Text

Enclosure 4 - Exelon/Amergen Risk Management Document No. OC-SDP-2004-1, Revision 0, Dated September 7, 2004 Oyster Creek Emergency Diesel Generator No. 1 Risk Assessment.
	ML042660346
Person / Time
Site:	Oyster Creek
Issue date:	09/07/2004
From:	Kirchner R, Pupek C; AmerGen Energy Co, Exelon Corp
To:	; Office of Nuclear Reactor Regulation
References
	2130-04-20206 OC-SDP-2004-1, Rev 0
	Download: ML042660346 (27)
	v • d • e

ENCLOSURE 4 Exelon/AmerGen Risk Management Document No. OC-SDP-2004-1, Revision 0, Dated September 7, 2004 "Oyster Creek Emergency Diesel Generator No. 1 Risk Assessment"

RM Documentation Approval RM DOCUMENTATION NO. OC-SDP-2004-1 REV:

0 STATION: Oyster Creek Nuclear Generating Station UNIT(S) AFFECTED: I TITLE: Oyster Creek Emergency Diesel Generator No. I Risk Assessment

SUMMARY

To support Exelon Regulatory review, a Significance Determination Process (SDP) Risk Assessment was completed for the EDG No. I degraded condition that existed from 4/30/2004 to 5/17/2004.

A risk evaluation which includes internal and external events assessments, leads to the following for the SDP quantification of risk metrics.

CHANGE IN RISK METRICS BASED ON CONFIGURATION SPECIFIC CONDITIONS (INTERNAL AND EXTERNAL EVENTS) l Change in Core Damage Change in Large Early Release Case Description Frequency Frequency Case 1: Degraded EDG Internal = 8.1E-7/yr Internal = 7.IE-8/yr Assessment, credit for actual External = 1.6E-7Iyr External = 1.6E-8/yr experienced EDG run times. Total = 9.7E-7Iyr (Green)(') Total = 8.7E-8/yr (Green)(')

Case 2: Degraded EDG Internal = 5.OE-7/yr Internal = 5.4E-8/yr Assessment, credit for actual External = 1.6E-7/yr External = 1.6E-8/yr experienced EDG run times plus Joliet Test run time. Total = 6.6E-7Iyr (Green)(') Total = 7.OE-8/yr (Green)(')

(') Note that the change in risk metric values are 'per year" when considered annualized assuming one occurrence over the calendar year.

The most realistic representation of the change in risk is considered to be Case 2. The following table provides a summary of the evaluation.

Internal and External Events Change in Core Change In Large Early Damage Frequency Release Frequency Best Estimate Result 6.6E-7 7.OE-8 GREEN Criteria 1.OE-6 1.OE-7 Color GREEN GREEN These are moderate variations in the risk metrics as a result of changes in the key input variables.

However, the resulting risk metrics are clearly GREEN when the diesel capability in the degraded condition is modeled In a realistic fashion by incorporating the diesel capability to run as long as 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months based on the Joliet D/G test run times and the 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months experienced in testing at OCNGS.

internal RM Documentation Electronic Calculation Data Flies: OC PRA models OC2002W modified as described in Attachment 1 to create Application Specific Model OC2WCSO; RISKMAN for Windows Version 5.02.

Prepared by: Robert Kirchner/Christopher Pupek l / / 1 Y Print - X ofDate Reviewed by: Don E. Vanover I 9)O-% 4' g Ir Q/11/04 Print Sign Date Method of Review: [X3 Detailed Alternate This RM documentation supersedes: N/A In Its entirety.

Approved by: Mike Godknecht/ J I 4**iv Print Sign Date External RM Documentation Reviewed by: N/A II Print Sign Date Approved by: NWA I I Print Sign Date Do anyASSUMP17ONS/ENGINEERINGJUDGEMENTSrequire laterverification? [ Yes X] No Tracked BY:AT#,_URE#_etc.)_

ii

PURPOSE:

A Probabilistic Risk Assessment (PRA) evaluation is being performed to assess the incremental risk that occurred at Oyster Creek during the time in which one of the emergency diesel generators (i.e., EDG 1) was in a degraded condition for 17.5 days, consistent with the methodology used in the NRC's Significance Determination Process (SDP).

SUMMARY

OF RESULTS:

A risk evaluation which includes internal and external events assessments, leads to the following for the SDP quantification of risk metrics.

CHANGE IN RISK METRICS BASED ON CONFIGURATION SPECIFIC CONDITIONS (INTERNAL AND EXTERNAL EVENTS)

T Change in Core Damage l Change in Large Early Release Case Description Frequency Frequency Case 1: Degraded D/G Internal = 8.1E-7/yr Internal = 7.1E-8Iyr Assessment, credit for actual External = 1.6E-7Iyr External = 1.6E-8Iyr experienced DIG run times. Total = 9.7E-7/yr (Green)( 1 ) Total = 8.7E-8/yr (Green)t')

Case 2: Degraded D/G Internal = 5.OE-7/yr Internal = 5.4E-8/yr Assessment, credit for actual External = 1.6E-7/yr External = 1.6E-8/yr experienced D/G run times plus Joliet Test run time. Total = 6.6E-7/yr (Green)(') Total = 7.OE-8/yr (Green)(')

(1) Note that the change in risk metric values are 'per year" when considered annualized assuming one occurrence over the calendar year.

The most realistic representation of the change in risk is considered to be Case 2. The following table provides a summary of the evaluation.

1

Internal and External Events I Change in Core Damage Frequency l Change in Large Early Release Frequency Best Estimate Result 6.6E-7 7.OE-8 GREEN Criteria 1.OE-6 1.OE-7 Color I GREEN [ GREEN There are moderate variations in the risk metrics as a result of changes in the key input variables.

However, the resulting risk metrics are clearly GREEN when the diesel capability in the degraded condition is modeled in a realistic fashion by incorporating the diesel capability to run as long as 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months based on the Joliet D/G test run times and the 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months experienced in testing at OCNGS.

REFERENCES:

1. OC PRA Application Specific Model OC2WCSO created from OC PRA model OC2002W using master frequency file OC2002W, RISKMAN for WINDOWS, Version 5.02.

2. ER-AA-600-1041, Rev. 1; "Risk Metrics."

3. 'Oyster Creek Individual Plant Examination for External Events;" December 1995.

4. "Oyster Creek Nuclear Generating Station Level 1 Probabilistic Safety Assessment (PSA) 2001 Update'; January 2002.

5. "Oyster Creek EDG Cooling Fan Drive Test: Technical Background and Basis;" August 2004.

6. EPRI TR-1 05928, "Fire Risk Analysis Implementation Guide', Final Report, December 1995.

BACKGROUND:

At approximately 03:10 on 05/17/04, Operations commenced the #1 Diesel Generator Load Test. During the surveillance, an operator reported that EDG 1 was making an unusual noise and the cooling fan belts and pulleys were observed to be loose. A field supervisor was dispatched to investigate. Upon evaluating the condition of the fan bearing, the field supervisor advised the control room to secure the diesel. After the diesel was secured, shift entered an unplanned 7-day LCO at approximately 05:00 on 05/17/04.

