ML051190518

Final Precursor Analysis - Nine Mile Point 1

ML051190518
Person / Time
Site:	Nine Mile Point
Issue date:	03/14/2005
From:	Eliezer Goldfeiz NRC/RES/DRAA/OERAB
To:
References
IR-03-003
Download: ML051190518 (29)

Text

Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Nine Mile Point Unit 1 Degraded Piping in Reactor Building Closed Loop Cooling System Event Date: 03/07/2003 NRC Special Inspection Importance = 4.2E-06 Report 220/03-003 March 14, 2005 Condition Summary Description. From February 10, 2003, to March 7, 2003, the NRC conducted a special inspection of the Nine Mile Point Nuclear Station - Unit 1, with regard to degraded piping in the reactor building closed loop cooling (RBCLC) system (Reference 1). This special inspection followed three shutdowns from power operation to repair leaks in the RBCLC system within an 8-month period.

The shutdowns for piping repair occurred as follows:

May 14-19, 2002 Repaired two RBCLC leaks Dec 5-11, 2002 Repaired one RBCLC leak Dec 13-24, 2002 Repaired one RBCLC leak The RBCLC system is a safety-related, risk-significant system that is required to operate during normal plant operation and accident conditions. The loss of the RBCLC system would result in the loss of cooling to several other systems and their subsequent failure. Major components supplied by the RBCLC system include the instrument air compressors (2 out of 3), the high- pressure injection system (i.e., feedwater pumps, feedwater booster pumps, and condensate pumps), control room air conditioning equipment, shutdown cooling heat exchangers, reactor recirculation pump coolers, drywell air coolers, reactor building equipment drain tank cooler, and fuel pool heat exchangers.

The NRC special inspection team determined that degraded piping in the RBCLC system was extensive. For example: the special inspection team learned that a full section of RBCLC piping was able to be manually broken apart following removal by maintenance personnel. Also, during the numerous repairs of piping during shutdowns, the licensee had discovered notable and widespread wall thinning in RBCLC piping sections, which were most severe at threaded mechanical connections. The NRC team determined that the licensees structural analysis did not provide evidence that the as-found condition of the degraded piping in the RBCLC system retained sufficient strength. Consequently, the structural integrity of the affected RBCLC system piping may not have been maintained when subjected to design loading conditions. The special inspection team concluded that the initiating event frequency for a loss of RBCLC had been increased over its nominal value and that other initiating events [loss-of-coolant accidents (LOCAs) and loss of all electrical ac power], if they occurred, would induce piping failures in the RBCLC system.

Cause. The NRC special inspection teams review of the events determined that the root and contributing causes for the degraded piping included inadequate system design, inadequate corrective actions, and degraded RBCLC system water chemistry.

1

INSPECTION REPORT 220/03-003 Time period/condition duration. This event was analyzed as a condition assessment.

The degraded condition of the RBCLC piping existed over a period of years. Prior to 2002, there had been numerous small bore piping leaks within the RBCLC system at threaded mechanical joints. Also, around May 2000, chloride and sulfate concentrations in the RBCLC system were found to be elevated. Near the same time, RBCLC system oxygen levels were found to be significantly below normal levels, and iron particulate levels were high. These parameters indicated an increased corrosion rate; however, efforts to identify the cause and correct the abnormal chemistry parameters were unsuccessful.

Per accident sequence precursor guidelines, the maximum time for evaluation of a condition assessment is 1 year. Therefore, the time period from March 7, 2002, to March 7, 2003, was used for this condition assessment. The total time for the condition assessment was assumed to be 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> even though the unit was shut down for approximately 29 days during the time period.

There were three times during the 1-year period that overlapping unavailabilities occurred with respect to other equipment.

Period 1 From September 24, 2002, to October 19, 2002 (390 hours0.00451 days <br />0.108 hours <br />6.448413e-4 weeks <br />1.48395e-4 months <br />), the #12 control rod drive (CRD) pump was unavailable as described in LER 220/02-002, Loss of One Control Rod Drive Pump due to Circuit Breaker Failure, (Reference 2) and NRC Integrated Inspection Report 05000220/2003004 (Reference 3).

Period 2 On November 1, 2002, for an 8-hour period, the potential existed for any trip of the reactor to cause a loss of offsite power (LOOP) as described in LER 220/02-001, 115 kilovolt Offsite Power Inoperable Due to Low Voltage on Line 4 and Line 1 Out of Service (Reference 4).

Period 3 For the entire period, no credit could be taken for the condensate system following failure of the high-pressure injection system. In Reference 5, the NRC discovered that EOP-2 did not address a hardware interlock and the steps necessary to bypass the interlock in order to be able to use the condensate system should no feedwater pumps be available.

Recovery opportunities. No recovery of the RBCLC system following a postulated break in RBCLC piping was assumed in the condition assessment. The basis for this assumption comes from Reference 1, in the section Risk Significance and Analysis of the Event.

Assumption #5: Failure of the RBCLC piping would result in system leakage in excess of the automatic makeup capability for the system. Consequently, the RBCLC expansion tank level would be lost and the operating RBCLC pumps would fail due to inadequate net positive suction head (NPSH).

2

INSPECTION REPORT 220/03-003 The team did not credit recovery of the RBCLC system because under certain entry conditions, Annunciator Response Procedure N1-ARP-H1, Control Room Panel H1, directed the starting of the standby RBCLC pump; and Annunciator Response Procedure N1-ARP-H1, Special Operating Procedure N1-SOP-8, RBCLC Failure, and Operating Procedure N1-OP-11, Reactor Building Closed Loop Cooling System, did not provide guidance to secure the operating RBCLC pumps when inadequate NPSH existed. Also, no procedural guidance existed to isolate an RBCLC leak and recover the RBCLC system.

Assuming no recovery of the RBCLC system leads to assuming no recovery of any of the equipment cooled by the RBCLC system.

Analysis Results

! Importance1 The total importance was calculated to be 4.2 x 10-6.

A summary of the calculation for importance is shown in the table below:

Condition assessment Conditional core damage probability (CCDP) 4.4 x 10-6 Nominal core damage probability (CDP) 2.3 x 10-7 (*)

Importance ()CDP = CCDP - CDP) 4 x 10-6

(*) = The reported CDPs are for those initiating events that are affected by the condition, namely IE-LORBC and the LOCA events (SLOCA, MLOCA, and LLOCA).

The Accident Sequence Precursor Program acceptance threshold for condition assessment is an importance ()CDP) of 1 x 10-6. The importance of the condition assessment for this event exceeds the precursor threshold.

