ML053060324
| ML053060324 | |
| Person / Time | |
|---|---|
| Site: | Vermont Yankee  |
| Issue date: | 10/26/2005 |
| From: | Favara J, Hong K, Palionis M, Yeh C Entergy Nuclear Northeast |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| %dam200601 VY-RPT-05-00110, Rev 0 | |
| Download: ML053060324 (303) | |
Text
- -
Engineering Report No. VY-RPT-05-001 R0 Rev. 0 Page 1 Of 303
- Enrfflgy ENTERGY NUCLEAR NORTHEAST Engineering Report Cover Sheet Engineering Report
Title:
VY PSA Model - Evaluation of Containment Overpressure (COP)
Engineering Report Type:
New El Revision E Cancelled El Superseded E Applicable Site(s)
IPN El IP2 El IP3 El JAF El PNPS El VY 0 Quality-Related: E Yes 0 No Prepared by: Mark E. Palonis r-&_ -- Date: 10126/2005 Responsible Engineer Prepared by: Kou-John Hong A ;z / 4 Date: 1012612005 Responsible Engineer Verifiedl Reviewed by: John A. Favara g o~2 ,'i? 2 Date: 1012612005 Desig erifier/Reviewer Approved by: Clem Yeh 6og Date: 1012612005 Supervisor Multiple Site Review Site [ Design Verifier/Reviewer I Supervisor I Date t 1 I fl L
,'/
RECORD OF REVISIONS Engineering Report No. VY-RPT-05-00000 Page 2 of 303 Revision No. Description of Change Reason For Change 0 Original report NA
_ _ I.___ I ____
I Engineering Report II Entergy REPORTNo.VY-RPT-05-0011 l Revision 0 Page 3 l of 1303 TABLE OF CONTENTS DESCRIPTION PAGE EXECUTIVE
SUMMARY
6 DEFINITIONS ................ ............................................................................................................................... 8 .
SECTION 1 INTRODI LJCTION 10 1.1. PURPOSE ............ ........................................................................................................................ 10 1.2. BACKGRC reI UI 1.1n U............................................................................................................................ 10 1.3. VERMONT YANKEE PROBABILISTIC SAFETY ASSESSMENT QUALITY .................................................. 11 SECTIC)N 2 EVALUATION 12 2.1. METHOD OF ANALYSIS .12 2.1.1. GENERAL .12 2.1.2. MODIFICATION OF THE VY PSA MODEL .12 2.2. FAULT TREE ANALYSIS .13 2.2.1. CONTAINMENT VENTING - ToP EVENT (VT) .13 2.2.2. PRIMARY CONTAINMENT INTEGRITY-TOP EVENT (IP) .13 2.2.3. ALTERNATE INJECTION & COP CONTROL-ToP EVENT (Al)......................................................... 14 2.3. EVENT TREE ANALYSIS .14 2.3.1. TRANSIENTS-EVENT TREE (TRANSIENT) .14 2.3.2. ANTICIPATED TRANSIENTS WlO SCRAM - EVENT TREE (ATWS) .15 2.3.3. LARGE LOCA-EVENT TREE (LOCALG) .15 2.3.4. MEDIUM LOCA -EVENT TREE (LOCAMD) .15 2.3.5. SMALL LOCA - EVENT TREE (LOCA SM)................................................................................. 16 2.3.6. INTERNAL FLOODINb - EVENT TREE (FLOODS) .16 SECTIC IN3
SUMMARY
OF RESULTS 18 3.1. CORE DAMAGE .18 3.2. RADIOLOGICAL RELEASE .18 3.3. PARAMETRIC UNCERTAINTY ANALYSIS .19 3.3.1. SOURCES AND TREATMENT OF UNCERTAINTY .19 3.3.2. QUANTIFICATION OF UNCERTAINTY .19 3.3.3. RESULTS OF UNCERTAINTY ANALYSIS .20 3.4. MODELING UNCERTAINTY ANALYSIS .20 3.4.1. PRE-EXISTING CONTAINMENT LEAKAGE (ISDWSMLEAK) .20
3.5. COMPLETENESS UNCERTAINTY ANALYSIS.
3.5.1. SEISMIC ............................................. .............................................................................................-
3.5.2. INTERNAL FIRES.................................. .................................................................................................................-. ...
3.5.3. OTHER EXTERNAL HAZARDS ................ ........................................................................................
3.5.4. SHUTDOWN RISK................................ ............................................
I.................................................................................................. of SECTION 4 CONCLUSIONS 35 4.1. ACCEPTABILITY OF CHANGE .................... . . . . . . . .. . . . . . . . . .. . . . . . . . . . . . . . . . . .. . . . . 35 ...
SECTION 5 REFERENCES 39 LIST OF ATTACHMENTS ATTACHMENT A TOP EVENT (VT) .................. 41 ATTACHMENT B TOP EVENT (IP) .................. 50 ATTACHMENT C TOP EVENT (Al)............................................................................................................. 77 ATTACHMENT D EVENT TREE (TRANSIENT)......................................................................................... 111 ATTACHMENT E EVENT TREE (ATWS) .................. 141 ATTACHMENT F EVENT TREE (LOCA ..LG) .................. 175 ATTACHMENT G EVENT TREE (LOCA_MD) .................. 191 ATTACHMENT H EVENT TREE (LOCASM) .................. 214 ATTACHMENT I EVENT TREE (FLOODS) .................. 239 ATTACHMENT J PRA QUALITY .................. 280
LIST OF Figures FIGURE 2.1 ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQUENCY 17 FIGURE 2.2 ACCEPTANCE GUIDELINES FOR LARGE EARLY RELEASE FREQUENCY 17 FIGURE 3.1 PRE-EXISTING CONTAINMENT LEAKAGE VS. CDF (MODEL VYCOP2) 21 LIST OF TABLES TABLE 3.1 SENSITIVITY CASES FOR ISDWSMLEAK 21 TABLE 3.2A BIN TOTALS FOR SEQUENCE GROUP = ALL 24 TABLE 3.2B BIN TOTALS FOR SEQUENCE GROUP = CDIPEV 25 TABLE 3.2C BIN TOTALS FOR SEQUENCE GROUP = FLOODS 26 TABLE 3.3 ACCIDENT TYPES AND THEIR CONTRIBUTION TO CDF 27 TABLE 3.4 LOCAS AND THEIR CONTRIBUTION TO CDF 27 TABLE 3.5A CONFIG#I CDF (I/RY) UNCERTAINTY 28 TABLE 3.5B CONFIG#2 CDF (I/RY) UNCERTAINTY 28 TABLE 3.6A MONTE CARLO SAMPLING RESULTS FOR THE CONFIG#1 29 TABLE 3.6B MONTE CARLO SAMPLING RESULTS FOR THE CONFIG#I 30 TABLE 3.6C MONTE CARLO SAMPLING RESULTS FOR THE CONFIG#I 31 TABLE 3.7A MONTE CARLO SAMPLING RESULTS FOR THE CONFIG#2 32 TABLE 3.7B MONTE CARLO SAMPLING RESULTS FOR THE CONFIG#2 33 TABLE 3.7C MONTE CARLO SAMPLING RESULTS FOR THE CONFIG#2 34 TABLE 4.3A SPLIT FRACTION SEQUENCES - CONFIG#I (BIN = IC) 36 TABLE 4.3B SPLIT FRACTION SEQUENCES - CONFIG#I (BIN= IIIC) 36 TABLE 4.4A SPLIT FRACTION SEQUENCES - CONFIG#2 (BIN = IC) 37 TABLE 4.4B SPLIT FRACTION SEQUENCES - CONFIG#2 (BIN = IIIC) 37 J'
EXECUTIVE
SUMMARY
The document reports on the risk impact assessment of the proposed licensing basis change to credit containment accident pressure (containment overpressure) to satisfy the net positive suction head (NPSH) requirements for RHR and Core Spray pumps.
A revision to Regulatory Guide 1.82 Rev. 3 allows individual plants to credit containment overpressure to ensure adequate NPSH. In performing the risk assessment evaluation the NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-informed Decisions on Plant-Specific Changes to the Licensing Basis" (RG 1.174) is used.
The risk assessment evaluation uses the current Vermont Yankee (VY) Probabilistic Safety Assessment (PSA) internal events model (i.e., transients, LOCAs, and internal flooding) that includes a Level 2 analysis of core damage scenarios and subsequent containment response resulting in various fission product releases. The Vermont Yankee Level 1 and Level 2 PSAs provide the necessary and sufficient scope and level of detail to allow the calculation of Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) changes due to the risk assessment crediting the use of containment overpressure to satisfy the NPSH requirements for the RHR system and Core Spray system emergency core cooling pumps.
The risk assessment evaluation examined VY PSA plant specific accident sequences in which the containment integrity is necessary for success of the RHR system and Core Spray system emergency core cooling pumps.
The steps taken to perform this risk assessment evaluation are as follows:
- 1) Modify the VY PSA Containment Isolation System fault tree to reflect the latest probability on the occurrence of pre-existing containment leakage.
- 2) Revise the appropriate event trees to reflect the Impact of containment overpressure on NPSH requirements.
- 3) Perform an uncertainty analysis on a number of important basic events associated with the containment overpressure modeling changes used in this risk assessment.
- 4) Characterized the risk assessment evaluation by the following risk metrics:
The change in Core Damage Frequency (CDF)
- The change in Large Early Release Frequency (LERF)
The conclusion of the plant internal events risk associated with this assessment is as follows.
- 1) Regulatory Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting in increases of core damage frequency (CDF) below 10/yr. Based on this criteria, the proposed change (i.e., use of COP to satisfy the net positive suction head (NPSH) requirements for RHR and Core Spray pumps) represents a very small change in CDF (approximately 5.78x1 0-&/ry)
- 2) Regulatory Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting in increases of Large Early Release Frequency (LERF) below 107 /yr. Based on this criteria, the proposed change (i.e.,
use of COP to satisfy the net positive suction head (NPSH) requirements for RHR and Core Spray pumps) represents a very small change in LERF (approximately 4.50x108/ry)
Nomenclature ACRS Advisory Committee on Reactor Safeguards ATWS Anticipated Transient without Scram CDF Core Damage Frequency CET Containment Event Tree Cl Containment Isolation System COP Containment Overpressure DW Drywell ECCS Emergency Core Cooling Systems HEP Human Error Probability HPCI High Pressure Core Injection system HRA Human Reliability Analysis IPE Individual Plant Examination IPEEE Individual Plant Examination for External Events ISLOCA Interface System Loss of Coolant Accident LB Licensing Basis LERF Large Early Release Frequency LNP Loss of Normal Power event LOCA Loss of Coolant Accident LOSP Loss of Offsite Power event LPCI Low Pressure Coolant Injection NPSH Net Positive Suction Head NRC United States Nuclear Regulatory Commission PRA Probabilistic Risk Analysis PSA Probabilistic Safety Assessment RCIC Reactor Core Isolation Cooling System RHR Residual Heat Removal System RPV Reactor Pressure Vessel TS Technical Specifications VDHS Vemon Dam Hydro Station VY Vermont Yankee Nuclear Power Station WW Wetwell
Definitions Accident sequence - a representation in terms of an initiating event followed by a combination of system, function and operator failures or successes, of an accident that can lead to undesired consequences, with a specified end state (e.g., core damage or large early release). An accident sequence may contain many unique variations of events that are similar.
Core damage - uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage is anticipated and involving enough of the core to cause a significant release.
Core damage frequency - expected number of core damage events per unit of time.
End State - is the set of conditions at the end of an event sequence that characterizes the impact of the sequence on the plant or the environment. End states typically include: success states, core damage sequences, plant damage states for Level 1 sequences, and release categories for Level 2 sequences.
Event tree - a quantifiable, logical network that begins with an initiating event or condition and progresses through a series of branches that represent expected system or operator performance that either succeeds or fails and arrives at either a successful or failed end state.
Initiating Event - An initiating event is any event that perturbs the steady state operation of the plant, if operating, or the steady state operation of the decay heat removal systems during shutdown operations such that a transient is initiated in the plant. Initiating events trigger sequences of events that challenge the plant control and safety systems.
ISLOCA - a LOCA when a breach occurs in a system that interfaces with the RCS, where isolation between the breached system and the RCS fails. An ISLOCA is usually characterized by the over-pressurization of a low-pressure system when subjected to RCS pressure and can result in containment bypass Large early release - the rapid, unmitigated release of airborne fission products from the containment to the environment occurring before the effective implementation of off-site emergency response and protective actions.
Large early release frequency - expected number of large early releases per unit of time.
Level 1 - identification and quantification of the sequences of events leading to the onset of core damage.
Level 2 - evaluation of containment response to severe accident challenges and quantification of the mechanisms, amounts, and probabilities of subsequent radioactive material releases from the containment.
LOCAOC - a LOCA Outside of Containment (LOCAOC) is a breach occurs in a system that interfaces with the RCS and bypasses containment, with the potential to impact systems needed for mitigation of such events.
LOCAOC includes breaks in high pressure piping, without the high-to-low pressure interface characteristic of ISLOCA.
Plant damage state - Plant damage states are collections of accident sequence end states according to plant conditions at the onset of severe core damage. The plant conditions considered are those that determine the capability of the containment to cope with a severe core damage accident. The plant damage states represent the interface between the Level I and Level 2 analyses.
Probability - is a numerical measure of a state of knowledge, a degree of belief, or a state of confidence about the outcome of an event.
Probabilistic risk assessment - a qualitative and quantitative assessment of the risk associated with plant operation and maintenance that is measured in terms of frequency of occurrence of risk metrics, such as core damage or a radioactive material release and its effects on the health of the public (also referred to as a probabilistic safety assessment, PSA).
Release category - radiological source term for a given accident sequence that consists of the release fractions for various radionuclide groups (presented as fractions of initial core inventory), and the timing, elevation, and
energy of release. The factors addressed in the definition of the release categories include the response of the containment structure, timing, and mode of containment failure; timing, magnitude, and mix of any releases of radioactive material; thermal energy of release; and key factors affecting deposition and filtration of radionuclides.
Release categories can be considered the end states of the Level 2 portion of a PSA.
Risk - encompasses what can happen (scenario), its likelihood (probability), and its level of damage (consequences).
Risk metrics - the quantitative value, obtained from a PRA analysis, used to evaluate the results of an application (e.g., CDF or LERF).
Severe accident - an accident that involves extensive core damage and fission product release into the reactor vessel and containment, with potential release to the environment.
Split Fraction - a unitless parameter (i.e., probability) used in quantifying an event tree. It represents the fraction of the time that each possible outcome, or branch, of a particular top event may be expected to occur. Split fractions are, in general, conditional on precursor events. At any branch point, the sum of all the split fractions representing possible outcomes should be unity. (Popular usage equates "split fraction" with the failure probability at any branch [a node] in the event tree.)
Vessel Breach - a failure of the reactor vessel occurring during core melt (e.g., at a penetration or due to thermal attack of the vessel bottom head or wall by molten core debris).
SECTION 1 INTRODUCTION 1.1. Purpose The purpose of this analysis isto provide a risk assessment of using containment accident pressure or containment overpressure to satisfy the Net Positive Suction Head (NPSH) requirements for emergency core cooling pumps which take suction from the suppression pool.
1.2. Background The design basis analysis evaluation of NPSH for various pumps used for Emergency Core Cooling and containment heat removal operating at Extended Power Uprate (EPU) conditions determined that NPSH requirements would not be satisfied for the large break LOCA and ATWS events. The difference in available NPSH between current licensed thermal power and EPU is attributed to higher reactor core decay heat during loss-of-coolant accidents (LOCAs), anticipated transient without scram (ATWS) and other transients events, which results in higher Torus pool temperatures. Because elevated Torus pool temperatures reduce available NPSH, a licensing basis change has been requested to credit containment overpressure (COP) to ensure adequate available NPSH for the following emergency core cooling system (ECCS) pumps in the large break LOCA and ATWS events:
- Core Spray (CS) Pumps
- Residual Heat Removal (RHR) Pumps used for Low Pressure Coolant Injection (LPCI)
The Nuclear Regulatory Commission (NRC) has allowed credit for COP to satisfy NPSH requirements in accordance with Regulatory Guide 1.82 (RG 1.82). Specifically, RG 1.82 Position 2.1.1.2 addresses containment overpressure as follows:
OFor certain operating BWRs for which the design cannot be practicably altered conformance with Regulatory Position 2.11. 1.1 may not be possible. In these cases, no additional containment pressure should be included in the determination of available NPSH than is necessary to preclude pump cavitation. Calculation of available containment pressure should underestimate the expected containment pressure when determining available NPSH for this situation. Calculation of suppression pool water temperature should overestimate the expected temperature when determining available NPSH."
The proposed change in the Vermont Yankee (VY) 'License Basis' (LB) crediting COP meets the approved positions of RG 1.82 Rev. 3. Entergy has opted to perform a 'risk-informed' analysis in accordance with NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-informed Decisions on Plant-Specific Changes to the Licensing Basis" (RG 1.174) [Reference 1] to provide justification for crediting COP.
The use of RG 1.174 for risk-informed approach analysis for a proposed License Basis change involves five key elements:
- 1) Meets regulatory requirements
- 2) Consistent with 'defense-in-depth' attributes
- 3) Maintains sufficient safety margins
, Engineering Report Enteroy REPORT No. VY-RPT-05011O l Revision 0 l Page 11 of 3031
- 5) Impact should be monitored using performance measurement strategies This report documents the requirements of element #4. Specifically, the following:
- The impact of containment integrity on NSPH requirements
- Considerations of model uncertainty 1.3. Vermont Yankee Probabilistic Safety Assessment Quality The VY PSA is of sufficient quality and scope for this application. The VY PSA modeling is highly detailed, including a wide variety of initiating events (e.g., transients, internal floods, LOCAs inside and outside containment, support system failure initiators), modeled systems, extensive level of detail, operator actions, and common cause events.
The PSA model (Level 1 and Level 2) used for this analysis was the most recent internal events risk model for the VY PSA (Revision VY04R1) [Reference 2]. This current model is an updated version of the model used in the 1993 individual plant examination (IPE) [Reference 3] and reflects the VY PSA configuration and Extended Power Uprate design changes and SBONemon Tie evaluation as of September 2004. The VY PSA model adopts the large event tree / small fault tree approach and uses the support state methodology, embodied in the RISKMAN code, for quantifying core damage frequency.
The PSA model has been updated several times since the IPE due to the following.
- Equipment performance - As data collection progresses, estimated failure rates and system unavailability data change.
- Plant configuration changes - Plant configuration changes are incorporated into the PSA model.
- Modeling changes - The PSA model is refined to incorporate the latest state of knowledge and recommendations from industry peer reviews.
The Vermont Yankee internal events received a formal industry PRA Peer Review in November 2000
[Reference 4]. All of the A and B priority comments have been addressed by Entergy and incorporated into the current VY PSA model as appropriate.
Refer to Attachment J for further details regarding the quality of the VY PSA.
SECTION 2 EVALUATION 2.1. Method of Analysis 2.1.1. General The Vermont Yankee PSA model uses widely-accepted PRA techniques for event tree and fault tree analysis. Event trees are constructed to identify core damage and radionuclide release sequences. The event tree "top events" represent systems (and operator actions) that can prevent or mitigate core damage. Fault trees are constructed for each system in order to identify the failure modes. Analysis of component failure rates (including common cause failures) and human error rates is performed to develop the data needed to quantify the fault tree models.
In PRA terminology, the Vermont Yankee PSA modeling approach can be characterized as an "event tree linking" approach. The event tree top events correspond to systems, as opposed to the more general functions used by some analysts. This approach divides the plant systems into two categories:
- 1. Front-Line Systems, which directly satisfy critical safety functions (e.g., Core Spray and Torus Cooling), and
- 2. Support Systems, which are needed to support operation of front-line systems (e.g., ac power and service water).
Front-line event trees are linked to the end of the Support System event trees for sequence quantification.
This allows us determination of the status of all support systems for each sequence before the front-line systems are evaluated. Quantification of the event tree and fault tree models is performed using Personal Computer version of the RISKMAN code. The Support System and Front-Une System event trees are
'linked' together and solved for the core damage sequences and their frequencies. This calculation is performed with the RISKMAN code's event tree module. Each sequence represents an initiating event and combination of Top Event failures that results in core damage. The frequency of each sequence is determined by the event tree structure, the initiating event frequency and the Top Event split fraction frequencies specified by the RISKMAN master frequency file. RISKMAN allows the user to enter the split fraction names and the logic defining the split fractions (i.e., rules) to be selected for a given sequence based on the status of events occurring earlier in the sequence or on the type of initiating event.
2.1.2. Modification of the VY PSA Model The risk assessment evaluation examined VY PSA plant specific accident sequences in which the containment integrity is necessary for success of the RHR system and Core Spray system emergency core cooling pumps.
The steps taken to perform this risk assessment evaluation are as follows:
- 1) Modify the VY PSA Containment Isolation System fault tree to reflect the EPRI-TR-1009325 probability for pre-existing containment leakage.
- 2) Revise the appropriate LOCAs, FLOODS, ATWS, TRANSIENT event trees to reflect the impact of COP on NPSH requirements.
- 3) Perform an uncertainty analysis on a number of important basic events associated with the containment overpressure modeling changes used in this risk assessment.
- 4) Characterized the risk assessment evaluation of containment overpressure impact on NPSH requirements by change in CDF and LERF risk metrics (as defined in (RG 1.174) [Reference 1].
The final step calculates the change in CDF and LERF and compares it to the acceptance guidelines presented in Figures 2.1 and 2.2 of Regulatory Guide 1.174 [Reference 1].
2.2. Fault Tree Analysis The specific issue to be assessed by this evaluation - control of containment over-pressure (COP) for ensuring adequate NPSH for the RHR and Core Spray pumps - required creation of a new fault tree for Top Event (IP), 'Primary Containment Integrity". In order to credit containment overpressure when necessary to maintain sufficient NPSH margin for LPCI and Core Spray pump operation, it is necessary that the primary containment remain intact. Because of the roles they play in the accident sequences of interest, information for Top Events (VT) and (Al) are included for completeness.
2.2.1. Containment Venting - Top Event (VT)
Top Event VT is used to evaluate containment venting as a means of depressurizing the containment during sequences when all containment heat removal capability fails or becomes inadequate. Successful use of the vent can provide the operator more time to recover heat removal equipment by limiting containment peak pressure to preserve containment structural integrity and the ECCS which rely on containment. The vent path is from the suppression pool air space to the plant vent stack.
The containment vent consists of 8" pipe connected to a suppression-pool-to-drywell vacuum line upstream of the vacuum breaker. The vent line is equipped with a rupture disc and one normally closed, remote/manual gate valve (MOV). The gate valve is used to initiate venting, and for manual isolation of the vent path after the containment has been depressurized to the desired pressure. Operators can reopen the vent path should periodic venting be appropriate.
No changes were made to this top event fault tree. See Attachment A for details on Top Event VT.
