steam generator tubes during a severe accident: (1)

High/Dry/ low (HDL), where the RCS is at high pressure and the steam generator with the flaw is at low pressure and dry, (2) low/dry/low (LDL), where the RCS is at a relatively low pressure (due to PORV operation or safety valve / PORV failure due to excessive cycling with water) and the steam generator with the flaw is at low pressure and dry, (3) High/Dry/ high (HDH) where the RCS is at high pressure and the steam generator with the flaw is also at high pressure and dry and, (4) low/dry/ high (LDH) where the RCS is at low pressure but the steam generator with the flaw remains at high pressure. This last type of sequence is bounded by the High/Dry /high and low/dry/low Page 27 of 121

variants, and so was not explicitly run. The MAAP calculations for these sequences are described below.

Two sets of figures (for a total of 18 figures) are presented in Appendix 7 of this report, for each MAAP run, in the order in which they are discussed below. One set shows the primary pressure and steam generator pressures. These steam generator pressures are shown for two loops: the so-called intact or unbroken loop, which in the CPSES MAAP model corresponds to three loops lumped together, and the broken loop, which in NIAAP is a single loop. Either or both the intact loop or/and the broken loop can represent the steam generator with the flawed tube, depending on the conditions under consideration.

The second set of figures shows the hot leg temperature and the tube temperature at the flaw location for both loops, along with the surge line temperature. These figures define the boundary conditions for the PROBFAIL runs.

High Dry Low (HDL). APET branch ISGTR04:

MAAP RUN ISGTR04:

This run represents APET branch ISGTRO4. In this scenario the RCS is at high pressure and the steam generator with the flaw is at low pressure and dry.

ISGTRO4 corresponds to an early core melt station blackout (from PDS 3SBO).

The RCS remained at high pressure and a steam generator safety valve stuck open after its first challenge. In this run there was no RCP seal leakage, so the loop seal remained plugged, resulting in the usual post core melt natural circulation path shown in Figure 1. This is essentially a worst case scenario from the point of view of the flawed tube rupturing before the hot leg / surge line and the boundary conditions from this case are input into PROBFAIL to determine the ISGTR split fraction for this branch.

MAAP RUN ISGTR04a:

Run ISGTR04a is for a late core melt where the TDAFW operated for 4 hrs (from PDS 4SBO). At battery depletion, level instrumentation is lost, and it is conservatively assumed that the operators allow the SG to overfill at a fairly rapid rate. Overfill is assumed to cause a SG safety valve to stick open, first in the broken loop and later in the intact loop steam generators. Both events cause the associated steam generators to blow down and dry out. The RCS depressurizes in response to the cooldown, and then repressurizes after dry-out.

There is no RCP seal LOCA for run ISGTR04a, the natural circulation pattern shown in Figure 1 applies. Both cases (ISGTRO4 and ISGTR04a) result in the high dry low scenario (APET path ISGTR04) and yield similar relative failure times for hot leg, surge line and flawed tube.

Page 28 of 121

MAAP RUN ISGTR04b:

This run investigates one of the likely operator depressurization strategies.

According to the Emergency Operating Procedures (ECA-0.0, Loss of all AC Power) in the event of a station blackout the operators would attempt to depressurize the RCS by depressurizing the steam generators in order to try to get the accumulators to inject into the RCS. The procedure requires that SG depressurization be secured when the lowest SG's wide range water level drops to 5 percent (approximately 5% of the initial mass of water). In interviewing operations support, it was concluded that operators would have latitude to either depressurize all steam generators simultaneously and then close the ARVs on all steam generators or, that they could depressurize three, hold one in reserve, then depressurize that one. In the latter case, operators would close all steam generators ARVs only when that last steam generator reached 5% wide range water level. The significance of this difference in strategies, all permissible by procedure, is that when the ARVs are finally closed in the second scenario, only the last steam generator is able to re-pressurize. Those steam generators that were allowed to dry out, although eventually sealed, do not have enough water mass remaining to re-pressurize. In this MAAP run ISGTR04b, the intact loop SGs (representing three loops) were depressurized early in the sequence. When the level in those steam generators reached approximately 5% wide range, the ARV in the BLSG was opened and when its level reached approximately 5%

wide range, all steam generator ARVs were closed. The pressure in the broken loop SG rose back to approximately 800 psia but the pressure in the other generators remained less than 200 psia. Clearly, it can also be concluded from the behavior of the broken loop SG in MAAP run ISGTR04b, that if the steam generators had all been depressurized simultaneously and then closed simultaneously at 5% wide range water level they would all have returned to 800 psia. PROBFAIL shows that when the steam generator is able to re-pressurize to approximately 800 psia, the flawed steam generator tube does not fail prior to the hot leg or surge line. Therefore, this runs forms the basis for the relevant basic event in the SG Remains @ Press Fault tree / APET branch. This was given as 50-50 probability that the operators would utilize the sequential depressurization strategy. This value is believed to be conservative based on operations support personnel input, specially in that it was felt that operators would not let the steam generators dry out prior to closing each ARV, even though procedure flexibility exists.

MAAP RUN ISGTR04c:

In most of the MAAP calculations, the rupture of the hot leg, surge line, or steam generator tube, while calculated, is not actually implemented. This allows the continued challenge of the remaining RCS components to be studied in the event that rupture is delayed, e.g. due to better-than-average materials properties. In this case, however, a conservatively early steam generator tube rupture was modeled to investigate the potential for a large, early release of fission products.

Page 29 of 121

This input for this run ISGTR04c is similar to that of previous run ISGTR04b, except the flawed steam generator tube rupture time calculated by PROBFAIL for the previous case is used as the time at which the tube is actually ruptured.

The run shows that even though the flawed tube ruptures prior to the hot leg, the rupture occurs when the steam generators, are depressurized but re-isolated.

While the steam generator will then slowly re-pressurize through the breach in the flawed tube, the pressure usually will not rise to the level of the steam generator safety valves setpoints until after hot leg rupture is calculated to occur in PROBFAIL. As a result, it is concluded that while proceduralized operator action to depressurize the steam generators can result in induced failure of the flawed tube (with an assumed 50% probability if steam generators are depressurized sequentially rater than simultaneously) this kind of steam generator depressurization, where the steam generators are eventually re-isolate, in most cases will not result in LERF since fission products will remain trapped in the steam generator. This MAAP run ISGTR04c forms the basis for a lower value for the LERF frequency in comparison with the ISGTR frequency, as indicated in branch ISGTRO4 of the APET (Figure 7). The quantification of this event is discussed below.

MAAP RUN ISGTR04d:

This run is the same as run ISGTRO4, except the RCS safety valve set points were slightly staggered to more realistically count the number of lifts with water and steam for each valve for purposes of determining the valve failure probabilities. The probability determination for this event is discussed in the Fault Tree Development and Quantification section of this report. This calculation was also used to investigate the effect of PORV availability on the thermal challenge of the tubes: in most of the sequences, PORVs are available, reducing RCS pressure by 150 psia compared to late core melt scenarios when only the PSVs are available.

Low Dry Low (LDL). APET branch ISGTR02:

MAAP RUN ISGTR02:

This MAAP run ISGTRO2 serves two purposes. First, provides boundary conditions for the PROBFAIL ISGTR APET branch ISGTRO2 split fraction determination for the case where the RCS is depressurized (one PORV is opened by the operators when core exit thermocouples (CET) reach 12000F) and the steam generators are depressurized. In this case it is assumed the safeties stick open at their first challenge, but similar results would be expected for cases where the operators depressurize the affected steam generator. This case is also an early station blackout from the 3SBO. The basis for the assumed timing of the RCS depressurization (CETs reach 12000F) is in the SAMGs. SACRG-2 clearly indicates that control of the accident passes from the control room to the TSC when CETs reach 12000F. In ERO drills the TSC is always staffed and Page 30 of 121

prepared prior to implementation of SACRG-2. In fact the CPSES ERO has SAMG engineer position whose job prior to SACRG-2 is simply to scan the SAMGs, i.e. begin monitoring the DFC and the SCST and to prepare for implementing any relevant guideline as soon as the transition to the TSC occurs.

The first guideline to be implemented is SAG-1, which is precisely to depressurize the RCS using the PORVs. The PORVs will be available in many of these cases because this is an early station blackout where battery power is still available. Operators at this point will not be reluctant to depressurize the RCS because of the high RCS temperature. In fact, they will be eager to do it given the possibility of accumulator injection. As a result of RCS depressurization, the PROBFAIL ISGTR APET split fraction indicates a very high likelihood that the flawed tube will fail after the hot leg or surge line. The second purpose of this MAAP run ISGTRO2 is that in combination with the PROBFAIL result, it establishes that one PORV is sufficient to depressurize the RCS to the point where even the flawed tube will fail after the hot leg or surge line.

MAAP RUN ISGTR02a:

This run ISGTR02b is the same as run ISGTRO2 except that 2 PORVs were used to depressurize the RCS in this case. This was done to examine the potential for the lower RCS pressure to eliminate hot leg creep rupture. If this were to occur, hot leg failure would not protect the defected tube from the challenge it would face when the RCS again repressurizes following core relocation to the lower head. Hot leg rupture well in advance of core relocation was observed, as in the case when only 1 PORV is available.

MAAP RUN ISGTR02b:

This run is identical to ISGTRO2 except that the nozzle thickness is substituted for the hot leg thickness to see if the nozzle would rupture prior to the hot leg.

Both elements were found to fail at nearly the same time (the thicker nozzle is made of weaker material than the thinner hot leg) so that the hot leg dimensions were kept in all of the other runs.

High Drv High (HDH). APET branch ISGTR03:

MAAP RUN ISGTR03:

As with ISGTRO2, this run ISGTRO3 also serves two purposes. First, it provides boundary conditions for the PROBFAIL ISGTR APET branch ISGTRO3 split fraction determination for the case where the RCS remains at pressure and the steam generators also are pressurized. Second, this case also establishes an approximate maximum leakage rate from the steam generator secondary such that the final steam generator pressure is still sufficiently high that the steam Page 31 of 121

generator tubes to fail after the hot leg. This case is also an early station blackout from the 3SBO. The RCS is assumed to remain pressurized but one of the steam generators is allowed to leak at 1 Kg/sec of steam from the safety valves starting at the time when they are first challenged. This establishes a quantitative maximum permissible leakage that is achievable. This information is used to justify the relevant basic event probability in the SG REMAINS@PRES fault tree.

APET Branches with RCP Seal Leakage Greater Than 60 gym/pmp And Less Than 250 gpm/pmp As previously explained the runs with intact loop seals and seal leakage between 60 and 250 gpm/pmp were conservatively bounded by the cases with no seal leakage. Thus, no runs were necessary for the cases where, in spite of the seal LOCAs, the loop seal and/or the core barrel remain blocked, so that the post core damage natural circulation path of Figure 1 applies. Again, ISGTRO7 is essentially the same as ISGTROI, ISGTRO2 is essentially the same as ISGTRO8, ISGTRO3 is essentially the same as ISGTR09 and ISGTR04 is essentially the same as ISGTR10. The main difference, between these runs is in the size of the RCP seal leakage, which is not relevant to the figures of merit: the relative rupture times. Thus, cases ISGTROI-ISGTRO4 have higher RCS pressures and are therefore conservative or essentially the same as cases ISGTR07-ISGTRIO with respect to timing the rupture of the flawed steam generator in relation to that of the hot leg /surge line. Consequently the results of runs ISGTROl-ISGTR04 discussed above are used for the split fractions of cases ISGTRO7-ISGTR10, respectively and those MAAP runs are not needed.

Also as previously explained, MAAP does not have a mechanistic model for clearing the loop seal, although it does have one for clearing the core barrel. Both these paths must be cleared for there to be a path for steam through the core, hot leg, steam generator tubes, cold leg, and back through the core. As a practical matter, based on previous experience, MAAP would not clear the core barrel for any of the 60-250 gpmlpmp seal LOCAs under consideration here until long after hot leg failure. Therefore, it is difficult to believe that this type of flow pattern would actually occur, in contrast with the usual severe accident flow pattern of Figure 1. Nevertheless, a certain probability is given to those cases and the through paths could be artificially forced clear in the relevant MAAP runs to follow this possible accident progression. Nevertheless, the cases where as a result of the seal LOCAs, both the loop seal and the core barrel cleared are probabilistically insignificant, due to reasons related to the nature of the sequences and PDSs involved in the present study. As a consequence these types of runs were not deemed necessary. It should be noted that the high dry low case with both the loop seal and the core barrel cleared, path ISGTR14, is so severe that even pristine tubes could fail prior to the hot leg / surge line, as happened in the Diablo Canyon study [11]. When that is the case, that end state does not contribute to delta LERF for purposes of the present study. Furthermore, cases where the RCS is depressurized via PORV might not be affected by loop seal core barrel clearing, since the reduction in pressure will disrupt the natural circulation of hot gases to the steam generator tubes.

Page 32 of 121

E. Probability of Tube Rupture and Large Fission Product Release As discussed previously, the tube rupture probability was quantified by determining how long a through-wall crack must be for tube rupture to occur prior to hot leg or surge line rupture. The key results of this analysis are shown in Table 3, and a brief discussion of the results is provided below. These results are applicable to ISGTR sequences that follow a similar progression through the APET.

Table 3: Tube Rupture Probability End State Average tube temperature at Critical crack Probability of median RCS creep rupture time length (inch) rupture ISGTR-2 764 K 0.99 Nil 646 K*

ISGTR-3 684 K

>1.5 Nil ISGTR-4 early 821 K 0.84 inch 0.3 ISGTR4 late 832 K 0.77 inch 0.6

• At time of PORV opening ISGTR-2 This is a sequence with a depressurized secondary, most likely caused by operator action.

In accordance with SAMGs, the operators open at least one PORV when the core exit thermocouples reach 1200 F. The likelihood that a pressurizer PORV or safety valve will stick open prior to this time was not credited in the MAAP calculation, even though this is quite likely in view of the results quoted in Appendix 6. Note also that a pressurizer safety valve has twice the rated flow of a PORV, and thus would be considerably more effective in depressurizing the RCS.

The tube temperature at the time the PORVs are opened is 646 K, and PROBFAIL predicts that this represents the most severe combination of temperature and pressure experienced by the tube. In other words, as time progresses the RCS pressure drops while the tube temperature increases, but the ratio of the applied stress to the temperature-dependent tube flow stress drops. Thus, the limiting condition for evaluating tube integrity is just slightly more severe than that which would be used for a design basis MSLB evaluation. Given that the burst pressure of the defect configuration at shutdown (i.e. the maximum defect length) is just capable of withstanding MSLB pressures, it is not surprising that the calculated critical crack length is slightly greater than the final crack length. For this reason, averaged over the cycle the probability of tube rupture is quite small and is determined in this sequence by pressure rather than thermal considerations.

ISGTR-3 This high-dry-high sequence has a pressurized RCS and a secondary pressure that is elevated, but slowly declining due to an assumed 1 kg/s steam leak. The tube Page 33 of 121

temperature at the time of hot leg rupture is relatively low (684 K), and the differential pressure is also relatively low. The critical crack length is much longer than the final length of the defect, and the chance of tube rupture is therefore considered very low.

ISGTR-4 This end state consists of sequences where the secondary side of the affected steam generator is depressurized, a pressurizer safety/relief valve does not stick open, and the operators either fail to open a pressurizer PORV to depressurize the reactor coolant system or else PORVs are not available. In the first variation, denoted ISGTR-4 early in Table 2, the PORVs are available but are not manually opened. The PORVs reduce the stress on the tubes compared to the second variation in which only the pressurizer safety valves are assumed to be available for controlling RCS pressure.

In both cases, the tube temperatures are relatively high, leading to relatively short critical defect lengths and a significant probability of tube rupture.

However, as noted above, if tube rupture does occur, it will in most cases cause a blowdown of the RCS into an isolated steam generator. Whether this will result in fission product release depends on whether the tube fails early enough to repressurize the secondary system to the relief valve setpoint prior to hot leg rupture. The time required to repressurize the secondary system was evaluated using MAAP to be about 900 seconds. Thus, for fission product release to occur, the defect must be sufficiently long that tube ruptures occurs earlier than 900 seconds before hot leg rupture. This reasoning leads to the results shown in the table below:

Table 4: Conditional Probability of Large Release of Fission Products in Sequences Involving Tube Rupture Into a Depressurized but Isolated Steam Generator.

End state Critical crack length for Conditional probability the fission product release, inch defect is this long, given that rupture occurs ISGTR-4 early 0.94 0.01 (PORVs)

ISGTR-4 late (no 0.86 0.33 PORVs)

As explained in the MAAP Calculations Section, split fractions for cases ISGTR2-4 apply to ISGTR8-10, respectfully. Also as previously explained, ISGTR7 is essentially the same as ISGTR1 and both are bounded by ISGTR2.

Effect of Leakage on Fission Product Release As discussed previously, a through-wall defect, even if it does not rupture, will leak fission products into the secondary side of the steam generator. This leakage rate is calculated in PROBFAIL using correlations for the crack opening area that are believed to be conservative in this application. For the limiting ISGTR-4 late sequence Page 34 of 121

(corresponding to MAAP calculation isgtrO4d), we can conservatively bound the effects of leakage by inputting a defect that is just barely short enough to avoid rupture. The calculated leakage in this case is about 290 kg. This represents only about 2 percent of the steam contained in the RCS, and the same percentage represents an upper bound on the potential fission product release due to leakage. The actual releases would be much smaller, since settling prior to being released through the leak would considerably attenuate all but the noble gasses. Thus, it is reasonable to ignore the effect of leakage through a non-ruptured tube when assessing the likelihood of a large release of fission products to the environment.

As mentioned above, the defect length was set to the largest value that would just avoid rupture. A reduction in the assumed length of the defect by 0.1 inch reduces the calculated leaked mass by 50 percent. Thus, for most of the operating cycle, the leaked mass would be smaller than mentioned above.

F. APET/Fault Tree Development and Quantification The Accident Progression Event Tree (APET) for induced Steam Generator Tube Rupture is provided in Figure 7. Top events in the APET focus on both phenomenological as well as systemic failure potential and thermal hydraulic conditions that can contribute to tube challenges. A description of APET top events was provided in the Accident Progression Event Tree section of this report. The following sections describe the APET branches in detail and the generation of the fault tree logic.

Description of APET Branches Systemic APET branches are modeled using a combination of existing PRA fault tree logic and new fault tree logic developed to address events being analyzed. The remaining branches are associated with thermal hydraulic conditions that are modeled using point estimates from MAAP analysis results. The quantification software also used success criteria to refine the results. A summary of the fault tree logic and success criteria used for each branch is provided below. A detailed description of the fault tree development is provided in following section.

FWCOAVAIL - This branch models the failure or success of having Auxiliary Feedwater, Main Feedwater and Condensate to Steam Generator #2. This branch was developed from the PRA model using the portion of the fault tree associated with the failure of Auxiliary Feedwater, Main Feedwater and Condensate. For the core damage sequences of interest, secondary heat removal has failed. However, several of these sequences were due to human failures. These may be recoverable later on in SAMG space, but were not credited in this analysis.

Page 35 of 121

60 TO 250GPM - This branch models a small induced RCP seal LOCA. The small induced RCP seal LOCA logic consists of a non-LOCA plant transient in combination with the probability of a small induced seal LOCA (seal cooling loss that results in seal leakage in the range of 60 to 250gpm per pump). This separation occurs in the sequences by using a combination of fault tree and success tree logic. This is discussed in detail in the following section.

0 TO 60GPM - This branch models a small induced RCP seal LOCA and cases where no induced seal LOCA occurred. The small induced RCP seal LOCA logic consists of a non-LOCA plant transient in combination with the probability of a small induced seal LOCA (seal cooling loss that results in seal leakage in the range of 0 to 60 gpm per pump). The separation of this size seal LOCA and the non-seal LOCA cases from the larger 60 to 250 GPM seal LOCA occurs in the sequences by using a combination of fault tree and success tree logic. This is discussed in detail in the following section.

SEALCLEAR2 - This branch is used to quantify the likelihood that the seal LOCAs cause loop seal clearing, that this occurs in loop 2, and that the core barrel uncovers prior to hot leg or surge line rupture. The branch probabilities point estimates have been determined by interpreting the results of previous SCDAP/RELAP5 calculations as previously discussed.

1 2PORVSO - This branch provides the logic for identifying whether at least one PORVs is stuck open. The logic development for this branch is described in the Primary Side Depressurization Fault Tree Details section that follows.

0 PORV - This branch provides logic for identifying when no PORVs are available. The logic development for this branch is described in the Primary Side Depressurization Fault Tree Details section that follows.

1 PORV - This branch provides the logic for identifying when at least one PORV is available. The logic development for this branch is described in the Primary Side Depressurization Fault Tree Details section that follows.

SGPRESS - This branches provides the logic for failure to depressure steam generator #2. The logic development for this branch is described in Secondary Side Depressurization Fault Tree Details section that follows.

ISGTRl through ISGTRl4 - This is the probability of induced Steam Generator Tube Rupture based on the path through the APET. These probabilities were determined using MAAP and PROBFAIL calculations and have been previously discussed. For the ISGTR cases that result in a high RCS pressure, low steam generator pressure, and dry steam generator only the value for late ISGTRs will be used (this conservatively neglects the benefits of lower RCS pressure when the PORVs are available but not used for manual depressurization).

Page 36 of 121

Description of APET Branch Fault Trees APET branches are modeled using a combination of fault trees and point estimates. This section provides details of the fault trees that feed APET branches along with their associated success tree.

Seal LOCA Size Fault Tree Details The Seal LOCA Size failure/success branch split was determined using the existing PRA Model of Record logic for seal LOCAs. Sequences ISTGR-7 through ISGTR-14 deal with a seal LOCA size in the range 60 to 250 GPM per pump. The logic for these sequences is an "AND" of the previous APET branches and the Model of Record fault tree for this size seal LOCA. This ensures that the cutsets generated for this branch only contain the seal LOCAs of interest. Logic for the upper portion (0-60 GPM) of the branch does not contain an explicit model of the seal LOCA size. The success logic is used to remove the 60 to 250 GPM per pump logic from these upper sequences. This is accomplished by using a "NOT" gate comprised of the 60 to 250 GPM per pump logic.