! Dominant sequences Condition assessment: The sequence with the highest importance (3.4 x 10-6 or 81%) is a sequence that starts with a pipe break in the RBCLC system followed by a failure of the reactor recirculation pump seals due to loss of RCP seal cooling. Thus the event proceeds as a small LOCA with the reactor tripped. Power conversion system fails; manual reactor depressurization is successful; core spray is successful, but the long term cooling fails (see Tables 1 and 2). The main failure combination leading to core damage is the failure of instrument air system and failure to recover it in a timely manner. This sequence is depicted in Figure 2, sequence 26.

1 For the condition assessment, the parameter of interest is the measure of the incremental increase between the conditional probability for the period in which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This incremental increase or importance is determined by subtracting the CDP from the CCDP. This measure is used to assess the risk significance of hardware unavailabilities especially for those cases where the nominal CDP is high with respect to the incremental increase of the conditional probability caused by the hardware unavailability.

3

INSPECTION REPORT 220/03-003 The following cutset dominates the sequence:

IE-SLOCA SMALL LOSS OF COOLANT ACCIDENT 2.98E-03 CSS-XHE-XM-ERROR1 OPERATOR FAILS TO RECOVER CSS FOLLOWING LOIAS 1.00E-02 IAS-SYS-FC-LORBC INSTRUMENT AIR FAILS AS A RESULT OF LOSS OF RBCCW 1.00E-01 IE-SLOCA-NOREC OPERATOR FAILS TO RECOVER SLOCA IN SHORT TERM 1.00E+00 Cutset CDP = 3.0E-06

! Results tables

- The conditional probabilities of the dominant sequences are shown in Table 1.

- The event tree sequence logic for the dominant sequences are provided in Tables 2a and 2b.

- The conditional cut sets for the dominant sequences are provided in Table 3.

- The definitions for the modified or dominant basic events are shown in Table 4.

Modeling Assumptions

! Assessment summary This event was modeled as a condition assessment.

The condition assessment was run for 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br />. Only four of the initiating events have an importance value: IE-LORBC, IE-SLOCA, IE-MLOCA, and IE-LLOCA. For all other initiating events, the change case and the base case are the same.

Due to the assumptions used in the analysis, only one of the three periods of overlapping unavailabilities had an impact on the calculations. For the overlapping period where the

1. 12 CRD pump was unavailable (390 hours0.00451 days <br />0.108 hours <br />6.448413e-4 weeks <br />1.48395e-4 months <br />), the unavailability had a small impact.

For the overlapping period where any reactor trip would cause a LOOP, the time period of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> was not long enough to have a significant impact. For the overlapping period where the condensate system would be unavailable following failure of the reactor feedwater pumps, no credit was taken for the condensate system in any of the change case evaluations, and so the overlapping failure of the condensate system had no additional impact on the analysis.

! Key Modeling Assumptions It is modeled that there is 0.50 probability of pump seal LOCA if the LORBC event occurs and the RCP seal cooling is lost, leading to SLOCA event. This probability is used in SDP and taken from the licensee PRA (Reference 1). Thus, 50% of the IE-LORBC frequency is taken out of this initiating event frequency and is added to the IE-SLOCA initiating event frequency, both in the base case and in the conditional case.

4

INSPECTION REPORT 220/03-003 Credit is given for potential isolation of leaking RCP pump since specific procedures for this purpose exist, namely N1-SOP-1.2 (Recirc Pump Seal Failure).

! SPAR model used in the analysis Nine Mile Point 1 (ASP BWR A), Revision 3.01, February 2003 (Reference 6)

! Unique system and operational considerations A break in the RBCLC piping would result in dependent failure of two of the three instrument air compressors. The SPAR Revision 3.01 model assumes that there is a 0.1 chance that instrument air fails as a result of loss of RBCLC, modeled as the basic event IAS-SYS-FC-LORBC = 0.1 in the IAS fault tree. This assumption has been retained in the analysis.

! Modifications to event tree and fault tree models The SPAR Revision 3.01 event trees and fault trees were used to calculate the base case values for the condition assessment for IE-LORBC, IE-SLOCA, IE-MLOCA, and IE-LLOCA. A modification is made to the IE-LORBC, as discussed below.

! Initiating event probability changes The SPAR model initiating event frequency of IE-LORBC is 9.5E-07/hr and IE-SLOCA is 5.71E-08/hr. These frequencies are modified as discussed below.

The LORBC initiating event frequency is increased by the following increment to account for the condition that can lead to pipe break:

(4 leaks/year) x (1 year/8760 hours) x (1/100 break per leak) = 4.6 x 10-6 per hour.

The 4 leaks/year came during the three shutdowns in the year prior to March 7, 2003.

The 1/100 break per leak is the value used in Reference 1 in the significance determination process.

Thus, the total IE-LORBC value is:

9.5E-07 + 4.6E-06 = 5.6E-06/hr.

In the base SPAR model, RCP seal leakage was not modeled in IE-LORBC; it was only addressed in SBO event. For this ASP analysis, the following modification is made: both in the base case, and the conditional case, 50% of the IE-LORBC frequency is assigned to RCP seal leakage As discussed later on 90% of these leaks are isolable, 10% are not (see basic event RRS-XHE-ISOLATE, introduced for this purpose). Only the unisolable leaks are assigned to IE-SLOCA. The initiating event frequencies are modified as follows:

Base Case:

IE-LORBC frequency consists of those cases where no leakage has occurred, plus the cases where the leakage is isolated (see the small event tree that illustrates this):

5

INSPECTION REPORT 220/03-003 No Seal Leak IE-LORBC 4.75E-07 LORBC 0.5 9.50E-07 Isolate Leak IE-LORBC 4.28E-07 Seal Leak 0.9 0.5 No Leak Isol. IE-SLOCA 4.75E-08 0.1 Total = 9.50E-07 IE-LORBC = 9.5E-07

• 0.50 + 9.5E-7

• 0.5

• 0.90 = 9.03E-07 /hr IE-SLOCA = 5.71E-08 + 9.5E-07

• 0.5

• 0.1 = 1.05E-07 /hr Current Case:

IE-LORBC = 5.6E-06

• 0.50 + 5.6E-6

• 0.5

• 0.90 = 5.3E-06 /hr IE-SLOCA = 5.71E-08 + 5.6E-06

• 0.5

• 0.1 = 3.4E-07 /hr MLOCA and LLOCA initiating event frequencies remained the same. Other initiating event frequencies are set equal to zero, both in the base and the conditional case, since they are not affected by the condition.

! Basic event probability changes S Probability of failure of reactor recirculation pump seals following loss of RBCLC). The probability that the reactor recirculation pump seals would leak following a pipe break in the RBCLC inside the drywell was set to 0.5 based on the evaluation of the licensee pump seal model by the Nine Mile Point 1 NRC special inspection team (Reference 1).