2.2.2. Primary Containment Integrity - Top Event (IP)
Top event IP is used to evaluate whether the containment is intact during the period of time that the hard-piped vent from torus air space is used to prevent over-pressurization (VT=S). Integrity of containment is a necessary condition in order to maintain sufficient pressure in the containment in support of continued operation of LPCI or Core Spray pumps taking suction from the suppression pool at elevated temperature.
Failure of containment integrity is defined to include failures in the containment boundary that allow leakage in excess of that which would maintain overpressure sufficient to satisfy the NPSH-r for the LPCI and Core Spray pumps at elevated suppression pool temperature. The leakage sources are divided into two principal categories:
Isolation valve failures: These are related to the failure of the isolation valves in containment penetration lines or failure of the isolation signals or power to close these valves.
o Pre-existing failures: These are failures primarily related to hatches, electrical penetration assemblies (EPAs), and other containment leakage paths not associated with failure of isolation valves to close.
The following assumptions were utilized in the fault tree model for top event IP:
- The containment pre-existing leakage probabilities (basic events ISDWSMLEAK and ISDWLGLEAK) were determined using EPRI's TR-1009325 [Reference 6]:
o Basic event ISDWSMLEAK represents the probability that containment pre-existing leakage is above the threshold at which adequate overpressure can be assured, but is less than the lower threshold used to define the large containment pre-existing leakage.
o Basic event ISDWLGLEAK represents the probability that containment pre-existing leakage is above the threshold used to define the large containment leakage.
- The isolation valves included in the quantification are those that communicate directly with the atmosphere of the containment on the following penetration lines:
o Drywell equipment drain sump lines o Drywell floor drain sump lines o Drywell and torus vent lines o Drywell and torus purge supply lines o Torus vacuum relief system
- Piping penetrations in systems which connect directly to the RPV are assumed to have negligible contribution to isolation failure since multiple isolation valves must fail in addition to the pipe rupturing.
A new fault tree was developed for this risk assessment. See Attachment B for details on Top Event IP.
2.2.3. Alternate Injection & COP Control - Top Event (Al)
Top Event Al is used to evaluate the success of long-term injection (from sources external to the containment) after containment heat removal challenges as a means of preventing core damage.
The alternate injection systems credited for Medium LOCA events are Condensate, CRD, and Condensate Transfer. In the case of Transient events, Internal Flooding events, and Small LOCA events, the Feedwater, HPCI, and RCIC systems are credited in addition to Condensate, CRD, and Condensate Transfer. In the case of Large LOCA events, the only alternate injection system credited is the Fire Water System via an emergency intertie provided between the Service Water System and the A Loop of the RHR System.
No changes were made to this top event fault tree. See Attachment C for details on Top Event Al.
2.3. Event Tree Analysis The specific issue to be assessed by this evaluation - control of containment over-pressure (COP) for ensuring adequate NPSH of RHR and Core Spray pumps - required the addition of new Top Event (IP),
'Primary Containment Integrity", to the event trees used to evaluate transients and LOCAs which occur inside containment.. For completeness, information for Event Tree (ATWS) is included. However, use of Alternate Injection (Al) as a mitigation strategy for ATWS events was not considered based upon the assumption that there is insufficient capacity from external injection sources (e.g., Condensate Transfer) and/or the limited time available to successfully implement this mitigation strategy for ATWS sequences when both the normal and emergency heat sinks are unavailable.
2.3.1. Transients - Event Tree (TRANSIENT)
The transient event tree is used to analyze a number of Transient initiating events, including some especial" initiators. The Transient event tree evaluates the critical safety functions of reactivity control, high pressure core injection, RPV depressurization, low pressure core injection, and containment heat removal. The Transient event tree does not evaluate the vapor suppression function, because transients
do not involve discharge of reactor coolant inventory to the drywell (except briefly if the safety valves open for pressure relief). Also, because there is no break, reactor pressure control (using Turbine Bypass Valves or SRVs) is evaluated in the Transient event tree. Failure to scram is not analyzed explicitly in the Transient event tree. Transient sequences where control rods fail to insert are evaluated instead by the ATWS event tree. The transient initiating event frequencies are based on review of VY experience through April 2002, as well as data provided in NUREG/CR-5750, *Rates of Initiating Events at US Nuclear Power Plants: 1987-1995-.
See Attachment D for details on the TRANSIENT event tree.
2.3.2. Anticipated Transients w/o SCRAM - Event Tree (ATWS)
Anticipated Transients without Scram (ATWS) are events where the plant is degraded in some manner such that a scram should have occurred, but the reactor remains at power due to failure of the Reactor Protection System. ATWS events have unique mitigating system requirements compared to Transient and LOCA events, including the need for alternate means of reactivity control. The ATWS initiating event frequencies are estimated by multiplying the transient related initiating event frequencies by the reactor scram failure probability. The reactor scram failure probability is represented in top events SM, SE and AR.
See Attachment E for details on the ATWS event tree.
2.3.3. Large LOCA - Event Tree (LOCALG)
A Large LOCA causes rapid depressurization of the reactor and requires rapid injection of water from high volume systems. Thus, the Large LOCA event tree does not credit use of HPCI and RCIC for high pressure injection to the reactor, and use of the ADS valves for reactor depressurization is not required.
We assume that the break location is inside the drywell for all LOCAs.
We assume that the break is located on the discharge side of a recirculation line, since this will disable one train (two pumps) of LPCI injection. This assumption envelopes a break in a Core Spray line, since Core Spray line breaks would also disable a single train (but only one pump) of injection. Also, the assumed location is conservative for recirculation suction side breaks since the recirculation loop isolation valves are designed to close for these breaks such that no train of low pressure injection would be disabled by the break location. The Large LOCA event frequency was estimated using NUREG/CR-5750,
'Rates of Initiating Events at US Nuclear Power Plants: 1987-1995". Frequencies were estimated by calculating the frequency of leaks or through-wall cracks that have occurred which challenge the piping integrity. Based on this reference, there were no medium or large pipe break LOCA events in worldwide experience. Additionally, conservative estimates were used for the conditional probability of a pipe break given leak. This analysis is elaborated in the Appendix J of NUREG/CR-5750.
See Attachment F for details on the LOCA_LG event tree.
2.3.4. Medium LOCA- Event Tree (LOCA MD)
A Medium LOCA causes eventual depressurization of. the reactor due to the break, but the rate of depressurization and rate of makeup required are less for a Medium LOCA. This allows use of HPCI in the early stage of a Medium LOCA to accomplish the high pressure injection function (we assume that the capacity of the RCIC System is insufficient to accomplish this function for Medium LOCAs). However, because the reactor is eventually depressurized by the break, low pressure injection systems are also required. Also, if high pressure systems fail to provide early injection rapid reactor depressurization via the ADS valves must occur in order for the low pressure systems to inject.
Because the break flow for a Medium LOCA is smaller than for a Large LOCA the Medium LOCA event tree considers drywell spray and RPV depressurization via the ADS valves as alternate means of accomplishing vapor suppression. Also, the smaller break flow for a Medium LOCA will divert less flow
from the reactor for breaks located on LPCI or Core Spray System injection piping. We assume that no trains of injection systems are disabled directly as a result of such flow diversion for Medium LOCAs. The Medium LOCA event frequency was estimated using NUREG/CR-5750, 'Rates of Initiating Events at US Nuclear Power Plants: 1987-1995". Frequencies were estimated by calculating the frequency of leaks or through-wall cracks that have occurred which challenge the piping integrity. Based on this reference, there were no medium or large pipe break LOCA events in worldwide experience. Additionally, conservative estimates were used for the conditional probability of a pipe break given leak. This analysis is elaborated in the Appendix J of NUREG/CR-5750.
See Attachment G for details on the LOCAMD event tree.
2.3.5. Small LOCA - Event Tree (LOCA SM)
Unlike Large and Medium LOCAs, Small LOCAs are assumed not to cause reactor depressurization via the break. This makes HPCI and RCIC viable long-term injection systems. However, if these high pressure injection systems fail, the reactor must be depressurized via the ADS valves in order for the low pressure injection systems to inject.
Like the Medium LOCA event tree, we assume that the break is located inside containment, and that no injection systems are disabled directly as a result of the flow diversion out the break. The Small LOCA event frequency was estimated using NUREG/CR-5750, 'Rates of Initiating Events at US Nuclear Power Plants: 1987-1995-. Frequencies were estimated by calculating the frequency of leaks or through-wall cracks that have occurred which challenge the piping integrity. Based on this reference, there were no medium or large pipe break LOCA events in worldwide experience. Additionally, conservative estimates were used for the conditional probability of a pipe break given leak. This analysis is elaborated in the Appendix J of NUREG/CR-5750.
See Attachment H for details on the LOCA SM event tree.
2.3.6. Internal Flooding - Event Tree (FLOODS)
The scope of potential flooding sources includes pipe break events that result in water accumulation (flooding), water spray or potential adverse environment (steam). Failure of any hoses and failure of water tanks were also included in the review scope. Piping systems that are outside the scope of this evaluation include the Main Steam, Feedwater, HPCI and RCIC steam piping, and Reactor Water Cleanup (RWCU).
Potential breaks in these high energy lines (HELBs) were included in the LOCA Outside Containment (LOCAOC) evaluation.
Based on the walkdowns performed, the principal internal flood sources include postulated breaks in the service water, fire water and circulating water systems. The principal buildings/areas subject to these internal flooding sources are the Reactor Building, Turbine Building, Intake Structure and Front Office Building. The flood initiating event frequency for each internal flood scenario was determined from pipe failure probabilities provided in EPRI TR 102266, 'Pipe Failure Study Update', and from applicable industry event data in Nuclear Plant Experiences (NEP).
See Attachment I for details on the FLOODS event tree.
J Engineering Report I
---Entergy REPORT No. VY-RPT-05-0011O l Revision 0 l Page I 17 j of 1303 Figure 2.1 Acceptance Guidelines' for Core Damage Frequency [Reference 1]
ID
Region II ,
10- ID CDF-O Figure 2.2 Acceptance Guidelines' for Large Early Release Frequency [Reference 1]
+/-
Regolii Region-.,,,, 'la'w'R*-II?-
iO0 5 LERF-*
1The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the Integrated decision making, the boundaries between regions should not be Interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.
SECTION 3
SUMMARY
OF RESULTS 3.1. Core Damage In order to assess the risk impact of utilizing containment accident pressure (containment overpressure) at EPU conditions to satisfy the net positive suction head (NPSH) requirements for RHR and Core Spray pumps, the PRA model changes described in Section 2 was created. This model was then exercised in the following configurations:
a CONFIG#1 The result from this model case (VYCOP2A) represents the risk when the COP is NOT available to satisfy RHR and CS pumps NPSH requirements.
CONFIG#2 The result from this model case (VYCOP2) represents the risk when the COP is available to satisfy RHR and CS pumps NPSH requirements.
The results of the front-line event tree analysis are accident sequences and their frequencies. Because there may be many thousands of such sequences, it is convenient to group these sequences into "bins",
where each bin represents a certain "type" of accident sequence. This binning can provide insights into the Core Damage Frequency (CDF) results. For example, there can be situations where many similar core damage sequences together represent a significant fraction of the CDF, even though each individual sequence alone only represents a small fraction of the total CDF. In this case, binning allows us to identify the total CDF contribution for this group of similar sequences.
The bins listed in Tables 3.2A, B, and C, are used to characterize the results of the front-end (i.e., Level I or CDF) analysis. As would be expected, the only difference between the two model cases lies in Endstate Bin IIV. This endstate contains sequences where (1)the main condenser and RHR fail, and the torus vent opens for containment pressure relief, or (2) the main condenser and RHR fail, and containment integrity failure exists from the onset of the event. Core damage occurs when ECCS systems fail due to inadequate NPSH. The incremental change in CDF, 5.78E-7/ry, indicates that use of the COP mitigation strategy has a very small risk impact. Comparison between the different sequence groups (i.e.:
ALL, CDIPEV, FLOODS) reveals that the incremental change in CDF for transient and LOCA events (sequence group CDIPEV) accounts for 4.41 E-7/ry of the total.
3.2. Radiological Release The spectrum of possible release times is discretized into three categories: Early, Intermediate, and Late.
The spectrum of possible release magnitudes isdiscretized into four categories: High, Medium, Low, and Low-Low. Combining both the timing and magnitude of release results in a total of twelve containment event tree (CET) endstate bins: Early/High, Intermediate/High, Late/High, Early/Medium, etc. These timing/magnitude bins are used to characterize the release.
The release timing is characterize based on the time at which the release begins, measured from the time of accident initiation:
Early (0-6 hours)
= Intermediate (6-24 hours) a Late (>24 hours)
Sequences with an "early" release time include those where the containment failure (and core damage) occurs in the "early" time frame. These include LOCA sequences where the containment fails due to
X Engineering Report Entergy REPORT No. VY-RPT-05-00110 l Revision 0 l Page I 19 I of 1 303 vapor suppression failure. However, in the case of transient events and internal flooding events, the time until core damage would occur and when containment failure would subsequently occur will be much greater than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; thus these initiating event sequences are excluded from consideration in the determination of LERF.
The incremental change in Large Early Release Frequency (ALERF) for VY from internal events for this risk assessment is conservatively assumed equal to the incremental change in core damage frequency (ACDF) from LOCA events for this risk assessment. Thus from Table 3.4 - LOCAs and Their Contribution to CDF", the ALERF is estimated to equal 4.50E-8/ry.
3.3. Parametric Uncertainty Analysis 3.3.1. Sources and Treatment of Uncertainty Parametric uncertainty associated with the numerical results of this study primarily caused by insufficient component failure mode data, problems interpreting failure data and component performance records, the use of generic data in a plant-specific data analysis, and the intrinsic variability of failure data. In assessing the contribution of parametric uncertainty to the numerical results, the parameters of interest are those used by the accident-sequence logic models. They include initiating event frequencies, component failure rates and unavailability, and human error probabilities.
In this study, parametric uncertainties were handled by defining a probability distribution for the value of each parameter such that the "nth" percentile of the distribution represents the value for which the analyst has n% confidence that the true value lies below the value. This subjective approach to the representation of uncertainty makes the propagation of parametric uncertainty through the evaluation mathematically straightforward. The evaluation was made using the Monte Carlo sampling technique.
The uncertainty ranges characterized by the distributions vary in origin. For example, if the estimates are based on plant-specific data, the range is characteristic of statistical uncertainty. If the estimates are generic (or non-plant specific) the range is characteristic of the factors that may affect the failure properties of the component in different uses and environments. Hence the range will include plant-to-plant variation.
The propagation of uncertainties was accomplished using the RISKMAN computer program to calculate probability distributions and determine the uncertainty in the accident frequency estimate. The modeling of uncertainties and their propagation is discussed and documented in NUREG/CR-4550, Volume 1, Revision 1.
3.3.2. Quantification of Uncertainty The uncertainty of the parameter values was propagated through the PSA models VYCOP2A for CONFIG#1 and VYCOP2 for CONFIG#2 using the RISKMAN computer program.
RISKMAN has three analysis modules: Data Analysis Module, System Analysis Module, and Event Tree Analysis Module. Appropriate probability distributions for each uncertain parameter in the analysis is determined and included in the Data Module. The System Module combines the individual failure rates, maintenance, and common cause parameters into the split fraction frequencies that will be used by the Event Module. A Monte Carlo routine is used with the complete distributions to calculate the split fraction frequencies. Event trees are quantified and linked together in the Event Module. The important sequences from the results of the Event Module are used in another Monte Carlo sampling step to propagate the split fraction uncertainties and obtain the uncertainties in the overall results.
The descriptive statistics calculated by RISKMAN for the total core damage frequency of the plant caused by internal events include:
Mean of the sample
I aEngineering Report E lte gy j REPORTNo.VW-RPT-05-0011O l Revision 0 l Page l 20 l of l 303
- Variance of the sample
- 5th, 50th, and 95th percentiles of the sample.
3.3.3. Results of Uncertainty Analysis The parametric uncertainty associated with core damage frequency was estimated for the two configurations using Monte Carlo techniques implemented in RISKMAN. Each configuration entails three sequence groups: ALL, CDIPEV, and FLOODS. The results are shown in Tables 3.5A and 3.5B.
To facilitate comparison between the two configurations, a sample size of 10,000 and identical random number seeds were used in the analysis. Split fractions of top events IP, LP, TC, CS, TCA, TCB, LA, LB, VA, VB, CA, and CB were correlated during the sampling process. Statistical input and output from the Monte Carlo simulation are provided in Tables 3.6A, B, and C (CONFIG#1) and Table 3.7A, B, and C (CONFIG#2).
3.4. Modeling UncertaintV Analysis Modeling uncertainty is concerned with the sensitivity of the results due to uncertainties in the structure and assumptions in the logic model. Modeling uncertainty has not been explicitly treated in many PRAs, and is still an evolving area of analysis. The PRA industry is currently investigating methods for performing modeling uncertainty analysis. EPRI has developed a guideline for modeling uncertainty that is still in draft form and undergoing pilot testing. The EPRI approach currently being tested takes the rational approach of identifying key sources of modeling uncertainty and then performing appropriate sensitivity calculations. This approach is taken here.
The modeling issues selected here for assessment are those related to the risk assessment of the containment overpressure credit. This assessment does not involve investigating modeling uncertainty with regard to the overall VY PRA. The modeling issue identified for sensitivity analysis was pre-existing containment degradation.
3.4.1. Pre-existing Containment Leakage (ISDWSMLEAK)
An evaluation was performed to determine the maximum size hole in containment that would still assure adequate overpressure. Using the conservative 10CFR50 Appendix K containment analysis as the starting point, the maximum leak was determined to be approximately 6OxLa. La is defined in the VY TS Bases 4.7 as 0.8 wt % per day at 44 psig.
A conservative leak rate was determined to be approximately 27xLa, using licensing-bases assumptions.
Sensitivity studies using analysis assumptions that are more realistic, but still conservative or bounding, show that peak suppression pool temperature would not increase above a value where credit for containment overpressure would be required. Therefore, on this basis the maximum leak would be infinite, i.e. there would be no need for the containment from a containment overpressure retention perspective. A leak rate of 6OxLa was used in the PRA case described above (i.e., CONFIG#2), which is believed to be a more representative best-estimate value for this term.
Quantitative sensitivity cases to assess the response of CDF to changes in the allowable pre-existing leakage rate were performed, where the probability value assigned to basic event ISDWSMLEAK is determined using EPRI's TR-1009325. Based upon the results of these sensitivity cases, provided in the table below, it appears that as the allowable pre-existing leakage rate drops below -30xLa, the estimated CDF will increase significantly.
Table 3.1 Sensitivity Cases for ISDWSMLEAK Sensitivity Description CDF Case(ALSqecs
- 1 Assume max allowable = 10 x L.; assign ISDWSMLEAK=7.63E-3) 1.0377E-5 (model case V4COPS3)
- 2 Assume max allowable = 20 x L.; assign ISDWSMLEAK=3.75E-3) 7.8600E-6 (model case V4COPS5)
- 3 Assume max allowable = 30 x L.; assign ISDWSMLEAK=1 .87E-3) 6.6407E-6 (model case V4COPS2)
- 4 Assume max allowable = 40 x L.; assign ISDWSMLEAK=8.80E-4) 5.9988E-6 (model case V4COPS4)
- 5 Assume max allowable = 60 x L.; assign ISDWSMLEAK=2.47E-4) 5.5884E-6 (model case VYCOP2; I.e., CONFIG#2) 1.1E-06 I flF-M 4- -.
9C)E )E-06 IL 0 7.C)E-06 C.
6.c)E-06 5.c E-06 4C ucw
_nr~n 0 10 20 30 40 50 60 70 ISDWSMLEAK (Muftiple of La)
FIGURE 3.1 Pre-Existing Containment Leakage vs. CDF (model VYCOP2)
J 3EaEngineering Report Eriergy REPORT No. W-RPT050011O l Revision 0 l Page l 22 l of l 303 3.5. Completeness Uncertainty Analysis Completeness uncertainty is addressed here by the qualitative assessment of the impact on the conclusions if external events and shutdown risk contributors are also considered.
3.5.1. Seismic The Vermont Yankee seismic risk analysis was performed as part of the Individual Plant Examination of External Events (IPEEE). Vermont Yankee performed a seismic margins assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequency sequences were quantified as part of the seismic risk evaluation.
The conclusions of the Vermont Yankee IPEEE seismic analysis are as follows:
For Vermont Yankee, the SMA identified that the lowest HCLPF components in the selected primary and alternate safe shutdown paths are the Condensate Storage Tank (CST) with a HCLPF of 0.25g and the Diesel Fuel Oil Storage Tank (FOST) with a HCLPF of 0.29g. The HCLPF for all other components in the safe shutdown paths meet or exceed the 0.3g review level earthquake. These values represent significant margin to the design basis 0.14g earthquake.
The conclusions of the SMA are judged to be unaffected by the EPU or the containment overpressure credit issue. The EPU has little or no impact on the seismic qualifications of the systems, structures and components (SSCs). Specifically, the power uprate results in additional thermal energy stored in the RPV, but the additional blowdown loads on the RPV and containment given a coincident seismic event, are judged not to alter the results of the SMA.
The decrease in time available for operator actions, and the associated increases in calculated HEPs, is judged to have a non-significant impact on seismic-induced risk. Industry BWR seismic PSAs have typically shown (e.g., Peach Bottom NUREG-1150 study; Limerick Generating Station Severe Accident Risk Assessment; NUREG/CR-4448) that seismic risk is overwhelmingly dominated by seismic induced equipment and structural failures.
Based on the above discussion, it is judged that seismic issues do not significantly impact the decision making for the VY EPU and containment overpressure credit.
3.5.2. Internal Fires As discussed in the VY EPU submittal, internal fires risk is not a significant contributor to the risk profile of the proposed EPU. Credit for containment overpressure is not required for VY Appendix R fire accident sequences. As such, it isjudged that fire issues do not significantly impact the decision making for the VY EPU and associated containment overpressure credit.
3.5.3. Other External Hazards In addition to seismic events and internal fires, the VY IPEEE Submittal analyzed a variety of other external hazards:
- High Winds/Tornadoes
- External Floods
- Transportation and Nearby Facility Accidents
- Other External Hazards
The VY IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. Based upon this review, it was concluded that VY meets the applicable NRC Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards. As such, these other external hazards are judged not to significantly impact the decision making for the VY EPU and containment overpressure credit.
Note that the VY IPEEE also analyzed internal flooding scenarios. However, internal flooding scenarios are now incorporated into the current VY PSA internal events model of record.
3.5.4. Shutdown Risk As discussed in the VY EPU submittal, shutdown risk is a non-significant contributor to the risk profile of the proposed EPU. The credit for containment overpressure is not required for accident sequences occurring during shutdown. As such, shutdown risk does not influence the decision making for the VY EPU containment overpressure credit.