This branch logic allows for all core damage bin sequences to be quantified.

Primary Side Depressurization Fault Tree Details Depressurization of the primary (RCS) system has a significant effect on the probability of an induced SG tube rupture in this analysis. For this reason, a key focus of the analysis was to insure that primary side depressurization was appropriately addressed in the fault trees. The APET provides logic for several conditions that could affect the primary (RCS).

pressure. The following sections describe modeling considerations for each portion of the primary side depressurization fault trees used to describe these conditions. The quantification of any branch of the APET is accomplished by combining the fault tree and success tree. To understand the logic, both trees must be viewed in concert with each other. The fault trees for the primary side depressurization are shown in figure 8.

At Least One PORV Sticks Open Fails - Failure of the Power Operated Relief Valve (PORV) to close or remain closed was considered during the development of the logic for "at least one PORV stuck open", 12PORVSO. Gates RC3 100 and RC3200 (FAILURE TO ISOLATE PORV) were extracted from the model of record and placed under an "OR" gate named 1_2PORVSO. The success for this branch is that the PORV does not stick open. To segregate the cutsets where the PORV did not stick open, a success tree was developed and used in the sequence quantification. The success fault tree logic is a "NOT" gate with gate 1_2PORVSO under it. This deletes any cutset with logic from the 1_2PORVSO gate from the quantification results.

At Least One PORV Available - The Power Operated Relief Valves if available, can be manually operated in accordance with the Severe Accident Management Page 37 of 121

Guidelines (SAMGs), post-core damage, to reduce primary (RCS) pressure. The fault tree developed to support this branch considers the availability of PORVs.

If no PORV was available due to loss or depletion of the station batteries, the time at which core damage occurred was considered. For those cases where core damage occurred prior to battery depletion (scenarios where core damage occurred within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the initiating event), then credit was taken for control power being available for the operators to perform primary (RCS) depressurization. The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> time frame was chosen as surge line/hot leg failure would occur within the remaining 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of battery life. During those 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, depressurization of the primary would preclude high differential pressures across the SG tubes, thus minimizing the likelihood of an ISTGR. No credit was taken for PORV availability if the battery depletion occurred prior to core damage.

The gate 0 PORV, no PORV available, is an "AND" gate composed of gates RCl l00B and RC1200B (PORV DOES NOT OPEN) from the model of record.

In addition a new event was added, RCSPSVNSO (SAFETY VALVE DOES NOT STICK OPEN) under gate 0_PORV.

The gate 1 PORV, at least one PORV available (Figure 8), is an "AND" of three gates. To simplify the fault tree logic, it is assumed that one PORV always fails, this is a conservative assumption. The first gate is PORVONE which is an "OR" gate of RC1 100B and RC1200B to represent hardware failures of the PORV.

The second gate is a new basic event HIOPPORV, OPERATOR FAILS TO OPEN PORV PER SAMGs LEADING TO RCS PRESSURE HIGH. The third gate is the new event RCSPSVNSO, (SAFETY VALVE DOES NOT STICK).

These two new events are discussed in detail below.

The success fault tree was used to remove the cutsets that were produced in 0_PORV from the cutsets produced in 1_PORV. This segregated the trees and ensured that at least one PORV was available. In addition, the success tree for both of these branches ensured that neither PORV had been previously stuck open.

Page 38 of 121

Figure 8 Primary Side Depressurization Page 39 of 121

Primary Safety Valve Does Not Sticks Open (RCSPSVNSO) - The Primary Safety Valves (PSV), can fail to re-close resulting in primary side depressurization. The basic event used in the fault tree has been designated

'RCSPSVNSO'. A value of 0.50 has been used in the CPSES APET quantification for the probability that a PSV fails open as a result of repeated lifts. This value is consistent with work done by others to investigate this occurrence and is very conservative based on the work presented in Appendix 6.

As discussed in NUREG 1570, there is a broad range of probability used for the boildown phase, ranging from about.02 to.2 in NUREG 4550, to about.69 to

.98 in EPRI work [2,11]. In NUREG 1570, the NRC staff concludes that the probability that the PSV sticks open post-core damage is 0.50 and notes that this late failure value captures the uncertainty in the boildown phase. However, test data cited in Appendix 6 suggests that one or more of these valves is highly likely to have stuck open prior to this time due to valve damage incurred due to repeated, long duration lifts with pressurized water. Nevertheless, the value of 0.50 was applied for this case.

Operator Fails to Open PORV as Directed by SAMG-Basic event 'HIOPPORV' was designated for this failure. This basic event probability was calculated using the EPRI HRA calculator. Procedures SACRG-1, Severe Accident Control Room Guideline Initial Response, SAG-2, Severe Accident Guideline 2, and interviews with the operators were use as inputs into HRA calculator. The value calculated was 6.50E-03. The details of the HRA calculations are shown in.

Secondary Side Depressurization Fault Tree Details Depressurization of the steam generators significantly increases the probability of an induced SG tube rupture. The APET provided logic for several conditions that could affect the SG pressure. The fault tree is shown in Figure 9. The following sections describe modeling considerations for each portion of the secondary side depressurization fault trees used to describe these conditions.

Page 40 of 121

Figure 9 Steam Generator Depressurization Page 41 of 121

ARV / Block Valve Fails Open - Failure of the Atmospheric Relief Valve (ARV) to close or remain closed combined with failure to close the associated block valve was considered during development of the steam generator depressurization fault tree. ARV failures are currently modeled in the model of record for the number one and four steam generators because they are the source of steam for the Turbine Driven Auxiliary Feed Pump. A point estimate for the number two steam generator was derived based upon ARV / block valve logic for the number one steam generator. The resulting failure probability of 6.60E-03 was applied to a basic event, 'MSGO16-2', in the steam generator depressurization fault tree.

MSIV Failure Results In Depressurization - Main Steam Isolation Valve failures were incorporated into the steam generator depressurization fault tree. The fault tree logic is comprised of two branches, both of which could lead to the depressurization of SG 2. The first branch, 'STEAM LINE BREAK NOT ISOLATED', has logic for the failure of the MSIV for SG 2 combined with a Main Steam line break. This gate is a combination of MSLB initiators "AND"ed with the existing model of record logic for failure to isolate steam flow from SG

2. The second branch, 'ANY OTHER S/G IS DEPRESSURIZED AND NOT ISOLATED', is an "AND" gate of the logic for depressurization of SGs 1, 2, or 3 and the failure of the MSIV for SG 2 to close.

Manual Steam Generator Isolation Fails After Loss Of FW/SG Level - This branch of the logic consists of three point estimates: Operator fails to isolate SG 2 leading to SG depress, SG 2 fails to remain isolated, and Operators depressurize the S/G in accordance with SAMGs. The development of the point estimate for each of these is discussed below.

Operator fails to isolate SG 2 leads to SG depressurization - This point estimate involves loss of all AC power combined with loss of all feed flow to the steam generators. CPSES Emergency Response Guideline ECA-0.0 "Loss of All AC Power" directs the operator to ensure:

main steam line isolation and bypass valves are closed, main feedwater control and bypass valves are closed, Blowdown and sample isolation valves are closed, and Main steam line drippot isolation valves are closed The procedure then directs the operator to depressurize intact steam generators provided narrow range level is maintained above 5% in at least one steam generator. The procedure directs the operator to depressurize by manually dumping steam at maximum rate using SG atmospheric(s) relief valve(s). The operator will close SG atmospheric(s) once level drops to 5% in the last steam generator. The MAAP runs indicate that sufficient water exists to repressurize the Page 42 of 121

steam generators even if one steam generator lags somewhat behind the other three. The extreme case where three steam generators are blown down to 5%

with their ARV remaining open, followed by the blowdown of the last steam generator, indicates that insufficient water would remain in the first three generators to cause repressurization. Procedure basis information reveals that the preferred method of depressurization is to blowdown all steam generators at the same time. If this occurred, SG2 would repressurize once the operators isolated the unit at 5 percent level. However the procedures provide the operators flexibility, and while discussion with operations personnel reveals that the worst case described above would be unlikely, some individuals indicated that one steam generator might be depressurized slower than the other three. Therefore a conservative estimate of 0.5 was used for failure of the steam generators to repressurize following blowdown and manual isolation prior to core damage.

SG 2 fails to remain isolated - The possibility of secondary side depressurization from MSIV leakage was considered during development of the fault trees.

Review of the EPRI report TR-107623-V2 Steam Generator Tube Integrity Risk Assessment Volume 2: Application to Diablo Canyon Power Plant [11] revealed that secondary side depressurization from leakage through MSIVs was not considered credible at Diablo Canyon. At CPSES, for steam generator 2, indications are that seat leakage was low at the last outage because wet layup procedures (SOP-312 "Steam Generator Outage Control & Recovery") require relatively low leakage to maintain a nitrogen blanket without frequent addition of additional nitrogen. Also, the MSIVs were blue checked at initial installation to ensure proper sealing with one valve subsequently blue checked and found in good condition. Discussion with the system engineer reveals that MSIV seat leakage has never been identified as a problem at CPSES. Therefore, significant

-leakage is considered unlikely at CPSES because significant seat leakage was not detected at the last outage and history has shown that subsequent seat degradation is unlikely.

Nevertheless, in this analysis a significant leakage probability of 0.2063 is assigned, consistent with assumptions in NUREG-1570 (section 2.3.5) for depressurization of one steam generator. In fact, sensitivity studies performed as part of this report indicate that even with a guaranteed failure of the secondary to remain at pressure, the conclusions of this report would be unchanged.

Operators depressurize the S/G in accordance with SAMGs (HISAMGDEPRESS)

- This basic event probability was calculated using the EPRI HRA calculator.

Procedures SACRG-1, Severe Accident Control Room Guideline Initial Response, SAG-1, Severe Accident Guideline 1, and interviews with the operators were use as inputs into HRA calculator. The value calculated for the action that the operators depressurize the secondary when cooling water is not available was 6.50E-03. The details of the HRA calculations are shown in. In other word, if it were not possible to inject water from some Page 43 of 121

low pressure source into the SG's, then there is a very high likelihood that the operators will not depressurize the SG's.

SG 2 Depressurizes Because MSSV Sticks Open - Main Steam Safety Valves (MSSVs) can fail to close and result in steam generator depressurization. Two types of failure were modeled in the steam generator depressurization fault tree.

These failures were those due to steam demands and those due to water demands.

This gate, 'SG/2 DEPRESSURIZES BECAUSE MSSV STICKS OPEN', consists of two branches. One branch is the MSSV fails open due to water and the other is failure due to steam demands. To ensure that the logic is applied correctly, the success fault tree was used. The logic in the success tree was that the MSSV would only see water demands if the SG was overfilled (SGPRESSN) and would only see steam demands if the SG was not overfilled (SGPRESSN1).

Failure rates from EPRI report TR-107623-VI Revision 1 "Steam Generator Tube Integrity Risk Assessment Volume 1: General Methodology" [2] section 7.1.6 were used for steam demands. The failure rate for the first demand was 4.5E-03, reflecting the possibility of a maintenance error. The failure rate for subsequent demands was 3.931E-04 per demand, based on interpretation of vendor test data

[2]. The overall failure probabilities were derived using a total of 31 demands based on CPSES simulator data from a sequence involving loss of all AC combined with loss of the ARVs and Turbine Driven Auxiliary Feedwater Pump.

Baseline calculations in this analysis make the conservative assumption that the MSSV failure probability for water demands (cause by overfill) is 1.0. A similar result would be obtained if the per demand failure rate of.l given in PLG-500 VOL. 2 was used.

Late Steam Generator Overfill - As noted above, overfill leads to water flowing through the MSSV and a very high probability of failure. However, in some cases overfill may occur so late that it is highly likely that equipment will be recovered, preventing large fission product releases. For this reason, this study took the conventional approach that core damage occurring after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> could be neglected. This is consistent with the considerations discussed in EPRI TR-107623-V2, Steam Generator Tube Integrity Risk Assessment [11], these are not considered in the ISTGR because they occur so late, beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and well after protective actions will have been implemented.

Interviews with operators and review of the appropriate procedures were used to determine the probabilities of early and late overfill relative to battery depletion.

Based on these discussions, it was assumed that the operators could take actions such that late overfill would occur 50% of the time. This split fraction was applied. The ability to prevent early overfill 50% of the time and thus prevent ISGTR was not explicitly modeled in the fault tree. The rule based recovery file was used to implement this logic. A recovery action, LATEOVRFL,-was added Page 44 of 121

to the rule based recovery file that is applied anytime SG overfill occurs provided that the overfill is not a result of operator actions.

G. Discussion of Initiators The core damage sequences of greatest concern for thermally-induced steam generator tube rupture are characterized by high RCS pressures and low secondary side pressures associated with dry steam generators. These conditions subject the Steam Generator tubes to differential pressures equivalent to main steamline break (MSLB) differential pressures. The effects of the tube defect increase the probability that containment bypass will occur for the baseline Core Damage Frequency accidents.

Two possibilities for tube rupture exist when these conditions are present. First, pressure induced failures could occur if a large differential pressure is seen across the tubes following secondary side depressurization. Second, the tubes become very hot due to the flow of high temperature steam from the damaged core to the tubes and thereby become susceptible to failure. This is of concern if some other portion of the RCS pressure boundary (e.g. hot leg or surge line) does not fail sooner.

The accident sequences from the Level I analysis have been binned into plant damage states. These bins are based on core damage state attributes (e.g., core damage timing and RCS pressure) as well as containment safeguards and isolation condition. For this specific issue, the RCS pressure and the condition of the secondary side heat removal are used to determine the applicable damage states.

For the tube defect in question, the occurrence of an induced SGTR requires that high pressure exist on the RCS side with low secondary side pressure. Since only specific sequences have the potential to create the environment in the RCS and the steam generators that can result in an ISGTR, it is necessary to determine which plant damage states contain these types of sequences. A review of the IPE Level II evaluation identified 6 PDSs containing sequences that have the potential to induce a SGTR.

The accident initiators that are included in those PDSs are; Inadvertent Safety Injection Signal, Loss of Offsite Power, General Transient, Main Steamline Break, Loss of a DC Bus, Loss of a Protection Channel Bus, Loss of a Non-Vital AC Bus, Loss of Main Feedwater, Loss of Support Systems (CCW, SSW, CH, CV, and CI), Very Small LOCA (including induced seal LOCA), and ATWS.

As in Reference [ 11 ] and for the reasons previously stated, only those core damage states or bins associated with High/Dry are of concern for ISGTR. These High/Dry conditions were found to be associated with PDSs: 3H, 3F, 4H, 4F, 3SBO, and 4SBO.

These PDSs will be the starting points for the Accident Progression Event Tree (APET) quantification. Additional information on these PDSs is provided in Appendix 1. Their frequencies are given in Reference [17].

Page 45 of 121

H. Quantification APET Conversion to a Fault Tree The APET was converted to a fault tree using the CAFTA Event Tree Editor. This produced a fault tree with the top logic for each sequence, ISGTR-1 through ISGTR-14.

Intermediate logic using gates from the model of record were developed to reflect the APET branches discussed previously. This fault tree was merged with the model of record (Smalltop.caf) to ensure the continuity of the new logic with the plant PRA model.

The model of record is an average test and maintenance model.

In general, the logic was taken from the model of record without modification. Several basic events were added such as Operator actions, stuck open SG safety valves, etc.

These events are discussed in the preceding paragraphs and in Appendix 3.

Additional Logic Considerations The additional logic considerations were the modification of the mutually exclusive file, the recovery file, and the use of success fault trees. The mutually exclusive file is used to prevent non-logical cutsets. The modification to the model of record mutually exclusive file ensures that the existing non-logical cutsets that were removed for pre-CDF battery depletion were also removed for post-CDF battery depletion. This was required because an event was added to post-CDF logic to differentiate the battery depletion timing.

Appendix 2 contains a list of the cutsets added to the mutually exclusive file.

Recoveries were added to the model of record recovery rule file (Appendix 2). These recoveries dealt with recovery of offsite power within 430 minutes [14] and operator actions preventing late SG overfill. The first offsite power recovery event was added to address the time (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) available before losing the AFW pumps on SG overfill due to battery depletion. A second offsite power recovery was added to address the time (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) available before the DGs run out of fuel in the day tank for cases of common cause failure of the DG fuel transfer pumps. These recovery events were developed in accordance with CPSES offsite power recovery methodology [14]. The last recovery added addressed the probability of operator actions that could prevent early SG overfill relative to the time of battery depletion. This recovery was specifically added for this analysis to address the overfill condition previously discussed.

Quantification using PRA Quant The individual sequences (ISGTR-1 through -14) were quantified using PRAQUANT, a component of the CAFTA software suite. The software solves the new fault tree developed from the APET. The success fault trees, mutually exclusive file and the recovery file are applied to the results of individual sequence quantification.

Page 46 of 121

IV Results A. Base Case Results The base case is defined by the probability values used for the key basic events that were not part of the model of record but were added as part of the APET fault tree development.

The table below shows the base case probabilities for these events along with their descriptions. Variations on these basic event probabilities constitute the sensitivity cases.

BASIC EVENT BASIC EVENT DESCRIPTION PROBABILITY COMMENTS BASE HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG 5.000E3-0 SG DEPRESSURIZES DEPRESS MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 2.063E-0I SG DEPRESSURIZES HISAMGDEPRESS OPERATORS DEPRESSURIZE THE S/G IN ACCORDANCE 6.500E-03 SG DEPRESSURIZES WITH SAMGS HIOPPORV OPERATOR FAILS TO OPEN PORV PER SAMGs LEADING 6.500E403 RCS DOES NOT TO RCS PRESSURE HIGH DEPRESSURIZE SGMSSVSO S/G MSSV STUCK OPEN DUE TO WATER RELIEF I.OOOE+00 SG DEPRESSURIZES RCSPSVNSO PRIMARY SAFETY VALVE DOES NOT STICK OPEN 5 OOOE-0 I RCS DOES NOT DEPRESSURIZE The results from the base case PRAQuant quantification for the APET sequences are shown in the table below.

APET End State Truncation Limit Quantification Results ISGTR-1 2.OOE-1 1 O.OOE+OO ISGTR-2 2.00E-1 O.OOE+OO ISGTR-3 2.00E-11 6.67E-12 ISGTR-4 2.OOE-10 3.75E-08 ISGTR-5 2.OOE-l 1 O.OOE+OO ISGTR-6 2.00E-1 1 O.OOE+OO ISGTR-7 2.OOE-1 1 O.OOE+OO ISGTR-8 2.00E-1 1 O.OOE+OO ISGTR-9 2.00E-l 1 O.OOE+OO ISGTR-10 2.OOE-1 1 3.78E-09 ISGTR-1 1 2.00E-l 1 O.OOE+OO ISGTR-12 2.00E-1 O.OOE+OO ISGTR-13 2.OOE-11 1.48E-10 ISGTR-14 2.00E-11 1.26E-10 Total 4.15E-08 The APET sequences were quantified at a truncation level of 2E-11 except for ISGTR-4.

ISGTR-4 was quantified at a truncation level of 2E-10 due to the limitations of the software being used. This limitation should not significantly affect the results since the Plant model is normally quantified at 2E-10.

Page 47 of 121

B. Sensitivity Studies Sensitivities were performed to gain risk insights. Several of the basic event probabilities were changed both individually and in combination. The model was quantified with these new values. The table below shows the resulting ISGTR probability for each of the sensitivity cases, along with a brief description of each. Detailed results of the sensitivity cases are shown in Appendix 8.

The sensitivities, as shown in the table below, did not significantly differ from the base case results. The values chosen for this analysis were considered reasonable.

Case Description Results BASE BASE CASE 4.15E-08 SENSITIVITY 1 Increased probability of PSV sticking open 3.17E-09 SENSITIVITY 2 Decreased probability of PSV sticking open 5.97E-08 SENSITIVITY 3 Operator always fails to isolate SG 2 6.35E-08 SENSITIVITY 4 Operator actions to inadvertently depressurizes SG 2 and Operator fails to 4.17E-08

_ depressurize RCS increased by a factor of 10 I

Page 48 of 121

V. Conclusions TXU performed an evaluation of the risk significance of a through-wall defect responsible for the Unit 1 steam generator tube leak that occurred in September 2002.

This work constitutes a portion of a Significance Determination Process (SDP) Phase 3 evaluation to assess the increase in Large Early Release Frequency (LERF) due to induced steam generator tube rupture (ISGTR). A previous report addressed the impact of the defect on the likelihood of spontaneous tube rupture and pressure-induced rupture during MSLB. This effort focuses on the analysis of thermally-induced tube rupture after the core uncovers in postulated severe accidents.

This analysis constitutes a retrospective, best-estimate evaluation of the risk of a specific defect. The analysis utilizes state-of-the-art techniques recently developed by both NRC and the industry. While the application of these techniques is done in a fashion similar to that used in typical assessments, e.g. evaluating whether eddy current indications should remain in service, there are key differences. For example, this analysis takes into account the specific, as-found condition and location of the defect, as-measured materials properties of the tube, leakage behavior of the defect, and the operating procedures that were in use during the period the plant operated with the defect.

Severe accident conditions beyond the design basis are addressed in this analysis, using a framework based on techniques outlined in NUREG-1570 [1] and EPRI's Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture [2, 11]. The analysis also takes advantage of insights from these previous works and more recent research conducted at Argonne National Laboratory [7]. The overall analysis consisted of five major steps:

• Quantification of the frequency of sequences with high RCS pressure and dry steam generators ("high/dry" sequences) using PRA techniques.