S Isolation of Leaking Recirc Pump. This new recovery action (RRS-XHE-ISOLATE) is introduced and used to reduce the initiating event frequency of consequential small LOCA due to RCP seal leakage. The HEP of this basic event is calculated in attachment A.

S Conditional Case Basic events set to failure (TRUE)

The following four basic events are set to failure for the conditional case.

These event are taken from the flag file for LORBC, where they are set to TRUE in the base case, affecting only the initiating event IE-LORBC. By putting them explicitly into the change set, they alos apply to LOCA events.

CDS-MDP-CF-PUMPS Condensate pumps fail from common cause to run LORBC Loss of RBCCW PCS-MOV-OC-STEAM Steam LOOP valves fail to remain open 6

INSPECTION REPORT 220/03-003 SDC-HTX-CF-PLUG Common cause plugging of SDC heat exchanger

! Model update and modifications

- Probability of one safety relief valve sticks open (PPR-SRV-OO-1VLV). This value was changed to 3.7 x 10-3 based on the latest BWR evaluation.

Sequence 36 in the LORBC event tree is transferred to ATWS, rather than left conservatively as is (core damage). Figure 1 shows the modified event tree.

The above calculated initiating event frequencies are used for the base case IE-LORBC and IE-SLOCA.

The base SPAR model is quantified with these changes and is stored as the base case for this analysis.

! Sensitivity analysis Two parameters are identified as those with potentially large uncertainties, and that would affect the results directly. These are Increase in frequency of IE-LORBC ( 0.04 per year).

Seal LOCA probability due to loss of RBC (0.50).

Since the calculated event importance is in less than mid 10-6, an increase of a factor of 2 in either parameter does not change the conclusions of the analysis; higher increases are not realistic. Thus, the uncertainty/sensitivity analyses are not pursued further.

7

INSPECTION REPORT 220/03-003 References

1. NRC Special Inspection Report 50-220/03-003, Preliminary White Finding, dated April 15, 2003 (ADAMS Accession Number ML031060288).

1. Licensee Event Report LER 220/02-002, Loss of one Control Rod Drive Pump due to Circuit Breaker Failure, dated December 26, 2002 (ADAMS Accession Number ML030070698).

2. NRC Integrated Inspection Report 05000220/2003004, dated August 4, 2003 (ADAMS Accession Number ML032160113).

3. Licensee Event Report LER 220/02-001, 115 kilovolt Offsite Power Inoperable Due to Low Voltage on Line 4 and Line 1 Out of Service, dated December 27, 2002 (ADAMS Accession Number ML030070699).

4. NRC Integrated Inspection Report 05000220/2003005, dated November 5, 2003 (ADAMS Accession Number ML033100273).

5. John A. Schroeder and Richard E. Gregg, Standardized Plant Analysis Risk Model for Nine Mile Point 1 (ASP BWR A), Revision 3.01, February 2003, computer model updated March 6, 2003.

8

INSPECTION REPORT 220/03-003 Appendix A. Human Reliability Analysis A new operator action, RRS-XHE-ISOLATE, isolation of leaking RCP pump(s), is defined. If this action is performed per Recirc Pump Seal Failure procedure N1-SOP-1.2.

The performance shaping factors for this action are minimal, except for stress, which is assigned high due to the existence of a rare event. Thus the diagnosis and action HEPs are calculated as 0.02 and 0.002, respectively. There are three valves to be closed per pump. If one is left open, the leak will not be terminated. This is reflected in the estimation of HEP by multipying the action HEP by 3. The final HEP for the basic event is HEP = 2.6E-03 ~ 3E-02.

If multiple RCP seals are leaking (with lesser probabilities), more valves need to be closed.

Thus, the action failure may be as high as 5 pumps

• 3 valves/pump

• 0.002 = 0.03, and the total HEP may be as high as 0.05 ( 0.02 + 0.03). However, the probability of such a scenario is expected to be lower.

The licensee has provided a HEP of 0.1 which was also used in the SDP analysis. This value is adapted for the current ASP analysis. Thus, HEP (RRS-XHE-ISOLATE) = 0.1.

9

INSPECTION REPORT 220/03-003 Table 1. Conditional probabilities associated with the highest probability sequences for the condition assessment.

Event Tree Sequence CCDP CDP Importance  %

SLOCA 26 3.40E-06 0.00E+00 3.40E-06 81.0%

LORBC 22 6.00E-07 1.00E-07 5.00E-07 11.9%

LORBC 34-20 1.80E-07 3.10E-08 1.50E-07 3.6%

LORBC 35-12 7.50E-08 1.30E-08 6.20E-08 1.5%

MLOCA 15 4.30E-08 0.00E+00 4.30E-08 1.0%

4.40E-06 2.30E-07 4.20E-06 Table 2a. Event tree sequence logic for the condition assessment.

Event Tree Sequence Logic

(/ denotes success; see Table 2b for top event names)

SLOCA 26 L /RPS PCS MFW

/DEP /LCS SPC CSS CVS LORBC 22 /RPS /SRV PCS ISO MFW /DEP CDS /LCS SPC SDC CSS CVS LORBC 34-20 /RPS P1 MFW /DEP CDS /LCS SPC SDC CSS CVS LORBC 35-12 /RPS P2 CDS /LCS SPC SDC CSS CVS MLOCA 15 /RPS /VSS MFW /DEP

/LCS SPC CSS CVS 10

INSPECTION REPORT 220/03-003 Table 2b. Definitions of top events listed in Table 2a.

Fault Tree Name Description CDS CONDENSATE INJECTION IS UNAVAILABLE CSS CONTAINMENT SPRAY COOLING FAILS CVS CONTAINMENT VENTING DEP MANUAL DEPRESSURIZATION FAILS ISO ISOLATION CONDENSER FAILURE L OPERATOR FAILS TO RECOVER SLOCA IN SHORT TERM LCS CORE SPRAY SYSTEM IS UNAVAILABLE MFW FEEDWATER SYSTEM FAILS P1 ONE SRV FAILS TO CLOSE PCS POWER CONVERSION SYSTEM FAILS RPS REACTOR SHUTDOWN FAILS SDC SHUTDOWN COOLING SYSTEM IS UNAVAILABLE SPC TORUS COOLING FAILS SRV SRVS FAIL TO RECLOSE VA1 ALTERNATE LOW PRESSURE INJECTION IS UNAVAILABLE 11

INSPECTION REPORT 220/03-003 Table 3. Conditional cut sets for LORBC.