Table 3.2A Bin Totals for Sequence Group = ALL Bin Bin Description CONFIG#1 l CONFIG#2 ACDF/ry CDF/ry CDF/ry ______
ID Sequences with loss of all Injection. Core damage occurs with the 1.3942 E-06 1.7909 E-06 3.9670 E-07 reactor at low pressure.
Sequences with loss of all high pressure Injection and failure to IA depressurize. Core damage occurs with the reactor at high 1.1321 E-06 1.1321 E-06 0 pressure.
IBL 'Late' SBOtype. Core cooling Is maintained by HPCI/RCIC until 8.3968 E-07 8.3968 E-07 0 batteries deplete.
IIA Sequences with loss of all containment heat removal. Core damage 4.2536 E-07 4.2536 E-07 0 is caused by containment failure.
IBE 'Early' SBO-type sequences. Core damage occurs due to early 3.1904 E-07 3.1904 E-07 0 failure of HPCI and RCIC.
IIIB Small or Medium LOCA sequences for which the reactor cannot be 2.0785 E-07 2.0785 E-07 0 depressurized prior to core damage occurring.
Sequences where the main condenser and RHR fail, and the torus IIV vent opens for containment pressure relief. Core damage occurs 1.9400 E-07 1.9398 E-07 -2.0 E-1 1 when ECCS systems fail NPSH, due to failure to reclose the vent.
IIIC Sequences with loss of Injection. Core damage occurs with the 1.3411 E-07 3.1555 E-07 1.8144 E-07 reactor at low pressure.
IVA ATWS sequences where core damage Is caused by containment 1.1693 E-07 1.1692 E-07 -1.0 E-1 1 failure.
IED 'Early' SBO-type sequences caused by failure of DC-1 and DC-2. 5.6127 E-08 5.6127 E-08 0 V Containment Bypass sequences. (Interfacing systems LOCA and 5.3176 E-08 5.3176 E-08 0 LOCA outside of containment.)
IVL ATWS sequences where core damage occurs due to overpressure 5.2938 E-08 5.2938 E-08 0 failure of the Reactor Coolant System.
IIL Loss of containment heat removal with RPV breach but no initial 4.6871 E-08 4.6871 E-08 0 core damage; core damage after containment failure.
IC ATWS sequences where core damage Is caused by loss of Injection 1.6074 E-08 1.6363 E-08 2.8900 E-1 0 during level/power control.
IEC Sequences with delayed loss of dc power due to failure of battery 1.0830 E-08 1.0830 E-08 0 chargers.
Sequences where core damage Is caused by containment failure.
IIID Containment fails due to failure of vapor suppression (stuck-open 6.3348 E-09 6.3348 E-09 0 vacuum breaker.)
lilA RPV ruptures due to failure of all over-pressure protection systems 4.3631 E-09 4.3631 E-09 0
__ _ _ _ _ _ (SO F). I __ _I__ _I Total 5.0100 E-06 5.5884 E406 5.7840 E-07
Table 3.2B Bin Totals for Sequence Group = CDIPEV2 Bin l Bin Description JCONFIG#1 CDF/_____y CONFIG#2 CDF/ry ACDFIry IBL 'Late' SBO-type. Core cooling Is maintained by HPCIIRCIC until 8.3968 E-07 8.3968 E-07 0 batteries deplete._______
ID Sequences with loss of all Injection. Core damage occurs with the 8.2931 E-07 1.2260 E-06 3.9669 E-07 reactor at low pressure.
Sequences with loss of all high pressure injection and failure to IA depressurize. Core damage occurs with the reactor at high 7.1219 E-07 7.1219 E-07 0 pressure.
IA Sequences with loss of all containment heat removal. Core damag IIA Is caused by containment failure. 3.3993 E-07 3.3993 E-07 0 IBE 'Earyy SBO-type sequences. Core damage occurs due to early 1.5294 E-07 1.5294 E-07 0 failure of HPCI and RCIC.
1111 Small or Medium LOCA sequences for which the reactor cannot be 1.3532 E-07 1.3532 E-07 0 depressurized prior to core damage occurring.
IIIC Sequences with loss of Injection. Core damage occurs with the 1.2242 E-07 1.6592 E-07 4.3500 E-08 reactor at low pressure.
IVA ATWS sequences where core damage is caused by containment 1.1304 E-07 1.1303 E-07 -1.0 E-11 failure.
Sequences where the main condenser and RHR fail, and the torus IIV vent opens for containment pressure relief. Core damage occurs 9.4479 E-08 9.4466 E-08 -1.3 E-11 when ECCS systems fail NPSH, due to failure to reclose the vent.
IED 'Early S80-type sequences caused by failure of DC-1 and DC-2. 5.6127 E-08 5.6127 E-08 0 V Containment Bypass sequences. (Interfacing systems LOCA and 5.3176 E-08 5.3176 E-08 0 LOCA outside of containment.)_______
IVL ATWS sequences where core damage occurs due to overpressure 5.2938 E-08 5.2938 E-08 0
____________failure of the Reactor Coolant System.________
III. Loss of containment heat removal with RPV breach but no Initial 4.6871 E-08 4.6871 E-08 0 core damage; core damage after containment failure.
IC ATWS sequences where core damage is caused by loss of injection 1.6074 E-08 1.6363 E-08 2.890 E-10
___________during level/power control.
IEC Sequences with delayed loss of dc power due to failure of battery 1.0830 E-08 1.0830 E-08 0
____ ___ chargers._ _ _ _ _ _ _ _
Sequences where core damage Is caused by containment failure.
IIID Containment fails due to failure of vapor suppression (stuck-open 6.3348 E-09 6.3348 E-09 0 vacuum breaker.)
IIIA RPV ruptures due to failure of all over-pressure protection systems 4.2849 E-09 4.2849 E-09 0
_ __ _ _ (SO =F). _ _ _ _ I__ _ _ _ _ _ I___ _ _ _ _ _ _
Total 3.5859 E-06 4.0264 E-06 4.4046 E-07 Sequence Group CDIPEV includes all Transient and LOCA initiating events.
Table 3.2C Bin Totals for Sequence Group = FLOODS Bin Bin Description CONFIG#1 CONFIG#2 ACDF/ry CDFry CDF/ry ID Sequences with loss of all injection. Core damage occurs with the 5.6491 E-07 5.6491 E-07 0 reactor at low pressure.
Sequences with loss of all high pressure Injection and failure to IA depressurize. Core damage occurs with the reactor at high 4.1989 E-07 4.1989 E-07 0 pressure.
IBE 'Early' SBO-type sequences. Core damage occurs due to early 1.6610 E-07 1.6610 E-07 0 failure of HPCI and RCIC.
Sequences where the main condenser and RHR fail, and the torus Iv vent opens for containment pressure relief. Core damage occurs 9.9517 E-08 9.9517 E-08 0 when ECCS systems fail NPSH, due to failure to reclose the vent.
IIA Sequences with loss of all containment heat removal. Core damage 8.5436 E-08 8.5436 E-08 0 Is caused by containment failure.
IIIB Small or Medium LOCA sequences for which the reactor cannot be 7.2531 E-08 7.2531 E-08 0 depressurized prior to core damage occurring.
IIIC Sequences with loss of Injection. Core damage occurs with the 1.1694 E-08 1.4963 E-07 1.3794 E-07 reactor at low pressure.
IVA ATWS sequences where core damage Is caused by containment 3.8906 E-09 3.8906 E-09 0 failure.
IlA RPV ruptures due to failure of all over-pressure protection systems. 7.8268 E-1 1 7.8268 E-1 1 0 Total 1.4240 E406 1.5620 E406 1.3794 E407
Table 3.3 Accident Types and Their Contribution to CDF Accident CONFIG#1 CONFIG#2 Type CDF/ry CDF/ry ACDF/ry TRANSIENTS 2.97857E-06 3.3737E-06 3.95134E-07 ATWS 1.451 39E-07 1.45425E-07 2.8593E-10 Loss of Coolant Accident 4.0905E-07 4.54059E-07 4.5009E-08 (LOCA)
Interfacing System LOCA 3.68603E-08 3.68603E-08 0 (ISLOCA)
LOCA Outside Containment 1.63158E-08 1.63158E-08 0 (LOCAOC)
Internal Flooding 1.42404E-06 1.56199E-06 1.37944E-07 (FLOODS)
TOTALS 1.42404E.06 5.58835E-06 5.78373E-07 Table 3.4 LOCAs and Their Contribution to CDF CONFIG#1 CONFIG#2 IE Name IE Description CDF/ry CDF/ry A CDF (COP not credited) (COP credited)
IORV Inadvertent Opening of a Relief Valve 2.6907E-07 2.863E-07 1.7230E-08 SORV Stuck-Open Relief Valve 6.8301 E-08 7.3354E-08 5.0530E-09 LLOCA Large LOCA 2.6159E-08 4.7324E-08 2.1165E-08 MLOCA Medium LOCA 2.4724E-08 2.4766E-08 4.2000E-11 SLOCA Small LOCA 2.0796E-08 2.2315E-08 1.51 90E-09 Total otl 4.5009E-08
Table 3.5A CONFIG#1 CDF (1/ry) Uncertainty CONFIG#1 CONFIG#1 CONFIG#1 COnfidenCe (ALL) (CDIPEV 3 ) (FLOODS 4)
MEAN VALUE 5.50E-06 4.21 E-06 1.32E-06 5th percentile 2.63E-06 1.75E-06 6.23E-07 50' percentile 4.36E-06 3.23E-06 1.05E-06 95th percentile 1.10E-05 8.70E-06 2.58E-06 Table 3.5B CONFIG#2 CDF (11ry) Uncertainty CONFIG#2 CONFIG#2 CONFIG#2 COnfidenCe (ALL) (CDIPEV) (FLOODS)
MEAN VALUE 6.12E-06 4.66E-06 1.46E-06 5th percentile 2.90E-06 1.93E-06 6.98E-07 50th percentile 4.82E-06 3.58E-06 1.16E-06 95th percentile 1.20E-05 9.48E-06 2.80E-06 Sequence Group CDIPEV includes all Transient and LOCA initiating events.
4 Sequence Group FLOODS includes all internal flooding cvents.
Table 3.6A Monte Carlo Sampling Results for the CONFIG#1 (Sequence Group ALL)
Distribution: ALL 10000 Samples, Using Seeds: 8314 17851 Sequence Quantified: 387 MEAN VARIANCE 6th %TILE 50th %TILE 95th %TILE l 5.4959E-06 l 1.1 245E-11I 2.6348E-06 l4.36-24E-06 l 1.0986E-05 BIN J BOUNDARY VALUE DISCRETE CUMULATIVE 1 1.6101 E-06 1.9707E-06 5.OOOOE-03 5.OOOOE-03 2 2.1277E-06 2.2103E-06 5.0000E-03 1.OOOOE-02 3 2.2655E-06 2.3454E-06 1.OOOOE-02 2.OOOOE-02 4 2.3959E-06 2.4411 E-06 1.OOOOE-02 3.OOOOE-02 5 2.4835E-06 2.5579E-06 2.OOOOE-02 5.OOOOE-02 6 2.6348E-06 2.7776E-06 5.OOOOE-02 1.OOOOE-01 7 2.9094E-06 3.1194E-06 1.OOOOE-01 2.OOOOE-01 8 3.3041 E-06 3.4808E-06 1.OOOOE-01 3.OOOOE-01 9 3.6502E-06 3.8223E-06 1.OOOOE-01 4.OOOOE-01 10 3.9899E-06 4.1751 E-06 1.OOOOE-01 5.OOOOE-01 11 4.3624E-06 4.5628E-06 1.OOOOE-01 6.OOOOE-01 12 4.7960E-06 5.0713E-06 1.OOOOE-01 7.OOOE-01 13 5.3847E-06 5.801 OE-06 1.OOOOE-01 8.OOOOE-01 14 6.2828E-06 7.0993E-06 1.OOOOE-01 9.OOOOE-01 15 8.1893E-06 9.3257E-06 5.OOOOE-02 9.5000E-01 16 1.0986E-05 1.2224E-05 2.OOOOE-02 9.7000E-01 17 1.3932E-05 1.5368E-05 1.OOOOE-02 9.8000E-01 18 1.7016E-05 2.1446E-05 1.OOOOE-02 9.9000E-01 19 2.7981 E-05 3.1725E-05 5.OOOOE-03 9.9500E-01 20 3.8422E-05 5.7278E-05 5.OOOOE-03 1.OOOOE+00 21 1.8246E-04
Table 3.6B Monte Carlo Sampling Results for the CONFIG#1 (Sequence Group CDIPEV)
Distribution: CDIPEV 10000 Samples, Using Seeds: 8314 17851 Sequence Quantified: 263 MEAN VARIANCE 6th %TILE 60th %TILE l 95th %TILE 4.2089E-06 7.3374E-12 l 1.7503E-06 J 3.2273E-06 8.7040E-06 BIN BOUNDARY VALUE DISCRETE CUMULATIVE 1 8.8l11 E-07 1.1925E-06 5.0000E-03 5.OOOOE-03 2 1.2936E-06 1.3530E-06 5.OOOOE-03 1.OOOOE-02 3 1.4047E-06 1.4760E-06 1.OOOOE-02 2.0000E-02 4 1.5391 E-06 1.5861 E-06 1.OOOOE-02 3.0000E-02 5 1.6197E-06 1.6883E-06 2.OOOOE-02 5.OOOOE-02 6 1.7503E-06 1.8714E-06 5.0000E-02 1.0000E-01 7 1.9813E-06 2.1565E-06 1.OOOOE-01 2.0000E-01 8 2.3199E-06 2.4586E-06 1 1.OOOOE-013.0000E-01 9 2.5883E-06 2.7465E-06 1.OOOOE-01 4.OOOOE-01 10 2.9013E-06 3.0607E-06 1.OOOOE-01 5.OOOOE-01 11 3.2273E-06 3.4143E-06 1.OOOOE-01 6.0000E-01 12 3.6172E-06 3.8698E-06 1.0000E-01 7.OOOOE-01 13 4.1608E-06 4.5174E-06 1.OOOOE-01 8.0000E-01 14 4.9333E-06 5.5954E-06 1.OOOOE-01 9.0000E-01 15 6.4895E-06 7.3487E-06 5.0000E-02 9.5000E-01 16 8.7040E-06 9.8300E-06 2.OOOOE-02 9.7000E-01 17 1.1150E-05 1.2223E-05 1.OOOOE-02 9.8000E-01 18 1.3786E-05 1.7209E-05 1.OOOOE-02 9.9000E-01 19 2.1314E-05 2.3706E-05 5.OOOOE-03 9.9500E-01 20 2.7797E-05 5.5878E-05 5.OOOOE-03 1.0000E+00 21 4.41OOE-04
Table 3.6C Monte Carlo Sampling Results for the CONFIG#1 (Sequence Group FLOODS)
Distribution: FLOODS 10000 Samples, Using Seeds: 8314 17851 Sequence Quantified: 124 MEAN [ VARIANCE 5th %TILE 50th %TILE 95th %TILE
.3227E-06 6.5392E-13 6.2256E-07 1.0475E-06 2.5769E-06 BIN BOUNDARY VALUE DISCRETE CUMULATIVE 1 3.1563E-07 4.5064E-07 5.OOOOE-03 5.OOOOE-03 2 4.8952E-07 5.0793E-07 5.OOOOE-03 1.OOOOE-02 3 5.2039E-07 5.4064E-07 1.OOOOE-02 2.0000E-02 4 5.5944E-07 5.7331 E-07 1.OOOOE-02 3.OOOOE-02 5 5.8474E-07 6.0570E-07 2.0000E-02 5.OOOOE-02 6 6.2256E-07 6.5943E.07 5.0000E-02 1.OOOE-01 7 6.9020E-07 7.4178E-07 1.0000E-01 2.OOOOE-01 8 7.8854E-07 8.3223E-07 1.0000E-01 3.0000E-01 9 8.7472E-07 9.1663E-07 1.0000E-01 4.0000E-01 10 9.5790E-07 1.001 5E-06 1.OOOOE-01 5.0000E-01 11 1.0475E-06 1.0989E-06 1.OOOOE-01 6.0000E-01 12 1.1538E-06 1.2168E-06 1.0000E-01 7.OOOOE-01 13 1.2859E-06 1.3789E-06 1.OOOOE-01 8.OOOOE-01 14 1.4900E-06 1.6686E-06 1.0000E-01 9.0000E-01 15 1.9212E-06 2.1991E-06 5.0000E-02 9.5000E-01 16 2.5769E-06 2.8669E-06 2.0000E-02 9.7000E-01 17 3.2505E-06 3.5838E-06 1.0000E-02 9.8000E-01 18 3.9181E-06 4.8492E-06 1.0000E-02 9.9000E-01 19 6.7286E-06 8.2246E-06 5.0000E-03 9.9500E-01 20 1.0677E-05 1.6686E-05 5.0000E-03 1.0000E+00 21 4.4247E-05
Table 3.7A Monte Carlo Sampling Results for the CONFIG#2 (Sequence Group ALL)
Distribution: ALL 10000 Samples, Using Seeds: 8314 17851 Sequence Quantified: 433
[ MEAN 6.1236E-06 VARIANCE 1.5562E-11 I5th %TILE 2.8963E-06 I
I 50th %TILE 4.8196E.06 I
l 95th %TILE 0.00001202 BIN BOUNDARY VALUE DISCRETE CUMULATIVE 1 1.6761 E-06 2.1403E-06 5.OOOOE-03 5.0000E-03 2 2.2878E-06 2.3556E-06 5.OOOOE-03 1.OOOOE-02 3 2.4204E-06 2.5087E-06 1.OOOOE-02 2.OOOOE-02 4 2.5843E-06 2.6539E-06 1.OOOOE-02 3.OOOOE-02 5 2.7244E-06 2.8095E-06 2.0000E-02 5.OOOOE-02 6 2.8963E-06 3.0718E-06 5.OOOOE-02 1.000E-01 7 3.2134E-06 3.4451 E-06 1.OOOOE-01 2.OOOOE-01 8 3.6463E-06 3.8285E-06 1.OOOOE-01 3.OOOOE-01 9 4.0241 E-06 4.2226E-06 1.OOOOE-01 4.OOOOE-01 10 4.4159E-06 4.6148E-06 1.OOOOE-01 5.OOOOE-01 11 4.8196E-06 5.0667E-06 1.OOOOE-01 6.OOOOE-01 12 5.3256E-06 5.6243E-06 1.OOOOE-01 7.OOOOE-01 13 5.9585E-06 6.4174E-06 1.0000E-01 8.0000E-01 14 6.9417E-06 7.7876E-06 1.OOOOE-01 9.OOOOE-01 15 8.9533E-06 1.0234E-05 5.OOOOE-02 9.5000E-01 16 1.2020E-05 1.3636E-05 2.OOOOE-02 9.7000E-01 17 1.6023E-05 1.7738E-05 1.OOOOE-02 9.8000E-01 18 2.0543E-05 2.5084E-05 1.OOOOE-02 9.9000E-01 19 3.1829E-05 3.8688E-05 5.OOOOE-03 9.9500E-01 20 4.6405E-05 6.6594E-05 5.OOOOE-03 1.OOOOE+00 21 1.1716E-04
I Engineering Report I
- Enterny REPORT No. VY-RPT-05-001 10 Revision 0 Page 33 of 303 Table 3.7B Monte Carlo Sampling Results for the CONFIG#2 (Sequence Group CDIPEV)
Distribution: CDIPEV 10000 Samples, Using Seeds: 8314 17851 Sequence Quantified: 295 MEAN j VARIANCE 6th %TILE J 50th %TILE 95th %TILE 4.6631E-06 [ 9.1553E-12 J 1.9265E-06 l 3.5846E-06 l 9.4815E-06 BIN BOUNDARY VALUE DISCRETE CUMULATIVE 9.8689E-07 1.3184E-06 5.0000E-03 5.OOOOE-03 2 1.4553E-06 1.5050E-06 5.0000E-03 1.OOOOE-02 3 1.5476E-06 1.6167E-06 1.OOOOE-02 2.0000E-02 4 1.6804E-06 1.7390E-06 1.OOOOE-02 3.0000E-02 5 1.7892E-06 1.8615E-06 2.OOOOE-02 5.0000E-02 6 1.9265E-06 2.0613E-06 5.0000E-02 1.OOOOE-01 7 2.1790E-06 2.3693E-06 1.0000E-01 2.0000E-01 8 2.5479E-06 2.7170E-06 1.OOOOE-01 3.0000E-01 9 2.8849E-06 3.0595E-06 1.0000E-01 4.0000E-01 10 3.2279E-06 3.4039E-06 1.OOOOE-01 5.0000E-01 11 3.5846E-06 3.7975E-06 1.0000E-01 6.0000E-01 12 4.0268E-06 4.2854E-06 1.0000E-01 7.0000E-01 13 4.581 OE-06 4.9774E-06 1.OOOOE-01 8.0000E-01 14 5.4303E-06 6.1607E-06 1.0000E-01 9.0000E-01 15 7.1467E-06 8.1491 E-06 5.0000E-02 9.5000E-01 16 9.4815E-06 1.0651 E-05 2.0000E-02 9.7000E-01 17 1.2303E-05 1.3720E-05 1.OOOOE-02 9.8000E-01 18 1.5298E-05 1.8473E-05 1.OOOOE-02 9.9000E-01 19 2.3554E-05 2.7813E-05 5.0000E-03 9.9500E-01 20 3.281OE-05 6.3309E-05 5.0000E-03 1.0000E+00 21 3.1614E-04
j Engineering Report
- Entery REPORTNo.VY-RPT-05-0011O Revision 0 l Page l 34 7 of l 303 I Table 3.7C Monte Carlo Sampling Results for the CONFIG#2 (Sequence Group FLOODS)
Distribution: FLOODS 10000 Samples, Using Seeds: 8314 17851 Sequence Quantified: 138 E MEAN 1.4624E-06 VARIANCE 8.0045E-13 6th %TILE 6.9828E-07 50th %TILE 1.1 632E-06 95th %TILE 2.7982E-06 BIN BOUNDARY VALUE DISCRETE CUMULATIVE 1 3.7976E-07 4.8475E-07 5.0000E-03 5.OOOOE-03 2 5.3439E-07 5.5720E-07 5.OOOOE-03 1.0000E-02 3 5.7962E-07 6.0132E-07 1.0000E-02 2.0000E-02 4 6.1991 E-07 6.3654E-07 1.OOOOE-02 3.OOOOE-02 5 6.5300E-07 6.7692E-07 2.0000E-02 5.0000E-02 6 6.9828E-07 7.3300E-07 5.OOOOE-02 1.OOOOE-01 7 7.6377E-07 8.2314E-07 11.0000E-01 2.0000E-01 8 8.7788E-07 9.2440E-07 11.0000E-01 3.0000E-01 9 9.7020E-07 1.0175E-06 1.OOOOE-01 4.0000E-01 10 1.0665E-06 1.1 147E-06 1.0000E-01 5.0000E-01 11 1.1632E-06 1.2202E-06 1.OOOOE-01 6.0000E-01 12 1.2837E-06 1.3585E-06 1.OOOOE-01 7.OOOOE-01 13 1.4379E-06 1.5396E-06 1.OOOOE-01 8.OOOOE-01 14 1.6592E-06 1.8505E-06 1.OOOOE-01 9.0000E-01 15 2.1155E-06 2.3958E-06 5.0000E-02 9.5000E-01 16 2.7982E-06 3.0877E-06 2.0000E-02 9.7000E-01 17 3.4983E-06 3.8274E-06 1.OOOOE-02 9.8000E-01 18 4.3019E-06 5.4149E-06 1.0000E-02 9.9000E-01 19 7.4320E-06 9.2798E-06 5.0000E-03 9.9500E-01 20 1.1861 E-05 1.7881 E-05 5.0000E-03 1.OOOOE+00 21 4.4536E-05
SECTION 4 CONCLUSIONS 4.1. Acceptability of Change Based on an evaluation of the results provided in Section 3, the aggregate effect of the proposed change (i.e., use of COP to satisfy the net positive suction head (NPSH) requirements for RHR and Core Spray pumps) represents a slight change of the potential risk associated with plant operation.