• Thermal-hydraulic analysis of selected accident sequences using MAAP 4.0 to calculate the pressure and temperature response of the reactor coolant system (RCS)

• Characterization of the defect as a function of time by combining information from observed leak rates, eddy current and visual inspection data, and defect growth models

• Analysis of the defect's response to the calculated temperatures and pressures using the EPRI PROBFAIL code

• Quantification of the change in the frequency of large, early release of fission products using an accident progression event tree (APET)

In general, the likelihood that a steam generator defect will lead to a tube rupture is governed by several key factors:

Length of defect: The longer a defect, the more likely that it will cause rupture when exposed to increased temperature or differential pressure. The defect in question varied in length over the course of the operating cycle, and at shutdown was of moderate length (about 0.91 inch).

Page 49 of 121

• Defect depth: The defect was relatively deep for much of the operating cycle, and was conservatively assumed to be through-wall in this analysis, i.e. no credit was taken for the strength of the remaining ligament.

• Defect location: The defect was located near the top of the bundle, in a tube whose inlet is on the periphery of the tube bundle. Both of these significantly reduce the temperatures to which the defect would be exposed.

• RCS pressure: High reactor coolant system pressure increases the stress on the tube as well as the effectiveness of natural convection in carrying heat from an uncovered core to the tube. Most sequences in CPSES result in low RCS pressure because of the availability of the pressurizer PORVs and procedural guidance in the Severe Accident Management Guidelines (SAMGs). This greatly reduces both the risk of tube rupture as well as the sensitivity of the results to uncertainties in pressurizer safety valve behavior, especially when water is being relieved.

• Steam Generator Pressure: Steam generator pressure has a similar effect, but in the opposite direction: high pressure reduces the stress on the tubes and promotes natural convection of steam which cools the tubes. As mentioned below, the risk of tube rupture in CPSES is dominated either by cases where the operators are assumed to fully depressurize and dry out the affected steam generator, or by cases where the steam generator overfills resulting in a stuck open valve. While this does increase the likelihood of tube rupture, all else being equal, it greatly reduces the sensitivity of the results to assumptions about main steam safety valve reliability and MSIV leakage.

• Loop seal clearing: Loop seal clearing can potentially cause an increased threat of tube rupture due to enhanced convection of high temperature gasses to the tubes.

This phenomenon plays little role in CPSES, however, for several reasons. First, the plant-specific core barrel design reduces the differential pressures that develop across the intermediate leg. Second, loop seal clearing in a loop not containing the defect in question would not threaten it. Third, seal LOCA sizes are relatively small given the Plant Damage States under consideration. Finally, the water level is unlikely to drop below the base of the core barrel prior to hot leg or surge line creep rupture.

The APET is used to treat these key issues in a systematic fashion and, in so doing, to quantify the likelihood of LERF. The top events of the APET address:

• Auxiliary Feedwater Availability

• Seal LOCA Magnitude

• Loop Seal Clearing and the development of Whole-loop through-flow

• RCS Depressurization

• Steam Generator Pressure

• ISTGR Occurring Prior to Hot Leg or Surge Line Creep Rupture

• Fission Product Release given ISGTR (treated qualitatively)

These events were quantified by performing a series of calculations that address accident initiators, subsequent equipment failures, operator actions, and tube performance during severe accidents. -

Page 50 of 121

The analysis reveals that the majority of high/dry sequences in CPSES are Loss of Offsite Power which lead to early core damage. This is because in the late sequences, offsite power is more likely to be recovered. This implies that batteries are usually available during core damage, which has an important implication that the pressurizer PORVs are nearly always available for RCS depressurization. In this case, emergency drill results strongly suggest that the operators will follow the SAMGs and depressurize the RCS in a timely fashion. Calculations reveal that opening one or more PORVs essentially eliminates thermal challenge. This conclusion is quite robust to phenomenological uncertainties associated with severe accident behavior. In fact, the challenge to the affected tube's integrity in sequences where the steam generator is fully depressurized and the RCS is depressurized in accordance with SAMGs is essentially the same as that faced under design basis conditions in MSLB sequences.

Secondary side pressure control is also important. For high/dry sequences in CPSES, the operators will depressurize the affected steam generator in an attempt to achieve accumulator discharge. Operators are expected to perform this action by depressurizing all the steam generators simultaneously, then isolating the steam generators when the wide range water level reaches 5 percent. In this situation, calculations indicate that the affected unit will substantially repressurize prior to core uncovering. However, the operators have procedural flexibility to delay the depressurization of one or more of the steam generators (assumed to be those that supply steam to the turbine-driven AFW pump; the affected steam generator is not one of those units). In this case, the affected steam generator will completely depressurize and dry out. All of the steam generators will be isolated again later per procedures. Under these conditions, tube rupture is relatively likely if no action is taken to depressurize the RCS. However, if tube rupture does occur, it will be into a depressurized, dry, isolated secondary. In many cases, the repressurization rate of the steam generator due to the ruptured tube is sufficiently slow that the hot leg would likely rupture prior to the first lifting of a secondary safety or relief valve. This would prevent fission product release from the ruptured tube.

In view of the dominant importance of RCS pressure and steam generator pressure, another significant contribution to LERF arises from late core melt sequences involving battery depletion. While the initiating frequency of such sequences is lower than the early core melt cases, battery depletion leads to both the unavailability of the PORVs for depressurizing the RCS and to loss of steam generator level instrumentation and potentially to overfill. It is assumed that if overfill occurs, it inevitably leads to a stuck open steam generator safety valve. However, CPSES Plant Operations staff believes it is highly likely that the time to overfill can be extended significantly beyond battery depletion (-16 hours [11]). Consistent with [11], this means it is highly likely that the eventual steam generator dry out might not take place, or even if it does, it would occur very late, beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and well after protective and recovery actions will have been implemented. Therefore, it is assumed that 50% of these potential overfill cases will not result in ISTGR/LERF. As noted in previous analyses [11], overfill in reality is not inevitable and even if it does occur, fission product releases will tend to be very late, allowing ample time for recovery of safety systems.

Page 51 of 121

The comprehensive analysis and evaluation of the tube defect reveal that its presence added very little risk to plant operation. This work supports a conclusion that the SDP Phase 3 finding is very low risk, i.e., delta LERF less than 1 E-07, and therefore it should be categorized as green. This conclusion is strongly supported by recent research results, plant specific considerations, the characteristics of the as-found tube condition, and the results of sensitivity studies on the important assumptions.

Page 52 of 121

VI. References

1. Risk Assessment of SevereAccident-Induced Steam Generator Tube Rupture. U.S.

Nuclear Regulatory Commission, NUREG-1570, March 1998

2. E.L. Fuller, G.W. Hannaman, M.A. Kenton, and M. Lloyd, Steam Generator Tube Integrity Risk Assessment, EPRI TR-107623-V1.

3. P.D. Bayless et al.

Severe Accident Natural Circulation Studies at the INEL.

NUREG/CR-6285, February 1995.

4. W.A. Stewart, A.T. Pieczynski, and V. Srivinas. Natural Circulation Experiments for PWR High-Pressure Accidents. EPRI TR-102815, August, 1993.

5. R.E. Henry, C.Y. Paik, and M.G. Plys. MAAP4-ModularAccidentAnalysis Program for LWR Power Plants. EPRI, May 1994.

6. M.M. Pilch, M.D. Allen, D.L. Knudson, D.W. Stamps, and E.L. Tadios.

The Probability of Containment Failure by Direct Containment Heating in Zion.

NUREG/CR-6075, Supp. 1, December 1994.

7. S. Majumdar, W.J. Shack, D.R. Diercks, K. Mruk, J. Franklin, and L. Knoblich.

Failure Behavior ofInternally Pressurized Flawed and Unflawed Steam Generator Tubing at High Temperatures-Experiments and Comparison with Model Predictions. NUREG/CR-6575, March 1998.

8. S.A. Chavez et. al, Estimating Structural Failure Frequency of Degraded Steam Generator Tubes, Int. Conf. Nucl. Eng, Vol 5, ASME, 1996.

9. M. Kenton, PROBFAIL: A Computer Code for Evaluating the Likelihood of Steam Generator Tube Rupture in Severe Nuclear Power Plant Accidents, Creare TM-2138, October, 2001.

10. T. Boardman, N. Jeanmougin, R. Lofaro, and J. Prevost, Leak Rate Analysis of the Westinghouse Reactor Coolant Pump, NUREG/CR-4294, July 1985.

11. E.L. Fuller, E.T. Rumble, G.W. Hannaman, and M.A. Kenton. Assessment of Risks from Thermal Challenge to Steam Generator Tubes During Hypothetical Severe Accidents: Diablo Canyon as an Example Plant. EPRI TR-107623, Vol. 2, May 1998.

12. Westinghouse letter, WPT-16414, Steam Generator Tube Burst Estimate, February 19, 2003.

13. CPSES Calculation R&R-PN-022, Revision 2, Accident Sequence Quantification, June 15, 2001

14. CPSES Calculation R&R-PN-030, Revision 2, Quantification of Offsite Power Non-Recovery Probabilities, July 26, 2001

15. NUREG/4551, 1989 Draft

16. CPSES Letter, CPSES-200300684, Steam Generator Tube Leak APET Input Information, March 24, 2003

17. CPSES Letter, CPSES-200300262, COMANCHE PEAK STEAM ELECTRIC STATION (CPSES) UNIT 1 - DOCKET NO. 50-445, supplemental information for consideration during significance determination process review of apparent violation 50-445/0209-01, March 05, 2003.

Page 53 of 121

Appendix 1 Plant Damage State Descriptions Page 54 of 121

The CPSES Plant Damage States (PDSs) are developed by combining the core damage state attributes with the containment safeguards status. For this study, the at-power, average test and maintenance model of record was used. The station blackout (SBO), the containment bypass and isolation failure core damage bins are not combined with the containment safeguards bins because those are implied by the core damage state. Each PDS is defined as a group of core damage sequences that have similar characteristics with respect to the severe accident progression and containment response. The core damage states and containment safeguards bins of interest for this evaluation are described below.

Core Damage Bin - 3: Sequence characteristics are high RCS pressure and leakage rates associated with boil-off of the reactor coolant through cycling pressurizer relief valves (not stuck open) or small seal LOCAs up to 60 GPM/Pump (0.6 inch diameter), with early core melt.

Core Damage Bin - 4: Sequence characteristics are high RCS pressure and leakage rates associated with boil-off of the reactor coolant through cycling pressurizer relief valves (not stuck open) or small seal LOCAs up to 60 GPM/Pump (0.6 inch diameter), with late core melt.

Core Damage Bin - vSBO: Sequence characteristics are Station Blackout sequences or equivalent equipment failures; y = 3 early melt, y = 4 late melt.

Containment Safeguards Bin - H: Sequence characteristics are those where both containment fan coolers and containment spray are failed.

Containment Safeguards Bin - F: Sequence characteristics are those where both containment fan coolers and containment spray are available.

The following paragraphs describe some of the features of the Plant Damage States of interest. These definitions were developed as part of the IPE and have remained unchanged since that time. Although the PDS results are changed to reflect the updated Level I PRA.

Plant Damage State 3H This PDS groups Transients involving loss of all feedwater with residual heat removal (RH) and safety injection (SI) system failures at injection. While the centrifugal charging pumps (CCPs) may or may not be available, they do not inject until after vessel failure due to the high head and containment spray failure at injection.

Plant Damage State 3F This PDS groups Transients involving loss of all feedwater with RH and SI system failures at injection. While the CCPs may or may not be available, they do not inject until after vessel failure due to the high head. In this PDS, containment sprays inject and Page 55 of 121

switchover successfully to recirculation, so there is no containment failure due to steam overpressurization.

Plant Damage State 4H This PDS groups Transients where the turbine drive auxiliary feedwater pump (TDAFW) operates for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after reactor trip and two CCPs inject on demand but fail at recirculation and containment sprays fail at injection. This PDS includes late containment failure probabilities due to steam over-pressurization that occur later in the scenario because the failure of containment sprays extends the duration of the ECCS injection period.

Plant Damage State 4F This PDS groups Transients where the TDAFW operates for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after reactor trip and ECCS injects successfully but fails at recirculation. Containment sprays inject and switchover successfully to recirculation, so there is no containment failure due to steam over-pressurization.

Plant Damage States 3SB0 This PDS groups Station Blackouts involving simultaneous loss of all feedwater (Main Feedwater and Auxiliary Feedwater). This PDS involves the RCS remaining at high pressure.

Plant Damage States 4SBO This PDS groups Station Blackouts involving loss of all feedwater after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of auxiliary feedwater being supplied by the TDAFW pump. This PDS involves the RCS remaining at high pressure.

Page 56 of 121

Appendix 2 Changes to Rule Based Recovery File and Mutually Exclusive File Page 57 of 121

Changes to the model of record Rule Based Recovery Files were made to address the recovery for loss of offsite power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> due to overfill of the TDAFW. The changes are shown below. These sequences are found in the model of record results but were of low importance. However, for the ISGTR study, these low core damage sequences became important and therefore were recovered in accordance with the CPSES offsite power recovery methodology [14].

• • RECOVERY**,X3RFF430,1.26E-03, EPBATTDEPL,INIT-X3,-AFCPTPTDO1FX,-AFCPTPTDO1NN,-

AFCTDAFWPMNX,-AFCVCAF038NN,-AFSEGC2,-AFSEGC3TM,-AFSEGX4,-

AFSEGX5,-AFSEGX6,-AFSEGX7,-ATWS,-EPCCFDGO12,-EPCCFDGOALL,-

EPCCFPMDALL,-FL-AF32-FAIL,-FL-AF38-FAIL,-FL-HV-2459,-FL-HV-2462,-FL-PV-2453A,-FL-PV-2454B,-FL-TDP-FAILS,-GSFLARGE,-

GSFSMALL,-HIADVBLOCKNY,-HISGLXAFWXNY,-PORVLIFT,-

SHUTDOWN,AFTDAFWPINH,FL-DGA-FAILR,FL-DGB-FAILR, The recovery file was also modified to reflect the recovery for loss of offsite power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> due to failure of the DG fuel oil pumps by common cause. This recovery was allowed because the day tank has enough fuel for the DG to run for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

These sequences are found in the model of record results but were of low importance.

However, for the ISGTR study, these low core damage sequences became important and therefore were recovered in accordance with the CPSES offsite power recovery methodology [14].

• • RECOVERY**,X3RFF430,1.26E-03, EPBATTDEPL,INIT-X3,-AFCPTPTDO1FX,-AFCPTPTDO1NN,-

AFCTDAFWPMNX,-AFCVCAF038NN,-AFSEGC2,-AFSEGC3TM,-AFSEGX4,-

AFSEGX5,-AFSEGX6,-AFSEGX7,-ATWS,-EPCCFDGO12,-EPCCFDGOALL,-

EPCCFPMDALL,-FL-AF32-FAIL,-FL-AF38-FAIL,-FL-HV-2459,-FL-HV-2462,-FL-PV-2453A,-FL-PV-2454B,-FL-TDP-FAILS,-GSFLARGE,-

GSFSMALL,-HIADVBLOCKNY,-HISGLXAFWXNY,-PORVLIFT,-

SHUTDOWN,FL-TDP-FAILR,FL-DGA-FAILR,EPBDGGEE02FN, In addition recoveries were added to reflect the operator's ability to manually control steam generator levels after battery depletion or loss of a DC bus as shown below.

• • RECOVERY**,LATEOVRFL,5. OE-01, AFTDAFWPINH,EPBATTDEPL,-HISGLXAFWXNY

• • RECOVERY**,LATEOVRFL,5.OQE-01, INIT-Xl-lED1,AFTDAFWPINH,-HISGLXAFWXNY

• • RECOVERY**,LATEOVRFL,5.OOE-01, INIT-Xl-lED2,AFTDAFWPINH,-HISGLXAFWXNY Page 58 of 121

Changes to the model of record Mutually Exclusive File were made to address the changes made in the APET fault tree to distinguish the availability of the PORV's post core damage with battery power available. These additions to the mutually exclusive file are identical to existing cutsets that contain the battery depletion tag (EPBATTDEPL).

These cutsets were duplicated with the original battery depletion tag replaced with the post core damage identifying tag (EPBATTDEPLR). The changes are shown below.

AFTDAFWPLNH MSSGFTI RCAVPV455AWC RCAVPV455AFF RCAVPV455AWC RCAVPV455ANF RCAVPCV456WC RCAVPCV456NF RCAVPCV456WC RCAVPCV456FF AFTDAFWPINH SAMGDEPRESS INIT-X3 NO-SBO 2HRSUCCESSSD ATWS EPBATTDEPLR INIT-X3 EPBATTDEPLR C

INIT-X3 EPBATTDEPLR C

INIT-X3 EPBAT1DEPLR F

INIT-X3 EPBATTDEPLR C

INIT-X3 EPBATlTDEPLR E

INIT-X3 EPBATIDEPL F

FL-DUMP-FAIL EPBATIDEPLR EPUPSHVACFAI WSFSMALL1 GSFSMALL

'L-SRV-OPEN GSFLARGE EPUPSCCFX3 FL-DUMP-FAIL INIT-X3 EPBATTDEPLR Page 59 of 121

Appendix 3 HRA Calculator Output Page 60 of 121

The following pages provide the input and output information used in determining the human reliability values for the operator actions HIOPPORV and HISAMGDEPRESS.

These actions are defined in Section C.2 of this report.

HIOPPORV, FAILURE TO OPEN THE PROV PER SAMG Basic Event Summary Analst:24

-W lj6 Date:`,

03/26/03 Rivel M HCRIOREITHERP Table 1: HIOPPORV

SUMMARY

Analysis Results:

without Recovery with Recovery P0gVV 2WiN/A 1.3e-05 6.5e-03 6.5e-03 Total HEP MM 6.5e-03 HFE Scenario

Description:

This is a high stress evolution but one that has been trained on in the simulator. The procedures provide details and warnings. The Operator is required to depressurize the RCS using the PORVs by the SAMGs. The TSC and EOF will be manned by the time this evolution is required to be performed. Also there is time to call out additional personnel if needed.

Related Human Interactions:

This is the failure of the Operator to depressurize the Reactor Coolant system using the PORVs in accordance with the Severe Accident Management Guidelines. These actions will be performed after there has been core damage which means that this will be a high stress evolution but the TSC will be manned. This means credit can be taken for additional personnel.

Performance Shaping Factors:

The performance shaping factors are: high stress, written procedures are used, additional personnel in the TSC and EOF, time to call out additonal personnel as needed, and this scenario (or one very much like it) is trained on the simulator.

Procedure and step governing HI:

Severe Accident Management Guidelines (SAMGs) lgri ing^4. weM None Classroom X

Simulator Frequency: 12 l.Deg e~e f Cla rityoCues &1ndicati ns':,:

Very Good X

Average Poor Page 61 of 121

l Q HUhrn

'a"~C'fin l n

e&Q X

Control Room Panels Local Control Panels Local Equipment laSpecial tReq~uirements=

=

a~

M Tools Parts Clothing Required Required Required Adequate Adequate Adequate Available Available Available iTyp of Respoiise.-

1 ;

Skills Rule X -

Knowledge liCoum'lexity'ofRe W#poe Cognitive Execution X

Complex Complex Simple X -

Simple

?Environment on-Lighting Heat/Humidity X -

Normal X

Normal Emergency Hot/Humid Portable Cold Radiation Atmosphere X

Background

X Normal Green Steam Yellow Smoke Red Respirator required kEquipmeht A ccesbsit y

0 7

Location Accessibility X

Control Room Front Panels Accessible Control Room Back Panels Hot Shutdown Panels Auxiliary Building Electrical Building Containment Pump house Switchyard FStess~ r Mm Optimum (Low)

Moderate X

Extreme(High)

Page 62 of 121

Cognitive HIOPPORV Cue:

The SAMGs are prescriptive in nature and there will be guidance from the support personnel in the TSC. The plant parameters will be monitored in both the control room, TSC and EOF. This will reduce the probability for error and increase the probability of recovering from an error.

System Time Window 3600 I

I I Median Response Time 300 I

I I

I I

Manipulation Time:

300 Start Time I

ni Unit Seconds Reference for System Time:

Reference for Manipulation Time:

Duration of time window available for action (TW): 3000 Seconds ltsigma(ERRT-TRIO0259)

K =

i Kq Plant Type Cue Response Type BWR X

CP1 X

PWR CP2 CP3 Sigma: 5.7e-01 HEP: 1.3e-05 Page 63 of 121

Execution Unrecovered HIOPPORV Table 2: HIOPPORV EXECUTION UNRECOVERED t _sPv Sem7.~~

l~.S :--:

.$$:g}OaissionI>

Co i

a mmlsslor

'w I">;Sg

^

I 4:^S.egTo:ta[

7 fz~t%4Qtsw2 1K

', 1 XTable altem i,. *Stressm; 'Stressw m

Table nltem2 [ Stressw Stessm aKI Over' N Per Step No.'a 4*

<~.

HEPil,t Ref;- I ffiRef.-'

XXE/M/O. >

EValue' HEP e

o Ref:

's Ref>

/M/O

.Me>

Valuep l wR dev.

'Step W' SAMG 1 1.3E-3 20-7b 3

E 5

3 8E-3 20-12 2

6 5e-03 Actions: OPEN PORV Comments:

Execution Recovery HIOPPORV Table 3: HIOPPORV EXECUTION RECOVERY Ic

't HEP Crit)D e#.'~n~H~z'Tta

~~

SAMG 1 OPEN PORV 6.5e 03 talW8 Unrecovered14 8.5e-03 i4 ffir*MTotal Recove red:

Page 64 of 121

HISAMGDEPRESS, OPERATOR DEPRESSSURIZES THE SG Basic Event Summary 03/26103 HCRIORE/THERP Table 4: HISAMGDEPRESS

SUMMARY

-Anal sisResults:ml without Recovery with Recovery p

N/A 1.0e-09 ip 6.5e-03 6.5e-03 bTotal HEP7 6.5e-03 Erron Factor n

5 HFE Scenario

Description:

This is a high stress evolution but one that has been trained on in the simulator. The procedures provide details and warnings. The Operator is required to not depressurize the Steam Generator by the SAMGs. The TSC and EOF will be manned by the time this evolution is required to be performed. Also there is time to call out additional personnel if needed.