Event Tree: SLOCA CCDF: 3.8E-010 Sequence: 26 CCDF  % Cut Set Cut Set Events 3.4E-010 87.52 IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 IE-SLOCA-NOREC 2.4E-011 6.13 IE-SLOCA-NOREC CSS-XHE-XM-ERROR CVS-XHE-XM-VENT1 1.7E-011 4.38 IAS-SYS-FC-LORBC IE-SLOCA-NOREC CSS-XHE-XM-ERROR Event Tree: LORBC CCDF: 6.8E-011 Sequence: 22 CCDF  % Cut Set Cut Set Events 5.2E-011 76.66 /SRV IAS-SYS-FC-LORBC ISO-XHE-XM-LOIAS CSS-XHE-XM-ERROR1 5.2E-012 7.67 /SRV MFW-XHE-XO-ERROR IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 5.2E-012 7.67 /SRV IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 ISO-XHE-XM-ERROR 2.6E-012 3.83 /SRV IAS-SYS-FC-LORBC ISO-XHE-XM-LOIAS CSS-XHE-XM-ERROR Event Tree: LORBC CCDF: 2.1E-011 Sequence: 34-20 CCDF  % Cut Set Cut Set Events 2.0E-011 93.22 PPR-SRV-OO-1VLV IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 9.8E-013 4.66 PPR-SRV-OO-1VLV IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR Event Tree: LORBC CCDF: 8.6E-012 Sequence: 35-12 CCDF  % Cut Set Cut Set Events 6.9E-012 79.81 PPR-SRV-OO-2VLVS IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 1.2E-012 13.51 PPR-SRV-OO-3VLVS IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 3.4E-013 3.99 PPR-SRV-OO-2VLVS IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR Event Tree: MLOCA CCDF: 4.9E-012 Sequence: 15 CCDF  % Cut Set Cut Set Events 4.6E-012 93.28 IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 2.3E-013 4.66 IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR Notes:

1. See Table 4 for definitions and probabilities for the basic events.

2. Total Importance includes all cut sets (including those not shown in this table).

12

INSPECTION REPORT 220/03-003 Table 4. Definitions and probabilities for modified or dominant basic events.

BASIC EVENT CHANGES Event Name Description Base Prob Curr Prob Type CDS-MDP-CF-PUMPS CONDENSATE PUMPS FAIL FROM C +0.0E+000 1.0E+000 TRUE IE-LORBC LOSS OF RBCCW 9.0E-007 5.3E-006 IE-SLOCA SMALL LOSS OF COOLANT ACCIDE 1.1E-007 3.4E-007 LORBC LOSS OF RBCCW +0.0E+000 1.0E+000 TRUE PCS-MOV-OC-STEAM STEAM LOOP VALVES FAIL TO RE 3.1E-002 1.0E+000 TRUE SDC-HTX-CF-PLUG COMMON CAUSE PLUGGING OF SDC +0.0E+000 1.0E+000 TRUE BASIC EVENT THAT ARE NOT CHANGED Event Name Description Base Prob Curr Prob Type CSS-XHE-XM-ERROR OPERATOR FAILS TO START/CONTROL CONTAINMENT S 5.0E-004 CSS-XHE-XM-ERROR1 OPERATOR FAILS TO RECOVER CSS FOLLOWING LOIAS 1.0E-002 CVS-XHE-XM-VENT1 OPERATOR FAILS TO VENT CONTAINMENT 1.4E-001 IAS-SYS-FC-LORBC INSTRUMENT AIR FAILS AS A RESULT OF LOSS OF R 1.0E-001 IE-SLOCA-NOREC OPERATOR FAILS TO RECOVER SLOCA IN SHORT TERM 1.0E+000 ISO-XHE-XM-ERROR OPERATOR FAILS TO CONTROL ISOLATION CONDENSER 1.0E-003 ISO-XHE-XM-LOIAS OPERATOR FAILS TO RECOVER ISOLATION CONDENSER 1.0E-002 MFW-XHE-XO-ERROR OPERATOR FAILS TO START/CONTROL FEEDWATER INJ 1.0E-003 PPR-SRV-OO-1VLV ONE SRV STICKS OPEN 3.7E-003 PPR-SRV-OO-2VLVS TWO SRVS STICK OPEN 1.3E-003 PPR-SRV-OO-3VLVS THREE OR MORE SRVS STICK OPEN 2.2E-004 SRV SRV'S CLOSE 5.2E-003 13

INSPECTION REPORT 220/03-003 Figure 1. IE-LORBC Event Tree LOSS OF RE ACTOR SRV'S PO WER ISOLATION FE EDWAT ER MANUA L CRD CONDENSA TE CORE ALTE RNA TE S UP PRESS ION M ANUA L SHUTDOWN CONTA INMENT CONTA INMENT CRD LONG-T ERM RB CCW PROTECTI ON CLOSE CONV ERSI ON CONDE NS ER RE ACTOR INJE CT ION SP RA Y LOW PRESS P OOL (TORUS ) REA CT OR COOLI NG SPRAY VE NTI NG INJECTION LOW PRESS SY STEM SY STE M DE PRESS (2 PUMP) I NJECTIO N COOLING DEP RE SS (1 PUMP ) I NJECTIO N IE -LORBC RP S SRV PCS ISO M FW DE P CRD CDS LCS VA S PC DEP SDC CS S CV S CR1 V A1 # STA TE NOTE S 1 OK 2 OK 3 OK 4 OK 5 OK 6 OK 7 CD 8 OK 9 OK 10 CD 11 OK 12 OK 13 OK 14 OK 15 CD 16 OK 17 OK 18 OK 19 OK 20 OK 21 CD 22 CD 23 OK 24 OK 25 OK 26 OK 27 CD 28 CD 29 OK 1 30 OK 1 31 OK 1 32 CD 1 33 CD 1 P1 T34 TRAN-1 P2 T35 TRAN-2 T36 ATWS LORBC - LOSS OF REACTOR BUILDING CLOSED COOLING WATER 2004/11/05 14

INSPECTION REPORT 220/03-003 Figure 2. SLOCA Event Tree SMALL SHORT REACTOR POWER FEEDWATER MANUAL CORE ALTERNATE SUPPRESSION CONTAINMENT CONTAINMENT LONG-TERM LOCA TERM SHUTDOWN CONVERSION REACTOR SPRAY LOW PRESS POOL (TORUS) SPRAY VENTING LOW PRESS RECOVERY SYSTEM DEPRESS INJECTION COOLING INJECTION IE-SLOCA L RPS PCS MFW DEP LCS VA SPC CSS CVS VA1 # ENDSTATE NOTES T1 TRAN 2 OK 3 OK 4 OK 5 CD 6 CD 7 OK 8 OK 9 OK 10 CD 11 CD 12 OK 13 OK 14 OK 15 CD 16 CD 17 OK 18 OK 19 OK 20 CD 21 CD 22 OK 23 OK 24 OK 25 CD 26 CD 27 OK 28 OK 29 OK 30 CD 31 CD 32 CD 33 CD SLOCA - SMALL LOSS-OF-COOLANT ACCIDENT 2002/12/04 15

INSPECTION REPORT 220/03-003 Attachment A Supporting Details for the Analysis Event Dates: between Jan-01-2002 and Dec-31-2004 Docket: 220 Date of Search: Oct-20-2004 Summary of Plant Status The reactor building closed loop cooling (RBCLC) system provides cooling for various reactor auxiliary equipment, as well as balance of plant equipment. Major components supplied by the system included the drywell air coolers, reactor recirculation pump coolers, reactor building equipment drain tank cooler, fuel pool heat exchangers, shutdown cooling system, control room air conditioning equipment, instrument air compressors, and the high pressure injection system (i.e., feedwater pumps, feedwater booster pumps, and condensate pumps). The RBCLC system is a safety-related, risk-significant system that is required to operate during normal plant operations and accident conditions.