At approximately 07:30, the OCC was staffed to support the development of a schedule and prepare a plan to repair the cooling fan. Parallel to the activities associated with the recovery plan, an investigation into the cause of the cooling fan failure commenced. Included in the investigation was a review of the total number of hours that EDG 1 was run since the two-year overhaul in late April, a review of the procedures and documentation that were used to perform the cooling fan maintenance and interviews with the individuals that performed the fan work during the overhaul. In addition, an extent of condition was performed to evaluate other fasteners that could have been disturbed during the 24-month inspection.

2

A work order and a clearance were prepared to complete the repairs to the cooling fan. The clearance was applied at approximately 12:20. The scope of the work order included reinstallation and torquing of the cooling fan pillow-block bearing, re-verification of torques that were applied to all disturbed fasteners during the recent inspection and incorporation of other associated minor repairs which had been identified during subsequent EDG I walk downs.

All repairs were completed at approximately 17:12 on 05/17/04 and the clearance was removed.

Immediately following the repairs, the EDG 1 Load Test was again performed as the cooling fan post-maintenance test and to validate operability. In addition, vibration readings were also taken to ensure no abnormal cooling fan pillow-block bearing frequencies were observed. Abnormal frequencies would indicate potential bearing degradation. No anomalies were noted and the surveillance test was completed satisfactorily. The diesel was declared operable on 05/17/04 at 20:25, but was available at 17:50 on 05/17/04.

Equipment degradation was localized to the EDG 1 cooling fan drive shaft. The fan continued to function until secured by Operations.

The resultant unavailability of EDG 1 is approximately 17.46 days (419 hours0.00485 days 0.116 hours 6.92791e-4 weeks 1.594295e-4 months ) since the fan pillow block is assumed to have been in the degraded condition following the return to available status from the EDG 1 overhaul at 06:33 on 04/30/04. The TS LCO for EDG 1 was entered at 05:01 on 05/17/04 due to the finding and EDG 1 subsequently restored to available status at 17:50 on 05/17/04.

DESIGN INPUT:

An engineering evaluation has provided an assessment that the diesel degradation increased progressively during the exposure period due to vibration induced by periodic start and stops on the diesel generator until on day 17, the condition was identified. Subsequent to the discovery of the degraded state, Exelon determined based on a separate test of virtually identical diesel that EDG I would have operated for at least 6 additional hours despite the degraded condition (Reference 5).

OVERALL APPROACH AND METHODOLOGY:

Analysis Description The PRA analysis is being performed to characterize a plant condition that involved a degraded diesel generator condition that may have existed over 17 days. The diesel was found during day 18 to have a condition, where bolts attaching the shaft operated fan, had vibrated loose. Subsequent to this discovery a test was performed on a similar machine in a different facility (Joliet, IL.) to estimate the time the diesel could operate in the as-found degraded state. It was determined in this single test that the diesel operated for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and then tripped due to high lube oil temperature. This test data is used to provide input to a risk assessment that considers that the degraded diesel condition at the end of the 17.5 day period could still have operated for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

3

KEY INPUTS AND SOFTWARE:

The Model of Record is the Application Specific Model OC2WCS0 model derived from the OC2002W RISKMAN Oyster Creek PRA model using average maintenance. The software used was RISKMAN for WINDOWS, Version 5.02. Details of the revisions made to the OC2002W model are described in .

TREATMENT OF DATA VARIABLES AND ANALYSIS INPUTS:

There are a number of important inputs to the evaluation that are critical to the realistic calculation of risk.

The intent of a risk-informed perspective is to provide a realistic evaluation and avoid either non-conservative or conservative biases. The critical inputs are evaluated to ensure that the latest available data and realistic modeling are used. The risk-informed perspective, if biased in the conservative direction, could result in forcing the limited resources of both NRC and Exelon to be shifted to issues that are of relatively low safety significance and potentially away from higher safety significant issues.

Initiating Event Frequency: The initiating event frequency for a loss of offsite AC power (LOOP) used in the current Qyster Creek Model of Record is based on the 2001 PRA update which used the Bayesian update of PJM grid data with Oyster Creek experience. The frequency was calculated to be 2.79E-02/yr.

However, in view of the importance of this input and the recent LOOP events in the industry, the LOOP frequency has been reassessed. This estimate of initiator frequency has been reassessed assuming that US generic data applies to Oyster Creek and Bayesian updated to include data for the years 2001, 2002, and 2003, including the 2003 Northeast Blackout. The reassessed frequency increases to 4.6E-2/yr.

Offsite AC Recovery Curve: The AC recovery curve used in the 2001 PRA update made use of generic industry data.

Because AC recovery is another critical input and in view of recent experience, an alternate AC recovery curve that is slightly more restrictive is used for the SDP calculation. This recovery curve also will be used in the next PRA update and includes the data from the 2003 Northeast Blackout.

The AC power recovery probabilities are shown in Table 1.

4

TABLE 1 OFFSITE AC POWER NON-RECOVERY PROBABILITY COMPARISION Time from LOOP NRC Exelon Exelon Event Initiation Failure to Recover Failure to Recover Failure to Recover (Hours) (NUREG/CR-5496) (OC2002W Model) (Updated Model) 0.5 0.541 0.607 1.0 0.393 0.407 0.497 2.0 0.249 0.268 0.374 4.0 0.136 0.145 0.251 8.0 0.059 0.144 10.0 0.056 0.041 0.115 Diesel Failure: The diesel failure probability as used in the PRA model is composed of the following:

Maintenance unavailabilities

Failure to start

Failure to run

Common cause failures

Support system failures All of these failures are assumed to occur at the time of LOOP initiation (t=O). This is a conservative characterization of the run failures which may occur much later in the mission time with less severe impacts during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months PRA mission time.

Diesel Condition: The subject diesel (EDG 1) was in a degraded condition with the identified loosened bolts discovered during a test run. This final condition was simulated in a test facility in Joliet, IL using a nearly identical diesel. This test demonstrated that the degraded diesel condition supported operation of the diesel for at least an additional 6 more hours at the end of the 17 days. It is noted that because the condition is a progressive degradation, the diesel capability would have been longer at all other times during the 17 days in the progressively degrading state. In fact, a successful test run for approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months was performed at 11.5 days into the degraded condition. A final test was run for approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months immediately prior to the condition being identified on day 18.