Related Human Interactions:

This evolution requires that the operator recognize that the Steam Generators are not being supplied water and should not be depressurized. The SAMGs are prescriptive in nature and there will be guidance from the support personnel in the TSC. The plant parameters will be monitored in both the control room, TSC and EOF. This will reduce the probability for error and increase the probability of recovering from an error Performance Shaping Factors:

The performance shaping factors are: high stress, written procedures are used, additional personnel in the TSC and EOF, time to call out additonal personnel as needed, and this scenario (or one very much like it) is trained on the simulator.

Procedure and step governing HI:

Severe Accident Management Guidelines (SAMGs)

None Classroom X

Simulator Frequency: 12 1Degree oEf Clirityof cues &i&dicatibns:

Ofk lQr i.

=W N

Very Good X

Average Poor IHumani&~a'chi efit eraffii66,:1, X;

1. ~

X Control Room Panels Page 65 of 121

Local Control Panels Local Equipment

,Sp'cial Req1u1re1me1t646 We;>ntgf. =

Tools Parts Clothing Required Required Required Adequate Adequate Adequate Available Available Available l"WWI Skills X

Rule Knowledge l^Cop-itA of RApons&

I "7

Cognitive Execution X

Complex Complex Simple X

Simple l~EnvWrbftfff eIW RYI J

g-Lighting HeatlHumidity X

Normal X

Normal Emergency Hot I Humid Portable Cold Radiation Atmosphere X

Background

X Normal Green Steam Yellow Smoke Red Respirator required Location Accessibility X

Control Room Front Panels Accessible Control Room Back Panels Hot Shutdown Panels Auxiliary Building Electrical Building Containment Pump house Switchyard lStresss:7 g

o

=

Optimum (Low)

Moderate X

Extreme (High)

Page 66 of 121

Cognitive HISAMGDEPRESS Cue:

The procedure (SAMGs) states in bold print that if there is no supply to the feedwater then the Steam generator is not to be depressurized. The TSC and EOF will be manned and will also be monitoring the plant parameters. This is a high stress evolution. This evolution is trained on in the simulator.

System Time Window 3600 I

I Median Response Time 300 l

Manipulation Time: 300 I

I lI Start Time:

I

-I I

Unit Seconds Reference for System Time:

Reference for ManiDulation Time:

Duration of time window available for action (TW): 3000 Seconds Sim DcsloEiE-

'I i D46 Skill vs. Rule Procedures Training Stress Skill X

Yes X

Yes X

Yes X

Rule No No No Sigma: 4.0e-01 HEP: 1.0e-09 Page 67 of 121

Execution Unrecovered HISAMGDEPRESS Table 5: HISAMGDEPRESS EXECUTION UNRECOVERED Sgte Owmisio-0

• r:

WComission

-otaIJ

=

e =m

~St===

Stressl OvTable t

'St StreSs 4 OVerw et"IPer

StepNOw 4&=

VHEP,.!

Ref..,:

,FRef I E 1O '..ValUe4 HER

VReLaj %Ref; VEtWO S Value ftRidei

'mm Stephuw6 SAMG 1.3E-3 20-7b l 3

l E

5 3.8E-3 20-12 1 2

l 6 5e-03 Actions: DEPRESSURIZING SG Comments:

Execution Recovery HISAMGDEPRESS Table 6: HISAMGDEPRESS EXECUTION RECOVERY it orila Step No.4

, MIRt

't.t

)

SAMG DEPRESSURIZING SG 6.5e-03 ig j

k.,r r a<

^otil Unrecovered: m&e-O03 5*W E

WMATotal Reovered:'rS 6.5o-03W Page 68 of 121

Appendix 4 Accident Progression Event Tree (APET)

Page 69 of 121

1-POIN {

_IG~rRI SOP RESS GEar R2 I

I iEar R3 CDY34 EhrRy eojYoc ii sOP RESS I

Eaur go 12PORWSO I burn EAR SOPRESS 1

HOarT WCOAVA IL IPORV Esar Rr SORESS hOSIEA rLEARZ 1

Gar Rs G-YORV I

EO SOP RESS eoQroJzsmPU 1

HOTrR10 I-POWI I

isOrRil GOP RGES S EA LCLEA R2 I

tisrR1Z I

ARI O-PORY I

15UrRI3 I

SOP RESS Page 70 of 121

Appendix 5 Top 50 Cutsets - Dominant Sequence (ISGTR-4)

Page 71 of 121

Cutsets with Descriptions Report ISGTR Top 50 Inputs Description Rate Exposure Event Prob Probability INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7.48E-01 I 84E-09 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 1 64E-03 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 oOE+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs I.OOE-02 I 00E-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1.00E+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE > 100 TIMES 1 OOE-02 I.OOE-02 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5.00E-01 RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 0 05 5 00E-02 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 1 OOE+00 2

INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7.48E-01 I.15E-09 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA 1 64E-03 1.64E-03 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 1.OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 I.OOE+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1 00E+00 RCCCFPOO12 Common Cause Failure of two components: VALVES, RELIEF(POWER OPERATED) - FAILTO 3.13E-04 3.13E-04 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 I.OOE+00 3

INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7 48E-0I 1.10E-09 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 1.64E-03 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 0.01 1.20E-02 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0 50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 I OOE+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE> 100 TIMES I OOE-02 I.OOE-02 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 0 05 5.00E-02 4

INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7.48E-01 I 06E-09 AFCCFPMD12 Common Cause Failure of two components CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA 1 64E-03 1 64E-03 AFCPTPTDOIFN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS DURING OPERATION 8 05E-04 24.00 1.93E-02 FLTDP-FAILR FLAG -TURBINE DRIVEN AFW PUMP FTR 1 00 1 00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5.001E-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 00E-01I NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE > 100 TIMES I OOE-02 1.00E-02 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 Page 72 of 121

1. _l_

Inputs Descnption Rate Exposure Event Prob Probability RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 0 05 5 00E-02 TDPUMPRUN TDAFWP FAILS TO RUN - RECOVERY 0 60 6.OOE-01 5

INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3 95E-02 7.77E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 OOE+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES I.OOE-02 I OOE-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 100 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 00E+00 EPCCFDGDI2 Common Cause Failure of two components: DIESEL FAIL TO START 2.71E-04 2.71 E-04 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 600E-01 NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1 OOE+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1.00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 1 OOE+00 LATEOVRFL LATE OVERFIL 5.OOE-01 X3RFA430 Loop Recovery (, 430 mn 0 05 4 84E-02 6

INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7.48E-01 6 90E-10 AFCCFPMD12 Common Cause Failure of two components CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 I.64E-03 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 001 1.20E-02 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0 50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6.OOE-01 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 RCCCFPOO12 Common Cause Failure of two components: VALVES, RELIEF(POWER OPERATED) - FAILTO 3.13 E-04 3.13E-04 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 00E-01 7

INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7 48E-01 6 67E-10 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 I 64E-03 AFCPTPTDOIFN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS DURING OPERATION 8 05E-04 24.00 1.93E-02 FL-TDP-FAILR FLAG - TURBINE DRIVEN AFW PUMP FTR 1 00 100E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 050 5.OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 RCCCFPOO12 Common Cause Failure of two components: VALVES, RELIEF(POWER OPERATED) - FAIL TO 3.13E-04 3.13E-04 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-0 1 TDPUMPRUN TDAFWP FAILS TO RUN - RECOVERY 0 60 6 00E-01 8

INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365.00 3 65E+02 5 93E-10 AFRMCLRBINH PROBABILITY THATTRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3 56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1.00E+00 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8.28E-03 8.28E-03 CSBCOOLN/INJ CS PUMP FAILURE PROBABILITY GIVEN A LOSS OF ROOM COOLING NORM. OPS/INJECT.

0 02 1.54E-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 0E+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 Page 73 of 121

Inputs Descnption Rate Exposure Event Prob Probability FL-IEAI-FAIL FLAG-BUS IEAI FAILS 1 00 1.00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs I.OOE-02 I OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.00E-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1 00E+00 9

INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365.00 3 65E+02 5.011E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0.36 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1.00E+00 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8.28E-03 828E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 100 1.ooE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E+00 EPSEGA05 BUS I EAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-IEAI-FAIL FLAG-BUS IEAI FAILS 100 100E+00 HIBFXXINITNY OPERATORS FAIL TO INITIATE FEED AND BLEED 001 L.30E-02 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 1.OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 100 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 050 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 11.OOE+00 10 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3.95E-02 4.91E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1 00E+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES 1 OOE-02 I OOE-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E+00 EPCCFBAID12 Common Cause Failure of two components: CPSES CIRCUIT BREAKER (480V AC AND ABOVE 1.71E-04 1.71E-04 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1.00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUETO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 00E-0I SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 IOOE+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 1.OOE+00 LATEOVRFL LATE OVERFIL 5.00E-01 X3RFA430 Loop Recovery @ 430 min 0 05 4.84E-02 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0.04 3.95E-02 4.68E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1 OOE+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES 1.00E-02 I1.OOE-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E+00 EPCCFPMDALL Common Cause Failure of all components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA 2.26E-03 2.26E-03 Page 74 of 121

l-I v r Inputs Rate Extposure Event Prob Probability i

FL-DGFOSTA

[

Loss of DIG l

FL-DGFOSTB I

Loss of D/G

_ _ _ _ _ __ 1.00 1.OOE+00 1.00 I.OOE+00 I

TIS.TRA PRORABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 OOE-0I NO-ATWS No ATWS Occurs 100 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5.OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1 00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 I1.OOE+00 LATEOVRFL LATE OVERFIL 5 OOE-01 X3RFG430 Loop Recovery @ 430 mm 350E-03 3 50E-03 12 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7 48E-01 4.55E-10 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 1 64E-03 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 0 01 1.20E-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 021 2 06E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE > 100 TIMES 1 00E-02 I.OOE-02 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 005 5.00E-02 13 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 748E-01 4.39E-10 AFCCFPMD12 Common Cause Failure of two components CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA 1.64E-03 1.64E-03 AFCPTPTDOIFN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS DURING OPERATION 8.05E-04 24 00 1.93E-02 FL-TDP-FAILR FLAG - TURBINE DRIVEN AFW PUMP FTR 1 00 1 00E+00 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 00E-01 MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 0.21 2 06E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 I.OOE+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE > 100 TIMES I.OOE-02 I OOE-02 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 0.05 5 OOE-02 TDPUMPRUN TDAFWP FAILS TO RUN - RECOVERY 0 60 6 00E-01 14 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3.65E+02 4.15E-10 AFRMCLRAINH PROBABILITY THAT TRAIN A MDAFWP FAILS ON LOSS OF ROOM COOLING 0.29 2 95E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 00E+00 CHSEGAITM CH PUMP TRAIN A UNAVAILABLE DUE TO TEST/MAINTENANCE 8.28E-03 8.28E-03 EPBATrDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1.00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APEr 1.00 1 OOE+00 EPSEGBO5 BUS IEA2 UNAVAILABLE DUE TO ITS FAULTS I 20E-05 1.20E-05 FL-IEA2-FAIL FLAG - BUS IEA2 FAILS 1.00 1 OOE+00 HIBFXXINITNY OPERATORS FAIL TO INITIATE FEED AND BLEED 001 1.30E-02 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs I OOE-02 I.OOE-0 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 1 00E+00 Page 75 of 121

Inputs Descnption Rate Exposure Event Prob Probability NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF I 00 1 00E+00 15 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0 75 7.48E-01 3 89E-10 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 I 64E-03 AFCPTPrDOINN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS TO START I 06E-02 1 00 1.06E-02 FL-TDP-FAILS FLAG - TURBINE DRIVEN AFW PUMP FTS 1.00 1.00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5 00E-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.001E+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE> 100 TIMES I.OOE-02 I.OOE-02 RCSPSVNSO SAFETY VALVE DOES NOT STICKOPEN DUETO PASSING WATER LEADTO RCS HIGH PRESS 050 5 00E-01 RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 005 5.00E-02 TDPUMPST TDAFWP FAILS TO START - RECOVERY 0 40 4 00E-01 16 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0.04 3.95E-02 3.85E-I0 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1.OOE+00 EPCCFDGDALL ALL 4 SITE ED~s FAIL TO START 1.08E-05 1.08E-05 EPUPSHVACFAI FLAG INDICATING FAILURE OF UPS HVAC 1 00 1.00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs I.OOE-02 I.OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1.00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1 00E+00 X3RFA110 Loop Recovery I 110 mm 030 3 02E-01 17 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0.04 3.95E-02 3.74E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1.OOE+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES 1 OOE-02 1 OOE-02 EPCCFBTD13 Common Cause Failure of two components: CPSES BATTERIES, 125 V DC - FAIL ON DEMA 1 04E-05 1.04E-05 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICKOPEN DUETO PASSING WATER LEADTO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1.00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1 OOE+00 X3RFA110 Loop RecoveryiIl10 min 0.30 3.02E-01 18 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3.95E-02 3.74E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1.OOE+00 EPCCFBTD13 Common Cause Failure of two components: CPSES BATTERIES, 125 V DC - FAIL ON DEMA I 04E-05 1 04E-05 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 1.00E-02 Page 76 of 121

Inputs Descnption Rate Exposure Event Prob Probability ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6.00E-01 NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1.00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1.00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 OOE+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 I 00E+00 X3RFA 10 Loop Recovery @ 110 min 0 30 3 02E-01 19 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365.00 3 65E+02 3 61E-10 AFRMCLRAINH PROBABILITY THAT TRAIN A MDAFWP FAILS ON LOSS OF ROOM COOLING 0.29 2 95E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1 OOE+00 CHSEGAITM CH PUMP TRAIN A UNAVAILABLE DUE TO TEST/MAINTENANCE 8 28E-03 8.28E-03 CSACOOLN/INJ CS PUMP FAILURE PROBABILITY GIVEN A LOSS OF ROOM COOLING NORM. OPS/INJECT.

001 1.13E-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET I 00 1.00E+00 EPSEGBO5 BUS I EA2 UNAVAILABLE DUE TO ITS FAULTS I 20E-05 1.20E-05 FL-I EA2-FAIL FLAG-BUS IEA2 FAILS 1 00 1 OOE+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 1 OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1 OOE+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E1+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 1 00E+00 20 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 3.59E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0.36 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1.OOE+00 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8 28E-03 8.28E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1 00E+00 EPSEGA05 BUS IEAl UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-IEAI-FAIL FLAG -BUS IEAI FAILS 1.00 1 00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 I OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 OOE-01 NO-ATWS No ATWS Occurs 1 00 1 OOE+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.00E+00 RCSEGA2 PORV I-PCV-0456 FAILS TO OPEN ON DEMAND 9 31E-03 9.3 1E-03 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1.00E+00 21 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3.65E+02 3.56E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3 56E-01 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 001 1.20E-02 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8.28E-03 8 28E-03 CSBCOOLN/INJ CS PUMP FAILURE PROBABILITY GIVEN A LOSS OF ROOM COOLING NORM. OPS/INJECT.

0 02 1.54E-02 Page 77 of 121

In uts Descnption Rate Exposure Event Prob Probability EPBAT`TDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1.00EI+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1 20E-05 FL-IEAI-FAIL FLAG -BUS IEAI FAILS 1.00 1.00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0 50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6.OOE-01 NO-ATWS No ATWS Occurs 1.00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 22 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 3.55E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 00E+00 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8 28E-03 8 28E-03 CSSEGBITM CSSEGBI, CCP TRAIN B, UNAVAILABLE DUE TO TEST/MAINTENANCE 9 22E-03 9 22E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1 00E+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-IEAI-FAIL FLAG -- BUS IEAl FAILS 1 00 1 00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs I I 00E-02 1 OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.00E-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1.00E+00 23 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 3.44E-10 AFCPTPTDOIFN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS DURING OPERATION 8.05E-04 24 00 1.93E-02 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3 56E-01 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8.28E-03 8.28E-03 CSBCOOLN/INJ CS PUMP FAILURE PROBABILITY GIVEN A LOSS OF ROOM COOLING NORM. OPS/INJECT.

0 02 1.54E-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 I.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 OOE+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-IEAI-FAIL FLAG-BUS IEAI FAILS 1 00 1 00E+00 FL-TDP-FAILR FLAG - TURBINE DRIVEN AFW PUMP FTR 1 00 1 00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5.00E-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 I 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1.00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 TDPUMPRUN TDAFWP FAILS TO RUN - RECOVERY 0 60 6 00E-01 24 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7 48E-01 3.18E-10 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 I 64E-03 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1 00E+00 Page 78 of 121

Inputs Descnption Rate Exposure Event Prob Probability HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1.00E-02 I 00E-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 RCSEGAI PORV l-PCV-0455A FAILS TO OPEN ON DEMAND 9.3 1E-03 9.3 1E-03 RCSEGA2 PORV l-PCV-0456 FAILS TO OPEN ON DEMAND 9.31 E-03 9.31 E-03 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1 00E+00 25 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7.48E-01 3 04E-10 AFSEGXI4 CST FAILS I 08E-04 1 08E-04 HIAFSSWRECVY OPERATOR FAILTO ALIGN AF SUCTION TO SW AFTER CST FAILURE 0.05 5.OOE-02 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5.OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 OOE-01 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1.00E+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE > 100 TIMES 1.OOE-02 I.OOE-02 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 050 5 OOE-01 RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 0 05 5 00E-02 26 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3.95E-02 3.03E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 100 1.OOE+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES 1 OOE-02 1 OOE-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1.00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 OOE+00 EPCCFDGO12 Common Cause Failure of two components: D G. FAIL AFTER FIRST HOUR I 46E-03 1 46E-03 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 100E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT I 00 1 00E+00 SGMSSVSO SIG SRV STUCK OPEN DUE TO WATER RELIEF 1

00 1.00E+00 LATEOVRFL LATE OVERFIL 5.OOE-01 X3RFG430 Loop Recovery a), 430 mmi 3 50E-03 3 50E-03 27 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 3 01E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3.56E-01 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 001 1 20E-02 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8.28E-03 8.28E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 00E+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS I 20E-05 1.20E-05 FL-IEAI-FAIL FLAG-BUS IEAI FAILS 1.00 1.00E+00 HIBFXXINITNY OPERATORS FAILTO INITIATE FEED AND BLEED 0.01 1.30E-02 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5.OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 Page 79 of 121

Inputs Description Rate Exposure Event Prob Probability NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.00E3+0 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.00E-01 28 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 2.97E-10 AFRMCLRAINH PROBABILITY THAT TRAIN A MDAFWP FAILS ON LOSS OF ROOM COOLING 0 29 2 95E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1 OOE+00 CHSEGAITM CH PUMP TRAIN A UNAVAILABLE DUE TO TEST/MAINTENANCE 8 28E-03 8.28E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1.00E+00 EPSEGBO5 BUS IEA2 UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-IEA2-FAIL FLAG -BUS IEA2 FAILS 1 00 1 00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 I.OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.001E+00 RCSEGAI PORV l-PCV-0455A FAILS TO OPEN ON DEMAND 9.3 IE-03 9.31 E-03 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 050 5.00E-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1.00E+00 29 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3.65E+02 2.97E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1.00E+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES I OOE-02 I OOE-02 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8.28E-03 8.28E-03 CSBCOOLN/INJ CS PUMP FAILURE PROBABILITY GIVEN A LOSS OF ROOM COOLING NORM. OPS/INJECT.