In May 2002, and again on December 5 and 12, 2002, the licensee experienced substantial leaks in RBCLC small bore (less than 2" diameter) piping. Following evaluation and analysis of these leaks, the licensee discovered notable and widespread wall thinning in RBCLC piping sections, which were most severe at threaded mechanical connections (where piping thickness was the smallest due to the thread roots). This reduction in wall thickness was ultimately attributed to a combination of general corrosion, flow-assisted corrosion, and galvanic corrosion.

Prior to 2002, there had been numerous additional small bore piping leaks within the RBCLC system at threaded mechanical joints. Repair methods for these leaks varied, and included tightening the connection or fittings, replacing components (such as flow switches), seal welding the threaded connections, and replacing affected pipe sections. Around May 2000, chloride and sulfate concentrations in the RBCLC system were found to be elevated. Near the same time, RBCLC system oxygen levels were found to be significantly below normal levels, and iron particulate levels were high. These parameters indicated an increased corrosion rate, however, efforts to identify the cause and correct the abnormal chemistry parameters were unsuccessful.

The NRC teams review of the event details determined the root and contributing causes for the degraded RBCLC piping included: inadequate system design, inadequate corrective actions, and degraded RBCLC system water chemistry. Subsequent to the December 12, 2002, leak, several immediate corrective actions were implemented, including extensive RBCLC small bore piping and fitting replacement with improved piping material and design. Longer term similar actions were also in progress for the remaining RBCLC piping sections that had not been replaced. In addition, the licensee was continuing their efforts to determine the cause and corrective actions for the unexpected and unexplained chemistry parameters. The performance deficiency was the failure, prior to December 12, 2002, to determine the cause of a significant condition adverse to quality and implement appropriate corrective actions to prevent further degradation of the RBCLC system. The NRC team determined that the licensees structural analysis did not provide evidence that the as-found condition of the degraded piping in the RBCLC system retained sufficient strength, and consequently, the structural integrity of the affected RBCLC system piping may not have been maintained when subjected to design loading conditions. The safety significance of the inspection finding, based on the increase in core damage frequency due to internal and external initiating events, was determined to be White, which represents a finding of low to moderate safety significance.

16

INSPECTION REPORT 220/03-003

Subject:

Nine Mile Point Unit 1, Special Inspection Report 220/03-003 Condition assessment of degraded piping in Reactor Building Closed Loop Cooling (RBCLC).

Treated as condition assessment for 1 year from date of completion (March 7, 2003) of NRC Special Inspection Report 220/03-003.

From March 7, 2002 to March 7, 2003, there were three shutdowns from power operation to repair leaks in the RBCLC piping and this extensive number of shutdowns caused the NRC Special Inspection. Other than these three shutdowns, the unit was operating at power over the entire period - no other shutdowns except for RBCLC leaks.

1. May 14 to May 19. Repaired two RBCLC leaks.

2. Dec 5 to December 11. Repaired one RBCLC leak.

3. Dec 13 to December 24. Repaired one RBCLC leak.

The degradation in piping appears to have been extensive. From the Special Inspection Report - The removed section of the pipe was visually examined by the inspection team to assess the material condition.

The removed section indicated a highly corroded piping section with missing thread root. Even where the material was not missing, a flashlight illumination indicated a material ligament so thin that it appeared nearly translucent. The team also learned that a full section of the pipe was able to be broken apart manually following removal by maintenance personnel.

Increased frequency for IE-LORBC From the SERP Worksheet for SDP-Related Finding at Nine Mile Point 1 Degraded RBCLC Piping Issue -

Assumptions: #2 The RBCLC system piping was significantly degraded and lacked adequate structural integrity. Therefore, the dominant failure mode of the RBCLC system involved a passive failure of the piping which resulted in an increase in the likelihood of a loss of RBCLC initiating event. The initiating event frequency was determined by taking into account the existing failure modes of the system (8.3E-3 per year),

the lack of structural integrity of the piping, the numerous leaks from the RBCLC piping over the years (between 1 and 5 per year), and the likelihood of a leak before break in the piping (100 to 1).

For the ASP analysis, the increase in the IE-LORBC frequency of pipe break = (4 leaks/year) x (1 year/8760 hours) x (1/100 based on leak before break) = 4.6E-6 breaks per hour.

Induced pipe break Loss coolant accidents result in drywell temperatures that induce thermal stresses in the RBCLC piping in excess of the structural capability of the piping. Therefore, a conditional failure probability of 1.0 for the RBCLC system is used in these events.

In effect, LOCAs and SBO would induce a pipe break in the RBCLC system inside containment that would be equivalent to IE-LORBC.

Recovery from pipe break in RBCLC The Special Inspection Report indicated Assumptions: #5 Failure of the RBCLC piping would result in system leakage in excess of the automatic makeup capability for the system. Consequently, the RBCLC expansion tank level would be lost and the operating RBCLC pumps would fail due to inadequate net positive suction head (NPSH).

The ABS analysis did not include any recovery from a pipe break in RBCLC. Recovery of the RBCLC system is not credited because under certain entry conditions, Annunciator Response Procedure N1-ARP-H1, Control Room Panel H1, directed the starting of the standby RBCLC pump; and Annunciator Response Procedure N1-ARP-H1, Special Operating Procedure N1-SOP-8. RBCLC Failure, and Operating Procedure N1`-OP-11, 17

INSPECTION REPORT 220/03-003 Reactor Building Closed Loop Cooling System, did not provide guidance to secure the operating RBCLC pumps when inadequate NPSH existed. Also, no procedural guidance existed to isolate a RBCLC leak and recover the RBCLC system.

Reactor Recirculation Pump Seals The Special Inspection Report indicated, Failure of the RBCLC piping would result in the inability to remove heat from the recirculation pump seals. Without cooling, the likelihood of a recirculation pump seal leak increased substantially. Therefore, the team used a seal failure probability of 0.5, which was based on the licensees recirculation pump seal package test results.