The result of the Joliet test supports a realistic evaluation that the diesel would not fail at t=O and therefore the PRA model is modified to incorporate this new failure mode into the model appropriately by recognizing the diesel could run for at least 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months before failure. Based on the actual run times from the tests, it is estimated that 9 total hours (i.e., 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months from 5/11 test + 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months from 5/17 test + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months from Joliet test) of run time would have been available prior to the first test (i.e., 11.5 days), and that 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (i.e., 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months from 5/17 test + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months from the Joliet test) of run time would have been available for the last six days of the exposure period. Figure 1 provides a timeline of the actual experienced run-times prior to the event identification and performance of the Joliet simulations.

5

4e' m~

6, A?

fm1 to Last 11.5 days I

Condition identified DIG Maintenance on EDG #1 restored to full operability Figure 1 Time Line for EDG I Condition Combustion Turbines: In addition to the on-site AC diesel generators, two Combustion Turbines (CTs) are installed adjacent to the site to provide emergency AC power. These are non-safety related CTs and are not controlled by Technical Specifications. The combustion turbines provide reliable power to the 'B" bus (Div 2).

SORV: Because the unique Oyster Creek design, consequential stuck open relief valves (SORVs) are potential severe challenges when coupled with a loss of AC power. The SORV probability is calculated in a conservative manner in the 2001 PRA. These conservatisms lie in the following comparison of input variables between the current model (OC2002W) and the model under development (2004):

TABLE 2 COMPARISON OF INPUT VARIABLES FOR DETERMINATION OF CONSEQUENTIAL SORV PRA Model Inputs Input Variable OC2002W J 2004 Update

Number of EMRV challenges

- Wth IC available 2 2

- With no IC available 5 6

Failure rate of initial SORV 9.16E-3 8.61 E-3

Failure of SORV to reclose 1.0 0.15 before core damage 6

Available data indicates that stuck open relief valves are highly prone to reclosing as the reactor pressure decreases. In order to recognize this probabilistically in the model, the available data is used to characterize the probability of stuck open valve reclosure before it compromises the IC operation. The probability is 0.15 that the SORV fails to reclose. Once reclosed, the sequence proceeds as an SBO without SORV, i.e., the ICs alone are a success. (This additional benefit associated with SORV reclosure is not currently credited. It is to be included in 2004 PRA update.)

External Events: The external events evaluation based upon the IPEEE has been assessed by the NRC to represent approximately a 2.4E-7/yr contribution to the CDF and LERF. A separate EXELON evaluation is provided later in the CALCULATIONS section.

Time to Core Damage: Oyster Creek specific MAAP runs show that for Station Blackout (SBO) scenarios with a stuck open EMRV and successful Isolation Condenser (IC) operation, core damage occurs 43 minutes after event initiation. (Note that makeup water to the IC shell is not credited for this scenario. Operator action to align makeup from the Diesel Fire Pump is not credited within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .) In addition, for the much lower frequency SBO scenarios with a stuck open EMRV and failure of the IC,core damage occurs 32 minutes after event initiation. For both cases, at least 30 minutes is available prior to core damage.

For SBO scenarios with an open EMRV, the ICalone is not successful to prevent core damage.

Level 2: Modeling for a "wet' drywell floor following a LOOP/SBO event is based on crediting offsite AC power recovery during the core melt progression. The time period after core damage but prior to vessel failure can be credited for both in-vessel RPV injection recovery and containment spray recovery due to recovery of offsite AC power.

Existing PRA: Conditional failure probability of AC power recovery to supply the Containment Sprays = 0.41 (1 additional hour after core damage).

2004 PRA update: Conditional failure probability of AC power recovery to supply the Containment Sprays = 0.25 (7 additional hours after core damage based on latest thermal-hydraulic calculations with latest AC recovery).

This SDP evaluation uses the existing credit for 1 additional hour after core damage. The credit for 7 additional hours after core damage will be included in the 2004 PRA update.

In-Vessel Recovery: There is substantial time duration (more than 7.0 hours0 days 0 hours 0 weeks 0 months based on the latest thermal-hydraulic calculations) following core damage when the RPV remains intact for low RPV pressure core melt progression scenarios. AC recovery during this time would result in restoration of RPV injection. In-vessel recovery would halt the core melt progression and avoid LERF contributors related to energetic failures and shell-debris attack failures.

This SDP evaluation uses the existing credit for 1 additional hour after core damage. The credit for 7 additional hours after core damage will be included in the 2004 PRA update.

In addition, use of FPS for injection is considered feasible after 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of the SBO initiation.

7

Unique Oyster Creek Plant Feature: A unique Mark I feature at Oyster Creek is the 'Jersey curb' referred to by Bob Bemero (NRC) in the Mark I containment performance issue evaluation. The concrete curb at the periphery of the drywell floor provides some protection of the drywell shell from debris attack.

The failure probability of the shell with no water injection is 0.75 in the Oyster Creek PRA model (0.25 success probability). Success of the curb in preventing immediate shell failure results in a delay in the overtemperature failure of containment until after the 'early" time frame; thus, making the eventual release non-LERF.

SAMGs: The NRC requested accident management program resulted in the development of Severe Accident Management Guidelines for all BWRs including Oyster Creek. The Oyster Creek implementation follows that of the BWROG and results in direction to initiate DW sprays during core melt progression (based on high drywell radiation). Therefore, if AC power is restored within the initial 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months of the SBO scenario with an SORV, the containment spray would be directed to be initiated to protect the drywell shell from debris attack.

This SDP evaluation uses the existing credit for 1 additional hour after core damage. The credit for 7 additional hours after core damage will be included in the 2004 PRA update.

Core Spray: The Core Spray system can be initiated manually or automatically. Due to the credit of the automatic initiation logic, the failure probability of the Core Spray system to be initiated is the 'AND" of manual and automatic system failure in the Oyster Creek PRA model.

Core Spray normally remains in a standby mode during plant operation. Upon receipt of a system initiation signal (low-low reactor vessel level OR high drywell pressure), the Core Spray pumps automatically start. Subsequent to an initiation signal, the Core Spray injection valves will automatically open when RPV pressure reaches 285 psig. If an initiation signal is received and automatic initiation does not occur, the Core Spray system is manually started. EOPs direct manual Core Spray initiation on low RPV water level signals or on loss of water level indication. Manual initiation of Core Spray given automatic initiation failure is modeled with a Human Error Probability (HEP) of 8E-3.

CALCULATIONS:

INTERNAL EVENTS Critical InDuts for SDP Evaluation Based on the information provided above, the following items are noted as critical inputs for the internal events analysis. These input variables are discussed below.

LOOP initiating event frequency: A value of 0.046/yr is used for this assessment consistent with the NRC recommended value that is based on information provided in NUREG/CR-5496. As noted previously, this will result in an increase in the risk metric results compared to the current PRA model, but it is expected that this is very close to the value that will be used in the next update of the Oyster Creek model based on preliminary efforts being pursued for the in-progress Oyster Creek and Limerick PRA updates.