0 02 1.54E-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 I.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E1+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1 20E-05 1.20E-05 FL-IEAI-FAIL FLAG -BUS IEAI FAILS 1 00 1.00E+00 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1 00E1+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5.00E-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 I.OOE+00 LATEOVRFL LATE OVERFIL 5.OOE-01 30 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 2 90E-10 AFCPTPTDOIFN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS DURING OPERATION 8 05E-04 24 00 1 93E-02 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0.36 3 56E-01 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8 28E-03 8 28E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1 OOE+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-IEAI-FAIL FLAG-BUS IEAI FAILS 1 00 1.00E+00 FL-TDP-FAILR FLAG - TURBINE DRIVEN AFW PUMP FTR 1.00 I.OOE+00 Page 80 of 121

Inputs Description Rate Exposure Event Prob Probability HIBFXXINITNY OPERATORS FAIL TO INITIATE FEED AND BLEED 0 01 1.30E-02 l_

l HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.00E-01 TDPUMPRUN TDAFWP FAILS TO RUN - RECOVERY 0 60 6 00E-01 31 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3 95E-02 2 87E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 00E+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES 1 OOE-02 I OOE-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 I 00E4+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E+00 EPSEGB03TM DIESEL IEG2 UNAVAILABLE DUE TO TEST/MAINTENANCE 0 01 1.47E-02 EPSEGP13 COMMON POTENTIALTRANSFORMER PT/IEAI-2 FAILS 6 83E-03 6 83E-03 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 OOE-01 NO-ATWS No ATWS Occurs 1 00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1 OOE+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1 00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 1 00E+00 LATEOVRFL LATE OVERFIL 5 00E-01 X3RFA430 Loop Recovery @ 430 min 0 05 4.84E-02 32 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0.04 3.95E-02 2.86E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 I.OOE+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES 1.OOE-02 I.OOE-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 1 OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 OOE+00 EPSEGA03TM DIESEL IEG I UNAVAILABLE DUE TO TEST/MAINTENANCE 001 1.46E-02 EPSEGQ13 COMMON POTENTIAL TRANSFORMER PT/IEA2-2 FAILS 6 83E-03 6 83E-03 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6.00E-01 NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 OOE+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1.00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1.00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF I 00 1.OOE+00 LATEOVRFL LATE OVERFIL 5.00E-01 X3RFA430 Loop Recovery @ 430 mm 0 05 4 84E-02 33 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7.48E-01 2.85E-10 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA I 64E-03 I 64E-03 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 0 01 1.20E-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6.00E-01 Page 81 of 121

Inputs Descnption Rate Exposure Event Prob Probability MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 0.21 2.06E-01 NO-INDUCED NO INDUCED LOCA OCCURS I 00 1.00E-+00 RCCCFPO012 Common Cause Failure of two components: VALVES, RELIEF(POWER OPERATED) - FAIL TO 3.13E-04 3.13E-04 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 34 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7.48E-01 2 81E-10 AFMANSTARTNY OPERATOR FAIL TO MANUALLY START AFW PUMPS ON AUTO-START FAILURE 005 5 OOE-02 ESCMFMISCL3X FAILUREOF INSTRUMENTCHANNELDUETOCCFMISCALIBRATION S/G LEVEL I.OOE-04 I.OOE-04 FL-SGLL DESIGNATES AN EVENT IN WHICH A STEAM GENERATOR LOW-LOW SIGNAL IS GENERATED 1 00 1 00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5.00E-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1.00E+00 PORV-CYCLES TRANSIENT REQUIRES PORV TO CYCLE > 100 TIMES 1 OOE-02 1.00E-02 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 RCXTKN2SUPTY OPERATOR FAILS TO RECHARGE ACCUMULATOR 0 05 5 00E-02 35 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0.75 7 48E1-01 2.75E-10 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA 1 64E-03 I 64E-03 AFCPTPTDOIFN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS DURING OPERATION 8.05E-04 24 00 1.93E-02 FL-TDP-FAILR FLAG - TURBINE DRIVEN AFW PUMP FTR 1 00 1 00E+00 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 00E-01 MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED' 021 2.06E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 I.OOE+00 RCCCFPOOI2 Common Cause Failure of two components: VALVES, RELIEF(POWER OPERATED) - FAIL TO 3.13 E-04 3 13E-04 RCSPSVNSO SAFETY VALVE DOES NOT STICKOPEN DUETO PASSING WATER LEADTO RCS HIGH PRESS 0.50 5.00E-01 TDPUMPRUN TDAFWP FAILS TO RUN - RECOVERY 0 60 600E-01 36 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3.65E+02 2.511E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 100 1 OOE+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES I OOE-02 I.OOE-02 CHSEGB ITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8 28E-03 8.28E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-I EAI-FAIL FLAG-BUS I EAI FAILS 1.00 1 00E+00 HIBFXXINITNY OPERATORS FAIL TO INITIATE FEED AND BLEED 001 1.30E-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 SGMSSVSO StG SRV STUCK OPEN DUE TO WATER RELIEF 1.00 I.OOE+00 LATEOVRFL LATE OVERFIL 5 OOE-01 37 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365.00 3.65E+02 2.49E-10 AFRMCLRAINH PROBABILITY THAT TRAIN A MDAFWP FAILS ON LOSS OF ROOM COOLING 029 2.95E-01 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 001 1.20E-02 Page 82 of 121

Inputs Desenption Rate Exposure Event Prob Probability CHSEGAITM CH PUMP TRAIN A UNAVAILABLE DUE TO TEST/MAINTENANCE 8.28E-03 8.28E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 1.00E4+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 00E+00 EPSEGBO5 BUS I EA2 UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 I 20E-05 FL-IEA2-FAIL FLAG -- BUS IEA2 FAILS 1 00 100E+00 HIBFXXINITNY OPERATORS FAIL TO INITIATE FEED AND BLEED 001 1.30E-02 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5.OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1.00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E4+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.OOE-01 38 INIT-T6 LOSS OF MAIN FEEDWATER - INITIATING EVENT 0 75 7.48E-01 2.44E-10 AFCCFPMD12 Common Cause Failure of two components: CPSES - PUMPS, STANDBY MOTOR-DRIVEN - FA 1.64E-03 1.64E-03 AFCPTPTDOINN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS TO START 1.06E-02 1 00 1.06E-02 FL-TDP-FAILS FLAG - TURBINE DRIVEN AFW PUMP FTS 1.00 1.00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6.OOE-01 NO-INDUCED NO INDUCED LOCA OCCURS 100 1.00E+00 RCCCFPO012 Common Cause Failure of two components: VALVES, RELIEF(POWER OPERATED) - FAIL TO 3.13E-04 3.13E-04 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 TDPUMPST TDAFWP FAILS TO START - RECOVERY 040 4 00E-01 39 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365.00 3.65E+02 2.41 E-10 AFCPTPTDOIFN TURBINE-DRIVEN PUMP CPI-AFAPTD-01 FAILS DURING OPERATION 8 05E-04 24 00 1.93E-02 AFRMCLRAINH PROBABILITY THAT TRAIN A MDAFWP FAILS ON LOSS OF ROOM COOLING 029 2.95E-01 CHSEGAITM CH PUMP TRAIN A UNAVAILABLE DUE TO TEST/MAINTENANCE 8 28E-03 8 28E-03 EPBAITTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1.00E+00 EPSEGBO5 BUS IEA2 UNAVAILABLE DUE TO ITS FAULTS I 20E-05 1.20E-05 FL-IEA2-FAIL FLAG -BUS IEA2 FAILS 1.00 1 00E+00 FL-TDP-FAILR FLAG - TURBINE DRIVEN AFW PUMP FTR 1 00 1 00E+00 HIBFXXINITNY OPERATORS FAILTO INITIATE FEED AND BLEED 001 1.30E-02 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0 50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 TDPUMPRUN TDAFWP FAILS TO RUN - RECOVERY 0 60 6.00E-01 40 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3.95E-02 2 31E-10 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 001 1 20E-02 EPCCFDGDALL ALL 4 SITE EDGs FAIL TO START L.08E-05 1.08E-05 EPUPSHVACFAI FLAG INDICATING FAILURE OF UPS HVAC 1.00 I 00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0 50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 OOE-01 Page 83 of 121

Inputs Descnption Rate Exposure Event Prob Probability NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00

_.00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 X3RFAl 10 Loop Recovery i), 110 mm 0 30 3 02E-01 41 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3.95E-02 2.28E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 00E+00 EPCCFDGOALL ALL 4 SITE EDGs FAIL TO RUN 1.05E-04 I 05E-04 EPUPSHVACFAI FLAG INDICATING FAILURE OF UPS HVAC 1.00 100E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 I OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 1 00E4+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 Iooe+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 1.OOE+00 X3RFG 10 Loop Recovery P, 110 min 0 02 i.84E-02 42 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0.04 3.95E-02 2.24E-10 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 0 01 1.20E-02 EPCCFBTD13 Common Cause Failure of two components: CPSES BATTERIES, 125 V DC - FAIL ON DEMA I 04E-05 1.04E-05 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.001E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 050 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1.00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1.00 1 00E4+00 X3RFA110 Loop Recovery (, 110 mm 0.30 3 02E-01 43 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 2 20E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0 36 3 56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 00E+00 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 1 00E+00 EPBA1TDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1.00E+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 EPSEGB06TM XFMRTIEB4 UNAVAILABLE DUE TO TEST/MAINTENANCE 4.73E-05 4.73E-05 FL-IEAI-FAIL FLAG -- BUS IEAI FAILS 1 00 1 00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs I.OOE-02 I.OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01I NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 050 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1.00 I.OOE+00 44 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 2.20E-10 Page 84 of 121

Inputs Desenption Rate Exposure Event Prob Probability AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING

_036 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1.OOE+00 l

EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E+00 EPSEGA05 BUS I EAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1 20E-05 EPSEGB07TM XFMR TI EB2 UNAVAILABLE DUE TO TEST/MAINTENANCE 4.73E-05 4.73E-05 FL-IEAI-FAIL FLAG -- BUS IEAI FAILS 100 1 00E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1 OOE-02 1.OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-0I NO-ATWS No ATWS Occurs 1 00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 I.OOE+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1 00E+00 45 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3.65E+02 2.18E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 036 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1.OOE+00 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS I 00 1 00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1.00E1+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 EPSEGBO6 XFMR TI EB4 UNAVAILABLE DUE TO ITS FAULTS 4.69E-05 4 69E-05 FL-IEAI-FAIL FLAG-BUS IEAI FAILS 1 00 1 OOE+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1.OOE-02 I OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6.OOE-01 NO-ATWS No ATWS Occurs I 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1 00E+00 46 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 2.18E-10 AFRMCLRBINH PROBABILITY THATTRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0.36 3.56E-01 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 1.OOE+00 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1.00E+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1 20E-05 1 20E-05 EPSEGBO7 XFMRTIEB2 UNAVAILABLE DUE TO ITS FAULTS 4.69E-05 4 69E-05 FL-IEAI-FAIL FLAG -- BUS IEAI FAILS 1 00 100E+00 HISGLXAFWXNY OPERATOR FAIL TO CONTROL AFW FLOW TO 4 S/Gs 1.OOE-02 I OOE-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 100 I.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.OOE+00 RCSPSVNSO SAFETY VALVE DOES NOT STICKOPEN DUETO PASSING WATER LEADTO RCS HIGH PRESS 0.50 5 OOE-01 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 I OOE+00 47 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 365 00 3 65E+02 2.16E-10 AFRMCLRAINH PROBABILITY THAT TRAIN A MDAFWP FAILS ON LOSS OF ROOM COOLING 0.29 2.95E-01 +

I Page 85 of 121

Inputs Descnption Rate Exposure Event Prob Probability AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 0 01 1.20E-02 CHSEGAITM CH PUMP TRAIN A UNAVAILABLE DUE TO TEST/MAINTENANCE 8.28E-03 8.28E-03 CSACOOLN/INJ CS PUMP FAILURE PROBABILITY GIVEN A LOSS OF ROOM COOLING NORM. OPS/INJECT.

0 01 1.13E-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1.00E+00 EPSEGBO5 BUS IEA2 UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1.20E-05 FL-IEA2-FAIL FLAG - BUS IEA2 FAILS 1.00 1.00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 050 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0.60 6 OOE-01 NO-ATWS No ATWS Occurs 1 00 1 00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 L.00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0 50 5 OOE-01 48 INIT-X2 LOSS OF THE HVAC SYSTEM INITIATING EVENT 36500 3.65E+02 2.15E-10 AFRMCLRBINH PROBABILITY THAT TRAIN B MDAFWP FAILS ON LOSS OF ROOM COOLING 0.36 3 56E-01 AFSEGC3TM TDAFWP UNAVAILABLE DUE TO TEST/MAINTENANCE 0 01 1.20E-02 CHSEGBITM SAFETY CHILLED WATER TRAIN B IS UNAVAILABLE DUE TO MAINTENANCE 8.28E-03 8.28E-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 I.OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1 00 1 00E+00 EPSEGA05 BUS IEAI UNAVAILABLE DUE TO ITS FAULTS 1.20E-05 1 20E-05 FL-IEAI-FAIL FLAG-BUS IEAI FAILS 1.00 1 00E+00 HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 LEADS TO SG DEPRESS 0.50 5 OOE-01 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1.00 1.001E+00 RCSEGA2 PORV I-PCV-0456 FAILS TO OPEN ON DEMAND 9 311E-03 9 31E-03 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 49 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3.95E-02 2.14E-10 AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1 00 1 00E+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES I.OOE-02 I.OOE-02 EPADGGEEOINX DIESEL GENERATOR CPI-MEDGEE-01 INADVERTENTLY DISABLED 5 IOE-03 5.1OE-03 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1 00 1 00E+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BATTERIES -APET 1.00 1.OOE+00 EPSEGB03TM DIESEL IEG2 UNAVAILABLE DUE TO TEST/MAINTENANCE 0 01 1.47E-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 00E-01 NO-ATWS No ATWS Occurs 1 00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS 1 00 1.00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5 OOE-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF 1 00 1 00E+00 LATEOVRFL LATE OVERFIL 5 OOE-01 X3RFA430 Loop Recovery @,430 mrin 0 05 4 84E-02 50 INIT-X3 LOSS OF OFFSITE POWER - INITIATING EVENT 0 04 3 95E-02 2.14E-10 Page 86 of 121

Inputs Description Rate Exposure Event Prob Probability AFTDAFWPINH PROBABILITY TDAFWP FAILS TO OPERATE ON SG OVERFILL 1.00 l.OOE+00 AFTDMANTRTLY OPERATOR FAIL TO LOCALLY THROTTLE TDAFWP FLOW VALVES 1 OOE-02 I OOE-02 EPBATTDEPL TAG INDICATING DEPLETION OF BATTERIES AT 4 HOURS 1.00 1 OOE+00 EPBATTDEPLR TAG INDICATING DEPLETION OF BAITERIES -APET 1.00 1 OOE+00 EPBDGGEE02NX DIESEL GENERATOR CPI-MEDGEE-02 INADVERTENTLY DISABLED 5 IOE-03 5.10E-03 EPSEGA03TM DIESEL IEGI UNAVAILABLE DUE TO TEST/MAINTENANCE 0.01 1.46E-02 ISGTR4 PROBABILITY OF ISGTR FOR THIS SCENARIO 0 60 6 OOE-01 NO-ATWS No ATWS Occurs 1.00 1.00E+00 NO-INDUCED NO INDUCED LOCA OCCURS I 00 1 00E+00 RCSPSVNSO SAFETY VALVE DOES NOT STICK OPEN DUE TO PASSING WATER LEAD TO RCS HIGH PRESS 0.50 5.00E-01 SBO-A DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1 OOE+00 SBO-B DUMMY EVENT - INDICATING POTENTIAL STATION BLACKOUT 1 00 1.00E+00 SGMSSVSO S/G SRV STUCK OPEN DUE TO WATER RELIEF I 00 1 00E+00 LATEOVRFL LATE OVERFIL 5.OOE-01 X3RFA430 Loop Recovery i 430 mm 0 05 4 84E-02 Page 87 of 121

Appendix 6 Primary Safety Valve (PSV) Reliability Assessment for Station Blackout (SBO) Scenario Evaluations at Comanche Peak Page 88 of 121

Summary This evaluation of PSV Reliability was performed to support an analysis of the impact of a previous Steam Generator (SG) tube leak on the assessment of LERF and delta LERF for the Comanche Peak generating station. A LERF evaluation includes assessments of a random SG tube failure; of a SG tube failure under accidentally induced large pressure differences; and of a SG tube failure due to creep rupture under the impact of hot gases associated with core damage events [A6.1]. Table 1 summarizes the PSV data generated by the model at four time indexes. Use of Index 33 is recommended for the LERF evaluation.

Table 1 Summary of key times for assessing the Prima Safety Valve Reliability Index V3S V3 V4 Notes Valve 3 Valve 4 Valve 3 Valve 4 Combined Standard W

W E(D(L)

E(D(L) normal normal Deviation from PSV Monte Carlo primary Simulation depressurization probability 28 10 16 2

50% damage model 9.19E-01 1.22E-01 420E-01 1.40E-02 4.28E-01 232E-01 33 10 19 4

Longest lift 1.24E+00 1.90E-01 7.28E-01 2.15E-02 7.34E-01 1.86E-01 44 19 19 6

Last Point for Operator Success 1 53E+00 3 04E-01 9.07E-01 4 09E-02 9.10E-01 1.08E-01 61 34 21 6

Hot leg rupture 1.79E+00 3 04E-01 9.76E-01 4 09E-02 9.77E-01 In this table, the "index" is a number used to count discrete valve opening events, and the next three columns refer to the number of lifts with water or steam for the two safety valves (MAAP model valve numbers 3 and 4) with the lowest set-points. The "notes" describe various key times in the evaluation, and the next two columns refer to the expected valve damage at these times (a damage value of 1 denotes the median failure probability). The next two columns incorporate the damage column into the cumulative normal models for valves 3 and 4. The last two columns provide the probability that one or more of the valves fail open, and the standard deviation for each case produced by Monte Carlo Simulation.

For LERF evaluations it is important to estimate the conditional probability of valve failure at a time when the subsequent depressurization would with high certainty prevent a SG tube rupture. Index 44 conservatively represents this case from the thermal-hydraulic viewpoint. It corresponds to the time when the operators would be expected to open the PORVs in accordance to the SAMGs. In this case the split fraction is 0.88/0.12.

This selection is considered quite conservative since the MAAP calculation, which simulated this event, was based on one PORV being opened (a PORV provides only half the flow area of the PSV), and the results showed substantial margin to SG tube failure.

Other ways of using the data in Table 1 to support the LERF evaluation includes selecting other indexes that provide additional conservatism to the assessment of LERF.

If index 28 is used as the estimate of PSV (about 50/50 as suggested in NUREG-1570 for this condition), it has the largest standard deviation and 70 minutes before the hot leg would fail. This leaves a large margin of time for full depressurization of the primary.

If index 33 is used, which follows the longest most damaging predicted water lift, it has a split fraction of 0.73/0.27. In this case the time before the hot leg is predicted to fail is 67 Page 89 of 121

minutes, which also leaves a large time margin for depressurization. In this case the standard deviation of the probability of failure is reduced from index 28.

Thus, there is a technical basis for selecting any one of the conditional probabilities to be used in the LERF calculation model. However, index 33 appears to have the strongest technical basis from the valve reliability viewpoint.

Background

The primary safety valve is an important component in evaluating the ways of avoiding LERF. The evaluations of LERF are based on minimizing the pressure differential across the SG tubes when the core temperature increases producing hot gases that circulate naturally in the primary circuit after the water is depleted and core damage begins.

If the accident scenarios have a low pressure on the secondary, one of the important ways of minimizing the SG tube pressure differential is by reducing primary pressure through failure of the primary safety valves (PSVs). Such a condition is likely, due to cumulative effect of lifts that relieve either steam or water. The other ways of reducing primary pressure include: (1) the operators opening a primary relief pathway using the power operated relief valves (PORVs) as instructed by procedures, (2) failure of the hot leg piping or (3) failure of the SG tubing due to creep rupture.

The analysis of a primary safety valve sticking open [A6.2] requires a base case thermal hydraulic analysis of the key PRA accident sequence leading to a core damage with the secondary side at low pressure and primary side at the relief valve set point pressure.

MAAP runs of a Loss of electric power with no diesel generators and loss of auxiliary feedwater is a standard sequence for this assessment [A6.3, 4]. These models assume that no operator actions are taken to reduce pressure and the valve works as designed.

This permits modeling of temperatures that cause creep rupture in both the hot leg and SG tubes under various conditions (e.g., delta pressure across the SG tubes).

This evaluation of PSV reliability provides the likelihood of an alternate sequence where a PSV fails open in enough time to lower primary pressure, and thus inhibit the hot gas path required to cause creep rupture of the tubing. If the primary pressure is low enough to stop the creep rupture condition, the LERF condition is avoided.

VALVE RELIABILITY MODEL ANALSIS Method Valve reliability is a function of the maintenance policies of the plant, which can involve inspections, lift testing and resetting the blowdown conditions; and the cumulative lifts during accident scenarios.

The statistical measures of valve failures on the first or second lift requirement can be attributed to errors in maintenance and testing according to the review of LERs related to valve demands, operations and failures. Based on event data evaluation, the following statistically based estimate is provided for the MSSV failure rate per valve on its first lift.

Page 90 of 121

The central estimate is determined from the formulation for one observed failure in the sample population.

Xd = 4.5E-3/d A number of IPE's use values in the range of 0.007/d and 0.1/d for water lifts.

Information from the NRC in the form of event studies and EPRI's actual valve tests were used to identify failure modes and causes of valve failures in sequences where numerous lifts of the PSVs occur [A6.5, 6, 7]. A relief valve is normally closed, and then following a lift challenge begins opening, stays open for the blowdown period, and

-then closes. Failures during these phases of multiple lifts are expected to be governed by causes such as wear and fatigue that are part of valve cycle conditions. For example, small amounts of wear occur to the valve structure during each lift, and these vary significantly according to fluid flowing through the valve. Damage changes can be observed as small changes in valve lift and closure times from graphical time plots in the EPRI experiments. The plots also indicate observable cyclic behavior of the valve stem.

The EPRI tests included both steam and water relief conditions in several valve types.

With this information available a basis for wear out modeling can be constructed using the Palmgren -Miner hypotheses [A6.3].

Valve Damage Model In this model E(D(L), is simply the reciprocal of the mean cycles to failure for the given mix of valve lifts.

En,(-')

En2( L)-

Sn3(

}E+(D(L))

I

+

N1 (SI)

N 2 (S 2 )

N 3 (S 3)

The cumulative failure rate density function E(D(L)) uses nl, which is a function of the time the valve is open when steam is flowing through the valve, n2, which is a function of the opening and closing stresses, and n3, which is a function of the time the valve is open when water is flowing through the valve. Input data for these elements are determined from experimental tests by observing the number of cycles at each stress intensity for specific lift types. N1, N2, and N3 are the estimated cycles to failure for each stress intensity S1, 2, 3; and i, j, and k are the indexes for each lift. Given a value for the damage function, E(D(L)), two distributions are considered for prediction of the PSV valve reliability. An exponential model is:

Fe(L) = 1-exp[-E(D(L))

• L].

2 In the case of a normal distribution, the cumulative failure probability is:

1, L)_

_3 aHera 2 (

a

)E Both Fe(L) and Fn(L) have the capability of modeling lift dependent wear-out when the cumulative damage function is used. Neither function assumes repair between lifts, but provide a simple method of implementing the valve failure distributions as a function of the number of lifts during a SBO event. Where E(D(L)) is the cumulative damage density function, a is the standard deviation, and p. is the value of the damage function Page 91 of 121

when 50% of the valves are expected to fail. Since this calculation is performed discreetly on a spreadsheet, different types of lifts (e. g., with and without water) can easily be modeled, whereas closed solutions require simplified (or lumped) stress intensity distribution functions. In what follows, the damage portion of the model is developed for use in both distributions.

Data for damage model Data from the tests such as the blowdown settings, the lift timing, the flutter or chattering, the time open and closing were classified for stress type and frequency by examination of each lift record. The data were "averaged" to produce the base line information for a lift with either water or steam in a PSV or a MSSV in Table 2.