In effect, some initiating events (IE-LORBC, IE-SLOCA, IE-MLOCA, IE-LLOCA) would cause a small LOCA from the reactor recirculation pump seals. The condition assessment made changes to the IE-LORBC analysis to consider the impact of this induced leakage.

The base SPAR Revision 3.01 model sets the following three basic events to 1.0 for IE-LORBC by the use of project rules (see the flag file in Figure 1):

CDS-MDP-CF-PUMPS Condensate pumps fail from common cause to run PCS-MOV-OC-STEAM Steam LOOP valves fail to remain open SDC-HTX-CF-PLUG Common cause plugging of shutdown cooling heat exchanger These three basic events are set to 1.0 for IE-SLOCA, IE-MLOCA, and IE-LOCA.

Moreover, 50% of the IE-LORBC frequency is assigned to RCP seal leak. Then, credit is given for proceduralized RCP seal leakage isolation with 90% success. The failures are assigned to IE-SLOCA frequency (by simply adding it to the IE-SLOCA frequency, to account for the seal LOCAs.)

How the Base and Conditional Runs are made:

The base case is run with all initiating event frequencies set equal to zero, except for LORBC, SLOCA, MLOCA, and LOCA.

The conditional case is run with the same initiating event frequencies, except LORBC and SLOCA frequencies are modified. Moreover, the effect of RORBC in LOCA events is reflected by setting other basic events to failure (true). This is done by defining a change set named IE-BC. The contents of this change set are shown in Figure 2.

Overlapping events during year of the condition assessment The 12 control rod drive pump failed to start during a routine surveillance test on October 17, 2002. Pump was determined to be unavailable from 9/24/02 to 10/19/03 (390) hours). LER 220/02-002 and NRC Integrated Inspection Report 220/03-004. As a stand-alone event, this event was rejected as a precursor as part of the Accident Sequence Precursor Program.

For a period of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> on 11/1/02, during maintenance on offsite-power lines to Unit 1, it was determined that it was possible that if Unit 1 tripped during these 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, a LOOP would be induced for Unit 1 as a consequence of the trip. LER 220/02-001 and NRC Integrated Inspection Report 220/03-004. As a stand-alone event, this event was rejected as a precursor based on extensive analysis as part of the Accident Sequence Precursor Program.

For the entire year, it was determined that an HPCI interlock would have prevented the use of the condensate pumps as a separate injection source to the reactor following failure of the reactor feedwater pumps. The bypass of the HPCI interlock was not included in the procedures used to inject water into the reactor vessel following failure of the reactor feedwater pumps. NRC Integrated Inspection Report 220/03-005.

18

INSPECTION REPORT 220/03-003 LER Number Event Date Plant Title 2202002001 11/01/2002 Nine Mile Pt 1 115 Kilovolt Offsite Power Inoperable Due to Low Voltage on Line 4 and Line 1 Out of Service 2202002002 10/17/2002 Nine Mile Pt 1 Loss of One Control Rod Drive Pump Train Due to Circuit Breaker failure 2202002003 12/02/2002 Nine Mile Pt 1 Loss of Power to Reactor Protection System (RPS) Bus 12 While RPS Bus 11 Emergency Power Source Was Inoperable Search Restrictions:

Status: Active, Canceled, Restricted Event Dates: between Jan-01-2002 and Mar-08-2003 Docket: 220 Date of Search: Jul-07-2004 LER Search for Windowed Events Nine Mile Pt 1 LER Number Event Date Event Description 2202002001 11/01/2002 115 Kilovolt Offsite Power Inoperable Due to Low Voltage on Line 4 and Line 1 Out of Service 2202002002 10/17/2002 Loss of One Control Rod Drive Pump Train Due to Circuit Breaker failure 2202002003 12/02/2002 Loss of Power to Reactor Protection System (RPS) Bus 12 While RPS Bus 11 Emergency Power Source Was Inoperable 2202003001 04/22/2003 Technical Specification Cooldown Rate Exceeded During Required Cooldown for a Failed Solenoid Actuated Pressure Relief Valve 2202003002 08/14/2003 Reactor Scram Due to Electric Grid Disturbance 2202003003 11/13/2003 Automatic Initiation of Emergency Diesel Generator 103 due to Momentary Loss of Offsite Power 2202003004 08/13/2003 Unplanned Inoperability of Emergency Cooling System Caused by Inadequate Review of Clearance for Replacement of Instrumentation Relay 2202004001 05/02/2004 Manual Reactor Scram and Cooldown Rate Exceeding Technical Specification Limits Due to Electromatic Relief Valve Failure to Close 2202004002 05/14/2004 Changes and Errors in the Methodology Used by General Electric and Global Nuclear Fuel to Demonstrate Compliance with Emergency Core Cooling System Performance Requirements 2202004003 02/25/2003 Inadequate Environmental Qualification Barrier Considerations Resulting in an Unanalyzed Condition Search Restrictions:

Status: Active, Canceled, Restricted Event Dates: between Jan-01-2002 and Dec-31-2004 Docket: 220 Date of Search: Oct-20-2004 19

INSPECTION REPORT 220/03-003 Figure 1 Flag File for LORBC in the Base SPAR Model 20

INSPECTION REPORT 220/03-003 Figure 2. Basic events in Change Set LORBC used for Conditional Case 21

Nine Mile Point ASP Analysis OERAB ASP ANALYSIS Summary Sheet 1 Plant Nine Mile Point 1 (BWR) 2 Docket # 05 000 220 3 Event Degraded piping in the reactor building closed loop cooling (RBCLC) system. The failure to adequately identify and evaluate equipment problems, and correct deficiencies, resulted in repetitive and continued degraded piping conditions in the RBCLC system.

Specifically, a RBCLC system piping leak occurred on May 15, 2002, due to significant pipe corrosion, primarily as a result of inadequate piping design, application and operation. Additionally, numerous RBCLC system leaks occurred during several preceding years. However, the cause for these leaks was not determined and appropriate corrective actions were not implemented. This led to further degradation of the RBCLC system piping such that additional significant leaks occurred on December 5, 2002, and again on December 12, 2002. These significant leaks in December 2002 were accompanied by a significant reduction in the pipe wall which degraded the structural integrity of the affected piping sections.

4 Event Date May 15, 2002, December 5, 2002, December 12, 2002 5 Auto Reactor Trip No reactor trip occurred. This is a plant condition with recurrent degraded RBCLC piping. The condition caused plant to shutdown from power operation to repair leaks.

6 LER # No LER 7 SDP Worksheet EAW-03-053 March 18, 2003 8 Inspection Report 50-220/2003-003 EA-03-053 April 15, 2003 9 SDP Finding White 10 Reason for Fast There is no reason for fast rejection since multiple safety systems Rejection of Event supported by RBCLC may be affected.