8

LOOP recovery curve: A more restrictive LOOP recovery curve compared to the current model and compared to the information from NUREG/CR-5496 is used for this assessment. This recovery curve also will be used in the next PRA update, and is based on available industry information through 2003 whereas the other sources have not yet factored in the more recent information. Table 3 provides the failure to recover probability values at key intervals.

TABLE 3 OFFSITE AC POWER NON-RECOVERY COMPARISON Time from LOOP NRC Exelon l Exelon Event Initiation Failure to Recover Failure to Recover Failure to Recover (Hours) (NUREG/CR-5496) (OC2002W Model) _ (Assessment Model) 0.5 0.541 0.607 1.0 0.393 0.407 0.497 2.0 0.249 0.268 0.374 4.0 0.136 0.145 0.251 8.0 0.059 0.144 10.0 0.056 0.041 0.115

D/G run time before failure: Three situations are examined. The first case (Case No.

1) includes no credit for any additional D/G run time. This is referred to as the conservative assessment based on assuming total unavailability of EDG#1. The second case (Case No. 2) examines crediting only the actual experienced available run times from Oyster Creek plant data (i.e., 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months of run time considered assured over the first 11.5 days of the fault exposure time, and 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of run time considered assured over the last 6 days of the fault exposure time). The third case (Case No. 3) examines crediting the actual experienced available run times from the Oyster Creek plant data plus the 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of run time experienced by the Joliet test diesel (i.e., 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months of run time allowed over the first 11.5 days of the fault exposure time, and 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months of run time allowed over the last 6 days of the fault exposure time). Note that as a simplification, the latter exposure time Is represented with 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of additional run time instead of 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months in the sensitivity case performed.

SORV probability of reclosing: As previously discussed, there is available information to support that it is likely that an occurrence of an SORV will reclose as the RPV pressure decreases, and therefore would not represent a continued threat to RPV integrity. Credit for this recovery is conservatively not included in this analysis.

DIG repair/recovery: The current Oyster Creek PRA model utilizes a 0.5 probability of recovering a failed D/G in SBO scenarios after 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This is approximately consistent with the NRC SPAR model representation of a Mean Time To Repair (MTTR) of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The recovery probability is assumed to apply to EDG 2 for this assessment and is only applied in SBO scenarios.

9

Sensitivity cases are performed to examine the effects of input variables. The internal events PRA results of the three cases are summarized in Table 4. Details of the evaluations used to support these results are provided in Attachment 1.

TABLE 4

SUMMARY

OF INTERNAL EVENTS ASSESSMENT RESULTS Configuration Specific Core l Configuration Specific Large Case Description Damage Frequency Early Release Frequency Base-Revised: Base OC2002W model, Increased LOOP frequency, Increased grid failure probability, credit 6.58E-6/yr 1.16E-6Iyr AC recovery for non-SBO LOOP (OC2WCSO Application Specific model)

Case 0: Overly Conservative Assessment, no credit for D/G 3.02E-5/yr for 17.5 days 3.04E-6/yr for 17.5 days run time.

Case 1: Degraded D/G Assessment, credit for actual experienced D/G run times.

3 hrs run time for 11.5 days 2.24E-5/yr for 11.5 days 2.57E-6/yr for 11.5 days 1.5 hrs run time for 6 days 2.56E-5/yr for 6.0 days 2.75E-6/yr for 6.0 days Case 2: Degraded D/G Assessment, credit for actual experienced D/G run times plus Joliet Test run time.

9 hrs run time for 11.5 days 1.61 E-5/yr for 11.5 days 2.24E-6/yr for 11.5 days 6 hrs run time for 6 days 1.85E-5/yr for 6.0 days 2.36E-6Iyr for 6.0 days 10

EXTERNAL EVENTS The increase in External Events (Internal Fire, Seismic and High Winds) was calculated consistent with the SDP Process.

Internal Fire:

Section 4 of the Oyster Creek IPEEE (Reference 3) was reviewed to evaluate the fire risk. Specifically areas that resulted in a LOOP event or failure of the Emergency AC Bus not powered by EDG 1 were included. In the latter case, a random LOOP event is included in the assessment. Fire areas and their ignition frequencies are taken from Table 4.6-1 of Reference 3.

One area identified in which a fire could directly lead to a LOOP event was the Main Control Room (OB-FZ-5). A scenario can be examined that includes failure to suppress the fire in the cabinets that include the potential to induce a LOOP prior to control room abandonment. However, this scenario solely relies on the protected train from the remote shutdown panel powered by EDG 2. Therefore, the availability of EDG 1 has minimal impact. Additionally, the likelihood of a fire that progresses sufficiently to lead to a LOOP initiator, but does not require Control Room abandonment is judged to be more benign (since recovery is potentially available). Additionally, the initiating event frequency of such a scenario would be orders of magnitude less than the LOOP frequency utilized in the internal events assessment. Therefore, this scenario is considered to be sufficiently encompassed within the internal events assessment.

As a result, there is minimal, if any, incremental change in the conditional core damage probability as is shown below.

Fires that induce LOOP Fire Ignition Frequency (Unprotected Cabinet Initiator, from detailed analysis in Section 4.6.3 of Reference 3): 5.01 E-3/yr Probability of Fire in Cabinet with Offsite Power Breaker Controls (8/17 Cabinets Unprotected by Halon System A or B): 4.71 E-1 Fire Suppression Failure Probability (Appendix J of Reference 6) 1.60E-2 Change in Conditional Core Damage Probability Given LOOP with Control Room Abandonment Required E Fault Exposure Factor (17.5/365) 4.79E-2 Control Room Fire Incremental Risk E Additionally, It is notable that the IPEEE models fires in two areas, MT-FA-12 (Main Transformer and CST) and TB-FZ-1 1C (Switchgear Room, West End of Turbine Building), as LOOP initiated events.

In the case of the Main Transformer fire, the LOOP Initiating event was used for conservative screening.

Upon further review in the IPEEE, it was found that loss of the main transformer would cause a plant trip but not a loss of offsite power nor loss of either emergency buses. As a result, there is no incremental change in the conditional core damage probability.

In the case of the Switchgear Room, a fire of sufficient intensity to cause the LOOP is assumed to also lead to the loss of the 1C 4160 VAC Emergency Bus equipment (via failure of the 1C DC bus). Because EDG 1 powers the 1C Bus, which is not available, the potential unavailability of EDG1 has no impact. As a result, there is no incremental change in the conditional core damage probability.