a Regulatory Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting in increases of core damage frequency (CDF) below 10lry. Based on this criteria, the proposed change (i.e., use of COP to satisfy the net positive suction head (NPSH) requirements for RHR and Core Spray pumps) represents a very small change in CDF (approximately 5.78x10 7 Iry)
Regulatory Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting in increases of Large Early Release Frequency (LERF) below 107/yr. Based on this criteria, the proposed change (i.e., use of COP to satisfy the net positive suction head (NPSH) requirements for RHR and Core Spray pumps) represents a very small change in LERF (approximately 4.50x104 /ry)
Table 4.3A SPLIT FRACTION SEQUENCES - CONFIG#1 (BIN = IC)
Rank Index Initiator Frequency Failed and Multi-State Split Fractions I 5 AMS 8.2573E-09 /IISMBASE'TBFAIL'LIBASE 2 4 AFWMS 5.0983E-09 ///SMBASE*TBFAILULtBASE 3 3 APCLP 1.3488E-09 /01 FAIL102FAILI/SMBASE-TBFAIL-LIBASE Table 4.3B SPLIT FRACTION SEQUENCES - CONFIG#1 (BIN = IIIC)
Rank Index Initiator j Frequency Failed and Multi-State Split Fractions 1 3 IORV 4.40E-08 I/PIBASEI/LPFAIL CSFAIL CNBASE 2 7 IORV 1.59E-08 //IWBASE'PIBASEI/LPFAIL CSFAILICNFAIL 3 2 SORV 1.30E-08 //PIBASE-/LPFAILLCSFAIL-CNBASE 4 12 IORV 7.1 7E-09 /0201 SI/PIBASE/LPFAIL.CSFAIL*CNFAIL 5 4 LLOCA 7.03E-09 //PIBASE'/LPFAIL CSFAIL 6 4 SORV 4.69E-09 //IWBASE'PIBASE*ILPFAIVCSFAILtCNFAIL 7 4 IORV 3.18E-09 //PIBASEItHPBASE'FWTBBSILPFAIL CSFAIL CNFWF1 8 22 IORV 2.88E-09 /D1BASEI/OSFAIL A3FAIL1TWFAILV1 FAILTPI1 A/HPFAIL FWFAIL'LPFAILICSFAIL CNFAIL 9 15 IORV 2.71 E-09 /D2D1 S'/OSFAILLA4FAI LTWFAIL-V2FAI L-PI 1B/LPFAIL-CSFA IL*CNFAI L 10 7 SORV 2.11 E-09 /0201 S*/P1BASE'/LPFAIL1CSFAIL'CNFAIL 11 19 IORV 1.35E-09 /01BASE0201FIPIBASEILPFAILCSFAIL-CNFAIL 12 8 IORV 1.1 SE-09 /rTWBASE*PIBASE*IHPBASE'FWFAIL*LPFAIL CSFAILtCNFAIL
//OSFAIL RWFAIL.TWFAILN1 FAILP11 A'/TBFAIL SCBASE-FWFAIL-HPFAIL-CAFAIL CBFAIL'VAFA 13 5 R303F1 1.11E-O9 IL.VBFAIL CNFAIL-TCAFL.AICDFL.AICTFL*AIFAIL
Table 4.4A SPLIT FRACTION SEQUENCES - CONFIG#2 (BIN = IC)
Rank Index Initiator Frequency I Failed and Multi-State Split Fractions 1 5 AMS 8.2573E-09 _I/SMBASE'TBFAILULIBASE 2 4 AFWMS 5,0983E-09 jI///SMBASE-TBFAIL LIBASE 3 3 APCLP 1.3488E-09 I /01FAIL02FAIL //SMBASE TBFAIL'LIBASE Table 4.4B SPLIT FRACTION SEQUENCES - CONFIG#2 (BIN = IIIC)
Rank l Index ) Initiator J Frequency Failed and Multi-State Split Fractions 1 4 IORV 4.40E-08 //PIBASEI/LPFAIL-CSFAIL-CNBASE 2 2 RBTRF4 4.14E-08 IIIIFWFAIL RCFAIL HPFAILIPBASE*CNFAIL AICDFL AICTFL AIFAIL 3 4 RBR3F1 2.58E-08 //OSFAIL*SWFAIL TWFAILIILAFAIL'TBFAIL FWFAIL-RCFAIL HPFAILIPBASE*CAFAILIVAFAIL CN FAIL'TCAFL'RMFA1L'AICDFl.
4 3 LLOCA 2.05E-08 /MIPBASL 5 9 IORV 1.59E-08 /nWBASE*PIBASE-ILPFAIL CSFAIL CNFAIL 6 3 SORV 1.30E-08 VIPIBASE/LPFAILICSFAIL CNBASE 7 2 TBSWF 1.1 4E-08 tlOSFAIL TWFAILIGFAILIITBFAILFWFAIL RCBASE'HPRCF1 IPIG'CNFAIL'RMFAIL 8 1 IORV 9.08E-09 //IHPBASE-FWTBBS'IPBASE 9 2 TBCWF 8.90E-09 //TWFAIL-IGFAILITrrBFAIL-FWFAIL RCBASE'HPRCF1I'PIG'CNFAIL'RMFAIL 10 15 IORV 7.17E-09 10201 SIPIBASE'ILPFAIL CSFAIL CNFAIL 11 5 LLOCA 7.03E-09 //PIBASE'ILPFAIL CSFAIL 12 2 DGBF2 5.42E-09 /B3FAILO1 FAIL/IOSFAIL-A3FAIL-TWFAIL IGFAIL-/TBFAIL-FWFAIL RCBASE-HPFAILIPIG-CNFAIL 122 GBF25.42.09 RMFAIL
/S2FAIL*B4FAIL*02FAILI/OSFAIL A4FAIL*TWFAIL*IGFAILI/ITBFAIL'FWFAIL RCFAIL'HPBASE'IPIG 13 3 DGAF2 480E-09 *CAFAILCNFAIL-TCAFLRMFAIL 14 5 SORV 4.69E-09 /rTWBASEIPIBASE-ILPFAIL CSFAIL CNFAIL 15 1 RTRFT2 4.57E-09 IIOSFAILVTWFAIL/IITBFAIL FWFAIL RCFAIL HPFAIL IPBASECNFAILRMFAIL IIAFAIL-S2FAIL B4FAIL*02FAIL*/OSFAIL A4FAIL'TWFAILIGFAIL*//TBFAIL FWFAIL-RCFAIL.HPBA 16 3 DGAF1 442E-09 SEIPIG*CAFAIL.CNFAIL.TCAFL RMFAIL
Table 4.4B SPLIT FRACTION SEQUENCES - CONFIG#2 (BIN = IIIC) [continued]
Rank J Index j Initiator Frequency l Failed and Multi-State Split Fractions 17 2 DGBF1 376E-09 AAFAIL B3FAILol FAIL^/OSFAIL'A3FAIL1TWFAIL IGFAIL /ITBFAIL'FWFAILIRCBASE-HPFAILIPIGI CNFAIL*RMFAIL 18 7 IORV 3.27E-09 /1rWBASE*IHPBASETFWFAILVIPBASE 19 5 IORV 3.1 BE-09 IIPIBASE/HPBASEIFWTBBS*LPFAIL'CSFAIL'CNFWFI 20 26 IORV 2.88E-09 ID1 BASEI/OSFAILA3FAIL7WFAILIV1 FAILIPI 1A/HPFAIL FWFAIL LPFAIL CSFAILICNFAIL 21 18 IORV 2.71 E-09 /D2D1 S/OSFAIL^A4FAIL TWFAIL V2FAIL'PI 1B/LPFAIL CSFAIL CNFAIL 22 1 SORV 2.68E-09 ///HPBASE-FWTBBS-IPBASE 23 8 SORV 2.11 E-09 /0201 S/PIBASE*/LPFAIL CSFAIL*CNFAIL 24 1 WMACHF 2.07E-09 //IGFAIL'//TBFAIL FWFAIL'RCBASEIHPRCF1I'PIG'CNFAIL RMFAIL 25 1 INTSWF 1.85E-09 //OSFAIL SWFAILITWFAIL //TBFAILFWFAIL RCBASEIHPRCF1'IPBASEICNFAIL RMFAIL AICDFL 26 2 CSTF 1.62E-09 ////TBFAIL FWFAIL RCBASE'HPRCF1*IPBASE'CNFAIL RMFAIL AICDFL AICTFL*AIFAIL 27 1 AOGCNF 1.61E-O9 ////TBFAIL.FWFAIL*RCBASE*HPRCF1*IPBASE.CNFAIL.RMFAIL 28 13 IORV 1.47E-09 /0201 S*/IHPBAS E'FWFAIL'IPBAS E 29 19 IORV 1.47E-09 /01 BASE*//HPIBASETFWFAILIPBASE 30 23 I0RV 1.35E-09 /01BASE'0201F/PIBASE'/LPFAIL CSFAILtCNFAIL 31 10 IORV 1.15E-09 //1WBASE'PIBASE-/HPBASE'FWFAIL*LPFAIL'CSFAIL'CNFAIL I/0SFAIL-RWFAIL-TWFAILN1 FAILIPI1 Ar/TBFAIL'SCBASE'FWFAIL HPFAIL'CAFAIL'CBFAILVAFA 32 R303F1 1.11E-09 IL'VBFAILICNFAIL'TCAFL AICDFL AICTFLIAIFAIL 33 4 TBSWF 1.10E-09 IIOSFAIL'TWFAIL'IGFAILI//TBFAIL SCBASEIFWFAIL HPBASE*IPIG'CNFAIL RMFAIL
SECTION 5 REFERENCES (1) U.S. Nuclear Regulatory Commission, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis", Regulatory Guide 1.174, November 2002, Revision 1.
(2) Vermont Yankee Report VY-RPT-04-00004, Rev.1, WVermont Yankee PSA Model Update",
September 2004.
(3) Vermont Yankee Nuclear Power Station, Vermont Yankee Individual Plant Examination (IPE)
Submittal, December 1993.
(4) Vermont Yankee PRA Peer Review Certification Report, GE Document BWROG/PRA-2000-03, November 2000.
(5) CBI Technical Services Company, 'Failure Pressure Probabilities for Vermont Yankee Mark I Containment Vessel," January 1992.
(6) Electric Power Research Institute, "Risk Impact Assessment of Extended integrated Leak Rate Testing Intervals", EPRI TR-1 009325, December2003.
(7) Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities-1 OCFR50.54 (0"dated November 23, 1988; and Supplement 1, dated August 29, 1989.
(8) USNRC NUREG-1335, "Individual Plant Examination: Submittal Guidance," U.S.-Nuclear Regulatory Commission, August 1989.
(9) Entergy Nuclear Northeast Procedure ENN-DC-151, Rev.0, "PSA Maintenance and Update Procedure", July 2003 (10) Memo, Vincent Andersen (ERIN) to Mark Palionis (ENNE), 'EPU COP Uncertainty Discussion Template", C166030001-6716, dated October 13, 2005.
(11) U.S. Nuclear Regulatory Commission, "Water Sources for Long-Term Recirculation Cooling Following a Loss-of-Coolant Accident," Regulatory Guide 1.82, Rev. 3, November 2003.
(12) USNRC NUREG/CR-5750, 'Rates of Initiating Events at US Nuclear Power Plants: 1987 - 1995",
February 1999.
(13) Electric Power Research Institute, "Pipe Failure Study Update", EPRI-TR-102266s, April 1993.
(14) USNRC NUREG/CR-4550, Vol.1, "Analysis of Core Damage Frequency: Internal Events Methodology", dated January 1990.
(15) USNRC NUREG 1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," June 1991.
(16) Electric Power Research Institute, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin", EPRI-NP 6041 SL, Revision 1, August 1991.
(17) USNRC NUREG-1 150, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants.", December 1991.
(18) USNRC NUREG/CR-4448, "Shutdown Decay Heat Removal Analysis of a General Electric BWR3/
Mark I," Sandia National Laboratory, March 1987.
Engineering Report
- Entery REPORT No. VY-RPT-05-00 10 l Revision 0 l Page l 40 l of l 303 l d
Attachment A Top Event (VT)
Engineering Report Ene-r
--- En~ter.c REPORT No. VY-RPT-05-00110 I Revision 0 lPage l 42 l of l 303 FALLKAX THORILCI1 TORUSIVE%ITOP ErNT vt I .
I l OtRAlCff; FISID lORU'.wl PATI fAA.3 1U FECDYJZE THENEED TO OOEN vWNlT TO7=ti3 FORPKASUPR REOtMMT YOP;> i wmI r
Fo*"Pe A-1
-C' Figure A.1-A Fault Tree (VT)
Engineering Report tergy 7En REPORTNo.VY-RPT-05-0011O l Revision 0 l Page l 43 l of l 303 l
.1 vttll V-SLv FA-5 %)t >rLr W-Cl tOCAAEYENJT 3
VtT vALVE ALS 1 OP~th MMn LOCA EVErNT VT5
__I LOCAEVEPT ocYSCU rS U %9JT VAyvE V4 FMLSQ 6OG,-OF CC,.1ADth l tCAT OFEN h XOELYOFID FEflrIVAL fllotF AVAL3.E LLOCAMM?~ %IT C-T II VA6U+/-:ALA&E OJE TO LOVzIAMhJ hO Lt)7N-E FC&ER 1O uE7A:E VI; i f ODLV.O I VFALS TO CFfPlON VA PEUJ !L AT ONt r-7lAMWI 1-__'(I I LOId$ .
AC KAVERf O V152 CF A,:FO*Lk MOMbu3 2 O
? ?AFALS5 rII7A T PfEOARE,
?P3De2T. M 0 0 Figure A.1-B Fault Tree (VT)
I QIVS~trft VAIHltP~i MEN, TcP .i vr2
/I I
I C915 16 T P9AT) IF AILS TO OFEN8 VI=
tI sPVAT"FAlr, FAtS IC OrENi fAuS 'O CF ri
'T~J-f DIE~SC I
$G7 MI.XT C<'Cic VALES1 r.URNG tiksrirtr (Ttfvi OF. rAm.ro uoXTrz PAm 10CA EYET IMTECIRT vr4 hipo3.-5r. VT I
0 I I
%oEftl VALVEfAPS IC OPEN'I [EUT VYf rFALSTOCFEH V'ALVE' Ct 7A FALS 1 -ECA VALVESor rd FAILSIC OLUAILOCAEtU4 I D%O. I 1LANfErN VIW] CI.5E 4M .oWAOot o~
EVEVT J
I~
I Vrs .J VTE u:O7AT ~ t-4tt h _,
?rP;;
UV ~
V?I( JZA . lAL O V . ~Y 7FAW.fri' Ev~in VC.UfZ$ lih FALS T JOP£1 REUXOE ItOSS Of tCOISTAIWD;T ArtC1US OF LUALUAWl'UA K ATi g r A C.WF a u "lt Tr ee ( V T Figure A.1-C Fault Tree (VT)
Table A-I Basic Events for Top Event (VT)
Basic Event Basic Event Basic Event Description Name Value Ml B02NRF 5.0000 E-01 AC POWER FROM BUS 2 OR MCC-7A NOT RECOVERED MCV07AFO 8.3500 E-04 CHECK VALVE SGT.7A FAILS TO CLOSE ON DEMAND MCV07BFO 8.3500 E-04 CHECK VALVE SGT.7B FAILS TO CLOSE ON DEMAND MMOV86FC 4.3000 E-03 V86 FAILS TO OPEN ON DEMAND VIA REMOTE ACTION MMOV86MT 4.6000 E-04 V86 UNAVAILABLE DUE TO MAINTENANCE MOPTVFL1 1.3000 E-03 OPERATOR FAILS TO RECOGNIZE THE NEED TO VENT TORUS FOR PRESSURE MRDCVSFL 1.0000 E-04 RUPTURE DISC FAILS TO OPEN ON DEMAND MW86LOF 1.0000 E-04 V86 FAILS TO OPEN REMOTE ACTIONS OR LOCAL MANUAL HANDWHEEL
Split Fraction: VTFAIL Split Fraction IPFAIL Boundary Conditions None.
Engineering Report
'a Entergy REPORT No. VY-RPT-05-001 10 I Revision 0 l Page l 47 l of l 303 l Split Fraction: VTLCBS SFName SF Value Split Fraction Description VTLCBS 7.8300E.03 TORUS VENT FAILS DURING LOCA EVENT WITH LOSS OF HEAT REMOVAL. V86 OPERATED REMOTELY, BUS2/MCC-7A ARE AVAILABLE.
Split Fraction VTLCBS Boundary Conditions Basic Event State Basic Event Description MLOCAEVENT S LOCA EVENT OCCURS WITH LOSS OF CONTAINMENT HEAT REMOVAL MTRANSEVENT F TRANSIENT EVENT OCCURS WITH LOSS OF CONTAINMENT HEAT REMOVAL
Split Fraction: VTLCO2 Split Fraction Description TORUS VENT FAILS DURING LOCA EVENT. V86 OPERATED REMOTELY, FAILURE TO RECOVER BUS 21MCC-7A Split Fraction VTLCO2 Boundary Conditions Basic Event State lBasic Event Description MLOCAEVENT F LOCA EVENT OCCURS WITH LOSS OF CONTAINMENT HEAT REMOVAL MTRANSEVENT S TRANSIENT EVENT OCCURS WITH LOSS OF CONTAINMENT HEAT REMOVAL YNPB02FL F AC POWER FROM BUS 2 OR MCC-7A FAILS
AM E Engineering Report
--- E n tergy REPORT No. VY-RPT-05-001 10 Revision 0 Page 49 1of 3031 a
Split Fraction: VTTRBS Split Fraction Description TORUS VENT FAILS DURING TRANSIENT (1W) EVENT. V86 OPERATED LOCALLY, BUS 2 POWER NOT REQUIRED.
Split Fraction VTTRBS Boundary Conditions Basic Event State Basic Event Description MLOCAEVENT F LOCA EVENT OCCURS WITH LOSS OF CONTAINMENT HEAT REMOVAL MTRANSEVENT S TRANSIENT EVENT OCCURS WITH LOSS OF CONTAINMENT HEAT REMOVAL YNPB02FL S AC POWER FROM BUS 2 OR MCC-7A FAILS
Engineering Report
'En tergy REPORT No. VY-RPT-05-00110 l Revision 0 l Page l 50 l of 303 Attachment B Top Event (IP)
VIIIIl11l0; I W ll CW S t" JtG
- MICSI t coIU IVOC CNA4tAMItKI LEAKA1:OR (V I__fAF.%7 Figure B.1 - A Fault Tree (IP)
Figure B.1 - B Fault Tree (IP)
Figure B.1 - C Fault Tree (IP)
Engineering Report Entergy REPORT No. VY-RPT-05-0011O l Revision 0 l Page I 54 1 of 1 303 b
FAAURE OFI HE OkWtA 1.
PJRGE 1JiD VENT PATH:
. : .: I - :
- . I 10 ;e
~At~ *I~kI~ Rt
- fAtLtUt£Cf lHEORVtWLI..
f'PiIMGANDVt'(t PA'*1 45~
I AO)sS-lseArAiLSTc I
CDSF LOSr OR FcitFMAN cl osr OR nx:05FO Ri AO. AL 0 -, A,&If1-
.5M . NT RVAM _I _ _ANFRICCM
,7
' '19
-,(AQ1IAL
- 7. '7--:
. 4_ _ _
Figure B.1 - D Fault Tree (IP)
Engineering Report
-- Entergy REPORT No. VY-RPT-05-001 10 I Revision 0l Page l 55 l of 1 303 l rim'cR Cc vA PVrc Am V.T PAT6-pEP. X216p I.. -- 12 3 Poel \ /
11 /
FAJ.URE Cf YAV PR*fE AND VEMT PATNFEN X.215I L) nw PU AND VENT LPli IFALURZ OF 4k, FAtURE . CONTAET4 E .mim
. -'.'_.ATH P3a : 1PI?
,I'm FopA?
I.I AO SSI 13r6BPALS TO . A-SB1-19 e FALS IO flOSE ON CEAMMD WtrEiS CL;iEOQFEVJJCL0SED PWRIALLyMNP-
. . .: :: - . :. .1
. -1A' F . . .. . .. I X ) _
A)SE 16 t97t CALS ro A0%S&M7 1ft9N :r[A tY REHAri -- S& O[NA CLOSE s1Fi.STO
... . . : AMP I I 5£ SE 6 TOJF IN MWLY CpEf. Ac11UV15 TOCFiAS TO
.... . 0.05£ 0
O?GEW'
. 1"WrCPEN
- 5. f J 0O U Figure B.1 - E Fault Tree (IP)
Figure B.1 - F Fault Tree (IP)
Engineering Report isEnftergy REPORT No. VY-RPT-05-001 10 I Revision 0 Page 57 1of 303
.' -O if N 11 Cbir
,ACVUI PEAtKRE FAttjP.F la PYqq \
..9. ...
VM.rw t OR b>:I>utUli;Xe
.J.CULV fREP:flOI*#
- FAURt VADUU LRiAWURLItl ' VACUttM t'JASEFAV Lt C dOIA'Er NFJ1IUfF K3iZAtl"tJA11 U&F --
. -i .
P~t 1
f hc-j~jUEFcLM ER VAtL r C$ECO VALVEVMUUM i.
VAWJU BRE KERVALVtE: CECK %'LVEVAOJIJPut CLE i '
(9- StJ 1t3 Fh'L5 T0 tRWANY MCLCEt IWEA)ER V12 tli19 128l CRlOS.LCAKA5C
.I4.2 -I. . S 2SO .