11 Preliminary ASP ASP analysis by ABS indicated that consequential small LOCA due to Analysis pump seal leakage dominates the risk with a event importance in the 10-E-5 range. Also, the SDP analysis uses SPAR models, and considers external, as well as internal events. The results of the SDP analysis for a 1-year exposure time is )CDF = 5.3E-06/year. Since these two results do not match, the ASP analysis is performed and documented in the main body of this document.

12 Contribution from Studied in SDP. Not a contributor to conclusions.

External Events 13 Contribution from Not relevant.

Shutdown Events 22

Nine Mile Point ASP Analysis 14 LERF Not an issue.

Considerations 15 Windowed Events 3 LERs are found:

LER Number Event Date Plant Title 2202002001 11/01/2002 Nine Mile Pt 1 115 Kilovolt Offsite Power Inoperable Due to Low Voltage on Line 4 and Line 1 Out of Service 2202002002 10/17/2002 Nine Mile Pt 1 Loss of One Control Rod Drive Pump Train Due to Circuit Breaker failure 2202002003 12/02/2002 Nine Mile Pt 1 Loss of Power to Reactor Protection System (RPS) Bus 12 While RPS Bus 11 Emergency Power Source Was Inoperable Search Restrictions:

Status: Active, Canceled, Restricted Event Dates: between Jan-01-2002 and Mar-08-2003 Docket: 220 Date of Search: Jul-07-2004 16 Recommendation Classify event as qualifying for ASP database with a delta CDP in the range of 3E-05.

23

Nine Mile Point ASP Analysis Attachment B SDP Phase 3 Analysis Internal Initiating Events:

The NRCs Standardized Plant Analysis Risk (SPAR) model, Revision 3.01, was used to evaluate the significance of this finding. The analyst determined that the SPAR model needed to be revised to link the loss of RBCLC event tree and the anticipated transient without scram (ATWS) event tree and to reflect the possibility of a recirculation pump seal leak following the loss of the RBCLC system. This revision resulted in an increase in the baseline core damage frequency from 7.88E-6 per year to 7.91E-6 per year.

Assumptions:

1. The performance deficiency existed for in excess of a year. Therefore, the analyst used an exposure time of 1 year.

2. The RBCLC system piping was significantly degraded and lacked adequate structural integrity. Therefore, the dominant failure mode of the RBCLC system involved a passive failure of the piping which resulted in an increase in the likelihood of a loss of RBCLC initiating event. The initiating event frequency was determined by taking into account the existing failure modes of the system (8.3E-3 per year), the lack of structural integrity of the piping, the numerous leaks from the RBCLC piping over the years (between 1 and 5 per year), and the likelihood of a leak before break in the piping (100 to 1). Applying engineering judgement, the team concluded that the loss of RBCLC initiating event frequency was approximately 5.0E-2 per year.

3. Loss of coolant accidents and SBO events result in drywell temperatures that induce thermal stresses in the RBCLC piping in excess of the structural capability of the piping. Therefore, the analyst used a conditional failure probability of 1.0 for the RBCLC system in these events.

4. Failure of the RBCLC piping would result in the inability to remove heat from the recirculation pump seals.

Without cooling, the likelihood of a recirculation pump seal leak increased substantially. Therefore, the analyst used a seal failure probability of 0.5, which was based on the licensees recirculation pump seal package test results.

5. Failure of the RBCLC piping would result in system leakage in excess of the automatic makeup capability for the system. Consequently, the RBCLC expansion tank level would be lost and the operating RBCLC pumps would fail due to inadequate net positive suction head (NPSH). The analyst did not credit recovery of the RBCLC system because under certain entry conditions, Annunciator Response Procedure N1-ARP-H1, Control Room Panel H1, directed the starting of the standby RBCLC pump; and Annunciator Response Procedure N1-ARP-H1, Special Operating Procedure N1-SOP-8, RBCLC Failure, and Operating Procedure N1-OP-11, Reactor Building Closed Loop Cooling System, did not provide guidance to secure the operating RBCLC pumps when inadequate NPSH existed. Also, no procedural guidance existed to isolate an RBCLC leak and recover the RBCLC system. In addition, because each of the dominant accident sequences involved the failure of operator actions prior to when RBCLC would have been recovered, the likelihood of the failure of the operators to recover RBCLC would be dependent on those prior failures. Consequently, the analyst considered the likelihood of the operators failure to recover the RBCLC system too high to credit.

The analyst revised the SPAR model to reflect these assumptions, determined a revised core damage frequency for the exposure period (1.32E-5 per year) and calculated the change in core damage frequency (

CDF) for this finding due to internal initiating events.

CDF = [(1.32E-5 per year) - (7.91E-6 per year)] = 5.29E-6 per year (White) 24

Nine Mile Point ASP Analysis Attachment C GEM Output for the Analysis C O N D I T I O N A S S E S S M E N T Code Version: 7:24 Model Version  : 1998/09/03 Project  : NMP1_3I Duration (hrs)  : 8.8E+003 User Name  : Total CCDP  : 4.4E-006 Event ID  : IE-LORBC Total CDP  : 2.3E-007 Importance  : 4.2E-006 Description : Condition Assessment BASIC EVENT CHANGES Event Name Description Base Prob Curr Prob Type CDS-MDP-CF-PUMPS CONDENSATE PUMPS FAIL FROM C +0.0E+000 1.0E+000 TRUE IE-LORBC LOSS OF RBCCW 9.0E-007 5.3E-006 IE-SLOCA SMALL LOSS OF COOLANT ACCIDE 1.1E-007 3.4E-007 LORBC LOSS OF RBCCW +0.0E+000 1.0E+000 TRUE PCS-MOV-OC-STEAM STEAM LOOP VALVES FAIL TO RE 3.1E-002 1.0E+000 TRUE SDC-HTX-CF-PLUG COMMON CAUSE PLUGGING OF SDC +0.0E+000 1.0E+000 TRUE SEQUENCE PROBABILITIES Truncation : Cumulative : 100.0% Individual : 1.0%

Event Tree Name Sequence Name CCDP CDP Importance SLOCA 26 3.4E-006 +0.0E+000 3.4E-006 LORBC 22 6.0E-007 1.0E-007 5.0E-007 LORBC 34-20 1.8E-007 3.1E-008 1.5E-007 LORBC 35-12 7.5E-008 1.3E-008 6.2E-008 MLOCA 15 4.3E-008 +0.0E+000 4.3E-008 NEGATIVE SEQUENCE PROBABILITIES Truncation : Cummulative : 100.0% Individual : 1.0%

Event Tree Name Sequence Name CCDP CDP Importance SLOCA 06 +0.0E+000 6.8E-008 -6.8E-008 SLOCA 05 +0.0E+000 6.3E-009 -6.3E-009 MLOCA 10 +0.0E+000 2.1E-009 -2.1E-009 SLOCA 16 +0.0E+000 2.1E-009 -2.1E-009 NOTE: Percent contribution to total Importance.