11

Fires that fail 1D 4160 VAC Emernency Bus Fire areas which fail the 1D 4160 VAC Emergency Bus and their ignition frequencies are taken from Table 4.6-1 of Reference 3. These areas are considered relevant since failure of the 1D bus in combination with a LOOP and concurrent unavailability of EDG 1 can be assumed to lead directly to core damage as a simplification for this assessment. These are tabulated below:

Fire Area Fire Ignition Frequency OB-FZ-6B 4.OOE-03 OB-FZ-8A/B 7.40E-03 OB-FZ-8C 3.71 E-03 OB-FZ-1 OA 9.28E-03 OB-FZ-1 OB 8.68E-04 OB-FA-22A 3.58E-03 TB-FA-3B 3.64E-03 TB-FZ-11 F 8.07E-03 TB-FZ-1 1H 4.73E-03 RB-FZ-1 F 8.05E-03 DG-FA-1 7 1.50E-02 TOTAL 6.83E-02 Since none of the areas listed above include potential fires that lead directly to a LOOP or are they expected to lead to an immediate plant trip, the probability of LOOP can be determined from the random probability over the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months PRA mission time. Additionally, a 0.2 fire severity factorP1 is applied to represent the likelihood that the fire does proceed to fail the bus. Less severe fires that do not fail the bus will not be impacted by the EDG 1 unavailability and were not pursued further. The Incremental conditional core damage frequency is then estimated by the following calculation:

Total Fire Ignition Frequency: 6.83E-2/yr Probability of Random LOOP (0.046/yr / 365 days/yr) 1.26E-4 Severity Factor 0.2 Fault Exposure Factor (17.5/365) 4.79E-2 Other Fire Incremental Risk 8.26E-8 Finally, fire area OB-FZ-4 (Cable Spreading Room) was examined. This area was analyzed in detail in Reference 3 and found not to induce a LOOP nor fail the 1D 4160 VAC Emergency Bus. Upon further investigation, it was found that this area is protected with automatic detection and suppression. Any fire sufficient enough to overcome the automatic protection would likely result in control room abandonment and would solely rely on the protected train from the remote shutdown panel powered by EDG 2.

Therefore, the availability of EDG 1 has minimal impact. As a result, there is minimal, if any, incremental change in the conditional core damage probability.

(" If we refer to the EPRI Fire PRA Implementation Guide (Reference 6), Appendix D, Section D.3, a range of values are provided. The highest is 40% for Diesel Generators. Control Room Cabinets and Pumps are next highest at 20%. The remaining sources are less than 20%. Given these values, the 20% generic factor being applied is conservative.

The EPRI document also mentions factors that can be taken as severity factors on page 4-22. This discussion focuses on small and moderate transient combustibles, and oil fires.

12

Seismic:

Section 3 of the Oyster Creek IPEEE (Reference 3) was reviewed to evaluate the seismic risk. The primary effect of a seismic event, relative to the degraded diesel generator, is a loss of offsite power.

Therefore, the risk is calculated as the sum of risks from each seismic category, based on the frequency of the seismic event, probabilities of loss and recovery of offsite power and the conditional core damage probability accounting for the seismic failure probability of the remaining diesel generator, bus, and diesel generator building. For each seismic category, it is calculated as follows:

Category SEISI (>O.13g)

Initiator Frequency (Table 3-1, Reference 3): 7.74E-3/yr Induced LOOP Probability (Table 3-8, Reference 3): 6.08E-3 Induced LOOP Non-Recovery Probability (Table 3-8, Reference 3 shows 4.6E-4.

Conservatively use 1E-2 for this assessment): 1.OOE-2 Failure of EDGs from Seismic Event (All from Table 3-8, Reference 3)

Seismic DG Building Failure = 2.61 E-4

2.54E-5 = 6.63E-9 (S1)

Seismic Failure of 4160 VAC Bus = 8.38E-4 (S2)

Seismic Failure of Diesel Generator = 2.14E-5 (S3)

Total Seismic Failure Probability of EDGs is obtained from Sl + S2 + S3- S1*S2 - S1*S3 - S2*S3 +S1*S2*S3 = 8.59E-4 Survival from Seismic Event of EDGs (1 - 8.59E-4) 9.99E-1 Change in Conditional Core Damage Probability Given LOOP and Survival of EDGs (w/ EDG 1 unavailable and no credit for AC power recovery, see Aft. 1, Table A6) 1.05E-1 Fault Exposure Factor (17.5/365) 4.79E-2 Category SEISI Incremental Risk 2.37E-9 Cateaorv SEIS2 (>0.36c)

Initiator Frequency (Table 3-1, Reference 3): 2.73E-5/yr Induced LOOP Probability (Table 3-8, Reference 3): 5.40E-1 Induced LOOP Non-Recovery Probability (Table 3-8, Reference 3 shows 2.16E-1.

Conservatively use 1.0 for this assessment): 1.0 Failure of EDGs from Seismic Event (All from Table 3-8, Reference 3)

Seismic DG Building Failure = 2.58E-1

7.55E-2 = 1.95E-2 (S1)

Seismic Failure of 4160 VAC Bus = 2.09E-1 (S2)

Seismic Failure of Diesel Generator = 3.94E-2 (S3)

Total Seismic Failure Probability of EDGs is obtained from S1 + S2 + S3- S1*S2 - S1*S3 - S2*S3 + S1*S2*S3 = 2.55E-1 Survival from Seismic Event of EDGs (1 - 2.55E-1) 7.45E-1 Change in Conditional Core Damage Probability Given LOOP and Survival of EDGs (w/ EDG 1 unavailable and no credit for AC power recovery, see Aft. 1, Table A6) 1.05E-1 Fault Exposure Factor (17.5/365) 4.79E-2 Category SEIS2 incremental Risk 5.55E-8 13

Cate-orv SEIS3 (>0.54g)

Initiator Frequency (Table 3-1, Reference 3): 2.72E-6/yr Induced LOOP Probability (Table 3-8, Reference 3): 8.40E-1 Induced LOOP Non-Recovery Probability (Table 3-8, Reference 3 shows 6.89E-1.

Conservatively use 1.0 for this assessment): 1.0 Failure of EDGs from Seismic Event (All from Table 3-8, Reference 3)

Seismic DG Building Failure = 7.94E-1

5.31E-1 = 4.22E-1 (SI)

Seismic Failure of 4160 VAC Bus = 5.31 E-1 (S2)

Seismic Failure of Diesel Generator = 3.03E-1 (S3)

Total Seismic Failure Probability of EDGs is obtained from Si + S2 + S3 - S1*S2 - S1*S3- S2*S3 + Si*S2*S3 = 8.11E-1 Survival from Seismic Event of EDGs (1- 8.11 E-1) 1.89E-1 Change in Conditional Core Damage Probability Given LOOP and Survival of EDGs (w/ EDG 1 unavailable and no credit for AC power recovery, see Aft. 1, Table A6) 1.05E-1 Fault Exposure Factor (17.5/365) 4.79E-2 Category SEIS3 Incremental Risk 2.18E-9 Categorv SEIS4 (>0.72a)

Initiator Frequency (Table 3-1, Reference 3): 9.83E-7/yr Induced LOOP Probability (Table 3-8, Reference 3): 9.30E-1 Induced LOOP Non-Recovery Probability (Table 3-8, Reference 3 shows 9.12E-1.