IM ~ ISCNV12"i
_ t I0~
C__)b t3 IAFAJ:.S W LM. l PA Pis I~u Fl.Wi N' $ .W aedt H FiYXJ W A rSki
- ZW te t9 IIte FA;L% IV [toss t.Y P.M sit~"
I%1Rw-I -P UVP;;~
2JI 1Flt.l Kw.t PEW,%cl-ostC - . -11tL dL'MIM tI Lr VTAL -- VAl CLOSt I ' ' A.l ' .. - T. 1
. . . .- AG rST PAtlF -:
I - .II
_ o~ - t .. [ .*, P AZ_
(9 (9 (9 ( (9 Figure B.1 - G Fault Tree (IP)
Engineering Report 7b Enrter, REPORT No. VY-RPT-05-001 10 I RevisionO Page j 58 of l 303 I.
Ic PURGE LttE IW
- 1P) ..
10 \ /
(
I CVPU -CEL'.t-T L0t4 ISC.4 ATIO' FAAURFS (PtU
"..' X-z) ,'
FAJLWrE 1 or It CX OtlL PMiRGFsuPr Y PAT4 IPFN 1P.
X9 ....
- I s . .
"~OMIr'awA e it: H I
MUSUPPY LINE ISaATY. A CR 2 JAd ,>$JPPLY
- FAL'RUE
. .WM .. ...
3 / \
Figure B.1 - H Fault Tree (IP)
WtI MSI3ATIM)FALUFF .
FLOW PAT 2rDDWETERCR C'REATER .: .:
- - JP2 : :---. .
Te Popci; rLW'PAIII rMLEART
- GRFAr-R .:..
. P. . .: .: . .:
lI _J VWNPURGECISCLAI PN Yw TOnuE:rZ'- EAVr;IAJC FAIIIJRFS . *aHpfiRFAPFl DATOY
. ~FAUPE
.N . ,:
IOfIK 7 r . FP4UP Ft f I Figure B.1 - I Fault Tree (IP)
- Sl.qa.ATlCAj FA: UhR,FSl PA1H r D.1A4tERfi :
CI.EAR . :
i 1
[ARFAlF R -E'
'. WPIt .
I....... I DE'PUre-: Lt DI-UStV4 CW talmUtrrIT~ r~o F&LURFS DA.
- WUFlSOt ArC;
.. irl . : .: :-. r4 frrP rI
.D.W EPLPWNTI RAFN OWfL DRNtAMbVt.
ISlLA.OtI FlAA f P Et: f LUR L j{ k' .A*:
.. .. .. .. . .I '.' . .:. .1 .
. p11 QT ............... O ........ .....
I I .
I
~~5 O A V X~~ tIAv MC2FO S v AW (9 (9 9 (9 Figure B.1 -J Fault Tree (IP)
WYj PURGE VNlE t,9 tUPJ
. rhtL s '.
lopo-AWIP Wl PJRE LIU LSOLATMU
- F~AURE3 . '
I :.-. --.-- :
I F§KIVRE OF WN Ft'R%; ANJD FA.LUIE- ( O' hPVRr
%^v1 PATH Fo: 2151) ts'2JLv PATW4 "n -
. IF .4
]F13 rnaNx LPI1v 1
A"VPJRE5ESUPRFY tJE I AP CU N' FUPF% 5 JPPLY
. . t..SOLAWN~
. . . . .. JALVE .. . -. .ftitESFMt tO:I ItF
. ', - I
. .. : :" ...- .,t. .. . .
IP i -: ,:. . tt3. .- :
Frs~m P (r i\
t / ..
Ftosk E 1S10FJIES ID OPEtJAtEC FAl5 TOCLOSE
. Raw ' '-r'.
., -~:.
- N I - - emmiCx I 0 I IE a IF,N6lICVVLAUY GFPt- A,) SEtS li tWM. TO I
-..... : i CLW-ON 'HWAND ';
I tSS5 'IJk--oi .. _ Isxr. 17 5 O-ED Figure B.1 - K Fault Tree (IP)
Table B-1 Basic Events for Top Event (IP)
Basic Event Basic Event Basic Event Description Name Value ISAVI 1AOP 3.0492 E-05 AO.SB.16.1 9.1 IA FAILS TO REMAIN CLOSED ISAV1 1BOP 3.0492 E-05 AO.SB.16.1 9.1 1B FAILS TO REMAIN CLOSED ISAV2082FO 1.4150 E-03 AO.20.82 FAILS TO CLOSE ON DEMAND ISAV2083FO 1.4150 E-03 AO.20.83 FAILS TO CLOSE ON DEMAND ISAV2094FO 1.4150 E-03 AO.20.94 FAILS TO CLOSE ON DEMAND ISAV2095FO 1.4150 E-03 AO.20.95 FAILS TO CLOSE ON DEMAND ISAVSB1OFO 1.5215 E-03 AO.SB.16.1 9.1 0 FAILS TO CLOSE ON DEMAND ISAVSB100P 3.0492 E-05 AO.SB.16.19.1 0 FAILS TO REMAIN CLOSED ISAVSB100PEN 2.0000 E-02 AO.SB.16.19.10 INITIALLY OPEN ISAVSB23FO 1.5215 E.03 AO.SB.16.19.23 FAILS TO CLOSE ON DEMAND ISAVSB230P 3.0492 E-05 AO.SB.16.19.23 FAILS TO REMAIN CLOSED ISAVSB23OPEN 2.0000 E-02 AO.SB.16.19.23 INITIALLY OPEN ISAVSB6AFO 1.5215 E-03 AO.SB.16.19.6A FAILS TO CLOSE ON DEMAND ISAVSB6AOP 3.0492 E405 AO.SB.16.19.6A FAILS TO REMAIN CLOSED ISAVSB6AOPEN 2.0000 E-02 AO.SB.16.19.6A INITIALLY OPEN ISAVSB6BFO 1.4150 E403 AO.SB.1 6.19.6B FAILS TO CLOSE ON DEMAND (VALVE IS NORMALLY OPEN)
ISAVSB6FO 1.4150 E-03 AO.SB.1 6.19.6 FAILS TO CLOSE ON DEMAND (VALVE IS NORMALLY OPEN)
ISAVSB7AFO 1.5215 E403 AO.SB.16.19.7A FAILS TO CLOSE ON DEMAND ISAVSB7AOP 3.0492 E-05 AO.SB.16.19.7A FAILS TO REMAIN CLOSED ISAVSB7AOPEN 2.0000 E402 AO.SB.16.19.7A INITIALLY OPEN ISAVSB7BFO 1.5215 E403 AO-SB1 6.119.7B FAILS TO CLOSE ON DEMAND ISAVSB7BOP 3.0492 E405 AO.SB.16.19.7B FAILS TO REMAIN CLOSE ISAVSB7BOPEN 2.0000 E-02 AO.SB.16.19.7B INITIALLY OPEN ISAVSB7FO 1.5215 E-03 AO.SB.16.19.7 FAILS TO CLOSE ON DEMAND ISAVSB70P 3.0492 E-05 AO.SB.16.19.7 FAILS TO REMAIN CLOSED ISAVSB70PEN 2.0000 E-02 AO.SB.16.19.7 INITIALLY OPEN ISAVSB8FO 1.5215 E-03 AO.SB.16.19.8 FAILS TO CLOSE ON DEMAND ISAVSB80P 3.0492 E-05 AO.SB.16.19.8 FAILS TO REMAIN CLOSED ISAVSB80PEN 2.0000 E-02 AO.SB.16.19.8 INITIALLY OPEN ISAVSB9FO 1.5215 E-03 AO.SB.16.19.9 FAILS TO CLOSE ON DEMAND ISAVSB9OP 3.0492 E-05 AO.SB.1 6.19.9 FAILS TO REMAIN CLOSED ISAVSB9OPEN 2.0000 E-02 AO.SB.16.19.9 INITIALLY OPEN ISCISFAILS 1.0000 E-04 CONTAINMENT ISOLATION SIGNAL FAILS ISCVI2AOP 1.2000 E-04 CHECK VALVE VACUUM BREAKER V12.16.19.12A GROSS LEAKAGE ISCV12BOP 1.2000 E404 CHECK VALVE VACUUM BREAKER V12.16.19.12B GROSS LEAKAGE ISDWLGLEAK 2.4700 E404 PRE.EXISTING CONTAINMENT RUPTURE (LARGE OPENING)
ISDWSMLEAK 2.4700 E404 PRE.EXISTING CONTAINMENT LEAKAGE (SMALL OPENING)
ISOPLLFL 3.4000 E-01 OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA ISOPSIGFL 3.2000 E-02 OPERATOR FAILS TO ISOLATE PATH DURING ALL EVENTS OTHER THAN LOCALG
Split Fraction: IPBASE Split Fraction IPBASE Boundary Conditions Basic Event I State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPLLFL S OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL S NO 125VAC POWER FROM INSTRUMENT AC BUS YNPVACFL S NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPBASL SF Name SF Value Split Fraction Description IPBASL 8.8324E-04 CNT ISOL FAILS (LLOCA) - ALL SUPPORT SYS AVAIL Split Fraction IPBASL Boundary Conditions Basic Event j State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPSIGFL S OPERATOR FAILS TO ISOLATE PATH DURING ALL EVENTS OTHER THAN LARG XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL S NO 125V AC POWER FROM INSTRUMENT AC BUS YNPVACFL S NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Engineering Report a En tergy REPORT No. VY-RPT-05-0011O l Revision 0 l Page l 65 l of l 303 l Split Fraction: IPFAIL Split Fraction IPFAIL Boundary Conditions None.
Split Fraction: IPGVIL SF Name SF Value Split Fraction Description IPGVIL 1.1232E-03 CNT ISOL FAILS (LLOCA) -- IG 6 VITAL/INSTR AC FAIL Split Fraction IPGVIL Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPSIGFL S OPERATOR FAILS TO ISOLATE PATH DURING ALL EVENTS OTHER THAN LARG XNSIASFL F LOSS OF PLANT INSTRUMENT AIR YNPIACFL F NO 125V AC POWER FROM INSTRUMENT AC BUS YNPVACFL F NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPIAC SF Name SF Value Split Fraction Description IPIAC [ 9.7243E-04 CONT. ISOL. FAILS - INSTR AC FAILS Split Fraction IPIAC Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPLLFL S OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL F NO 125VAC POWER FROM INSTRUMENT AC BUS YNPVACFL S NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Engineering Report imEntergoy REPORT No. VY-RPT-05-O01 10 Revision 0 Page 68 of 303 Split Fraction: IPIACL SF Name SF Value Split Fraction Description IPIACL 1.0032E.03 CNT ISOL FAILS (LLOCA) - INSTR AC FAILS Split Fraction IPIACL Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPSIGFL S OPERATOR FAILS TO ISOLATE PATH DURING ALL EVENTS OTHER THAN LARG XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL F NO 125V AC POWER FROM INSTRUMENT AC BUS YNPVACFL S NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPIG SF Name SF Value Split Fraction Description IPIG 1.0924E-03 CONT. ISOL. FAILS - IG FAILS Split Fraction IPIG Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPLLFL S OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA XNSIASFL F LOSS OF PLANT INSTRUMENT AIR YNPIACFL S NO 125V AC POWER FROM INSTRUMENT AC BUS YNPVACFL S NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPIGAC SF Name SF Value lSplit Fraction Description IPIGAC 1.0924E-03 CONT. ISOL. FAILS - IG & VITAL/INSTRU AC FAIL Split Fraction IPIGAC Boundary Conditions Basic Event State l Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPLLFL S OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA XNSIASFL F LOSS OF PLANT INSTRUMENT AIR YNPIACFL F NO 125V AC POWER FROM INSTRUMENT AC BUS YNPVACFL F NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPIGL SF Name SF Value Split Fraction Description IPIGL 1.1 232E-03 CNT ISOL FAILS (LLOCA) - IG FAILS Split Fraction IPIGL Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPSIGFL S OPERATOR FAILS TO ISOLATE PATH DURING ALL EVENTS OTHER THAN LARG XNSIASFL F LOSS OF PLANT INSTRUMENT AIR YNPIACFL S NO 125V AC POWER FROM INSTRUMENT AC BUS YNPVACFL S NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPSE SF Name SF Value Split Fraction Description IPSE 3.2849E-02 CONT. ISOL FAILS - SE PORTION OF RPS SIGNAL Split Fraction IPSE Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISCISFAILS F CONTAINMENT ISOLATION SIGNAL FAILS ISOPLLFL S OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL S NO 125V AC POWER FROM INSTRUMENT AC BUS YNPVACFL S NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPVAC SF Name SF Value Split Fraction Description IPVAC 9.7243E-04 CONT. ISOL. FAILS - VITAL AC FAILS Split Fraction IPVAC Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPLLFL S OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL S NO 125VAC POWER FROM INSTRUMENTAC BUS YNPVACFL F NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPVACL SF Name SF Value Split Fraction Description IPVACL 1.0032E-03 CNT ISOL FAILS (LLOCA) -VITAL AC FAILS Split Fraction IPVACL Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPSIGFL S OPERATOR FAILS TO ISOLATE PATH DURING ALL EVENTS OTHER THAN LARG XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL S NO 125VAC POWER FROM INSTRUMENT AC BUS YNPVACFL F NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Engineering Report Split Fraction: IPVIAC SF Name SF Value Split Fraction Description IPVIAC 1.0924E-03 CONT. ISOL. FAILS - VITAL & INSTRU AC FAIL Split Fraction IPVIAC Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPLLFL S OPERATOR FAILS TO ISOLATE PATH DURING LARGE LOCA XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL F NO 125VAC POWER FROM INSTRUMENT AC BUS YNPVACFL F NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Split Fraction: IPVIL Split Fraction IPVIL Boundary Conditions Basic Event State Basic Event Description IERCSFL S INITIATING EVENT CAUSES RCS FAILURE OUTSIDE CONTAINMENT ISOPSIGFL S OPERATOR FAILS TO ISOLATE PATH DURING ALL EVENTS OTHER THAN LARG XNSIASFL S LOSS OF PLANT INSTRUMENT AIR YNPIACFL F NO 125VAC POWER FROM INSTRUMENTAC BUS YNPVACFL F NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE
Engineering Report
-- Entergy REPORT No. VY-RPT-5-OO0110 Revision 0 Page 77 of 39 Attachment C Top Event (Al)
Engineering Report
--Entergy REPORT No. VY-RPT-05-001 10 I Revision 0 l Page l 78 l of l 303 l Figure C.IA Fault Tree (IP)
Engineering Report
-- Entergvy REPORT No. VY-RPT-05-001 10 I Revision 0 1 Page 1 79 l of 1 303 1 Figure C.1 B Fault Tree (IP)
NUtI'P4 lAFARS OULLUtR FLaC Accl 3 F_. . .
fU /
I' 2lUF P4tIAFAAISTODUFAtR Frw PLWPKPaIA FPJ$ 310 1SAAR P1U4WPt IAMLS TOUN :NEO( VALE CST ?A FM.S I "T ORES URE 15W1T:
(Ps FAk. TO rEJlKJ ruA' l P4 IA UIJVAILck WPu tUL OroD1P&ND .. D2Flj q Ltv We OP4 PS13'?5. FIS F 1A.MTER VAMERVlCE lOt 4 i14 AFtcC P.V fft 1111 . .tP44T I HN'dAT4 Figure C.1C Fault Tree (IP)
Figure C.ID Fault Tree (IP)
Engineering Report
- En tergy REPORT No. VY-RPT-05-001 10 I Revision 0 l Page 1 82 l of l 303 l Figure C.IE Fault Tree (IP)
- CIU
- sVbAILP ivANiFtk PJJPSP S3 tA*P63 tSFPL 1cbDftft1t now S1DU
'cPtwp-)
GUE4 NV.TER tRAt.SFP PAiVPSP01.A .- IWBiF.1 7ODcr.EP noLW 51DM4 I
CjM;,LvW14E P TAtI: C'EMNIdIAtER IR.AjSFR PV1AP434AFAJLS Msi;PT PgtUPP83de FAJLS 10 SIAFT cr GflAPO rsdtokiAsf SIt, W II ,I I I I CUUJ WATERTUANFR DEV1N lTER TRAIIS'E I;I C>ECt.VMVE DW137AFALS DIUINl ATERTR;A.YER CEV' I WTER TRAISFER CE' 'VLVE CW 32 FALS PVLVMP P
V I FA4 S T3!AR I DttPDE1AJR5TJO j VUP P 6S IA FtPS T, PU UJ TOOP'-t COfDOEIJ8" PUI.1P Pl3 10 FEA$TCOTVAST PWPPFC t FAS 10;PJ T C'ifNNAMtO CtI DEAUWD c L;RM LI ;Si 3 l
CDURING WZIOl TIME Il SlG ___ I L SZ rs1 L I STDCV1WIC I [ SC ss STD?: hR, Mr.01Z-C
( 9 (9 (9 0 Figure C.1F Fault Tree (IP)
-A Engineering Report E-itergy REPORTNo.VY-RPT-05-0011O l Revision 0 l Page l 84 l of l 303 l 5t I(JWLLU.L FJP V'S?1A FALS 0CELAE R FLCW SID3 Ie')l \ /
SThIUO'aItiL PJUJPP*914A FAIL '.0 rEL, FLCW
$1D11
(
I 61AIIOtNWs PtJPPPSj 5 FLi P tl IA IAr4tl aIPR FAAS X0(kfjw0'; MAsU~( *AI.E X FAIL $ I )>CC VALVEFV im FAILSI FALS 1DSTARIChDEWU ALU 10 RUt DUR;fn VISSO? ICEUAO 13 hNQEDEO 0i Di IENA10 Mr1'II Sr7,f",AS
_ STO I.'.4it I I 5TDAVnIl f C I IJt xrc II STi%',1.S2e:
C.) (9 0 0 Figure C.1G Fault Tree (IP)
Figure C.1 H Fault Tree (IP)
VALVES IltLDFl-h FU 51 WMMJUP F&l TO ORSATE STfIm To v .q VALVES tNEEDE F:P CST mArtij ra tLOOF-.tRAIE Smt'V
.E4U0CE PATEPt FAILC rM.IfKCHTEL-L TDCST ifKMh TO"ObY1tL CCQIROlI Vi(s 5T'tt2 57KH3
_H WY %AFPS TOOPEUON LfVIA2FAIS TOOI tJO rE ItA1 Uth
' FtSID FwAfQWV M t K&.W-0 l~ 1 F[!A;.otfz 1 i L;VIAIFM.STOOtEtirJCI IIUo We Lzz~szJ laV'VIA2!S'W [I I U 0 O f /-> 0 Figure C.IJ Fault Tree (IP)
4LA' ri Fx At IQ L "rFt. LCIA STDMI 1y uUUIPS FAL TODELPAE& FLOA STDWtf FlLlfREWSIEPFFWF5 vALv sbFL 1SFtyW DA rAto STATIU Wati M *VUPP.1-1A DEWNW*ATER YPN.!'fEFI F-79-&tA.P9 7BFA LTO TOCST FA S TO CENER QCH' FMIFPS F X FA)L P-6!L1A
- P463 CEtNEP. FLOW z tO DEMr .Ow STDlMtb o.~~f StV12 N- __r fm PagoI STDMA StDA V5V)6 FALS TOcPEEN O CCk VALVEM'A FALS O5W410 TO CFEII Ci DERAN STL4WJifC STVVMFC Figure C.1K Fault Tree (IP)
Figure C.AL Fault Tree (IP)
Engineering Report
- Entergy REPORT No. VY-RPT-05-001 10 I RevisionO Page 1 89 l of 303 tLt5FCI -L'J~L5IF- UI M fiEAA RS rL r~alv:N Fl$13 to Pux4. \/
ECTrICA
. . , RbTrA tt ER5 TAt rD ap4 3j UAEES j Fl31t
_ _ -I ELECTRCAL DTP8rOA "4 DC MOWL fVAEPteL$
MEjr EPS FAt TOCfERA'E AIMD CWEPArOR FALS TO
.OCXLYOFEPATE MEWtA FISISI rIS1,2 1+
, l5TF!bUlVCPI bREA-S FA.
Y;OCFEN C~l O I
t~t ER f) ERSFP TMCUCME 9-t;c CJTFoL FPM ;Rr ALS CPERATCS FAlS TDLOCA.AY ODEPAFEBPESKEn FOP
'4 atc MI VLIE<:Tr:: VALVZ.J 1 .1
.E'AIIFC I JBIA2:3 I FIS'83 b~A0'02 0D 0 T 0 DS7V. i"IL tA-1 0IC 9~l) P CPCi0-2Fp^ J Zl.'FD-'TFL Figure C.1M Fault Tree (IP)
Figure C.AN Fault Tree (IP)
Engineering Report A-En ter, REPORT No. VY-RPT-05-001 10 I Revision 0 l Page l 91 l of 1 303 1
.5 Figure C.IP Fault Tree (IP)
Engineering Report
-En tergy REPORT No. VY-RPT-05-0011O I Revision 0 l Page 92 of 1 3031 CWtMICAIL I-Afit F; STSTEuA fAJLS TODEUVEF ncraNVA tU cn CCOE SPA 2i \
CcjtDEti.TE TFRd iFER St~lit VA lSTO CCEU SF_'
SPA=
I I r
CMt.{?AtE lF*liFPF IAll,' O FAf FIJ tLf
'I t£FLA]UN -ALb IUALK.N IYSTEM KA1rWrAAEALUPES Cfwrvt COrMENs.AtE METRIATE WJEC1 cft M1 1liNSFEf FLO* TO 'Vv ~iaEIt£tt x MODIEPSEATE TRAJSFER sn IJA= CCtILLOWTL H1,OPAJITKA C, _U CCitP5A1 ' TFR~45FE1F COMt1UIATE TFRAN3ER K.FIENt OfWcOENr.AE RAIPSFA SVM FSTEUFAItSDUET*0 TIzOERM IACO PASstpi MM VtIr,t.'arAxS
_ _*___ _F_ _ _TI _ A_
fI?" F*r /,\
( 9 P.WJALVr fS At 10 2t i CF.V1 VFSA1
_C_ 1_
JKISCO.CINAO "A?41r 6L Figure C.1 R Fault Tree (IP)
ALOWAtIAdCtCI VtIf Q
- ';OUME SYSTEUVERTE2 A-!IFRUtTE RUE CT C6f.OIV
. . . jATED EN FiOv DvE R'ED EM4b.
TWR0fHso.r.Hkv?.AATfP I 2 Fvcl.