Test Data Valve test data were reviewed looking for trends that would support the Palmgren-Miner fatigue strength hypothesis. To evaluate various test cycle loading conditions this integral is simplified by assuming that three different levels of stress loading are associated with spring loaded valve lifts. A review of models and data for addressing valve component failures under the kind of loads and cycles expected for safety relief valves during a SBO severe accident indicates that vibration induced fatigue damage could be classified in three groups with different vibration frequency and stress intensity conditions:

• During stable blowdown conditions rapid small intensity changes in valve spindle position occur due to variations in fluid flow rate through the valve seat. 4 SI.

The number of valve spindle cycles per unit time was estimated considering variations in the measured stem position and sound frequency as described in reference 3.

• During stable lift off and closure as the seat and disk separate and pop to full open position and reclose positions, oscillations occur with a medium stress intensity.

->S2. The number of valve spindle cycles per unit time was estimated from the frequency of larger oscillations upon opening and closing measured by stem position, and observed stem flutter on opening and closing as described in reference 3.

• During unstable conditions (due to operation under poorly optimized conditions) large intensity oscillations called chattering can occur. This case is applied to solid water passing the valve, as well. -e S3. The number of large valve oscillations per unit time was estimated by observation of the valve stem position measures when water passed through the valve, and when heavy chattering occurred.

The number of stress cycles of each type necessary to cause failure, NI, was estimated from material properties data in handbooks and from the test data by examination of the lifts between overhauls triggered by extended chattering on the previous test lift to define an end point and cumulative cycles to that point. The data in Table 2 are calibrated to an average lift condition for opening, open and closing times. The average time open can be related to the predicted open times in MAAP to produce a Page 92 of 121

lift specific damage accumulation. The opening and closing times are assumed to be average for each lift.

Table 2 Data for valve reliability modeling cumulative damage model (Ref 3)

Data Summary for 5% blow down base case Model values Data Inputs MSSV PZR steam PZR water Valve test data N(SI)

I OE+06 I OE+06 L.OE+06 N(S2)

I OE+05 3 OE+04 3.OE+04 N(S3)

I.OE+03 N/lift 5 800 4000 6055 N/iM S2 318 10 200 N/lift S3 50 Palmgren-Miner cumulative Damage hypothesis E(D)/lift 0.0040 0 0043 0 0627 Valve Reliability models Constant failure per lift 0.0040 0 0043 00627 Ave blowdown %

8 65 8.7 11.2 Ave Blow down time 8

30 40 Normal Mean of E(D) t9failure I

I I

Sigma 0 28 0 4 0 4 Initial lift value for maintenance impact 0.0045 0 0045 0045 Uncertainty in Estimating Stress Cycles The usual specification of accuracy of prediction of the mean is by specifying "confidence limits" which lists the range of the independent variable, E(D(L)),

cumulative damage in this case, associated with a given percent confidence. For example, one might indicate that the failure of a given valve operating under specific conditions occurs between 0.67 and 1.33 on the cumulative damage measure, which corresponds to 100 to 300 steam lifts per valve with 90 percent confidence. Confidence limits are determined from the "percentiles" of the distribution. The 90 percent confidence band of a distribution is that range between the 5th and 95th percentiles. For this assessment the distributions for failure per lift and failure in time were calculated numerically within a spreadsheet program to obtain both the mean and the variance. The results of an uncertainty evaluation are shown in Appendix A and the input distributions to the model are described in Appendix B.

Analysis Results for TXU SBO scenario This analysis of failure of the pressurizer PSVs applies to all PRA sequences initiated by a loss of offsite power, failure of diesel generators to start and failure of the auxiliary feedwater pump for an extended time period. Additional features of the PSV designs that impact the results. These are that the valve rings are set for a 5 percent blowdown, PSV 3 has the lowest set point, and PSV 4 has the next highest set point. During the transient PSV 3 is assumed to continue to have the lowest set point as the sequence progresses. This is expected because the set point is assumed to tend to drift downward.

The failure mode of interest is PSV fails open and thus depressurizes the primary before the hot leg is predicted to fail and cause a rapid depressurization. If the valve opens the Page 93 of 121

first time, then valve failure closed or sticking becomes very unlikely because the causes are not active. Even if the valve remains closed the next highest set point valve would substitute for valve 3.

The input timing data for valve opening and duration from the MAAP code are provided in table 3. In summary valve 3 is subjected to 20 lifts with water and 34 lifts with steam prior to approximate time of hot leg rupture, and valve 4 has 6 lifts with water and no lifts with steam. In the MAAP run valves 3 and 4 are assumed to work for the purpose of evaluating the time of hot leg failure and assessing the potential for SG tube rupture failure.

It is assumed that the PSVs do not have a loop seal containing water for the first lift. (If they do, the results above would shift to the next full index e.g., index 28 would have the reliability values of index 29 for an additional water lift).

This calculation of the valve failure probability permits evaluations of alternate ways to depressurize the primary given core damage sequences. The combined reliability model is the Boolean sum of the failure probability of valve 3 and valve 4. Figure 1 provides a graphical picture of the combined reliability functions for three different reliability models.

The models are cumulative damage function with a normal failure model, cumulative damage function as input to an exponential failure model and two constant failure rates (4.5E-3 for steam and 4.5E-2 for water) into and exponential failure model.

The results of the quantitative valve reliability analysis are provided in table 4 and presented graphically in Figure 1. This shows the significant difference between steam and water lifts on the reliability function. Also the impact of different valve blowdown timing can be observed as the small changes in slope especially in the normal model.

To understand the impact of key uncertainties on the model, the input information for indexes 28, 33, and 44 were examined for the impact of uncertainties in the cumulative damage model assuming that the MAAP run represents a valid deterministic picture of the valve lifts. The results of the uncertainty assessment are presented in Appendix A. In this case the model inputs were assigned distributions that represented the expected range of values as described in Appendix B. The resulting Monte Carlo distributions at these three points shows a wide range of distribution shapes as the likelihood of sticking open increases toward a probability of 1. The uncertainty measure of standard deviation first increases as the lifts begin, and then after peaking around the 50/50 damage point decrease as the number of lifts increase. At index 28 the distribution has a peak at about

.5, the peak rapidly shifts to 1.0 by index 33 following the longest lift.

Table 3 Conversion of MAAP results into scenario specific input to the valve reliability model Time at opening Time valve is open V3 steam V3 water V4 steam V4 water Notes (seconds)

(seconds) lifts lifts lifts lifts 2123.574 3.931 1

Valve 3. safety with lowest setpoint 2

2568.503 4 05 2

3 2868.053 3 62 3

4 3097 6 3.345 4

5 3273.046 2.877 5

6 3418 581 3 171 6

7 3554 512 2 921 7

8 3677.669 2.942 8.

Page 94 of 121

Time at opening Time valve is open V3 steam V3 water V4 steam V4 water Notes (seconds)

(seconds) lifts lifts lifts lifts 9

3780.659 2 431 9

10 38641206 2.926 10 I11 3929353 7 275 10 I

Water lifts start here Valve 3 12 4009.696 9 097 10 2

13 4087.146 8.92 10 3

14 4171.399 10.371 10 4

15 4250.434 9 788 10 5

1 6 4331.765 11.37 10 6

17 4414.592 11.498 10 7

18 4489.206 10.968 10 8

19 4567.281 12.319 10-9 20 4644 625 13.283 10 10 21 4715 881 12.177 10 1 1 22 4775 894 11.449 10 12 23 4835 84 10 58 10 13 23.5 4836 421 4.797 10 13 I

Valve 4-safety with 2nd lowest set point 25 4908 025 10 485 10 14 1

25.5 4908 63 5.974 10 14 2

27 4978 172 15 244 10 15 2

50% damage model 28 5043 817 20 371 10 16 2

50% damage model 29 5125 909 12 12 10 17 2

29.5 5126588 8 234 10 17 -

3 31 5200.189 10 815 10 17 3

31.5 5200 946 8242 10 18 4 -

33 5261.48 685 049 10 19 4

Longest lifton Valve 3 33 5 5262.182 9 053 10 19 5

34.5 5610 238 231.636 10 19 6

36 5986 467 72 415 11 19 6

Steam below this ponit 37 6093.702 72 215 12 19 6

38 6199 794 95 212 13 19 6

39 6340.769 74 244 14 19 6

40 6479 06 80 902 15 19 6

41 6635 016 50 51 16 19 6

42 6755 662 48 485 17 19 6

43 6884 049 41.348 18 19 6

44 7004 755 38 044 19 19 6

Last pomt - operator success on PORVs 45 7154 077 19.1

-20 19 6

46 7246 154 29.134 21 19 6

47 7382.729 18 554 22 19 6

48 7482.888 33.354 23 19 6

49 7656 775 30 341 24 19 6

50 7839 554 16 943 25 19 6

51 7946 348 28.94 26 19 6

52 8115 258 26 344 27 19 6

53 8257.801 16 617 28 19 6

54 8393 803 40 375 29 19 6

55 8490 069 47.684 30 19 6

56 8695 839 38 794 31 19 6

57 8807.69 84 289 32 19 6

58 8922 219 23.073 33 19 6

59 8979.37 20.394 34 19 6

60 9182.207 14 142 34 20 6

61 9274 847 13.578 34 21 6

Hot leg rupture Page 95 of 121

Table 4 Summary of reliability modeling for PSVs 3 & 4 MAAP SI S2 S3 E(D(L))

E(D(L))

Valve 3 Valve 4 Valve 3 Valve 4 Combined Combined Combined index steam water Cum cum

- normal normal normal exponential constant damage' damage 2 model model (cum-(cum with 2 rates damage) damage) 1 0.0005 0 0003 0 0573 0 0009 0 0581 0 0054 0 0045 6.45E-03 6.41E-03 128E-02 2.06E-02 4 49E-03 2

0.0005 0 0003 0 0573 0 0009 0 0582 0 0062 0 0045 6.49E-03 6.41E-03 1.29E-02 2.14E-02 8 96E-03 3

0.0005 0 0003 0 0572 0 0008 0 0580 0 0070 0 0045 6.53E-03 6.41E-03 1.29E-02 2.22E-02 1.34E-02 4

0.0004 0 0003 0 0572 0 0008 0.0580 0 0078 0 0045 6 56E-03 6 41E-03 1.29E-02 2.30E-02 1.78E-02 5

0.0004 0 0003 0 0571 0 0007 0.0578 0 0085 0 0045 6 59E-03 6 41E-03 1.30E-02 2 37E-02 2.22E-02 6

0 0004 0 0003 0 0571 0 0008 0.0579 0 0093 0 0045 6 63E-03 6 41E-03 1.30E-02 2.44E-02 2.66E-02 7

0 0004 0 0003 0 0571 0.0007 0.0578 0 0100 0.0045 6 66E-03 6 41E-03 1.30E-02 2.51E-02 3.10E-02 8

0 0004 0 0003 0 0571 0.0007 0.0578 0 0107 0.0045 6 70E-03 6411E-03 1 31 E-02 2 58E-02 3.54E-02 9

0 0003 0 0003 0.0570 0.0007 0 0577 0 0114 0.0045 6 73E-03 641E-03 1.31E-02 2 65E-02 3 97E-02 10 0 0004 0 0003 0.0571 0.0007 0 0578 0 0121 0.0045 6 76E-03 6 41E-03 I 31E-02 2 72E-02 4 40E-02 I

00010 0 0003-0.0578 0 0013 0 0591 0 0134 0 0045 6 82E-03 641E-03 1 32E-02 2 84E-02 8 61E-02 12 0 0012 0.0003 0 0580 0 0015 0 0596 0.0730 0 0045 1.02E-02 6 41E-03 I 66E-02 8 46E-02 1.26E-01 13 0.0012 0.0003 0 0580 0 0015 0 0595 0.1326 0 0045

- 1.51E-02 6 41E-03 2.14E-02 1.38E-01 1 65E-01 14 0.0014 0.0003 0 0582 0 0017 0 0600 0.1925 0 0045 2.18E-02 6.41E-03 2 80E-02 1 88E-01 2 OIE-01 15 0.0013 0.0003 0 0581 0 0016 0 0598 0.2523 0 0045 3.08E-02 6.41E-03 3.70E-02 2.35E-01 237E-01 16 0.0015 0 0003 0 0584 0 0018 0 0602 0 3125 0 0045 4.28E-02 6.41E-03 4.90E-02 2.80E-01 2.70E-01 17 0 0015 0 0003 0 0584 0 0019 0 0603

-0.3728 0 0045 5 84E-02 6.41E-03 6.45E-02 3.22E-01 3.02E-01 18 0 0015 0 0003 0 0583 0 0018 0 0601 0 4329-0 0045 7.81E-02 641E-03 8.41E-02 3.61E-01 3.33E-01 19 0 0016 0 0003 0 0585 0 0020 0.0605 0 4934 0 0045 1 03E-01 6 41E-03 1.08E-01 3 99E-01 3.62E-0O 20 0 0018 0 0003 0 0587 0 0021 0.0608 0 5542 0.0045 1 33E-01 641E-03 1.38E-01 4 34E-01 3.90E-0O 21 0 0016 0 0003 0 0585 0.0020 0.0605 0 6147 0.0045 1 68E-01 6411E-03 1.73E-01 4 67E-01 4 17E-01 22 0 0015 0 0003 0 0584 0.0019 0 0603 0 6749 0.0045 2 08E-01 641E-03 2.13E-01 4.99E-01 4 43E-01 23 0 0014 0 0003

-0.0583 0.0017 0 0600 0 7350 0.0045 2 54E-01 6 41E-03 2.59E-01 5 28E-01 4 67E-01 23 5 0 0006 0 0003 0.0574 0.0010

-0 0584 0.7350 0.0629 2 54E 9 57E-03 2 61E-01 5 29E-01 4 91E-01 25 0 0014 0 0003 0.0583 0 0017 0 0600 0.7949 0 0629 3 04E-01 9 57E-03 3.1 1E-01 5.57E-0O S 13E-01 25.5 0 0008 0 0003 0.0576 0 0011 0 0587 0.7949 0 1216 3 04E-01 1.40E-02 3 14E-01 5 59E-01 5 35E-0I 27 0 0020 0.0003 0 0590 0 0024 0 0613 0.8563 0 1216 3.60E-01 1.40E-02 3 69E-01 5 85E-01 5.55E-01 0.0027 0.0003 0 0598 0 0030 0 0628 0.9191 0 1216 4.20E-01 1.40E-02 4.28E-01 6 IOE-01 5 75E-01 29 0.0016 0.0003 0 0585 0 0019 0 0605 0 9795 0 1216 4 80E-01 1.40E-02 4.87E-01 6.33E-01 5.93E-01 29.5 0.0011 0 0003 0 0579 0 0014 0 0593 0 9795 0 1809 4 80E-01 2.03E-02 4.90E-01 6.35E-01 6.11 E-0 1 31 0 0014 0 0003 0 0583 0 0018 0 0601 1 0396 0 1809 5.39E-01 2.03E-02 5.49E-01 6 57E-01 6.11 E-01 31.5 0 0011 0 0003 0 0079 0 0014 0.0093 10396 0 1903 5 39E-01 2.15E-02 5 49E-01 6.57E-01 6.45E-01 334 0 0913 0 0003 0 1114 0 0917 0.2030 12427 0.1903 7 28E-01 2.15E-02 7 34E-01 7.20E-01 6 60E-01 335 0 0012 0 0003 0 0230 0 0015 0.0246 1.2427 0.2148 728E-01 2 48E-02 7.35E-01 7.21E-01 6 75E-01 345 0 0309 0 0003 0 0577 0.0312 0 0889 1.2427 0.3038 7.28E-01 4 09E-02 7.39E-01 725E-01 6.90E-01 36 0 0097 0 0003 0 0366 0.0100 0 0466 1.2893 0.3038 7 65E-01 4 09E-02 7 75E-01 738E-01 6 91E-01 37 0 0096 0 0003 0.0366 0.0100 0 0466 13358 0.3038 7.99E-01 4 09E-02 8 08E-01 7.50E-01 6 92E-01 38 0 0127 0 0003 0.0421 0.0130 0 0551 13909 0 3038 8 36E-01 4 09E-02 8 43E-01 7.63E-01 6 94E-01 39 0 0099 0 0003 0 0179 0 0102 0 0281 1.4191 0 3038 8.53E-01 4 09E-02 8 59E-01 7.70E-01 6 95E-01 40 0 0108 0.0003 0 0189 0 0111 0 0300 1.4491 0 3038 8.69E-01 4.09E-02 8.75E-01 7.77E-01 6 97E-0I 41 0.0067 0.0003 0 0143 0 0071 0 0214 1.4705 0 3038

-8.80E-01 4.09E-02 8.85E-01 7.81E-01 6 98E-01 42 0.0065 0.0003 0 0140 0 0068 0 0208 1.4913 0 3038 8 90E-01 4 09E-02 8.95E-01 7.86E-01 6.99E-01 43 0.0055 0.0003 0 0129 0 0058 0 0188 1.5101 0 3038 8 99E-01 4 09E-02 9.03E-01 7.90E-01 7.0IE-0I 44 0 0051 0 0003 0 0124 0 0054 0 0178 1.5279 0 3038 9 07E-01 4 09E-02 9.10E-01 7.94E-01 7.02E-01 45 0 0025 0 0003 0 0096 0 0029 0 0124 1 5403 0.3038 9 12E-01 4 09E-02 9 15E-01 7.96E-01 7.03E-01 46 0 0039 0 0003

-0 0111 0 0042 0.0153 1 5556 0 3038 9 18E-01 4 09E-02 9.21E-01 7.99E-01 7.05E-01 47 0 0025 0 0003 0 0095 0.0028 0.0123 1 5679 0.3038 9 22E-01 4 09E-02 9 25E-01 8 02E-01 7.06E-01 48 0 0044 0 0003 0 0117 0.0048 -

0.0165 1.5844 0.3038 928E-01 4 09E-02 9 31E-01 8 05E-01 7 07E-01 49 0 0040 0 0003 0.0113 0.0044 0 0156 1 6001 0.3038 9 33E-01 4 09E-02 9 36E-01 8 08E-01 7 09E-01 50 0 0023 0 0003 0.0092 0.0026 0 0118 1 6119 0.3038 9.37E-01 4 09E-02 9 40E-01 8 IOE-01 7 IOE-01 51 0 0039 0 0003 0.0110 0 0042 0 0152 1 6271 0 3038 9 42E-01 4 09E-02 9 44E-01 8.13E-01 7.1 IE-0I 52 0 0035 0 0003 0.0107 0 0038 0 0145 1 6416 0 3038 9 46E-OI 4 09E-02 9 48E-01 8.16E-01 7 12E-01 53 0.0022 0 0003 0.0092 0 0025 0 0117 1.6533 0 3038 9.49E-01 4 09E-02 9 51E-01 8.18E-01 7.14E-OI

'The likelihood of failure is 50/50 when the damage function is 1.0.

2 The first lift failure rate is due to previous test and maintenance conditions, and represents failure probability prior to first lift. It becomes part of cumulative failure probability and for simplicity is included in the damage function.

3The grayed lines represent possible cases to use as branch point estimates for PSVs fail to reclose depressurizing the primary.

Between index 31 and 33 the models are in basic agreement for the numerical value of valve reliability. This is also the longest lift.

Page 96 of 121

MAAP SI S2 S3 E(D(L))

E(D(L))

Valve 3 Valve 4 Valve 3 Valve 4 Combmed Combined Combined index steam water Cum cum normal normal normal exponential constant damage5 damage6 model model (cum-(cum with 2 rates damage) damage) 54 00054 00003 00128 00057 00185 1.6718 0 3038 953E-01 409E-02 9.55E-01 821E-01 7.15E-01 55 0 0064 0 0003 0 0139 0 0067 0 0206 1.6924 0 3038 9 58E-01 4 09E-02 9.60E-01 8 25E-01 7.16E-01 56 1 0 0052 0 0003 0 0125 0 0055 0 0180 1.7105 0 3038 9 62E-01 4 09E-02 9.64E-01 828E-01 7.18E-01 57 00112 00003 00194 00116 00310 1.7415 0 3038 968E-01 409E-02 9.69E-01 833E-01 7.19E-01 58 00031 00003 00102 00034 00136 1.7550 03038 970E-01 409E-02 9.72E-01 836E-01 7.20E-01 59 0 0027 0 0003 0 0098 0 0031 0 0128 1.7678 0 3038 9.73E-01 4 09E-02 9.74E-01 8.38E-01 7.21E-01 60 0 0019 0 0003 0 0088 0 0022 0 0110 1.7789 0 3038 9 74E-01 4 09E-02 9.75E-01 8.39E-01 7.34E-01 61 0 0018 0 0003 0.0087 0 0021 0 0109 1.7897 0 3038 9.76E-01 4 09E-02 9.77E-01 8 41E-01 7.45E-01 5The likelihood of failure is 50/50 when the damage function is 1.0.

6 The first lift failure rate is due to previous test and maintenance conditions, and represents failure probability prior to first lift. It becomes part of cumulative failure probability and for simplicity is included in the damage function.

Page 97 of 121

Ca) a.

0 C

0.

co Q.-

4-0 2

Probability that either PSV3 or PSV4 fails to reclose during SBO transient (Valve setting at 5% blowdown) 1 000 _ _ MX.W At this point there is a 50150 Vf

=

ths pointitis still conservative to

~

assume that if one PSV fails open It f

prevents any reasonable chance of a

[ t ermally Induced SG tube rupture 0.100 X

-c o

ioo hi Kui4 w 4 i t X

-iA Norma! model (cum damage) - Exponential model (cum damage) o i Exponental (2 constant failure rates) _

0 010 -

4 1

11 21 31 41 51 61 71 Lift index from MAAP Run (isgtrO4d)

Figure 1 Lift dependent depressurization due to failure to reclose of a PSV References A6.1.

"Steam Generator Tube Integrity Risk Assessment: volume 1: General Methodology, Revision I," EPRI TR-107623-V I, EPRI, Palo Alto, CA, 2002. (By Fuller, E.L, E. T. Rumble, G. W. Hannaman, M. A. Kenton, and M. Lloyd.)