Conservatively use 1.0 for this assessment): 1.0 Failure of EDGs from Seismic Event (All from Table 3-8, Reference 3)

Seismic DG Building Failure = 9.59E-1

8.77E-1 = 8.41 E-1 (S1)

Seismic Failure of 4160 VAC Bus = 7.35E-1 (S2)

Seismic Failure of Diesel Generator = 6.45E-1 (S3)

Total Seismic Failure Probability of EDGs is obtained from S1 + S2 + S3-Si *S2 - S1*S3 - S2*S3 + S1*S2*S3 = 9.85E-1 Survival from Seismic Event of EDGs (1 - 9.85E-1) 1.50E-2 Change in Conditional Core Damage Probability Given LOOP and Survival of EDGs (wI EDG I unavailable and no credit for AC power recovery, see Att. 1, Table A6) 1.05E-1 Fault Exposure Factor (17.5/365) 4.79E-2 Category SEIS4 Incremental Risk 6.9E-1 1 As a result, the total calculated incremental change in seismic core damage probability is:

TOTAL Seismic Incremental Risk 6.01 E-8 14

High Winds:

Section 5 of the Oyster Creek IPEEE (Reference 3) was reviewed to evaluate the risk from High Winds.

Similar to seismic events, the primary effect of a high wind event, relative to the degraded diesel generator, is a loss of offsite power. However, the event frequency utilized is the frequency of F(2) winds minus the frequency of the F(3) winds or higher. This is judged to be realistic because winds of category F(3) or higher would fail the available EDG. Category F(1) winds were excluded because events in this category are included in the Internal Events LOOP frequency and derived LOOP recovery probabilities.

For High Winds that cause a LOOP but do not fail the EDGs, the incremental core damage probability is calculated as follows:

High Winds Initiator Frequency (Figure 7, Section 5, Reference 3, -5.OE-6Iyr - -1.OE-6/yr): 4.OOE-6/yr Induced LOOP Probability (Assumed): 1.0 Induced LOOP Non-Recovery Probability (Assumed): 1.0 Change in Conditional Core Damage Probability Given LOOP 1.05E-1 Fault Exposure Factor (17.5/365) 4.79E-2 High Winds Incremental Risk 2.02E-8 Total External Events Risk The total External Events incremental conditional core damage probability is the sum of constituents as follows:

Total Fire Incremental Risk 8.26E-8 Total Seismic Incremental Risk 6.01 E-8 High Winds Incremental Risk 2.02E-8 Total External Events Incremental Core Damage Risk 1.63E-7 For impact on Large Early Release frequency risk, a factor of 0.1 was applied consistent with the Internal Events results. This is judged to be acceptable since the likely availability of EDG 1 for some time frame would reduce the LERF potential such that the internal events detailed LERF estimates also provide an approximate representation for the impact from external events:

Total External Events Incremental Large Early Release Risk 1.63E-8 15

SUMMARY

AND CONCLUSION Table 5 provides the results of the internal events analysis with respect to the SDP quantification of risk metrics.

TABLE 5 CHANGE IN RISK METRICS BASED ON CONFIGURATION SPECIFIC CONDITIONS (INTERNAL EVENTS)

Annualized Change in Core Annualized Change in Large Case Description Damage Frequency Early Release Frequency Case 0: Overly Conservative (3.02E-5/yr - 6.58E-6/yr) * (3.04E-6/yr- 1.16E-6/yr)

Assessment, no credit for D/G 17.5 days / 365 days/yr 17.5 days /365 days/yr run time. = 1.13E-6/yr(') 9.01E-8Iyr Case 1: Degraded D/G Assessment, credit for actual experienced D/G run times.

3 hrs run time for 11.5 days (2.24E-5/yr - 6.58E-6Iyr) * (2.57E-6/yr - 1.1 6E-6/yr)

11.5 days /365 days/yr 11.5 days / 365 days/yr

= 4.98E-7/yr + = 4.44E-8/yr +

1.5 hrs run time for 6 days (2.56E-5/yr - 6.58E-6/yr)

6.0 (2.75E-6/yr - 1.16E-6/yr)

6.0 days 1365 days/yr days 1 365 days/yr

= 3.13E-7/yr = 2.61 E-8/yr

= 8.11E-7/yr') = 7.06E-8/yrel Case 2: Degraded DIG Assessment, credit for actual experienced DIG run times plus Joliet Test run time.

(1.61 E-5/yr - 6.58E-6Iyr) * (2.24E-6tyr - 1.16E-6/yr)

9 hrs run time for 11.5 days 11.5 days / 365 days/yr 11.5 days / 365 days/yr

= 3.OOE-71yr + = 3.40E-8/yr +

6 hrs run time for 6 days (1.85E-5/yr - 6.58E-6/yr)

6.0 (2.36E-6/yr - 1.16E-6/yr)

6.0 days / 365 days/yr days / 365 days/yr

= 1.95E-7/yr = 1.97E-8/yr

= 4.96E-7/yr') = 5.38E-8/yre)

(" Note that the change in risk metric values are 'per year' when considered annualized assuming one occurrence over the calendar year.

16

Including the External Events assessment based on the Exelon analysis leads to the following for the SDP quantification of risk metrics. Note that the external events results are the same for each case since recovery of offsite AC power is not credited for the external events assessment.

TABLE 6 CHANGE IN RISK METRICS BASED ON CONFIGURATION SPECIFIC CONDITIONS (INTERNAL AND EXTERNAL EVENTS)

Change in Core Damage Change in Large Early Case Description Frequency Release Frequency Case 1: Degraded D/G Internal = 8.1 E-7/yr Internal 7.1E-8/yr Assessment, credit for actual External = 1.6E-7Iyr External =1 .6E-8/yr experienced DIG run times. Total = 9.7E-7/yr (Green)(') Total = 8.7E-8Iyr (Green)(')

Case 2: Degraded D/G Internal = 5.OE-7/yr Internal = 5.4E-8/yr Assessment, credit for actual External = 1.6E-7Iyr External = 1.6E-8/yr experienced D/G run times plus Joliet Test run time. Total = 6.6E-7/yr (Green)(" Total = 7.0E-8/yr (Green)("

(1) Note that the change in risk metric values are 'per year" when considered annualized assuming one occurrence over the calendar year.

The most realistic representation of the change in risk is considered to be Case 2. Table 7 provides a summary of the evaluation.

Table 7 Internal and External Events I Change in Core Damage Frequency l Change in Large Early Release Frequency Best Estimate Result 6.6E-7 7.OE-8 GREEN Criteria 1.OE-6 1.0E-7 Color GREEN GREEN There are moderate variations in the risk metrics as a result of changes in the key input variables.