SEQUENCE LOGIC Event Tree Sequence Name Logic SLOCA 26 L /RPS 2005/03/14 12:25:33 page 1 25

Nine Mile Point ASP Analysis PCS MFW

/DEP /LCS SPC CSS CVS LORBC 22 /RPS /SRV PCS ISO MFW /DEP CDS /LCS SPC SDC CSS CVS LORBC 34-20 /RPS P1 MFW /DEP CDS /LCS SPC SDC CSS CVS LORBC 35-12 /RPS P2 CDS /LCS SPC SDC CSS CVS MLOCA 15 /RPS /VSS MFW /DEP

/LCS SPC CSS CVS SLOCA 16 L /RPS PCS /MFW

/LCS SPC CSS CVS MLOCA 10 /RPS /VSS

/MFW LCS VA SLOCA 05 L /RPS

/PCS /LCS SPC CSS

/CVS VA1 SLOCA 06 L /RPS

/PCS /LCS SPC CSS CVS Fault Tree Name Description CDS CONDENSATE CSS CONTAINMENT SPRAY 2005/03/14 12:25:33 page 2 26

Nine Mile Point ASP Analysis CVS CONTAINMENT VENTING DEP MANUAL REACTOR DEPRESS ISO ISOLATION CONDENSER L OPERATOR FAILS TO RECOVER SLOCA IN SHORT TERM LCS CORE SPRAY MFW FEEDWATER P1 ONE SRV FAILS TO CLOSE P2 TWO SRVS FAIL TO CLOSE PCS POWER CONVERSION SYSTEM RPS REACTOR PROTECTION SYSTEM SDC SHUTDOWN COOLING SPC SUPPRESSION POOL (TORUS) COOLING SRV SRV'S CLOSE VA ALTERNATE LOW PRESS INJECTION VA1 LONG-TERM LOW PRESS INJECTION VSS VAPOR SUPPRESSION SEQUENCE CUT SETS Truncation: Cummulative: 100.0% Individual: 1.0%

Event Tree: SLOCA CCDF: 3.8E-010 Sequence: 26 CCDF  % Cut Set Cut Set Events 3.4E-010 87.52 IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 IE-SLOCA-NOREC 2.4E-011 6.13 IE-SLOCA-NOREC CSS-XHE-XM-ERROR CVS-XHE-XM-VENT1 1.7E-011 4.38 IAS-SYS-FC-LORBC IE-SLOCA-NOREC CSS-XHE-XM-ERROR Event Tree: LORBC CCDF: 6.8E-011 Sequence: 22 CCDF  % Cut Set Cut Set Events 5.2E-011 76.66 /SRV IAS-SYS-FC-LORBC ISO-XHE-XM-LOIAS CSS-XHE-XM-ERROR1 5.2E-012 7.67 /SRV MFW-XHE-XO-ERROR IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 5.2E-012 7.67 /SRV IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 ISO-XHE-XM-ERROR 2.6E-012 3.83 /SRV IAS-SYS-FC-LORBC ISO-XHE-XM-LOIAS CSS-XHE-XM-ERROR 2005/03/14 12:25:33 page 3 27

Nine Mile Point ASP Analysis Event Tree: LORBC CCDF: 2.1E-011 Sequence: 34-20 CCDF  % Cut Set Cut Set Events 2.0E-011 93.22 PPR-SRV-OO-1VLV IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 9.8E-013 4.66 PPR-SRV-OO-1VLV IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR Event Tree: LORBC CCDF: 8.6E-012 Sequence: 35-12 CCDF  % Cut Set Cut Set Events 6.9E-012 79.81 PPR-SRV-OO-2VLVS IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 1.2E-012 13.51 PPR-SRV-OO-3VLVS IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 3.4E-013 3.99 PPR-SRV-OO-2VLVS IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR Event Tree: MLOCA CCDF: 4.9E-012 Sequence: 15 CCDF  % Cut Set Cut Set Events 4.6E-012 93.28 IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR1 2.3E-013 4.66 IAS-SYS-FC-LORBC CSS-XHE-XM-ERROR Event Tree: SLOCA CCDF: +0.0E+000 Sequence: 16 CCDF  % Cut Set Cut Set Events

+0.0E+000 100.00 <FALSE>

Event Tree: MLOCA CCDF: +0.0E+000 Sequence: 10 CCDF  % Cut Set Cut Set Events

+0.0E+000 100.00 <FALSE>

Event Tree: SLOCA CCDF: +0.0E+000 Sequence: 05 CCDF  % Cut Set Cut Set Events

+0.0E+000 100.00 <FALSE>

2005/03/14 12:25:33 page 4 28

Nine Mile Point ASP Analysis Event Tree: SLOCA CCDF: +0.0E+000 Sequence: 06 CCDF  % Cut Set Cut Set Events

+0.0E+000 100.00 <FALSE>

BASIC EVENTS (Cut Sets Only)

Event Name Description Curr Prob

<FALSE> SYSTEM GENERATED SUCCESS EVENT +0.0E+000 CSS-XHE-XM-ERROR OPERATOR FAILS TO START/CONTROL CONTAINMENT S 5.0E-004 CSS-XHE-XM-ERROR1 OPERATOR FAILS TO RECOVER CSS FOLLOWING LOIAS 1.0E-002 CVS-XHE-XM-VENT1 OPERATOR FAILS TO VENT CONTAINMENT 1.4E-001 IAS-SYS-FC-LORBC INSTRUMENT AIR FAILS AS A RESULT OF LOSS OF R 1.0E-001 IE-SLOCA-NOREC OPERATOR FAILS TO RECOVER SLOCA IN SHORT TERM 1.0E+000 ISO-XHE-XM-ERROR OPERATOR FAILS TO CONTROL ISOLATION CONDENSER 1.0E-003 ISO-XHE-XM-LOIAS OPERATOR FAILS TO RECOVER ISOLATION CONDENSER 1.0E-002 MFW-XHE-XO-ERROR OPERATOR FAILS TO START/CONTROL FEEDWATER INJ 1.0E-003 PPR-SRV-OO-1VLV ONE SRV STICKS OPEN 3.7E-003 PPR-SRV-OO-2VLVS TWO SRVS STICK OPEN 1.3E-003 PPR-SRV-OO-3VLVS THREE OR MORE SRVS STICK OPEN 2.2E-004 SRV SRV'S CLOSE 5.2E-003 2005/03/14 12:25:33 page 5 29