A6.2.

Karpyak Steve, Mark Kenton, "Personnel communication on results of MAAP run isgtrO4d for Comanche Peak SBO scenario " 3/72002.

A6.3.

Hannaman G. W., " Safety Valve Reliability Assessments for PSAs," ANS PSA meeting Detroit, 2002.

A6.4.

MAAP4 _ Modular Accident Analysis Program for LWR Power Plants, EPRI Research Project 3131-02 Computer Code manual, May 1994. Report," Electric Power Research Institute, Palo Alto, California, December 1982.

A6.5.

EPRI NP-2628-SR "EPRI PWR Safety and Relief Valve Test Program Safety and Relief Valve Test A6.6.

EPRI NP-4306-SR, "Safety and Relief Valves In Light Water Reactors" Electric Power Research Institute, Palo Alto, California, December 1985.

A6.7.

Continum Dynamic, Inc. "Summary of Crosby Main Steam Safety valve test program results," Electric Power Research Institute, project 2233-21 Palo Alto, California, June 1989.

Page 98 of 121

Appendix A Uncertainty Simulation Results These uncertainty assessments produce a distribution on the uncertainty of the probability that the PSV sticks open at a fixed time index given a number of lifts. The uncertainties address the issues within the reliability models and do not consider factors within MAAP. The four times evaluated are for index 11 which represents the time when water lifts start, 28 when the 50% damage model is exceeded, 33 just following the longest water lift, and 44 which is the last point for operator success in depressurizing.

Forecast: water lifts start here (index 11)

Cell: G37 Summary:

Display Range is from O.OOE+O to 3.50E-1 PSV failure prob.

Entire Range is from 1.26E-9 to 3.26E-I PSV failure prob.

After 10,000 Trials, the Std. Error of the Mean is 3.1OE-4 Statistics:

Value Trials 10000 Mean 2.30E-02 Median 1.07E-02 Mode Standard Deviation 3.10E-02 Variance 9.63E-04 Skewness 2.45 Kurtosis 11.11 Coeff. of Variability 1.35 Range Minimum 1.27E-09 Range Maximum 3.26E-0l Range Width 3.26E-0l Mean Std. Error 3.1 OE-04 Forecast water lifts start here 10,000 Trials Frequency Chart 0 Outliers 294

-2

-2940 221-

-I,

.147 074 735 00° -

0 111 3 -- -1 0OODE+O

&75E-2 1 75E-1 2.6E-1 3.50-1 PSVfalue prb.

Page 99 of 121

Percentiles:

Percentile 0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

PSV failure prob.

1.27E-09 4.72E-04 1.72E-03 3.65E-03 6.54E-03 1.07E-02 1.67E-02 2.51E-02 3.82E-02 6.26E-02 3.26E-01 End of Forecast Forecast: 50% damage model index 28 Cell: G39 Summary:

Display Range is from O.OOE+0 to l.OOE+0 PSV failure probability Entire Range is from 1.OIE-2 to l.OOE+0 PSV failure probability After 10,000 Trials, the Std. Error of the Mean is 2.32E-3 Statistics:

Trials Mean Median Mode Standard Deviation Variance Skewness Kurtosis Coeff. of Variability Range Minimum Range Maximum Range Width Mean Std. Error Value 10000 4.93E-01 4.67E-01 1.OOE+00 2.32E-01 5.37E-02 0.32 2.27 0.47 L.O1E-02 1.OOE+00 9.90E-01 2.32E-03 Forecast 50% damage model 1 0,000 Trials Frequency Chart 0 Outliers

.018 i

014 -

135 ODD 0

a.OE+o 215CE-1 5 OOE-1 7 50E-1 1 OE4O PSVbaluepwbablty Page 100 of 121

Percentiles:

Cell: G39 Percentile 0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

PSV failure probability 1.01E-02 2.02E-01 2.78E-01 3.42E-01 4.06E-01 4.67E-01 5.34E-01 6.14E-0l 7.09E-01 8.35E-01 1.OOE+00 Forecast: Longest lift (index 33)

Summary:

Display Range is from O.OOE+O to l.OOE+0 PSV fails open Entire Range is from 2.84E-3 to 1.OOE+O PSV fails open After 10,000 Trials, the Std. Error of the Mean is 1.86E-3 Statistics:

Trials Mean Median Mode Standard Deviation Variance Skewness Kurtosis Coeff. of Variability Range Minimum Range Maximum Range Width Mean Std. Error Cell: G43 Value 10000 7.50E-01 7.74E-01 1.86E-01 3.46E-02

-0.51 2.40 0.25 2.84E-03 1.OOE+00 9.97E-01 1.86E-03 Forecast: Longest lift 10,000 Trials Frequency Chart 0 Outliers 072

- 720 054-

-540

.0 036-

-360 18 L. 018 18

.1000 4 0 0 OOE+0 2 50E-1 5 OOE-1 7.50E-1 1 OOE+0 PSV fails open Page 101 of 121

I Percentiles:

Percentile 0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

PSV fails open 2.84E-03 4.83E-01 5.74E-01 6.52E-01 7.15E-01 7.74E-0l 8.32E-01 8.86E-01 9.38E-01 9.80E-01 1.OOE+00 Forecast: Last Point for Operator Success index 44 Cell: G41 Summary:

Display Range is from 3.00E-1 to 1.OOE+0 PSV failure probability Entire Range is from 3.09E-1 to I.OOE+0 PSV failure probability After 10,000 Trials, the Std. Error of the Mean is 1.08E-3 Statistics:

Trials Mean Median Mode Standard Deviation Variance Skewness Kurtosis Coeff. of Variability Range Minimum Range Maximum Range Width Mean Std. Error Value 10000 9.OOE-01 9.39E-01 l.OOE+00 1.08E-0l 1.17E-02

-1.29 4.18 0.12 3.09E-0l 1.OOE+00 6.91E-0l 1.08E-03 Forecast. Last Point for Operator Success 10,000 Trials Frequency Chart 0 Outliers

.201 2-Do8 151 Z%

-I

.D n

8 100-L-

D50 502 CL 000

,.,,,,,,,llllllll 3OOE-1 4 75E-1 6 50E-1 8 25E-1 1 ODE40 PSVfaIae prbablity Page 102 of 121

Percentiles:

Cell: G41 Percentile 0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

PSV failure probability 3.09E-01 7.35E-01 8.14E-01 8.67E-01 9.06E-01 9.39E-01 9.63E-01 9.81E-0I 9.93E-01 9.99E-01 11.OOE+00 End of Forecast Page 103 of 121

Appendix B Assumptions Assumption: N(Sl)

Cell: C6 Normal distribution with parameters:

Mean I OE+06 Standard Dev L.OE+05 Selected range is from -Infinity to +Infinity Mean value in simulation was I.OE+6 Assumption: N(S2)

Cell: C7 Normal distribution with parameters Mean 3 OE+04 Standard Dev 3 OE+03 Selected range is from -Infinity to +Infinity Mean value in simulation was 3.0E+4 Assumption: N(SI)w Cell: D6 Normal distribution with parameters Mean l.OE+06 Standard Dev I OE+05 Selected range is from -Infinity to +Infinity Mean value in simulation was L.OE+6 Assumption: N(S2)w Cell: D7 Normal distribution with parameters Mean 3 OE+04 Standard Dev.

3 OE+03 Selected range is from -Infinity to +Infinity Mean value in simulation was 3 OE+4 Assumption: N(S3)w Cell: D8 Normal distribution with parameters:

Mean l.OE+03 Standard Dev.

2 0E+02 Selected range is from -Infinity to +Infunity Mean value in simulation was I OE+3 Assumption: S1*N/lift steam Cell: CIO Normal distribution with parameters:

Mean 4,00000 Standard Dev.

300.00 Selected range is from -Infinity to +Infinity Mean value in simulation was 3,999 61 Assumption: S2*Nllift steam Cell: Cll Normal distribution with parameters Mean 10 00 Standard Dev 2.00 Selected range is from -Infinity to +Infinity Mean value in simulation was 10 00 Assumption: N*Sltlift water Cell: D10 Normal distribution with parameters Mean 6,055 00 Standard Dev 1,500 00 Selected range is from 3,025 00 to 9,025.00 Mean value in simulation was 6,056 25 Assumption: S2*N/lift water Cell: Dll Normal distribution with parameters Mean 200 00 Page 104 of 121

Standard Dev.

40 00 Selected range is from -Infinity to +Infinity Mean value in simulation was 200.18 Assumption: S3*N/lift water Cell: D12 Normal distribution with parameters Mean 50 00 Standard Dev 15 00 Selected range is from 27.80 to +Infinity Mean value in simulation was 52.35 Assumption: E(D)llift steam Cell: C14 Normal distribution with parameters:

Mean 0 0043 Standard Dev.

0 0004 Selected range is from -Infinity to +Infinity Mean value in simulation was 0 0043 Assumption: E(d)/lift water Normal distribution with parameters Mean 0 0627 Standard Dev.

0 0063 Selected range is from -Infinity to +Infinity Mean value in simulation was 0 0627 Assumption: Average Blowdown time steam Cell: C18 Normal distribution with parameters:

Mean 30 00 Standard Dev.

8 00 Selected range is from -Infinity to +Infinity Mean value in simulation was 29 94 Assumption: Average Blowdown time water Cell: D18 Lognormal distribution with parameters:

Mean 40 00 Standard Dev 6 00 Selected range is from 0 00 to +Infinity Mean value in simulation was 39 97 Assumption: damage model Cell: C20 Normal distribution with parameters Mean 1 00 Standard Dev.

0 01 Selected range is from -Infinity to +Infinity Mean value in simulation was 1 00 Assumption: Sigma on damage function Cell: C21 Lognormal distribution with parameters Mean 0 40 Standard Dev 0 10 Selected range is from 0.00 to +Infinity Mean value in simulation was 0 40 Assumption: Initial lift probability Cell: C23 Lognormal distribution with parameters Geometric Mean 4.50E-03 90% - tile 1.30E-02 Selected range is from 0 OOE+0 to +Infinity Mean value in simulation was 6.28E-3 Page 105 of 121

Appendix 7 Plots of Key Pressures and Temperatures From MAAP Calculations Page 106 of 121

RUN ISGTu2 -KEY TEMPERATURES

-IL Hot Leg...... BL Hot Leg - & -Surge Une-IL SG Tube@ Fbaw --

BL SG Tube

@ FIEw 1

E I-163 -m 140

=-

=

=

=

=

=

^ OE40W 2 WE+03 4 WE403 6 WE-03 8D E4O3 1 WE404 120E404 1 40E404 1i SE+O4 1 SOE404 2 WE-04 Time (S)

RUN ISGTR02. KEY PRESSURES l-Pnmary -

Intact Loop SG9

.kn Loop SG l

2.WE407 -_

IlBOEiG7 I 60E407 -

I 40E+07.--

1204E+07 e m407

_OO_0

_7 6 CE406-E4 2 W5E406__

u WE+0 2 0E+03 4 WE+03 6 WEu3 r3 E403 1 WE+u4 I 20E104 1 40E+04 1 6uE+04 I 6uE+u4 2.WE404 lime (S)

Page 107 of 121

RUN ISGTD2A -KEY TEMPERATURES

-IL Hot Leg BL Hot Leg...

Surge Lne -

ILSG Tube@ Flew -BLSG Tubo CFlow eco0 -8000 1400 1IM 1

Ianr

,\\,--

am 1N"nf anL g

E A'4 4

2tMt 4

i i4i 5 tUE4O3 I WE404 I 50EIO4 2 wEia4 2 505E04 Time (S)

RUN ISGTRO2A -KEY PRESSURES I-Pnmary -Intact Loop SG$.

...Broken Loop SO 2.WE4(J7 1 50E407 I SOE.07 V

I 40E.07 I \\

,11 20E407 I amEm-=

a E0 I

4 E4+06 2.00E+06-OmE40 a Mr=

IVV -------

404 5.2E+.03 1 2E5404 Tim. (S)

Page 108 of 121 I 50E404 2.00r04 2 50E404

RUN ISGT02B -KEY TEMPERATURES

-tLHotLeg-LHotLeg - - A Surge Ue

-ILSGTubeFlaw LSOTubeFlawI E

I-lime (a)

RUN ISGTR02B -KEY PRESSURES I-Pnmary -Intact Loop WG.-...Broken Loop SG 2 50E407 2 DOE407 I 50E+07 I

L=

iI_ _ L Q.

I t

5515451 -

I I5 I

OOFEDD 200E403 4A0E403 6.0015403 S.51E5i0 I O1E+04 i 512504 145E404 160E504 1 WE04 2.D0E.04 lime (5)

Page 109 of 121

RUN ISGT03 -KEY TEMPERATURES I-ILHotLtg -

• - -BLHotLeg-r -.Surge Lne-ILSGTube@Flaw-BLSGTubn@Flv l tI-ODE+00 2.OOE+03 4 A

EE43 6 E*EEC3 8 OE+03 1 WE+04 1 20E+04 1 40E+04 1 60E404 1 BDE+04 Tim. (0)

RUN ISGTR03 KEY PRESSURES I-Pnmary Intect Loop SGa. *.. Broken Loop SG l 2 WE_07 -

I 6OE+07 -

I 60E+07 ¢--_ ____

I 40E+07 I WE+07

! I OOE +O1

& B ME4fl6__

6 OOE+06 -

4 SCE4

2. WE+06 O. WE+00.

O E.W 2 WE4M3 4 OE.03 6 OE.03 a8 E403 1

Ei04 1E.O4 1 40E04 E

1 E+04 1 BOE+04 Tlme (5)

Page 110 of 121

RUN ISGT04 -KEY TEMPERATURES

-L Hot Log --

BL Hot Leg.. &..Surge Ln -IL SG Tube a Flow

-BL SO Tub* Fbew l60D 1400 12(0 9

1000 Izt

'4 am a

D EI I

D Time (S)

RUN ISGTR04 -KEY PRESSURES Pmary-I ntact Loop SGs BrokenpSG 2 DOE407 I BOEi07 I AOEi07 I 20E+07 I 1OE+07 c6 8 0E+06-6cDOE4M 4 OOE06 -

2 OOE406-

__1 cleee'e' n ncen O OOEfOO 0 O0E4W 2 0E4C3 4 O0E01 3

E O5E 3 8 DOE+03 I OOE404 20EE404 IAOE4O4 1 6WE404 1 SE+04 Time (S)

Page 111 of 121

RUN ISGT04A -KEY TEMPERATURES l-ILHctLeg..

BLHutLeg -

.*SurgeUne-ILSGTubesFlaw-8LSGTube@Fl aw E

I-500EO04 5mOE+04 700E+04 800E404 9mE4O4 1E405 lime (S)

RUN ISGTR04A -KEY PRESSURES l-Pnmary -Intact Loop SG

.Brokn Lccp SG n rne7 I WE+07 I 6DE407 1 40E+07 I I 20E407 4I XE+O7 O.OOE4+O O

OOE4 2 OOEn06 11-1' l

0 0 -

4

+

I I

I I

I I

I I

I I

I i

I

/ I I

J I

j I

I I

4+00 I OOE+04 2 OOE+04 3 OOE404 4 IfE4O4 5W E4o4 6 OE4O4 70E+04 80WE+O4 900E4o4 I 0E405 Time (5)

Page 112 of 121

RUN ISGT04B -KEY TEMPERATURES I-LHotLeg.....

BLHotLeg.. A.SurgeLine LSGTube@Flaw

- BLSGTube@FlawI a

IE 16W 1200/W0 6 W0 4W OWE4G) 20OEiCM 4OE4M3 6WE403 8ME403 1 WE404 I 20E404 I 40E404 I 6OE404 I B3E404 TImn (S)

RUN ISGTR04B KEY PRESSURES I-Pnmery -

Intact Loop SGs..

.Broken Loop SG 2 M+E07, I BDE*fl7-

.UP-1 60E+07 l

7 e_

I 40E.07 q I 20E.0

? 1 WE+07 I

I X. 8 OOE+OE -= =

6.00E+06 I____I A DDE+06 I__

2.02E506

\\______

0 OOEi0 2OE+403 4 ODE403 6.02E403 8.02E403 1 02E404 1 20E404 1 40E404 1 60E+04 1 BOE04 TIme SI9 Page 113 of 121

g I-E RUN ISGTD4C - KEY TEMPERATURES

-IL Hot Leg 6LHot Leg -.. Surge Line -

IL SG Tube

@ Flaw BL SG Tube @FFlw 1400 1600 200 af o 0 E400 260E403 4 °°240 6 OOE43 8 mE403 1600404 1 20E404 I 402404 1 60E404 1 04E+04 Time (

RUN ISGTRD4C

• KEY PRESSURES l-P nmary -

Intact Loop SG.*

Broken Loop 2 0E07 -

1 60E407 I 60E+07 -

1 40E+07 -

I1 20E407-

• I 6OE+07 I

k

N I/

a. 8.OOE06406 MI g

4 60E4W 6 2.60E4%

4:::

n.00 0 0 6064(

2 mE+03 4 60403 6 0062403 6606403 1 06404 12 D404 1 40E404 1 60E+04 1 6E+04 Time (S)

Page 114 of 121

RUN ISGT04D -KEY TEMPERATURES tL4HolLeg.

... BL4HntLeg...-

. Surge Le-ne-IL SG Tube g Flow -

L SG Tube a HtwI 1EOO l 1400

-W 12E=

8AW 6W -

_A g

I-e IE 400 OOOE+00 2 OOE+t 4 DOE<E 6.00E03t 9 C8Et O

1 WE204 I

1 I 40E404 I GOE+04 I 50E404 Time (5)

RUN ISGTR04D -KEY PRESSURES I -

Pnmary -Intat Loop SG.s.

B r

• Enken Loop SG

250E407, 2 WE.07 i

I M fF ~fl7 h'.

I

0. I WuvO7 4-4

-4.

4 4

4 I

S OOE4C5 \\

n fnr.m.1 4

I OWDE49O 200E403 400Ei43 6EiOE43 800E4M3 1OE+a4 12WE404 140E404 IEOE404 1IOE404 Time (5)

Page 115 of 121

I Appendix 8 Sensitivity Case Results Page 116 of 121

1. Effect of reducing probability the pressurizer safety valves stick open spontaneously A sensitivity was performed in which the value for the pressurizer safety relief valve not sticking open due to passing water was reduced from 5.OOE-01 to a relatively small value, 9.OOE-02. This change was made to see the effect on results if the value for RCPSVNSO was the value at 7000 seconds after core damage, 9.OOE-02. The sensitivity value was chosen based on the work provided in Appendix 6. The tables below show the values used for this quantification and the results.

BASIC EVENT BASIC EVENT DESCRIPTION PROBABILITY COMMENTS BASE HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 5 OOOE-01 SG DEPRESSURIZES LEADS TO SG DEPRESS MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 2 063E-01 SG DEPRESSURIZES HISAMGDEPRESS OPERATORS DEPRESSURIZE THE 6 500E-03 SG DEPRESSURIZES S/G IN ACCORDANCE WITH SAMGS HIOPPORV OPERATOR FAILS TO OPEN PORV 6 500E-03 RCS DOES NOT PER SAMGs LEADING TO RCS DEPRESSURIZE PRESSURE HIGH RCSPSVNSO SAFETY VALVE DOES NOT STICK 9.OOE-02 RCS DOES NOT OPEN DEPRESSURIZE The results from the PRAQuant quantification for the APET sequences are shown in the table below.

APET End State Truncation Limit Quantification Results ISGTR-1 2.00E-1 1 0.OOE+00 ISGTR-2 2.OOE-11 1.65E-10 ISGTR-3 2.OOE-1 1 O.OOE+00 ISGTR-4 2.00E-10 2.63E-09 ISGTR-5 2.OOE-l 1 O.OOE+00 ISGTR-6 2.OOE-l 1 O.OOE+00 ISGTR-7 2.00E-l 1 O.OOE+00 ISGTR-8 2.OOE-1 1 O.OOE+00 ISGTR-9 2.OOE-1 1 O.OOE+00 ISGTR-10 2.00E-11 3.37E-10 ISGTR-1 1 2.00E-l 1 O.OOE+00 ISGTR-12 2.OOE-l1 0 OOE+00 ISGTR-13 2.OOE-1 1 2.3 1E-1 1 ISGTR-14 2.OOE-11 2.19E-Il Total 3.17E-09 Although this is by definition a best estimate study, an exception was made for this basic event probability, which was taken conservatively because of the high sensitivity identified above. This effectively attaches additional margin to the results.

Page 117 of 121

A second sensitivity was performed in which the value for the Pressurizer safety relief valve not sticking open due to passing water which leads to high RCS pressure, RCPSVNSO, was changed. This changed was made to see the effect on results if the value for RCPSVNSO was the value at -5000 seconds after core damage, 6.30E-01. The sensitivity value was chosen based on the work provided in Appendix 6. The table below shows the values used for this quantification and the results.

BASIC EVENT BASIC EVENT DESCRIPTION PROBABILITY COMMENTS BASE HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 5 OOOE-OI SG DEPRESSURIZES LEADS TO SG DEPRESS MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 2 063 E-0I SG DEPRESSURIZES HISAMGDEPRESS OPERATORS DEPRESSURIZE THE 6.500E-03 SG DEPRESSURIZES S/G IN ACCORDANCE WITH SAMGS HIOPPORV OPERATOR FAILS TO OPEN PORV 6.500E-03 RCS DOES NOT PER SAMGs LEADING TO RCS DEPRESSURIZE PRESSURE HIGH RCSPSVNSO SAFETY VALVE DOES NOT STICK 6.300E-01 RCS DOES NOT OPEN DEPRESSURIZE The results from the PRAQuant quantification for the APET sequences are shown in the table below.