However, the resulting risk metrics are clearly GREEN when the diesel capability in the degraded condition is modeled in a realistic fashion by incorporating the diesel capability to run as long as 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months based on the Joliet D/G test run times and the 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months experienced in testing at OCNGS.

17

ATTACHMENT I OYSTER CREEK RISKMAN MODEL OF RECORD AND CALCULATIONS Calculation of Risk Metrics Related to Degraded EDG #1 A situation existed at Oyster Creek wherein, for a period of 17 days, EDG #1 would have failed after 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of operation due to a pre-existing degraded condition. This document will describe the evaluation of the risk impact of this condition.

Base Model Update Since the last PRA update a number of LOOP related events have occurred in the industry.

Therefore, the LOOP initiating event frequency is increased from 0.0279/yr to 0.046/yr (Reference Al). Also, the grid recovery basic events have been increased as shown in Table Al (Reference Al).

Table Al Grid Recovery Modification Summary Basic Event Basic Event Old Value New Value Description GRID30MIN Failure to recover 0.541 0.6075

_____________________ grid in 30 minutes __ _ __ _0.6075 GRID60MIN GRID6OMIN ~~Failure to minutes grid in 60 recover 047046 0.407 0.4966 LP3GRID4HRS Failure to recover 0.145 0.2514

__________________ grid in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 0.059 0.1438 GRID8HRS Failure to recover 0.059 0.1438

__ _ _ _ _ _ _ _ _ _ _ I grid in 8 H ours_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Also, offsite power recovery in Non-SBO scenarios was, conservatively, not previously credited in the Oyster Creek PRA. This conservatism is addressed by adding 3 new split fractions to the model to credit grid recovery during non-SBO scenarios. These new split fractions for LOSP and non-SBO conditions do not credit EDG recovery or use of the Combustion Turbines. These latter actions are not procedurally directed in non-SBO conditions.

The 3 split fractions were first added to the LP top event quantification (LPA, LPB, LPD). LPA represents the 30 minute recovery, LPB represents the 60 minute recovery, and LPD represents the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months recovery. The values used are taken directly from Table Al, above.

The split fractions were added to the LTGT event tree logic directly above the LPF rule. The following shows the 3 new rules added:

LPA (OP=F+EF=F)*IC=S*(VR=F+SR=F+VS=F)*(XB=S+XC=S)*AD=S LPB (OP=F+EF=F)*IC=S*VR=S*SR=S*VS=S*(MU=F+FP=F+SL=F)*(XC=S+XB=S)*AD=S LPD (OP=F+EF=F)*CS=S*AD=S*(XB=S+XC=S)

These mimic the SBO rules for LP except that ADS is required to be successful, to capture potential operator dependency, and long term DC power is required, to capture chargers as well as non-SBO AC support.

A-1

This recovery success path is added to the SIC success macro by appending the following logic to the end of the existing SIC macro:

+(OP=F+EF=F)*LP=S*-ATWS This provides an additional success path for LOOP scenarios that do not involve SBO. The model transfers these scenarios directly to success if the grid is recovered. This treats frontline systems as successful given AC recovery. With the potential recovery of 2 trains to BOP equipment as well as at least one safety related train, this modeling decision is not significant.

The results of the revised base model quantification were a CDF of 6.58E-6/yr and a LERF of 1.16E-6Iyr.

Model for Evaluating Plant Condition A post incident test of a diesel similar to the one with the loosened bolts was performed by Exelon at a Joliet, IL test facility. The test demonstrated an additional run time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months was likely given the off normal condition of the bolts.

Since the EDG would not have met PRA specified failure conditions, it could be assumed failed in the PRA model. However, since it would have likely operated for at least 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , it is appropriate to develop a means of crediting this level of safety benefit. In the OC PRA model, AC power recovery is credited as a means of mitigating Station Blackout (SBO) events, the main scenarios affected by failed or degraded EDGs. AC power recovery is significantly influenced by the amount of time available for recovery. The OC PRA model defines four AC Power recovery times windows based on specific independent failures that can occur within an SBO scenario.

Specifically these can be described by Table A2:

Table A2 OC PRA AC Recovery Modeling Summary SBO SBO Scenario Boundary Condition Description Base Model Scenario Recovery Time Boundary Window Condition ID LP1 SBO with Stuck open EMRV, Stuck open Safety valve, or 30 Minutes Failure to isolate SDV LP2 SBO with Seal LOCA or Failure to Make-up to IC Shell 60 Minutes LP3 SBO with failure of DC Train 4 Hours LP4 SBO with No Additional Failures 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months LPA Non-SBO LOSP with Stuck open EMRV, Stuck open 30 Minutes Safety valve, or Failure to isolate SDV LPB Non-SBO LOSP with Seal LOCA or Failure to Make-up to 60 Minutes IC Shell LPD Non-SBO LOSP with No Additional Failures 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Development of PRA Model Parameter Changes With a degraded EDG potentially available to operate for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , AC Power Recovery can be extended by a period of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the degraded EDG operates for the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months period and RPV makeup isavailable. For this evaluation, it is assumed that only core spray could provide A-2

adequate RPV makeup. Figure Al shows the logic for calculating a revised AC Power Recovery failure probability, given credit for EDG operation for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Figure Al shows a basic event representing the Base model recovery 'ANDed' with a group of 3 basic events which are 'ORed".

The 'ORed" basic events represent the conditional AC recovery failure probability with credit for 6 additional hours along with failure of the degraded EDG to operate for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or failure of 1 division of core spray (i.e., 2 pump trains).

Figure Al - Logic Model For AC Power Recovery Failure Probability Revision to Credit Degraded EDG A-3

The LP-BASE basic event is taken directly from the base model and represents the AC Recovery failure probability with no additional credit for the degraded EDG. Table 3 shows the value of this basic event for the set of four boundary conditions (i.e., scenario types) modeled in the PRA.

The DG2 basic event represents the probability that the degraded EDG fails to operate for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This is taken from the base model split fraction ED2. ED2 is calculated based on a 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months mission time and it is conservative to use this value for a 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months mission time. It is also assumed that the failure rate of the degraded EDG is the same for the first 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months as if it were completely available and operable. This value is 4.02E-2 per event (the 'no maintenance" value applies).

Basic event CS2 represents operation of one division of core spray for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and is equal to 7.36E-4 per event. This is taken from the base model split fraction CS2. This value is calculated based on a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time and its use is conservative for this evaluation.

Basic event LP-PLUS-6-HR represents the conditional failure of AC power recovery given an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months above-and-beyond the base model. This was calculated by using the base AC recovery fault tree model with revision to credit an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The AC recovery model credits grid recovery, alignment of the Combustion turbines (CT), or recovery of EDG failure.

Since the alignment of CTs is not significantly time dependent in the model, no CT related change is necessary for the additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Likewise, EDG recovery is not credited before 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Therefore, the only credited benefit of the additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is based on grid recovery.