P FNFIS PVWPSDl'E 10 CFEIOIVALYC RIl UP.F c4ARG C?-EC VALVE _DOiAPsECECX VALVE VIC.ORf.CHECt.VALVE DCIwJGE 1ECl 'VALVE ri PUWDI W.r.E CA Cv iHFPAUPDisc*YP.GE CIECl VtJ IAFA S tO CLOSc ON t
- AJLS TC ttOS CJI Vr: IC TAlS TOCGCOII I C FCWtS lO 05£ Ct VAV VIC4'lA rCGS VAL V1I; CC1IQ, DEVCUo C"WID Cfu o UCRWA!Zt LCtASC LN..A^C
£W A V0 1 V10CO X WO~F0 JVCUAR J2Vtut 0/0 0 _
Figure C.1S Fault Tree (IP)
ziet4N`lcrY:s MM I EO AND RE F tMS 4C70;zZ To \~
CSTVr44tCRT is DEPIEIED AD F.EFILLFTS'S Ac2 IF I LOCAE(VWlCAuFAS S F UR£E TOPUFLL "I WTHN DME7OtN Cr CST tt H RS I TTVrAIErv __
C)1 I
FALMtE IOFEF U CSTUSprJ FeAtUP TO RFLUCS1 VIA SE ;K ATEPANO DEM1r1 CSTEM CIDEt1IGATC SYWItUJ 2THW slime
- ~sjrngF 4 IF..-
TO D(nAVrf,0 f fA OIFh II 5THFc LONGTEFMISJ.PCE PAmSW@
U F~tLAT.-
I:rf 5 EUPSi'SIEMJ
- r. Isut SiT u SSTEUAFALL'ES I 3?OFCSi1FL. St;ptOlFL 5Ttsrw' U 1 k FtiVjF"Q FKm. i.'Ni JUVAC Fri R Wisisll PRPt CS OaFRATl ,TFNwF*ur J
-o
,fhpFUft t - YNJASWL ___I C
Figure C.1T Fault Tree (IP)
tWJeA1lbAVXLAtL WCM ODIM -PLAlI
!ISO3I IO*)W.sj trWWATERAVALMAE rpc.
NMS8 Ftk! PLUP F'SO) 1-F'E ro VI;E WATER P-Ai>ADE'(F i
O'Et fIn ME WA0LIAL VALVYEW) S FALS TO PUr FAIL EO CPEPAE CPEN IAtCeF FlSt2 U 1+r P Q tADIESE.1 rQArEPJ tE Pal 'A W5Ef VMU FIRE OTIRok.IEW F5t E' PAtV I& U&VA L&aE DUEJ TO F&Lt'1E TOPEALVI P IA Ri;rFMAS TO SA 1 pFl)' c¢ts TO FLit" CHECKVALYE ATERMAmNTEIRiCt 1.,WAFSJ$,AFR A6!x5F WJ1W1IT JhEXIWt' Figure C.1 U Fault Tree (IP)
JJKtI(AILA ftACt'lU?1U.
AIL1O~rEIO.tJ;L1.CKPC to P '
11sl ALIERNAff tECTt0tJbt Ait TO JOL'4 OCwt Wdr r1) D AU
$cERAVAA2LE DEM3E t I
A1lEt~ANA 04JECTIUWNS MlZ P-SIt II /\
(7T Lc1R0V CYIIIIIT E IE V; uW 13 W FIS TO OENJ O DEMO3 IEU .EW TOMR!t VALVE !. Hr1YE5LtaIcL AJ, to tsI FSTO OPtI or, V. "zD D~OEUA-0 t VALVE
'.lYJ 027AFFrSTOr14fE NV~t> V.'7AFC _
( 9 U Figure C.1V Fault Tree (IP)
al Figure C.IW Fault Tree (IP)
Table C-1 Basic Events for Top Event (Al)
Basic Event Basic Event Basic Event Description Name Value BMC08BFL 9.9504 E-07 480V MCC.8B FAILS/SHORTS DURING MISSION TIME BMC09BFL 9.9504 E-07 480V MCC.98 FAILS/SHORTS DURING MISSION TIME BMC89AFL 9.9504 E-07 480V MCC.89A FAILS/SHORTS DURING MISSION TIME HCV48ACFC 1.6700 E.03 LOOP CHECK VALVES FAIL TO CLOSE ON DEMAND HCVCST7AFC 1.8272 E-04 CHECK VALVE CST 7A FAILS TO OPEN HCVCST7BFC 1.8272 E-04 CHECK VALVE CST 7B FAILS TO OPEN HHEP4AMT 1.0000 E-04 FAILURE TO REALIGN PUMP P4-4A AFTER MAINTENANCE HHEP4BMT 1.0000 E-04 FAILURE TO REALIGN PUMP P4-1 B AFTER MAINTENANCE HHP41AFR 8.1190 E-04 PUMP P4.1A FAILS TO RUN DURING MISSION TIME HHP41AFS 3.0597 E-03 PUMP P4.1A FAILS TO START ON DEMAND HHP41AMT 2.1000 E-03 PUMP P4-1A UNAVAILABLE DUE TO MAINTENANCE HHP41 BFR 8.1190 E-04 PUMP P4.1 8 FAILS TO RUN DURING MISSION TIME HHP41 BFS 3.0597 E-03 PUMP P4.1 B FAILS TO START ON DEMAND HHP41 BMT 2.1 000 E-03 PUMP P4-1B UNAVAILABLE DUE TO MAINTENANCE HOPATINJL 3. 000E-02 OPERATOR FAILS TO ALIGN ALTERNATE INJECTION USING HOPALTINJFL 3.1000 E-02 CONDENSATE TRAIN HPFCONTFL 1.0000 E-04 CONDENSATE TRANSFER SYSTEM FAILS DUE TO PASSIVE FAILURE HPS1075AFL 3.0139 E-07 SUCTION PRESSURE SWITCH PS.107.5A FAILS HPS1075BFL 3.0139 E-07 SUCTION PRESSURE SWITCH PS.107.5B FAILS HVV7OA71AFL 2.0000 E-04 MANUAL VALVES FAIL TO OPEN J2P01AFR 2.4641 E-02 P40.1A DIESEL DRIVEN FIRE PUMP FAILS TO RUN J2P01AFS 3.3088 E-02 P 40.1 A DIESEL DRIVEN FIRE PUMP FAILS TO START J2P01AMT 6.7800 E-04 P40-1A UNAVAILABLE DUE TO MAINTENANCE JB1AIIFC 2.5975 E-03 DISTRIBUTION BREAKERS FAIL TO OPEN JB1AI2FO 9.6594 E-03 DISTRIBUTION BREAKERS FAIL TO CLOSE JCV01AFO 8.3529 E-04 DISCHARGE CHECK VALVE V70.1A FAILS TO CLOSE ON DEMAND JCV01BO 8.3529 E-04 DISCHARGE CHECK VALVE .B FAILS TOCLOSE.ON DEMAND JCV01 CFO 8.3529 E-04 DISCHARGE CHECK VALVE V70.1C FAILS TO CLOSE ON DEMAND
Table C-1 Basic Events for Top Event (Al) (continued)
Basic Event Basic Event B . .c.
Name Value Basic Event Descnpton JCV01 DFO 8.3529 E-04 DISCHARGE CHECK VALVE V70.1 D FAILS TO CLOSE ON DEMAND JCV48AFL 1.2860 E-05 RHR PUMP DISCHARGE CHECK VALVE V10.48A GROSS LEAKAGE JCV48CFL 1.2860 E-05 RHR PUMP DISCHARGE CHECK VALVE V10.48C GROSS LEAKAGE JCV63BFL 1.2860 E-05 MOTOR DRIVEN FIRE PUMP DISCHARGE CHECK VALVE V76.3A GROSS LEAKAGE JDGJDDFR 7.4434 E-02 JOHN DEERE DIESEL GENERATOR FAILS TO RUN DURING MISSION TIME JDGJDDFS 2.1373 E-02 JOHN DEERE DIESEL GENERATOR FAILS TO START JDGJDDMT 9.8200 E-04 JOHN DEERE DIESEL GENERATOR UNAVAILABLE DUE TO MAINTENANCE JHE401AMT 1.0000 E-04 FAILURE TO REALIGN P40-1A AFTER MAINTENANCE JHEJDDMT 1.0000 E-04 FAILURE TO REALIGN JDD AFTER MAINTENANCE JMV183FC 4.2953 E-03 EMERGENCY INTERTIE VALVE MOV.10.183 FAILS TO OPEN ON DEMAND JMV184FC 4.2953 E-03 EMERGENCY INTERTIE VALVE MOV.10.184 FAILS TO OPEN ON DEMAND JMV27AFC 4.2953 E-03 RHR TO VESSEL INJECT VALVE MOV.1 0.27A FAILS TO OPEN ON DEMAND JOPFISO1 1.0000 E-01 OPERATOR FAILS TO INITIATE FIRE SYSTEM AND J.D. DIESEL FOR Al JOPFIS02 6.0000 E-02 OPERATOR FAILS TO LOCALLY OPERATE BREAKERS FOR ALTERNATE JOPFIO2 60000E-02 INJECTION JVL1 11 FO 1.5215 E-03 SW DISCHARGE MANUAL VALVE V70.1 OR V70.11 FAILS TO CLOSE JVL768FC 1.5215 E-03 FIRE TO SERVICE WATER MANUAL VALVE V70.8 FAILS TO OPEN QPLCNSFL 5.1300 E-03 LOSS OF PLANT CONDENSATE SYSTEM STDAVRIOFC 1.5215 E-03 AOV R.10 FAILS TO OPEN ON DEMAND STDCV105FC 1.8272 E-04 CHECK VALVE PW.105 FAILS TO OPEN ON DEMAND STDCV32AFC 1.8272 E-04 CHECK VALVE DW.32A FAILS TO OPEN ON DEMAND STDCV32BFC 2.6906 E-04 CHECK VALVE DW.32B FAILS TO OPEN ON DEMAND STDCV37AFC 1.8272 E-04 CHECK VALVE DW.37A FAILS TO OPEN ON DEMAND STDCV42AFC 1.8272 E-04 CHECK VALVE H.42A FAILS TO OPEN ON DEMAND STDCV44AFC 1.8272 E-04 CHECK VALVE H.44A FAILS TO OPEN ON DEMAND STDMV36FC 4.2953 E-03 MOV.36 FAILS TO OPEN ON DEMAND STDPFO1 FL 1.0000 E-04 PASSIVE FAILURES IN THE MAKEUP SYSTEM STDPP63AFR 8.1190 E-04 DEMIN WATER TRANSFER PUMP P.63.1A FAILS TO RUN DURING MISSION TIME
Table C-1 Basic Events for Top Event (Al) (continued)
Basic Event Basic Event Basic Event Description Name Value STDPP63AFS 3.0597 E-03 DEMIN WATER TRANSFER PUMP P.63.1A FAILS TO START ON DEMAND STDPP63BFR 8.1190 E-04 DEMIN WATER TRANSFER PUMP P.63.1 B FAILS TO RUN DURING MISSIO STDPP63BFS 3.0597 E-03 DEMIN WATER TRANSFER PUMP P.63.1 B FAILS TO START ON DEMAND STDPP79AFR 8.1190 E-04 FILTER BOOSTER PUMP P.79.1A FAILS TO RUN DURING MISSION TIME STDPP79AFS 3.0597 E-03 FILTER BOOSTER PUMP P.79.1A FAILS TO START ON DEMAND STDPP79BFR 8.1190 E-04 FILTER BOOSTER PUMP P.79.1 B FAILS TO RUN DURING MISSION TIME STDPP79BFS 3.0597 E-03 FILTER BOOSTER PUMP P.79.1 B FAILS TO START ON DEMAND STDPP97AFR 8.2010 E-04 STATION WELL PUMP P.97.1A FAILS TO RUN DURING MISSION TIME STDPP97AFS 3.2899 E.03 STATION WELL PUMP P.97.1A FAILS TO START ON DEMAND STDW1 06FC 1.0000 E-04 MANUAL VALVE PW.1 06 FAILS TO OPEN ON DEMAND STOPCSTI FL 5.0000 E-02 OPERATOR FAILS TO REFILL CST FOR LONG TERM SOURCE TAV1A2FC 1.5215 E403 LCV.1A.2 FAILS TO OPEN ON DEMAND TAVIA3FC 1.5215 E-03 LCV.1A.3 FAILS TO OPEN ON DEMAND TMV55AFC 4.2953 E-03 MOV 55A FAILS TO OPEN ON DEMAND TMV55BFC 4.2953 E403 MOV 55B FAILS TO OPEN ON DEMAND TSTPFHWFL 1.0000 E-04 PASSIVE FAILURES IN HOTWELL SYSTEM YNPBU9FL 5.0000 E-01 NO 480V AC POWER FROM BUS 9 (SII)
ZNPDCIFL 5.0000 E-01 NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
ZNPDC2FL 5.0000 E-01 NO 125V DC POWER FROM DISTR. PANEL DC-2 (DII)
Split Fraction: AIBASE Split Fraction Description ALTERNATE CORE COOLING SYSTEMS; 2 TRAINS OF CRD AND CONDENSATE TRANSFER AVAILABLE (BASECASE)
Split Fraction AIBASE Boundary Conditions Basic Event State Basic Event Description CORESPAVAIL F CORE SPRAY SUPPORT SYSTEMS NOT AVAILABLE HALTCOOLINGFL S FAILURE OF ALTERNATE COOLING MODE HCONDFLOWFL S LPCI AND CORE SPRAY FAIL TO DELIVER CONDENSATE TRANSFER FLOW TO HCSHARDWAREFL S CORE SPRAY HARDWARE FAILURE HOPALIGNFL F OPERATOR FAILS TO ALIGN CORE SPRAY FROM CST NOCSTWATER S LOCA EVENT CAUSES DEPLETION OF CST NOSBO S NO 560 CONDITION EXISTS TSSRWSFL S LOSS OF STATION SERVICE WATER SYSTEM VRBCCWFL S LOSS OF RBCCW SYSTEM YESSBO S SBO CONDITION EXISTS YNPBU2FL S NO 4KV AC POWER FROM BUS 2 YNPBU7FL S NO 480V AC POWER FROM MCC'S 7B AND 7C (ASSOC; W/ 4KV BUS 2)
YNPBU8FL S NO 480V AC POWER FROM BUS 8 (SI)
YNPBU9FL S NO 480V AC POWER FROM BUS 9 (SII)
ZNPDC1 FL S NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
ZNPDC2FL S NO 125V DC POWER FROM DISTR. PANEL DC-2 (DII)
Split Fraction: AICRAF SF Name SF Value Split Fraction Description AICRAF 2.9494E-04 1ALT CORE CLG; CRD A FAILED (AC4 OR D2 FAILED)
Split Fraction AICRAF Boundary Conditions Basic Event State Basic Event Description CORESPAVAIL F CORE SPRAY SUPPORT SYSTEMS NOT AVAILABLE HALTCOOLINGFL S FAILURE OF ALTERNATE COOLING MODE HCONDFLOWFL S LPCI AND CORE SPRAY FAIL TO DELIVER CONDENSATE TRANSFER FLOW TO HCSHARDWAREFL S CORE SPRAY HARDWARE FAILURE HOPALIGNFL F OPERATOR FAILS TO ALIGN CORE SPRAY FROM CST NOCSTWATER S LOCA EVENT CAUSES DEPLETION OF CST NOSBO S NO SBO CONDITION EXISTS TSSRWSFL S LOSS OF STATION SERVICE WATER SYSTEM VRBCCWFL S LOSS OF RBCCW SYSTEM YESSBO S SBO CONDITION EXISTS YNPBU2FL S NO 4KV AC POWER FROM BUS 2 YNPBU7FL S NO 480V AC POWER FROM MCC'S 7B AND 7C (ASSOC; WI 4KV BUS 2)
YNPBU8FL S NO 480V AC POWER FROM BUS 8 (SI)
YNPBU9FL F NO 480V AC POWER FROM BUS 9 (SII)
ZNPDC1 FL S NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
ZNPDC2FL F NO 125V DC POWER FROM DISTR. PANEL DC-2 (DII)
Split Fraction: AICRBF SF Name SF Value Split Fraction Description AICRBF 2.9494E-04 ALT CORE CLG; CRD 'B' FAILED (AC3 OR D1 FAILED)
Split Fraction AICRBF Boundary Conditions Basic Event State Basic Event Description CORESPAVAIL F CORE SPRAY SUPPORT SYSTEMS NOT AVAILABLE HALTCOOLINGFL S FAILURE OF ALTERNATE COOLING MODE HCONDFLOWFL S LPCI AND CORE SPRAY FAIL TO DELIVER CONDENSATE TRANSFER FLOW TO HCSHARDWAREFL S CORE SPRAY HARDWARE FAILURE HOPALIGNFL F OPERATOR FAILS TO ALIGN CORE SPRAY FROM CST NOCSTWATER S LOCA EVENT CAUSES DEPLETION OF CST NOSBO S NO SBO CONDITION EXISTS TSSRWSFL S LOSS OF STATION SERVICE WATER SYSTEM VRBCCWFL S LOSS OF RBCCW SYSTEM YESSBO S SBO CONDITION EXISTS YNPBU2FL S NO 4KV AC POWER FROM BUS 2 YNPBU7FL S NO 480V AC POWER FROM MCC'S 7B AND 7C (ASSOC; W/ 4KV BUS 2)
YNPBU8FL F NO 480V AC POWER FROM BUS 8 (SI)
YNPBU9FL S NO 480V AC POWER FROM BUS 9 (SII)
ZNPDC1FL F NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
ZNPDC2FL S NO 125V DC POWER FROM DISTR. PANEL DC-2 (DII)
Split Fraction: AICRBS SF Name SF Value Split Fraction Description AICRBS 1.1 536E.02 ALTERNATE CORE COOLING SYSTEM; CONDENSATE TRANSFER AVAIL. WITH CRD FAILED INJECTION Split Fraction AICRBS Boundary Conditions Basic Event State Basic Event Description CORESPAVAIL F CORE SPRAY SUPPORT SYSTEMS NOT AVAILABLE HALTCOOLINGFL F FAILURE OF ALTERNATE COOLING MODE HCONDFLOWFL S LPCI AND CORE SPRAY FAIL TO DELIVER CONDENSATE TRANSFER FLOW TO NOCSTWATER S LOCA EVENT CAUSES DEPLETION OF CST NOSBO S NO SBO CONDITION EXISTS TSSRWSFL F LOSS OF STATION SERVICE WATER SYSTEM VRBCCWFL F LOSS OF RBCCW SYSTEM XNSIASFL F LOSS OF PLANT INSTRUMENT AIR YESSBO S SBO CONDITION EXISTS YNPBU1FL F NO 4KV AC POWER FROM BUS 1 YNPBU2FL S NO 4KV AC POWER FROM BUS 2 YNPBU7FL S NO 480V AC POWER FROM MCC'S 7B AND 7C (ASSOC; W/ 4KV BUS 2)
YNPBU8FL F NO 480V AC POWER FROM BUS 8 (SI)
YNPBU9FL F NO 480V AC POWER FROM BUS 9 (SII)
YNPVACFL F NO 120V AC POWER FROM THE UNINTERRUPTIBLE VITAL AC DIST PANE ZNPDC1 FL F NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
Split Fraction: AICTAF SF Name SF Value Split Fraction Description AICTAF 8.9461 E-03 ALT CORE CLG; CTS (BUS2 FAILED) & CRD 'A' FAILED (AC4 OR D2 FAILED)
Split Fraction AICTAF Boundary Conditions Basic Event State Basic Event Description CORESPAVAIL F CORE SPRAY SUPPORT SYSTEMS NOT AVAILABLE HALTCOOLINGFL S FAILURE OF ALTERNATE COOLING MODE HCONDFLOWFL S LPCI AND CORE SPRAY FAIL TO DELIVER CONDENSATE TRANSFER FLOW HCSHARDWAREFL S CORE SPRAY HARDWARE FAILURE HOPALIGNFL F OPERATOR FAILS TO ALIGN CORE SPRAY FROM CST NOCSTWATER S LOCA EVENT CAUSES DEPLETION OF CST NOSBO S NO SBO CONDITION EXISTS TSSRWSFL S LOSS OF STATION SERVICE WATER SYSTEM VRBCCWFL S LOSS OF RBCCW SYSTEM YESSBO S SBO CONDITION EXISTS YNPBUI FL F NO 4KV AC POWER FROM BUS 1 YNPBU2FL F NO 4KV AC POWER FROM BUS 2 YNPBU7FL F NO 480V AC POWER FROM MCC'S 7B AND 7C (ASSOC; WI 4KV BUS 2)
YNPBU8FL S NO 480V AC POWER FROM BUS 8 (SI)
YNPBU9FL F NO 480V AC POWER FROM BUS 9 (Sll)
ZNPDC1 FL S NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
Split Fraction: AICTBF SF Name SF Value Split Fraction Description AICTBF 8.9461 E-03 ALT CORE CLG; CTS (BUS2 FAILED) 8 CRD 'B' FAILED (AC3 OR DI FAILED)
Split Fraction AICTBF Boundary Conditions Basic Event State Basic Event Description CORESPAVAIL F CORE SPRAY SUPPORT SYSTEMS NOT AVAILABLE HALTCOOLINGFL S FAILURE OF ALTERNATE COOLING MODE HCONDFLOWFL S LPCI AND CORE SPRAY FAIL TO DELIVER CONDENSATE TRANSFER FLOW TO HCSHARDWAREFL S CORE SPRAY HARDWARE FAILURE HOPALIGNFL F OPERATOR FAILS TO ALIGN CORE SPRAY FROM CST NOCSTWATER S LOCA EVENT CAUSES DEPLETION OF CST NOSBO S NO SBO CONDITION EXISTS TSSRWSFL S LOSS OF STATION SERVICE WATER SYSTEM VRBCCWFL S LOSS OF RBCCW SYSTEM YESSBO S SBO CONDITION EXISTS YNPBU1FL F NO 4KV AC POWER FROM BUS I YNPBU2FL F NO 4KV AC POWER FROM BUS 2 YNPBU7FL F NO 480V AC POWER FROM MCC'S 7B AND 7C (ASSOC; W/ 4KV BUS 2)
YNPBU8FL F NO 480V AC POWER FROM BUS 8 (SI)
YNPBU9FL S NO 480V AC POWER FROM BUS 9 (SI)
ZNPDC1 FL F NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
Split Fraction: AICTBS Split Fraction Description ALTERNATE CORE COOLING SYSTEMS; 2 TRAINS OF CRD AVAILABLE, NO CT DUE TO BUS 2 FAILURE) (CRD BASECASE)
Split Fraction AICTBS Boundary Conditions Basic Event State Basic Event Description CORESPAVAIL F CORE SPRAY SUPPORT SYSTEMS NOT AVAILABLE HALTCOOLINGFL S FAILURE OF ALTERNATE COOLING MODE HCONDFLOWFL S LPCI AND CORE SPRAY FAIL TO DELIVER CONDENSATE TRANSFER FLOW TO HCSHARDWAREFL S CORE SPRAY HARDWARE FAILURE HOPALIGNFL F OPERATOR FAILS TO ALIGN CORE SPRAY FROM CST NOCSTWATER S LOCA EVENT CAUSES DEPLETION OF CST NOSBO S NO SBO CONDITION EXISTS TSSRWSFL S LOSS OF STATION SERVICE WATER SYSTEM VRBCCWFL S LOSS OF RBCCW SYSTEM YESSBO S SBO CONDITION EXISTS YNPBU1 FL S NO 4KV AC POWER FROM BUS 1 YNPBU2FL S NO 4KV AC POWER FROM BUS 2 YNPBU7FL F NO 480V AC POWER FROM MCC'S 7B AND 7C (ASSOC; W/ 4KV BUS 2)
YNPBU8FL S NO 480V AC POWER FROM BUS 8 (SI)
YNPBU9FL S NO 480V AC POWER FROM BUS 9 (SI)
ZNPDC1 FL S NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
Split Fraction: AIFAIL SF Name SF Value lSplit Fraction Description AIFAIL 1.OOOOE+00 IALTERNATE CORE COOLING SYSTEMS; GUARANTEED FAILURE Split Fraction AIFAIL Boundary Conditions None.