APET End State Truncation Limit Quantification Results ISGTR-1 2.OOE-1 1 O.OOE+00 ISGTR-2 2.OOE-1 1 O.OOE+00 ISGTR-3 2.00E-11 8.42E-12 ISGTR-4 2.00E-10 5.41E-08 ISGTR-5 2.OOE-1 1 O.OOE+00 ISGTR-6 2.00E-1 1 O.OOE+00 ISGTR-7 2.OOE-1 1 O.OOE+00 ISGTR-8 2.OOE-Il O.OOE+00 ISGTR-9 2.OOE-l 1 O.OOE+00 ISGTR-10 2.OOE-11 5.18E-09 ISGTR-l 1 2.OOE-l 1 O.OOE+00 ISGTR-12 2.OOE-l 1 O.OOE+00 ISGTR-13 2.00E-1I 2.32E-10 ISGTR-14 2.00E-1I 1.59E-10 Total 5.97E-08 This sensitivity shows that the model is not affected significantly by the value for the probability that the Pressurizer Safety does not stick open when the value was increased.

Page 118 of 121

2. Effect of assuming that operators always depressurize SG2 whenever ARVs are available A third sensitivity was performed in which the value for the Operator fails to isolate Steam Generator (SG) 2 after it reaches less than 5% wide level indication which leads to low SG 2 pressure, MSSGFTI, was changed. This change was made to see the effect on results if SG 2 was not isolated due to operator action. The table below shows the values used for this quantification and the results.

BASIC EVENT BASIC EVENT DESCRIPTION PROBABILITY COMMENTS BASE HIMSSGFTI OPERATOR FAILS TO ISOLATE 1.00E+00 SG DEPRESSURIZES SG2 LEADS TO SG DEPRESS MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 2.063E-01 SG DEPRESSURIZES HISAMGDEPRESS OPERATORS DEPRESSURIZE THE 6.500E-03 SG DEPRESSURIZES SIG IN ACCORDANCE WITH SAMGS HIOPPORV OPERATOR FAILS TO OPEN PORV 6 500E-03 RCS DOES NOT PER SAMGs LEADING TO RCS DEPRESSURIZE PRESSURE HIGH RCSPSVNSO SAFETY VALVE DOES NOT STICK 5.00E-01 RCS DOES NOT OPEN DEPRESSURIZE The results from the PRAQuant quantification for the APET sequences are shown in the table below.

APET End State Truncation Limit Quantification Results ISGTR-1 2.OOE-11 O.OOE+00 ISGTR-2 2.OOE-1 1 O.OOE+00 ISGTR-3 2.OOE-1 1 6.67E-12 ISGTR-4 2.OOE-10 5.82E-08 ISGTR-5 2.OOE-I I O.OOE+00 ISGTR-6 2.OOE-l 1 O.OOE+00 ISGTR-7 2.OOE-l 1 O.OOE+00 ISGTR-8 2.00E-1 I O.OOE+00 ISGTR-9 2.OOE-11 O.OOE+00 ISGTR-10 2.OOE-1 1 4.96E-09 ISGTR-11 2.OOE-1 1 O.OOE+00 ISGTR-12 2.OOE-1 1 O.OOE+00 ISGTR-13 2.00E-11 1.48E-10 ISGTR-14 2.OOE-1 I 1.50E-10 Total 6.35E-08 This sensitivity shows that the model is not affected significantly by the value for the probability that the operator fails to isolate the Steam Generator.

Page 119 of 121

4. Effect of high failure rate in depressurizing RCS per SAMGs A fourth sensitivity was performed in which the values for the Operator fails to isolate SG 2 leads to SG depressurization, HISAMGDEPRESS, and Operator fails to open the PORV, HIOPPORV, per SAMGs leading to RCS high pressure was changed. This change was made to see the effect operator action had on ISGTR if failure probability was increase by a factor of 10. The table below shows the values used for this quantification and the results.

BASIC EVENT BASIC EVENT DESCRIPTION

-PROBABILITY COMMENTS

_ _ _B A SE HIMSSGFTI OPERATOR FAILS TO ISOLATE SG2 5 OOE-01 SG DEPRESSURIZES LEADS TO SG DEPRESS MSSGPCSG02NF SG2 FAILS TO REMAIN ISOLATED 2 063E-01 SG DEPRESSURIZES HISAMGDEPRESS OPERATORS DEPRESSURIZE THE 6.500E-02 SG DEPRESSURIZES SIG IN ACCORDANCE WITH SAMGS HIOPPORV OPERATOR FAILS TO OPEN PORV 6.500E-02 RCS DOES NOT PER SAMGs LEADING TO RCS DEPRESSURIZE PRESSURE HIGH RCSPSVNSO SAFETY VALVE DOES NOT STICK 5 OOE-01 RCS DOES NOT OPEN DEPRESSURIZE The results from the PRAQuant quantification for the APET sequences are shown in the table below.

APET End State Truncation Limit Quantification Results ISGTR-1 2.00E-1 1 O.OOE+00 ISGTR-2 2.00E-1 1 O.OOE+00 ISGTR-3 2.OOE-1 1 6.67E-12 ISGTR-4 2.00E-10 3.76E-08 ISGTR-5 2.OOE-l 1 O.OOE+00 ISGTR-6 2.OOE-1 1 O.OOE+00 ISGTR-7 2.OOE-l 1 O.OOE+00 ISGTR-8 2.OOE-l 1 O.OOE+00 ISGTR-9 2.00E-11 O.OOE+00 ISGTR-10 2.OOE-11 3.78E-09 ISGTR-11 2.00E-1 1 O.OOE+00 ISGTR-12 2.OOE-1 I O.OOE+00 ISGTR-13 2.OOE-11 1.48E-10 ISGTR-14 2.00E-11 1.26E-10 Total 4.17E-08 Page 120 of 121

This sensitivity shows that the model is not affected significantly by the values for the probability that the operator fails to operate the PORV per the SAMGs and the operator inadvertently depressurize the secondary when cooling water was unavailable. Therefore based on this sensitivity the values for both of these HRA events (6.50E-03) were considered reasonable.

Page 121 of 121

ENCLOSURE 2 TXU ENERGY LETTER (TXX-03072)

COMANCHE PEAK STEAM ELECTRIC STATION UNIT 1 - 1RF09 STEAM GENERATOR PULLED TUBE REPORT

SUMMARY

AND CONCLUSIONS

INTRODUCTION Two tubes were pulled during the lRF09 outage, both from SG2. The pulled tubes were RI 1C42 hot leg and R25C30 cold leg. Rl11C42 was pulled to determine the burst pressure of the freespan axial ODSCC indication at H5 +10.63 inch, to characterize the degradation mechanism, and to help to define bobbin coil detection capabilities. R25C30 was pulled to investigate the ding ODSCC reported on the cold leg.

Following the removal from the steam generators, the pulled tube segments were transported to the Westinghouse Remote Metallographic Laboratory for destructive and nondestructive examinations.

The evaluation effort consisted of the following activities:

+ Nondestructive examinations (visual, dimensional characterization, radiography, ultrasonic and eddy current testing)

+ Characterization of the condition of the tube in the area of the indication and at support structures

+ Burst and tensile testing

+ Material chemistry verification

• Destructive examinations (SEM and SEM fractography, metallography, depth and morphology of stress corrosion cracks, microhardness, residual stress, grain size, carbide distribution and Huey testing)

• Chemical characterization of deposits and oxide films (EDS of OD deposits and fracture face oxides, X-ray diffraction of OD tube deposits, and Auger of OD surface deposits and fracture face oxides).

+ Residual stress measurements.

The results of the various evaluations are summarized in the following sections.

1

RI l C42 HL - Top of Tubesheet Circumferential Crack

+ The circumferential crack reported at the top of the tub esheet for RI 1 C42 HL was confirmed to be due to ODSCC. The maximum depth based on fractography was approximately 70%.

The crack was contained within the expansion transition and was composed of multiple circumferential cracks connected by a network of ductile ligaments.

• Burst test results of the area with eddy current indication satisfied the structural integrity requirements. The burst pressure of the crack network exceeded 10,900 psi. The axial burst occurred above the circumferential crack.

• No chemical species were identified either on the OD surface or on the fracture face, which would appear to have contributed to the ODSCC.

RI I C42 HL - Freespan Axial Cracks

• The mechanical strength, grain size, and carbide distribution for Ri 1C42 HL are typical of the mill annealed Alloy 600 tubing of this vintage.

• Visual and ultrasonic inspection results, as well as burst testing, indicate that the freespan cracking observed in RI I C42 HL is consistent with a discontinuity that is axially oriented and extending over a considerable length of the tube. The azimuthal orientation of the discontinuity is approximately 225 degrees near the tubesheet and tends to spiral 85 degrees to approximately 310 degrees at a location near the H7 support plate.

• Although the nature of the intergranular cracking is typical of mill annealed Alloy 600 tubing, the straightness and the length of the axial SCC seen in Ri I C42 HL is considered unusual.

No evidence of intergranular attack or branching, short axial cracking was seen.

• The free span locations identified by eddy current exhibited intergranular cracking to a maximum depth of 27 mils. Additional intergranular cracking ranging in depth from 1 to 10 mils was seen on the same azimuthal orientation as the eddy current indication.

• Burst test results of the areas with eddy current indications satisfied the structural integrity requirements. Burst pressure ranged from 8,177 to 8,546 psi.

• No conclusive evidence was found of OD mechanical damage or cold work associated with the discontinuity.

• All burst faces and adjoining intergranular cracks contained evidence of longitudinal stringers predominantly near the OD surface.

• Radial metallography performed for RI I C42 HL showed an increased propensity of longitudinal stringers in the area corresponding to the discontinuity. The stringers tended to be aligned with the main discontinuity.

• Microhardness measurements indicate a higher hardness at the azimuth corresponding to the discontinuity in Ri 1 C42 HL. The higher hardness extends to a depth of 0.004 to 0.006 inch.

2

+ Residual stress measurements in the area of the axial anomaly were typical of mill annealed, straightened, and polished Alloy 600 tubing and were similar to other regions of the tube.

+ The crack face oxides were thin at most locations and were enriched in chromium relative to the bulk alloy. This would be expected for a freespan location where there was little chance for a concentrated and aggressive chemical environment to develop.

• The impurities detected by analyses in the open crack face were carbon, potassium, sulfur, chlorine, aluminum, fluorine and calcium. These elements persisted with sputtering, suggesting that they were incorporated into the crack face during operation.

• Analyses of the stringer areas showed the presence of aluminum, fluorine, potassium, silicon, magnesium, and calcium. Analyses of the typical discrete inclusions, routinely seen in Alloy 600 tubing material was dominated by titanium and carbon.

R25C30 CL -Axial Crack at Ding

• The mechanical strength, grain size, and carbide distribution for R25C30 CL are typical of the mill annealed Alloy 600 tubing of this vintage. No evidence of longitudinal stringers was seen. The inclusions seen in the microstructure were the typical discrete distribution and did not appear to be associated with the observed cracking.

• Burst test results of the area with eddy current indication satisfied the structural integrity requirements. The burst pressure was 10,989 psi.

• The observed axial crack was confirmed to be related to local deformation, i.e., ding, on the OD surface. The maximum depth of the cracking was 56% and was 0.095 inch in length.

• The crack face oxide was quite thin at all locations and enriched in chromium relative to the bulk.

• The only impurities detected in the open crack face were carbon and calcium. No other chemical impurities were identified either on the OD surface or on the fracture surface.

R25C30 CL - Volumetric Indications The indications reported above supports C4 and C5 were related to tube manufacturing and not related to corrosion degradation. The indication reported in the freespan above support C4 was related to a manufacturing "lap" which resulted in a local reduction in the wall thickness. The indication reported in the freespan above support C5 was likely related to a local burnishing operation during tube manufacturing to remove a surface imperfection.

3

SUMMARY

The following paragraphs present brief summary statements of the results of each aspect of the tube examinations and characterizations performed.

Tube Removal. Receipt Inspection and Sectioning Tube removal was accomplished at the Comanche Peak Unit 1 site without incident. The Rli C42HL tube was cut below the H8 tube support plate and removed in seven segments. The initial pull force was 2,693 lbs and varied from 242 lbs to 1,088 lbs for the seven segments removed. The R25C30 CL tube was cut below the C8 tube support plate and removed in eight segments. The initial pull force was 2,339 lbs and varied from 1,0881bs to 1,251 lbs. for the eight segments removed.

The seven Ri IC42 HL tube segments totaled 166.875 inches in length and the eight segments of R25C30 CL totaled 167.25 inches in length. The freespan sections of the tubing were covered with a light gray oxide, with occasional axial scratches introduced during the tube pull.

Circumferential marks were also seen which were attributed to the tube pull operation. The top of the tubesheet region of Ri I C42 HL exhibited a granular gray oxide, while the R25C30 CL region showed a light gray oxide similar to the oxide seen on the freespan surfaces. No evidence of oxide or deposit buildup was seen at any of the support structures. It was difficult to locate the support structures on the pulled tube segments due to the uniform and light oxide seen on the tube surfaces. Minimal color contrast was seen along the tube surface and no evidence of a whitish-gray deposit commonly observed at TSP locations.

Each of the tube segments for which specific examinations or inspections were performed was carefully sectioned to isolate the areas of interest. Care was exercised in the sectioning operations to avoid contamination or the unnecessary heating of samples, either of which could compromise the examination results.

Nondestructive Examinations [ECT and UT]

Eddy current and UT inspections and data evaluations in the laboratory were performed to satisfy a number of objectives. The most important of these were to review and reevaluate the field inspection data for these tubes, and to perform careful laboratory examinations with field and special laboratory-quality probes. The laboratory inspections exhibited a high degree of correspondence with the field inspections. This was true for both the eddy current and the ultrasonic examinations.

In general the ultrasonic inspection results for RI 1 C42 HL were consistent with the eddy current findings. The indications identified in the freespan regions displayed characteristics consistent with a discontinuity that is axially oriented and extends over a considerable length of the tube.

4

Ultrasonic inspection results on the indications reported in R25C30 CL confirmed the location of the indications, but with different signal characteristics. Two of the indications were spatially confined and were associated with a localized deformation (ding) or with a localized wall loss.

The third indication was purely a loss of wall, and, as destructive examination showed, was related to an OD "lap".

Additional NDE efforts included inspections with the MHI Intelligent probe and the X-Probe.

These array probes provided additional confirmation of the field inspection results.

Burst Testing Free span areas of both tubes with and without NDE indications were burst tested at room temperature. No leak tests were performed since leakage was not expected. The two free span regions of RI I C42 HL with axial NDE indications burst at pressures ranging from 8,177 to 8,546 psig, while a free span section with no reported NDE indications burst at 10,142 psig. A tube segment from Rl lC42 HL containing a circumferential crack at the top of tubesheet was also burst tested. The area containing the indication bulged at a pressure of 10,900 psig. An axial burst occurred at a distance of 1.95 inches above the top of tubesheet. Two free span regions of R25C30 CL, one with an axial indication associated with a "ding" and the second with no reported NDE indication, were burst tested. The burst pressure of the segment with the axial crack was 10,989 psig, while the non-degraded free span segment burst at 12,178 psig. Based on the industry database, the burst pressure of a non-degraded 0.750 inch diameter x 0.043 inch thick mill annealed Alloy 600 tubing is expected to be approximately 12,500 psig.

All burst pressures were well above the safety margin guideline of 3 times normal operating pressure differential or 4125 psig at room temperature.

All burst fractures were axial and characterized by fishmouth openings. The only burst fracture which did not exhibit evidence of intergranular stress corrosion cracking was the non-degraded free span segment from the R25C30 CL tube. For all other burst openings, areas of intergranular stress corrosion cracking could be discerned on the fracture surfaces.

Fractographv The burst opening fracture surfaces were examined by Scanning Electron Microscopy (SEM),

combined with Energy Dispersive Spectroscopy (EDS), in order to characterize the fracture morphology and surface chemistry.

The results of the SEM examinations of the free span burst fractures on RI I C42 HL confirmed the presence of OD-initiated axial intergranular stress corrosion cracking. The cracking tended to follow a spiral path from an azimuthal position of 225 to 310 degrees along the length of the pulled tube segments. No evidence of IGA was observed. Evidence of intergranular cracking was seen at this orientation in segments with no reported NDE indications. Evidence of an OD surface anomaly was seen associated with the observed axial cracks. Examination of the various burst fractures showed uniform intergranular cracking ranging from 0.5 to 10 mils in depth. The free span locations identified by eddy current to be degraded exhibited intergranular cracking ranging from 25 to 30 mils. All free span burst fractures showed evidence of an unusually large quantity of "stringers" which tended to be orientated in the longitudinal direction.

5

The circumferential crack reported at the top of the tubesheet for RI 1 C42 HL was confirmed to be ODSCC. The crack was contained within the expansion transition and was composed of multiple circumferential cracks connected by a network of ductile ligaments.

The axial indication reported to be associated with a "ding" on R25C30 CL was confirmed.

Fractography showed the indication to be related to a local OD surface-deformed region. The length of the indication was approximately 0.1 inch and with a throughwall depth of 56%. The crack profile was elliptical in shape and exhibited a uniform depth. No evidence of cracking outside of the deformed area was seen.

The EDS results of the burst fracture faces did not identify any chemical species that would appear to have directly contributed to the intergranular cracking. As expected, the spectra for both the ductile and IGSCC regions were dominated by chromium, nickel, and iron. Minor concentrations of calcium, aluminum, titanium, and silicon were detected. Analyses of the stringers showed the presence of aluminum, fluorine, potassium, silicon, magnesium, and calcium.

Metallography of Degraded Regions Specimens containing regions of intergranular stress corrosion cracking were examined by standard metallographic techniques to characterize the extent and morphology of the cracking.

Specimens were mounted to permit transverse and radial inspections. These examinations confirmed that the degradation had initiated at the OD surfaces and was totally intergranular.

Intergranular attack (IGA) was randomly present but was extremely shallow, on the order of 0.002 inch in depth.

Crack Face and Surface Deposit Chemical Analyses Analyses were performed on the stress corrosion crack faces and the OD surface deposits in an effort to identify elements or compounds that may have contributed to the degradation. -These efforts included the use of X-ray Diffraction (XRD) and Auger Emission Spectroscopy (AES).

The results obtained on surface deposits and crack faces did not identify the presence of any contaminating species in sufficient concentrations to explain the cracking. This finding is not uncommon in that the results of chemical and other microanalytical analyses do not establish a unique condition or species responsible for the degradation. All crack face oxides were enriched in chromium relative to the bulk. Chromium rich oxides are expected for slightly alkaline/oxidizing environments to moderately acidic/reducing environments. The crack face oxides were thin at most locations.

The impurities detected in the open crack face for the freespan RI 1C42 indications were carbon, potassium, sulfur, chlorine, aluminum, fluorine, and calcium. These elements persisted with sputtering, indicating that they were likely incorporated into the crack face oxide during operation. The aluminum, fluorine, and potassium levels were highest within the stringers, suggesting they may have been the source of these contaminant elements.

6

Comanche Peak Unit 1 Tubing Materials Characterizations The characteristics and properties of the pulled tubes were determined by a number of standard metallurgical tests. These included determining the tensile properties, bulk chemistry, microstructures, microhardness, and residual stress. In addition, Modified Huey tests were performed in order to determine whether or not the tubing was sensitized.

The mechanical properties of the pulled tubes were consistent with the CMTR's. The grain size and microstructure were typical of mill annealed Alloy 600 tubing manufactured at that time. The grain size of both heats was approximately 8 to 10 ASTM. Microhardness measurements were in agreement with the tensile properties. Chemical analyses were generally consistent with the compositions reported in the CMTR for these heats. The material was not sensitized, i.e.: grain boundary chromium depletion was not detected.

The results of the split-ring residual stress tests indicated residual net-section tensile hoop stresses from 13.6 to 16.1 ksi. These values are typical for mill annealed, straightened, and polished Alloy 600 tubing produced for Model D4 application.

In order to determine if local surface residual stresses were a primary factor in the freespan indication seen in Rl l C42 HL, X-ray diffraction residual stress measurements were made.

Surface and subsurface residual stress measurements were made at nominal depths of 0.0005, 0.001, 0.002, 0.003, 0.005, 0.007, and 0.010 inch. Measurements were made in the hoop and axial directions at the 90-degree azimuth and at the location of the axial anomaly, i.e., 276 degree azimuth. Both the hoop and axial stresses were generally compressive near the surface. The stresses become tensile below a depth of 0.003 inch for the hoop direction and below a depth of 0.004 inch for the axial direction at both the 90-degree and 276-degree locations. The hoop tensile stress approaches +30 ksi and the axial tensile stress approaches +20 ksi at 0.010 inch below the surface. The measured stress levels and their distribution are typical for mill annealed, straightened, and polished Alloy 600 tubing material. No appreciable difference in the measured residual stress levels was noted in the area of the OD surface anomaly identified at an azimuth of 276 degrees compared to other locations.

7

CONCLUSIONS The occurrence of ODSCC in mill annealed Alloy 600 tubing is not unusual. The finding of circumferential ODSCC in the hard roll transition of RI IC42 HL and the axial cracking in the R25C30 CL "ding" is consistent with industry experience. Both of these areas have known residual stress levels that could lead to stress corrosion cracking under steam generator operating conditions. The proposed mechanism for the intergranular cracking identified in the R25C30 cold leg tube is a slip dissolution process. The presence of intersections of slip lines, introduced by mechanical deformation or straining of the material, as well as the presence of twins, are likely to increase the anodic dissolution reaction.

There are a number of possible mechanistic models that could be developed in an attempt to describe the freespan cracking identified in the RI1 C42 hot leg. Based on the results of the examination performed, the most likely mechanism is a "localized IGA" process associated with film rupture and selective anodic dissolution at the grain boundaries. This proposed mechanism is influenced by the segregation of impurities at the grain boundaries, which may in turn be related to the axial stringers. The presence of non-metallic elements in the "stringers" are likely to be incorporated into the local corrosion film and may contribute to the passive and transpassive dissolution reaction.

Based on visual and metallographic examination of the OD surface, as well as X-ray residual stress measurements, there is no evidence of mechanical damage or high residual stress associated with the azimuthal location exhibiting the OD-initiated degradation.

8