The information provided in Table 2 is as follows:

Column I - Split fraction and applicable base time frame

Column 2 - Base grid recovery failure probability

Column 3 - Revised grid recovery failure probability if 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is added to each boundary condition in Column 1. This is based on the following recovery curve:

P.= exp(-0.7t° 49)

(Reference A2).

This revised grid failure value was used in place of the base grid recovery failure probability in sensitivity cases where EDG 1 run capability was to be credited for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Column 4 - Base total AC recovery failure probability (includes applicable credit for EDG 2 recovery after 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and CT alignment).

Column 5 - AC recovery failure probability with credit for the additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (includes applicable credit for EDG recovery after 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and CT alignment).

Column 6 - Revised total AC power recovery failure probability based on logic in Figure 1 (Gate G001). These values were used to replace the AC recovery values in the PRA model and reflect the benefit of EDG operation for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

A-4

Table A3 AC Power Recovery Values Summary Grid Failure AC Power AC Power Probability Base AC Power Recovery Failure Base Grid Given 6 Recovery Given 6 (Conditional)

Boundary Recovery Fail Additional Failure Additional *Value for G001 in Condition Probability Hours I Probability Hours Figure Al LP1 (30 MIN) 0.6075 0.1735 0.04867 1.39E-02 1.59E-02 LP2 (60 MIN) 0.4966 0.1626 0.03882 1.27E-02 1.43E-02 LP3 (4 HRS) 0.2514 0.1149 9.72E-03 4.44E-03 4.84E-03 LP4 (8 HRS) 0.1438 0.0780 3.91E-03 2.13E-03 2.29E-03 LPA (30 MIN) 0.6075(1) 0.1735 0.6075(1) 0.1735 1.98E-01 LPB (60 MIN) 0.4966(1) 0.1626 0.4966(1) 0.1626 1.83E-01 LPD (8 HRS) 0.1438(1) 0.0780 0.1438(1) 0.0780 8.39E-02 Model Requantification Since EDG#1 does not meet PRA success criteria, as discussed above, it is considered failed and its representative split fraction EC2, is set to 1.0 (i.e. failed). However, while failed, the EDG can provide some benefit. As discussed above, this benefit is credited by reducing AC Power recovery failure probability as derived above. Thus, split fraction LP1 is reduced from 0.04867 to 0.0159, LP2 is reduced from 0.03882 to 0.0143, LP3 is reduced from 1.94E-2 to 4.84E-03, and LP4 is reduced from 7.84E-3 to 2.29E-3. LPA, LPB, and LPD were similarly reduced. With these changes made, the model was requantified.

The OC2002W model was requantified as application specific model OC2WCSO using Riskman Version 5.02. The following table shows a summary of results and includes other sensitivity quantifications performed. Model changes were made by manually editing the base model master frequency file.

(1) No credit for EDG recovery or CT alignment. AC recovery failure probability based on grid recovery failure probability only.

A-5

Table A4 Model Quantification Summary Quantification CDF (/yr) LERF (yr) Summary of Model Changes Base-Revised 6.58E-6 1.16E-6 OC2002A, LOSP increased to 0.046, Grid recovery failure probability increased, Recovery of Non-SBO LOSP added.

6 Hr Case 1.85E-5 2.36E-6 EC2=1.0, AC Recovery improved for 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months degraded DG 1.5 Hr Case 2.56E-5 2.75E-6 EC2=1.0, AC Recovery improved for 1.5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months degraded DG 3 Hr Case 2.24E-5 2.57E-6 EC2=1.0, AC Recovery improved for 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months degraded DG 9 Hr Case 1.61 E-5 2.24E-6 EC2=1.0, AC Recovery improved for 9 hour1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months degraded DG 0 Hr case 3.02E-5 3.04E-6 EC2=11.0, AC Recovery not improved for potential degraded DG operation However, there is some uncertainty regarding the expected run duration of the degraded EDG.

Therefore, Table A5 shows the AC recovery impact of several potential degraded EDG operation time-windows. The quantified results based on each of these degraded EDG operation time-windows are shown in Table A4.

Table A5 Summary of AC Recovery Versus Degraded EDG Run Time Boundary 6 hourEDG 11.5hourEDGl 3hourEDG 9 hourEDG lOhourEDG Condition I Run Timee') I Run Time I Run Time [ Run Time I Run Time LP1 (30 MIN) 1.59E-02 3.20E-02 2.40E-02 1.17E-02 4.87E-02 LP2 (60 MIN) 1.43E-02 2.77E-02 2.13E-02 1.06E-02 3.88E-02 LP3 (4 HRS) 4.84E-03 8.09E-03 6.68E-03 3.60E-03 9.72E-03 LP4 (8 HRS) 2.29E-03 3.47E-03 2.99E-03 1.81 E-03 3.91 E-03 LPA (30 MIN) 1.98E-01 3.99E-01 2.99E-01 1.46E-01 6.08E-01 LPB (60 MIN) 1.83E-01 3.54E-01 2.72E-01 1.35E-01 4.97E-01 l LPD (8 HRS) 8.39E-02 1.27E-01 1.10E-01 6.64E-02 1.44E-01 To support the extemal events evaluation, an additional assessment was performed to evaluate the conditional core damage probability given that a LOOP event has occurred. In this case, no credit is given for AC power recovery from any other source other than the on-site EDGs. To perform this assessment, the LOSP initiating frequency was set to 1.0 and all of the LP boundary condition values were set to 1.0 as well. The first case includes nominal availabilities of both EDGs. The second case assumes EDG 1 is unavailable. The results from this assessment as shown in Table A6 are used to determine the change in conditional core damage probability given unavailabity of EDG 1.

A-6

Table A6 Conditional Core Damage Probability with No Credit for AC Power Recovery from Off-site AC Power Sources Description Conditional Core Damage Probabilty EDG 1 Unavailable and EDG 2 includes nominal failure 1.10E-1 probabilities and availabilities EDG 1 and EDG 2 both include nominal failure 4.69E-3 probabilities and availabilities Changel in CCDP w/ EDG 1.05E-1 Unavailable References Al 'Initiating Event Notebook: OCNGS PRA - 2004 Update;" (In-Progress). Note: The 0.046/year Initiating Event Frequency is consistent with NUREG/CR- 5496. The LOOP recovery probabilities in the draft update are consistent with the Recovery Curves developed in 'Peach Bottom Atomic Power Station: Initiating Events Notebook, Appendix C;" March 2003.

A2 'Peach Bottom Atomic Power Station: Initiating Events Notebook, Appendix C;" March 2003.

A-7

ML042660346

Contents

Text

SUMMARY

SUMMARY

REFERENCES:

SUMMARY

SUMMARY

Navigation menu

ML042660346

Text

SUMMARY

SUMMARY

REFERENCES:

SUMMARY

SUMMARY

Navigation menu

Search