Split Fraction: AISBO SF Name SF Value Split Fraction Description AISBO 2.8696E-01 FAILURE OF ALTERNATE INJECTION VIA DIESEL DRIVEN FIRE PUMP AND JOHN DEERE DIESEL GENERATOR Split Fraction AISBO Boundary Conditions Basic Event State Basic Event Description JOPFIS02 S OPERATOR FAILS TO LOCALLY OPERATE BREAKERS FOR ALTERNATE INJECTI NOSBO F NO SBO CONDITION EXISTS YESSBO S SBO CONDITION EXISTS ZNPDC1 FL S NO 125V DC POWER FROM DISTR. PANEL DC-1 (DI)
ZNPDC2FL S NO 125V DC POWER FROM DISTR. PANEL DC-2 (DII)
Split Fraction: AISUCC Split Fraction AISUCC Boundary Conditions None.
Attachment D Event Tree (TRANSIENT)
r, - ! - --
=:Rvvi;vt;
'- A -
Z
. -G2 Z TX n 6 - .
.1 0 v - v
^ ~ )x xx
. I. .. ....
a, to I-
TRANSIENT Event Tree - Ust of Top Events Top Event Description Name CR CONTROL ROD INJECTION - REACTOR SHUTDOWN TB TURBINE BYPASS MODEL SO SRVS FAIL TO OPEN ON DEMAND SC SRVS FAIL TO CLOSE AFTER SUCCESSFUL OPEN FW FEEDWATER SYSTEM RC RCIC SYSTEM HP HPCI SYSTEM AD AUTOMATIC DEPRESSURIZATION SYSTEM (ADS)
IP PRIMARY CONT. INTEGRITY FOR LEVEL 1 ANALYSIS LP LPCI SYSTEM CS LOW PRESSURE CORE SPRAY SYSTEM CN CONDENSATE SYSTEM TC TORUS COOLING SYSTEM RM RECOVERY OF MAIN CONDENSER VT TORUS HARD-PIPED VENT FOR LEVEL 1 ANALYSIS Al ALTERNATE CORE COOLING SYSTEM, CRD, CONDENSATE TRANSFER, CST REFILL, COP EH HPCI AND RCIC UNAVAILABILITY DURING SBO EVENT
Initiators:
a T (General Transient) 0 TMS (Transient initiated with MSIV closure) o TFWMS (Transient initiated with MSIV closure and loss of F)t
° TPCLP (Transient initiated with plant-centered LOSP) o TGRLP (Transient initiated with grid-related LOSP)
= TA3 (Transient initiated with loss of Bus 3) 13 TA4 (Transient initiated with loss of Bus 4)
TDI (Transient initiated with loss of DC-1)
TD2 (Transient initiated with loss of DC-2)
TSW (Transient initiated with loss of Service Water)
Modified Endstate Binning Rules - TRANSIENT CONFIG#1 (model VYCOP2A)
Bin Rule ID (CN=F)*(AI=F)+(VT=B)*(AI=F)*((TC=S))
Sequences with loss of all injection. Core damage occurs with the reactor at low pressure.
CONFIG#2 (model VYCOP2)
-Bin ' Rule - - - - ---
ID (CN=F)' (AI=F) + (VT=B) * (AI=F) * (-(TC=S)) + (((RM=S) * (AI=F) * (TC=F)) + ((TC=S) *
(RM=F))) * (IP=F) * ((LP=S) + (CS=S))
Sequences with loss of all injection. These sequences fail after successful depressurization using ADS. For sequences where LPCI and Core Spray are initially available, injection failure will occurdue to inadequate NPSH if containment isolation is unsuccessful (IP=F). Core damage occurs with the reactor at low pressure.
Top Event: CR - Control Rod Insertion CR General Notes: None.
CR Split Fraction Rules:
CRBASE I CR is considered to be independent of all other systems, hence the base case split fraction is used for all cases, i.e., CR has no support systems.
Top Event: TB - Turbine Bypass/Main Condenser TB General Notes:
Support system failures for top event TB (Turbine Bypass & Main Condenser) are as follows:
Support System Failure Impact on TB 4kV Bus I (01) TB/MC fail (failure of auxiliary oil pump, one circulating water pump, and steam packing exhauster) 4kV Bus 2 (02) TB/MC fail (failure of CST emergency makeup to main condenser (MOV-64-31),
two circulating water pumps, all three circulating water booster pumps, and vacuum priming pump)
Instru. Air (IG) TB/MC fail (SJAE assumed to fail) 120V Vital Bus (VC) and 120V Instru. Bus (IC) TB/MC fail (SJAE assumed to fail)
Service Water (SW TB/MC fail (failure of pump cooling for circulating water pumps)
The following transient initiators impact TB (Turbine Bypass & Main Condenser):
Initiator Impact TMS TB/MC fail (MSIV closure)
TFWMS TB/MC fail (MSIV closure is assumed to occur for loss of FW initiator)
TPCLP TB/MC fail (loss of power to 4KV Buses 1 and 2)
TGRLP TB/MC fail (loss of power to 4KV Buses I and 2)
TSW TB/MC fail (see SW impact above)
TD1 TB/MC fail (loss of AC-1 (Bus 1) breaker control power)
TD2 TB/MC fail (loss of AC-2 (Bus 2) breaker control power)
TB Split Fraction Rules:
TBFAIL (INIT=TMS) + (INIT=TFWMS) +
(-01=S) + (-02=S) + (SW=F) + (-IG=S) + ((-IC=S) * (-VC=S))
Note that the rule -01 =S covers initiator TD1 (similarly for -02=S and initiator TD2).
TBBASE I We assume that TB has all support systems available for other transient initiators and support system combinations. Note that we use TBBASE even when TB is degraded by the failure of IC alone or VC alone (TBFAIL is used when both IC and VC fail).
Top Event: SO - Safety/Relief Valves Open SO General Notes:
3 SO models opening of the SRVs/SVs for the pressure relief function.
SO Split Fraction Rules:
SOBASE I SRV/SV opening to satisfy the pressure relief function has no support systems.
E Engineering Report vE7&ifergy REPORT No. VY-RPT-05-0011O Revision 0 l Page I 119 I of l 303 Top Event: SC - Safety/Relief Valves Close SC General Notes:
D Given the demand to open the SRVs/SVs in top event SO, top event SC models the failure probability of the SRVs/SVs to close.
SC Split Fraction Rules:
SCBASE I SRV closing after successful pressure relief function has no support systems.
Top Event: FW- FeedwaterSystem (high pressure injection)
FW General Notes:
D Top event FW in the Transient Event Tree is the same as top event FW in the Medium and Small LOCA event trees with the following exceptions:
- 1. FW is guaranteed failure for transient initiators TFWMS, TLP, TDI, TD2, TSW (SW failure leads to TW failure which, is assumed to fail Feedwater pump cooling).
- 2. FW success does not require a hotwell makeup source of water for transients events where TB is available.
The support system impacts assumed for FW are:
Support System Failure Impact of Feedwater 4kV Bus 1 (01) FW fails, FW pumps A & B fail, aux. oil pump for pump C fails, Cond. pump A fails.
4kV Bus 2 (02) FW fails, FW pump C fails, Cond. pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31.
125V DC-1 (DI) FWfails, loss of Bus 1 (01).
125V DC-2 (D2) FW fails, loss of Bus 2 (02).
120V Vital Bus (VC) FW fails, loss of power to FW reg. valves, including low flow valve.
120V Instru. Bus (IC) FW fails, loss of pumps A,B,C.
Instru. Air (IG) FW fails, loss of air to FW reg. valves, including low flow valve.
TBCCW (TM ) FW fails, loss of cooling for FW and Cond. pumps A,B,C.
FW Split Fraction Rules:
FWFAIL (-O1=S) + (-02=S) + (-VC=S) + (-IC=S) + (-IG=S) + (-TW=S) + (INIT=TFWMS)
Refer to the FWFAIL rule developed for the Medium LOCA event tree.
FWTBBS (-TB=S) + (INIT=TMS)
When FW is not guaranteed failure by the FWFAIL rule, then the FW split fraction depends on whether TB is failed. When TB fails (-TB=S or INIT=TMS), then the FWTBBS split fraction is used. Because TB succeeds for all other cases, the FWBASE split fraction (below) is used.
FWBASE 1
Top Event: RC - Reactor Core Isolation Coolinu, RC General Notes:
o The Top events RC/HP in the TRANSIENT event tree are modeled as a common-cause failure group.
Because RC is asked before HP in the transient tree, RC is always evaluated independent of HP. We also assume that RCIC must be manually initiated and controlled and there is no credit for automatic initiation on low RPV level or high drywell pressure signals. For Plant-Centered Loss of Offsite Power transients (INIT=TPCLP) where offsite power is recovered in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (RO=S), we credit the potential for recovering the AC power supply to the battery chargers. Thus, RC failure due to battery depletion requires that A4 fail (A4=F) and that A4 is not recovered (-A4R). For Grid-Related Loss of Offsite Power transients (INIT=TGRLP), the potential for recovering AC power supply via the Vernon Tie (A9R) is instead evaluated. Also, we note that although the RCIC fault tree model and split fraction values include
'failure of auto suction transfer from CST to torus' as a failure mode, the contents/volume of the CST is not challenged (suction transfer judged not needed according to MAAP analyses) and this failure mode is thus a slightly conservative aspect of the fault tree and event tree models.
The support system impacts for RC are:
Support System Failure Impact on RCIC 125V DC-2 (D2) RC fails (no MOV motive power, etc.)
120V Vital Bus (VC) RC fails (loss of flow controller power) 24V ECCS Division B (V2) Failure of the automatic function to transfer suction from the CST to the suppression pool (requires manual operator action for success)
Note that there are no other auto signal requirements for RC since we assume that the operator must manually initiate the system. The operator action for initiation and control of HPCI and RCIC is also assumed to be a completely dependent action.
RC Split Fraction Rules:
RCFAIL (D2=F) + ((-C2=S)*(-A9R)) + ((A4=F) I (-A4R)*(-A9R)) + (-VC=S)
RC is guaranteed failure when DC-2 fails. RC also fails if the battery charger fails (long term DC power, top event C2), or if AC power for the chargers is not recovered (A9R), or if A4 fails and is not recovered (A4R and A9R).
Failure of the 120V Vital Bus (VC) will also fail RCIC.
RCV2F (-V2=S)
This split fraction is used if the 24vdc ECCS Division B power supply is failed, preventing automatic transfer of RCIC suction from the normal source (CST) to its alternate source (suppression pool).
RCBASE I
Top Event: HP - HiMh Pressure Coolant Injection HP General Notes:
In the TRANSIENT event tree, HPCI is evaluated dependent on RCIC. HPCI has only two support systems, 125V DC-1 and 120V Vital Bus. We also assume that HPCI must be manually initiated and controlled and there is no credit for automatic initiation on low RPV level or high drywell pressure signals.
For Plant-Centered Loss of Offsite Power transients (INIT=TPCLP) where offsite power is recovered in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (RO=S), we credit the potential for recovering the AC power supply to the battery chargers. Thus, RC failure due to battery depletion requires that A4 fail (A3=F) and that A3 is not recovered (-A3R). For Grid-Related Loss of Offsite Power transients (INIT=TGRLP), the potential for recovering AC power supply via the Vernon lie (A8R) is instead evaluated. Also, we note that although the HPCI fault tree model and split fraction values include Ofailure of auto suction transfer from CST to torus' as a failure mode, the contents/volume of the CST is not challenged (suction transfer judged not needed according to MAAP analyses, refer to Transient rule descriptions) and this failure mode is thus a slightly conservative aspect of the fault tree and event tree models.
Support system failure impact on HPCI is as follows:
Support System Failure Impact on HPCI DC-I fails HPCI fails 120v Vital AC fails HPCI auto suction transfer from CST to torus fails (requires manual operator action for HP success)
HP Split Fraction Rules:
HPFAIL (DI=F) + ((-C1=S)*(-A8R)) + ((A3=F) * (-A3R)'(-A8R))
HP is guaranteed failure when DC-1 fails. HP also fails if the battery charger fails (long term DC power, top event Cl), or if AC power for the chargers is not recovered (A8R), A3 fails and Is not recovered (A3R and AMR).
HPVCF (-VC=S)
This split fraction is used if the 120v Vital AC power supply is failed, preventing automatic low-level transfer of HPCI suction from the normal source (CST) to its alternate source (suppression pool).
HPBASE (D2=F) + (-C2=S) + ((A4=F) * (-A4R))
These split fraction rules for HPVCF and HPBASE cover cases where RC is bypassed and HP is asked independent of RC. Note that the event tree structure never asks HP if RC=B, hence there is no RC=B rule. HP is independent of RC only when RC is guaranteed to fail by support system failures. This only occurs when (-
VC=S) which degrades HP (split fraction HPVCF), or when (D2, C2 or A4 fail) which has no impact on HP (split fraction HPBASE).
Engineering Report Entfey REPORT No. VY-RPT-05-00 10 l Revision 0 l Page l 123 l of 303l HPRCF2 (RC=F) * (-V2=S)
HPRCFI (RC=F)
These split fraction rules for HPRCF2 and HPRCFI cover the cases where HP is asked dependent on RC. Note that there are no rules for RC=S since HP is bypassed in the event tree structure when RC=S.
HPFAIL I If none of the above rules apply, the HPFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Engineering Report
- Entergy REPORT No. VY-RPT-05-0011 l Revision 0 l Page l 124 l of l 303 l Top Event: AD - RPV Depressurization AD General Notes:
AD models manual depressurization of the RPV via the SRVs (discharging to the suppression pool) as a means of reducing RPV pressure to allow injection of low pressure systems. We assume that AD requires long-term operation of the SRVs, hence we require success of the containment gas nitrogen supply (top event CG). The only other support systems for AD are 125V DC-1 and DC-2. Given the system design, failure of both DC power sources is required to fail the depressurization function (fail all SRVs). DC-2 supplies the 'normal' control power to each SRV solenoid valve. Upon failure of DC-2, control power to each solenoid valve will automatically transfer to DC-1 via de-energized relay K1 1A, B, C and D.
AD Split Fraction Rules:
ADFAIL (-CG--S) + ((Dl=F) I (D2=F))
AD is guaranteed to fail when CG fails or when both DC-1 and DC-2 fail.
ADSDA (Dl=F)
ADSDB (D2=F)
Split fraction ADSDA(B) applies the operator action HEP associated with RPV depressurization during Small LOCA events when Division 1 (2) of DC power has failed.
ADSBS I Split fraction ADSBS applies the operator action HEP associated with RPV depressurization during Small LOCA events when all support systems are available.
Engineering Report Top Event: IP - Primary Containment Integrity IP General Notes:
0 Top event IP is asked in order to establish whether the containment is intact when the hard-piped vent from torus air space is used to prevent over-pressurization (VT=S). Integrity of containment is a necessary condition in order for the operator to control and maintain sufficient pressure in the containment in support of continued operation of LPCI or Core Spray pumps taking suction from the suppression pool at elevated temperature.
0 Failure of containment integrity is defined to include failures in the containment boundary that allow leakage in excess of that which would prevent maintaining overpressure sufficient to satisfy the NPSH-r or the LPCI and Core Spray pumps at elevated suppression pool temperature. The leakage sources are divided into two principal categories:
o Isolation valve failures: These are related to the failure of the isolation valves in containment penetration lines or failure of the isolation signals or power to close these valves.
o Pre-existina failures: These are failures primarily related to hatches, electrical penetration assemblies (EPAs), and other containment leakage paths not associated with failure of isolation valves to dose.
IP Split Fraction Rules IPIG (IG=F)+((VC=F)*(IC=F))
This split fraction is used when both the "inboard' and *outboard" isolation valves fail due to support system failures.
The "inboard" and "outboard' valves for the PCAC system require instrument air (IG)for normal operation.
The isolation valves will fail CLOSED on interruption of air supply pressure. The "inboard' isolation valves are dependent on Vital Bus (VC) 120vac, and the 'outboard' isolation valves are dependent on Instrument Bus (IC) 120vac. These isolation valves will fail CLOSED on loss of control power.
Inboard torus-to-RB vacuum breaker SB-16-19-11A requires Vital Bus (VC), while the SB-16-19-11 B vacuum breaker requires Instrument Bus (IC). These valves will fail OPEN on loss of air pressure or electric power. Note that the outboard torus-to-RB swing-check valves are in-series with the air-operated vacuum breakers, hence failure of the air-operated vacuum breakers to close does not necessarily cause failure of containment isolation.
IPVAC (VC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-llA fails due to failure of the Vital Bus (VC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated IPIAC (IC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-11 B fails due to failure of the Instrument Bus (IC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated
IPBASE I No other support system failures affect the containment isolation system. Thus, the base case (all support systems available) split fraction applies to all sequences not captured by one of the previous rules.
Top Event: LP - Low Pressure Coolant Injection LP General Notes:
0 LP independent split fraction rules are the same as those used in the Medium/Small LOCA trees.
a the min. flow valve in each LPCI loop (MOV-16A/16B) is maintained normally open and success of the LPCI loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume LPCI success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on LP 125V DC-I (D1) fails RHR Pumps C and Dfail; degraded injection valve ECCS signal.
125V DC-2 (02) fails RHR Pumps A and B fail; degraded injection valve ECCS signal.
4kV Bus 3 (A3) fails RHR Pumps C and Dfail; injection valve ECCS signal not degraded.
4kV Bus 4 (A4) fails RHR Pumps A and B fail; injection valve ECCS signal not degraded.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW fails No impact assumed based on room heatup assessment. Also, RHR pump seal and bearing cooling via SW/RBCCW assumed not needed for injection mode.
RBCCW (RW) fails No impact; RHR pump seal and bearing cooling via RBCCW assumed not needed for the injection mode function.
ECCS Signal (SIG) fails Failure of the ECCS signal and failure to manually initiate low pressure pumps are assumed to cause failure of LPCI (and CS). Failure of the signal and manual backup action is handled in the SIGF rule.
LP Split Fraction Rules:
SIGF: (-Pl=S) + ((-DW=S) *((-LV=S) + (-PS=S))) (-OI=S)
This is the Marco rule for developing the failure logic if the ECCS signal. The SIGF macro is used below in the rules for LPCI and later for Core Spray. The ECCS signal is made up of a combination of low pressure interlock (PI), drywell high pressure (DW), low reactor level (LV), low reactor pressure (PS). The operator (01) can also fail to 'backup" a failed signal provided that the signal did not fail due to PI.
LPFAIL (SIGF) + ((DI=F) + (A3=F)) * ((D2=F) + (A4=F))
All of LPCI is guaranteed to fail when the ECCS signal fails or all support systems fail.
- ^
LP2VA (DI=F)
LP2VB (D2=F)
LPCI configuration will be 2 pump failure with degraded LPCI injection valve logic given DC-1 or DC-2 failure.
LP2FA (A3=F)
LP2FB (A4=F)
LPCI configuration will be 2 pump failure without degraded LPCI injection valve logic given failure of 4KV AC Bus 3 (LP2FA) or AC Bus 4 (LP2FB) failure.
LPBASE (-SIGF) * (DI=S) * (A3=S)(*D2=S) (A4=S)
LPCI base case reliability is applied when all support systems are successful and the SIGF has not failed.
LPFAIL I If none of the above rules apply, the LPFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: CS - Core Spray CS General Notes:
The min. flow valve in each CS loop (MOV-5A/5B) is maintained normally open and success of the CS loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume CS success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on CS 125V DC-I (Dl) fails CS Loop B fails - Pump B and MOV-1 1B/1 2B.
125V DC-2 (D2) fails CS Loop A fails - Pump A and MOV-1 1A/N 2A.
4kV Bus 3 (A3) fails CS Loop B fails - Pump B and MOV-1 1B/1 2B.
4kV Bus 4 (A4) fails CS Loop A fails - Pump A and MOV-1 1A/12A.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW/RW fail No impact on Core Spray.
ECCS Signal (SIG) fails Assumed to cause failure of CS for large break LOCA event (*
(*) Refer to top event LP above for summary of the SIGF rule.
CS Split Fraction Rules:
CSFAIL (SIGF) + ((D1=F) + (A3=F)) * ((D2=F) + (A4=F))
Both divisions of CS are guaranteed to fail when the ECCS signal fails or all support systems fail.
CSA4F ((A4=F) + (D2=F)) * ((A3=S) * (D1=S))
This is a train-specific split fraction, which applies the reliability of CS division B when AC Bus 4 or DC Bus 2 fail, but AC Bus 3 and DC Bus 1 are success.
CSA3F ((A3=F) + (DI=F)) I ((A4=S) I (D2=S))
This is a train-specific split fraction, which applies the reliability of CS Division A when AC Bus 3 or DC Bus I fail, but AC Bus 4 and DC Bus 2 are both success.
CSBASE 1 CS base case reliability is applied when the above rules are not satisfied.
Engineering Report
!En tergy REPORT No. VY-RPT-05-00 10 l Revision 0 l Page l 130 l of l 303 l Top Event: CN - Condensate System (low pressure iniection)
CN General Notes:
None.
Support System Failure Impact of CN 4kV Bus 1 (01) CN Pump A fails 4kV Bus 2 (02) CN Pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31) 125V DC-2 (02) CN fails (02 failure) 120V Vital Bus (VC) CN fails (no power to FW reg. valves)
Instru. Air (IG) CN fails (no air to FW reg. valves)
TBCCW (TM CN fails (no pump motor cooling)
CN Split Fraction Rules:
CNFAIL (-02=S) + (-VC=S) + (4G=S) + (-TW=S) + (INIT=TPCLP) +
(INIT=TGRLP) + (INIT=TFWMS) + (INIT=TSW)
This rule for the transient tree also includes CN failure due to initiators TFWMS. We assume that the TFWMS initiator causes loss of both FW and CN.
CN is asked independent of FW when FW is bypassed by the event tree structure or when FW is guaranteed failure by support system failures. This occurs only when (FW=B) or (-01=S) or (-IC=S). Failure of 4kV Bus I (-
01 =S) degrades the CN model. Thus we have the following two split fraction case, CN1 F and CNBASE. These rules apply when CN is not already failed (see CNFAIL) and is asked independently of FW.
CNI F (-01=S)
Condensate system is degraded (one pump fails) when 4KV Bus 1 fails.
CNBASE (-IC=S)
The transient event tree structure asks CN only after FW=F. Thus, CN is independent of FW only when FW is guaranteed failure by support system failures. The only support system failures that fail FW and not CN are -
01 =S (Bus 1 fails, which degrades CN, split fraction CN F) and -IC=S (Instrument Bus fails FW but does not degrade CN, split fraction CNBASE).
All other cases involve FW=F (CN is only asked after FW=F) with CN dependent on FW. All support systems for FW and CN have been accounted for by previous rules except for TB. The next two rules below (CNFWF1 and CNFWF2) apply to cases where CN is dependent on FW and TB is either failed (CNFWF1) or is success (CNFWF2).
CNFWF1 (FW=F) * ((-TB=S) + (INIT=TMS))
Condensate System fails given Feedwater fails (TBCCW unavailable).
CNFWF2 (FW=F) * (TB=S)
Condensate System fails given Feedwater fails (TBCCW available).
CNFAIL I If none of the above rules apply, the CNFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: TC- Torus Cooling General Notes:
a In general, Torus Cooling (top event TC) is dependent on Low Pressure Coolant Injection (top event LP) due to shared RHR equipment. The impact of single support system failures on TC are as follows:
Support System Failure Impact on Torus Cooling 125V DC-I (DI) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
125V DC-2 (D2) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
4kV Bus 3 (A3) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
4kV Bus 4 (A4) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
RRU7 (R7) fails No impact on equipment is assumed based on room heatup assessment.
RRU8 (R8) fails No impact on equipment is assumed based on room heatup assessment.
SW fails RHR Pumps A, C & B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode), RHRSW Pumps A, C & B, D fail due loss of service water suction.
ECCS Signal (SIG) fails No impact on TC function is assumed.
TC Split Fraction Rules:
TCFAIL ((SW=F) ^ (-AW=S)) + ((DI=F) + (A3=F)) * ((D2=F) + (A4=F))
This rule captures all cases for which support system failures will fail both trains of TC. Note that we credit AW (which considers recovery of service water and use of the Alternate Cooling Mode) as a backup to SW in top event TC for Transient events.
TC3FA ((LP=B)+(SIGF))*((DI=F)+(A3=F))
TC3FB ((LP=B)+(S IGF))*((D2=F)+(A4=F))
Single loop TC with 2 RHRSW pump and 1 RHR pump available, Dl (D2) or A3(A4) unavailable.
TCBASE ((LP=B) + (SIGF))
TC split fractions TC3FA(B) and TCBASE evaluate TC independent of LP. The LPFAIL rule (see top event LP) defines the cases where LP is guaranteed to fail by support system failures. Some of the same support system combinations that fail LP also fail TC and are accounted for in the TCFAIL rule. The only support system failure which appears in the LPFAIL rule and does not guarantee failure of TC is SIGF. Because SIGF guarantees failure of LP, TC is being evaluated independent of LP for these cases. LP can also be "bypassed' in the Small LOCA event tree because other injection systems can satisfy the RPV inventory function, consequently TC must still be evaluated (independently). Therefore, we have also included the (LP=B) portion of the rule. The above rules for TC3FA(B), and TCBASE capture these cases.
Note: If TC3FA(B) and TCBASE split fractions do not apply, TC must be evaluated "dependent" upon the success or failure of LP. The following "dependent" LP/TC split fractions were developed to cover the various support system states given LP success /failure.
TCLS7A (LP=S)*(DI =F)
TCLS7B (LP=S)*(D2=F)
TC failure given LP success when either D1 (TCLS7A) or D2 (TCLS7B) has failed.
TCLS6A (LP=S)-((A3=F))
TCLS6B (LP=S)*((A4=F))
TC failure given LP success when either A3 (TCLS6A) or A4 (TCLS6B) has failed.
TCLPS5 (LP=S)
TC failure given LP success when all support systems are available/successful.
TCLF7A (LP=F)*((DI=F))
TCLF7B (LP=F)*((D2=F))
TC failure given LP failure when either D1 (TCLF7A) or D2 (TCLF7B) has failed.
TCLF6A (LP=F)*((A3=F))
TCLF6B (LP=F)*((A4=F))
TC failure given LP failure when eitherA4 (TCLF6A) orA3 (TCLF6A) has failed.
TCLPF5 (LP=F)
TC failure given LP failure when all support systems are available/successful.
TCFAIL I If none of the above rules apply, the TCFAIL rule will ensure a conservative result and assist in checking the validity of the results.
To, Event: RM- Recover Main Condenser RM General Notes:
O For Transient events, we credit recovery of the main condenser providing that all support systems are success. The support system failures for top event TB (Turbine Bypass & Main Condenser) are assumed as follows:
SupDport System Failure Impact on TB/Main Condenser 4kV Bus 1 (01) TB/MC fail (failure of auxiliary oil pump, one circulating water pump, and steam packing exhauster) 4kV Bus 2 (02) TB/MC fail (failure of CST emergency makeup to main condenser (MOV-64-31), two circulating water pumps, all three circulating water booster pumps, and vacuum priming pump) 120V Vital Bus (VC) TB/MC fail (SJAE assumed to fail) 120V Instru. Bus (IC) TB/MC fail (SJAE assumed to fail)
Instru. Air (IG) TB/MC fail (SJAE assumed to fail)
Service Water (SW) TB/MC fail (failure of pump cooling for circulating water pumps)
RM Split Fraction Rules:
RMBASE (((O1=S) * (02=S)) + (OIR
- 02R)) * (SW=S) * (IG=S) I ((IC=S) + (VC=S))
The base case split fraction (RMBASE) is used whenever all support systems for the main condenser are available., ForAC power, we require that either 01 and 02 are available (01=S
- 02=S), or that both 01 and 02 are recovered (01 R
- 02R). We credit recovery of offsite power for RM because > 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> exists to establish heat removal with the main condenser before containment is threatened by overpressure, and before suppression pool temperature increase would threaten continued operation of LPICS pumps.
RMFAIL I Recovery of the main condenser is assumed to fail for all remaining cases (RMFAIL) because one or more support systems are unavailable. Also, if the RMBASE rule does not apply, the RMFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: VT- Torus Vent (hard-pinedvent from torus airspace)
VT General Notes:
Torus vent valve (TVS-86) is Onormally" closed and requires manual action to open the valve and enable the use of the venting path with rupture disc. For transients, we assume that the valve can be operated remotely from the control room if 480V MCC-7A (associated w/ 4kV Bus 2) is available, or the valve can be operated locally. Local operation is assumed possible because there is sufficient time before the vent path would be needed (12 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). Also, because of the potential for a harsh environment is remote, the Reactor Building is assumed to remain habitable to perform the local operation.
Vr Split Fraction Rules:
VTTRBS I Local manual operation of the vent valve is assumed, therefore no AC power support systems are necessary for success and the VTTRBS (Vent-Torus-Transient-Base-Case) split fraction is assigned for transients.
Top Event: Al - Alternate Iniection (Long Term Injection)
Al General Notes:
Top event Al is asked after containment heat removal, top events TC, RM and VT, in order to establish the availability of "alternate" injection. "Alternate" injection may be required because:
- 1. Other injection systems have failed earlier in the event tree (i.e. for SBO sequences or when AD=F), or
- 2. Systems which have succeeded earlier are jeopardized by high suppression pool temperature when TC=F.
Among the injection systems (for non-SBO sequences) credited for Al are FW/HP/RC/CN all with suction from the CST (if such systems had succeeded earlier), LP (if it had succeeded earlier, with bearing/seal cooling provided by RW or AW), CRD , Condensate Transfer (with injection via the LPCI or Core Spray injection lines), and using the diesel-driven fire pump via the RHRSW-to-RHR cross-tie (MOVs 183 and 184).
Note that the capacity of some of these systems (CRD, Condensate Transfer) is limited to approximately 100 gpm (each). Because Al is asked 'late' (at least several hours after scram), even these 'low capacity" injection systems will provide sufficient flow to assure core cooling. Note also that no credit is taken for Core Spray injection with suction directly from the CST.
Finally, note that, with the exception of LP (and the diesel fire pump), all systems credited for Al take suction from the CST. Based on a review of the Level I 'Success Criteria" runs made with MAAP, we conclude that the normal CST inventory (350,000 gallons, which is 70% of the 500,000 gallon capacity) provides enough inventory to assure core cooling for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a transient event.
The various sequences where Al is credited are discussed below.
Station Blackout Station Blackout (SBO) refers to sequences where 4kV Buses 3 and 4 have no power, A3=F and A4=F. We credit RPV injection using the diesel-driven fire pump after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for SBOs. That is, for SBO sequences, Al success is defined as *RPV injection using the diesel-driven fire pump after four hours". Note that AI=S alone will not assure success of an SBO sequence. For us to bin such sequences to success, we require that "early" RPV injection be accomplished with HPCI or RCIC until the batteries deplete at about four hours (see top event EH).
Al Split Fraction Rules:
AISBO (A3=F) * (A4=F) ' (AD=S)
The AISBO split fraction is used whenever A3 and A4 are failed (SBO), but AD succeeds in depressurizing the RPV. This split fraction accounts for hardware failures, as well as for the operator action to align the diesel-driven fire pump for RPV injection (including alignment of the John Deere diesel generator for supplying motive power to the necessary MOVs, including MOVs 183 and 184).
Rules for non-SBO type sequences:
AIFAIL ((AD=S) ^ (CN=F)) + (AD=F)
For Al to succeed, both RPV depressurization and early injection from a high capacity system (LP, CS, FW or CN) must succeed. CN is only asked if all other early injection sources have failed, therefore CN=F indicates total failure of early injection.
AISUCC (FW=S) + (HP=S) + (RC=S) + (CN=S)
This first part of this rule applies regardless of whether RM=S or VT=S is responsible for accomplishing heat removal, since FW/HP/RC/CN do not take suction from the suppression pool (in the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />): FW/CN take suction from the HotwelVCST and HP/RC take suction from the CST. Based on MAAP calculations, we assume that refill of the CST is not necessary for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of transient sequences. Thus, if either FW, HP, RC or CN had succeeded earlier for core cooling, then Al is set to guaranteed success.
AISUCC (RM=S) ^((LP=S) + (CS=S))
The second part of the AISUCC rule accounts for sequences where LP/CS has succeeded earlier in the event tree. Note that this rule only applies when RM=S, because of concerns with loss of NPSH for pumps taking suction from the suppression pool when TV=S.
AISBO (AD=S)-(-(RW=S)) *((-02=S)) + (LP=F) * (CS=F))
Al using the diesel-driven fire pump is examined when the failure of support systems or injection paths for both CRD and CT has occurred. For injection via the diesel-driven to succeed, the RPV must be depressurized and early injection must have succeeded. Note that cases where both ADS and early injection have failed are already captured in the first rule.
AICTAF (((A4=F)+(D2=F))*(RW=S))*((-(02=S))+((LP=F)*(CS=F)))
AICTBF (((A3=F)+(Dl=F))*(RW=S))*(((02=S))+((LP=F)k(CS=F)))
AICTAF(BF) is used when only 1 CRD pump is available for altemate injection. It is conservatively assumed that CRD pump operation requires that RBCCW (RW) be available. Only 1 CRD pump is available because either Bus 3 (AICTAF) or Bus 4 (AICTBF) power is success and component cooling via RBCCW is success. CT has failed because Bus 2 is not success or the injection paths via LP and CS have failed.
AICTBS (RW=S)) * ((-02=S)) + ((LP=F) + (CS=F))
AICTBS is for the configuration of 2 CRD pumps available for aitemate injection with no CT pump capability. CT is failed because either 1) failure of LP and CS is assumed to fail the injection paths or 2) power via Bus 2 (02) is unavailable. Both CRD pumps are available because both 4kV Buses 3 and 4 are available.
AICRBS (((A3=F)*(A4-F)) + (-RW=S))) * ((02=S) I ((LP=S) + (CS=S)))
AICRBS is used for configurations where both CT pumps are available but neither of the CRD pumps is available.
CT pumps have power from Bus 2 and at least one injection path via LP or CS is available. CRD pumps have failed either from lack of motive power from Bus 3 and Bus 4 or from failure or RBCCW.
AICRAF ((A4=F)+(D2=F))h((02=S)*((LP=S)+(CS=S)))*(RW=S)
AICRBF ((A3=F)+(DI=F))*((02=S)h((LP=S)+(CS=S)))*(RW=S)
AICRAF(BF) is used when both CT pumps and only I CRD pump are available for alternate injection. Only 1 CRD pump is available because either Bus 3 (AICRAF) or Bus 4 (AICRBF) power is success and component cooling via RBCCW is success (satisfied by the above rule). Both CT pumps are available because support systems are success (Bus 2) and an injection pathway to the RPV via LPCI or Core Spray is success.
AIBASE ((02=S) ' ((LP=S) + (CS=S))) * (RW=S)
AIBASE is used when both CT pumps and both CRD pumps are available for alternate injection. All support systems needed by CRD and CT are success. CT requires the injection pathway to the RPV via LPCI or Core Spray, which is success.
AIFAIL I If none of the above rules apply, the AIFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: EH - Early HPCIIRCIC Iniection for SBO EH General Notes:
Top event EH is evaluated only for Station Blackout (SBO) sequences where 4kV Buses 3 and 4 have failed (A3=F and A4=F), and where ac power is not recovered within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (-A3R and -A4R). For these sequences, HPCI and RCIC are assumed to be failed (i.e., HPFAIL and RCFAIL split fractions apply; see earlier rules for top events HP and RC) due to the eventual depletion of the batteries at about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. EH is used to determine whether HPIRC succeed for "early" core cooling (i.e., before the batteries deplete). EH is needed to divide the accident Class I B (SBO) sequences into 'early SBO (core damage < 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) and Late' SBO (core damage > 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />).
The existing HP/RC fault tree models are used to develop split fraction values for EH. The "unique" support system impacts for the HP/RC "merged" model are:
Support System Failure Impact 125V DC-I fails (D1) causes failure of HP 125V DC-2 fails (D2) causes failure of RC 120V AC Vital Bus fails (VC) fails RC flow controller and requires operator action for HP suction transfer 24V ECCS Battery fails (V2) requires operator action for RC suction transfer Although the "mission time" for EH is only 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, we will use the split fraction values already calculated for the HPIRC merged model (which assume a 24 mission time). This is conservative for EH because it overestimates the "failure to run". However, because EH is only needed for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, we will assume that VC and V2 are not needed for the HP/RC suction transfers (refer to MAAP runs). Thus, we will assume the following unique impacts for EH:
Support System Failure Impact D1 fails fails HP, no impact on RC D2 or VC fail fails RC, no impact on HP The existing split fractions for HP/RC which we use here for EH are:
HPRCBS HP/RC merged model with all support systems available.
HPBASE HP model (RC failed) with all HP support systems available.
RCBASE RC model (HP failed) with all RC support systems available.
We define the following split fractions for EH:
EH Split Fraction Corresponding HPIRC Split Fraction Value EHBASE HPRCBS EHHP HPBASE EHRC RCBASE EHFAIL PFAIURCFAIL
EH Split Fraction Rules:
EHFAIL (C2=S) * ((A4=S) + (A4R)) * (C1=S) * ((A3=S) + (A3R))
This rule ensures that EH is evaluated only during SBO sequences, i.e. when power to A3 and A4 have failed.
EH should not be applied (split fraction value 1.0) to non-SBO sequences, which are identified in this rule when long term DC power is success (CI=S and C2=S), Buses 3 and 4 are success (A3=S and A4=S) or AC power to these buses has been recovered (A4RIA3R). The first half of the rule, (C2=S) * ((A4=S) + (A4R)), checks for non-SBO sequences associated RCIC long termn support systems. The second half of the rule, (CI=S) * ((A3=S)
+ (A3R)), checks for non-SBO sequences associated with HPCI long term support systems.
EHFAIL (DI=F) * ((D2=F) + (-VC=S))
HPCI is guaranteed failure by failure of Dl. RCIC is guaranteed failure by failure of either D2 or VC.
EHRC (D1=F) * ((D2=S) I (VC=S))
EHHP ((D2=F) + (-VC=S)) * (DI=S)
EHRC split fraction applies when HPCI is guaranteed failure by support system failures, but RCIC support systems are available. EHHP is used when RCIC is failed by support system failures, but HPCI support systems are available.
EHBASE (DI=S) * (D2=S) * (VC=S)
The EHBASE split fraction is used when all support systems are available for both HPCI and RCIC.
EHFAIL I If none of the above rules apply, the EHFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Engineering Report
---Entergy REPORT No. VY-RPT-05-001 10 I Revision 0 l Page 1 141 l of l 303 l Attachment E Event Tree (ATWS)
Engineering Report Entergy REPORT No.VY-RPT-05-00110 l Revision 0 l Page l 142 of 303 i rI2 a X E,
4) w (I,3 LL
Ea Engineering Report
--~Entergoy REPORT No. VY-RPT-05-0011O l Revision 0 l Page 1 143l of 303 Top Event Name Description SM FAILURE TO SCRAM - MECHANICAL FAULT SE FAILURE TO SCRAM - ELECTRICAL FAULT AR ALTERNATE ROD INJECTION SYSTEM TB TURBINE BYPASS MODEL RP RPT SYSTEM FT FEEDWATER PUMP TRIP LOGIC (USED FOR ATWS MITIGATION)
FW FEEDWATER SYSTEM PR PRESSURE RELIEF SYSTEM - ATWS MITIGATION SL STANDBY LIQUID CONTROL SYSTEM (SLC)
IA INHIBIT ADS DURING ATWS ED EMERGENCY DEPRESSURIZATION SYSTEM (USED FOR ATWS MITIGATION)
LC LEVEL CONTROL DURING ATWS LI OPER. ACTION TO STOP INJECTION BEFORE RX DEPRESSURIZATION DURING ATWS CN CONDENSATE SYSTEM LP LPCI SYSTEM CS LOW PRESSURE CORE SPRAY SYSTEM RM RECOVERY OF MAIN CONDENSER OT OPERATE INITIATES TORUS COOLING DURING ATWS TC TORUS COOLING SYSTEM VT TORUS HARD-PIPED VENT FOR LEVEL 1 ANALYSIS
Engineering Report 4=Eentercgy REPORT No. VY-RPT-05-001 10 I Revision 0 lPage 1 144 1 of l 303 l i
Initiators:
o A (ATWS General Transient) a AMS (ATWS Transient initiated with MSIV closure)
AFWMS (ATWS Transient initiated with MSIV closure and loss of FW) o APCLP (ATWS Transient initiated with plant-centered LOSP) o AGRLP (ATWS Transient initiated with grid-related LOSP)
Modified Endstate Binning Rules - ATWS CONFIG#1 (model VYCOP2A)
Bin Rule IC (LI=F)+(CS=F)
ATWS sequences where core damage is caused by loss of injection during level/power control.
IVA (SL=F) + (IA=F) + (ED=F) + (LC=F) + (VT=F) + ((RM=F) * ((OT=F) + (TC=F)))
ATWS sequences where core damage is caused by containment failure.
CONFIG#2 (model VYCOP2)
Bin - .-Rule - -:
IC (LI=F) + (CS=F) + (((LP=S) + (CS=S)) (IP=F))
ATWS sequences where core damage is caused by loss of injection during level/power control. If initially successful, LPCI and Core Spray are assumed to ultimately fail due to inadequate NPSH resulting from failure to maintain containment overpressure. Loss of containment overpressure will occur if primary containment isolation fails (IP=F).
IVA (SL=F) + (IA=F) + (ED=F) + (LC=F) + (VT=F) + ((RM=F) * ((OT=F) + (TC=F) + (IP=F)))
ATWS sequences where core damage is caused by containment failure. For sequences where RHR is initially available, suppression pool cooling failure will occur due to inadequate NPSH if containment isolation is unsuccessful (IP=F).
Note: The RPS can be divided into two principal parts. These are:
o Scram Electrical (SE): The electrical portion of the RPS involving the logic, signal generation. and relays required to initiate a reactor scram.
Scram Mechanical (SM): The mechanical portion of reactor scram involving the physical movement of the control rods including: depressurization of the scram air header, alignment of high pressure accumulator water to the under side of the drive pistons, discharge water to the Scram Discharge Volume (SD\), and movement of the control rod.
It is necessary to evaluate SE and SM separately so that the effectiveness of ARI/RPT independent electrical design features can be evaluated as an alternate means of inserting the control rods given that SE has failed but SM is successful.
Top Event: SM - SCRAM - Mechanical Function SM General Notes:
D SM has no support systems, hence the base case split fraction is used for all ATWS sequences.
SM SPIit Fraction Rules:
SMBASE I
Top Event: SE - SCRAM - Electrical Function SE General Notes:
D SE has no support systems, hence the base case split fraction is used for all ATWS sequences.
SE Split Fraction Rules:
SEBASE I
AEngineering Report
- Enterfy REPORTNo.VY-RPT-05-OO11 l Revision 0 Page 149 of 303 Top Event: AR - Alternate Rod Insertion AR General Notes:
The Alternate Rod Insertion (ARI) feature provides an automatic backup to SE (Scram electrical) on either low reactor water level or high reactor pressure signals. We assume that either a low water level or high pressure condition actually exists. The split fraction values for AR (and later top event RP) are the same for low water level and high pressure, hence we do not discriminate between these conditions in the split fraction rules below.
The support system impacts on the ARI instrumentation are as follows:
Support System Failure Impact on ARI 120V Vital Bus ARI Logic Channels B & Dfail, Channels A & C are OK.
125V DC-1 ARI Logic Channels B & Dfail, Channels A & C are OK.
120V Instrument Bus ARI Logic Channels A & Cfail, Channels B & D are OK.
125V DC-2 ARI Logic Channels A & Cfail, Channels B & D are OK.
ARI is a one-out-of-two-taken-twice logic. Thus, either Channels A AND C OR Channels B AND Dare needed for actuation success.
AR Split Fraction Rules:
ARFAIL ((-VC=S) + (DI=F)) ^ ((-IC=S) + (D2=F))
ARI is guaranteed to fail whenever a "divisional' power supply fails to both logic divisions.
ARAF (-IC=S) + (D2=F)
ARBF (-VC=S) + (DI=F)
Split fraction ARAF(ARBF) is applied to model degraded ARI logic due to a single logic division failed whenever one of its supporting power supplies fails.
ARBASE I If the above rules for ARFAIL and AR1 F do not apply, the base case ARI split fraction (fully redundant logics) is applied since all support systems are success.
Top Event: TB - Turbine Bypass, Main Condenser TB General Notes: None.
Support system failures for top event TB (Turbine Bypass & Main Condenser) are as follows:
Support System Failure Impact on TB 4kV Bus 1 (01) TB/MC fail (failure of auxiliary oil pump, one circulating water pump, and steam packing exhauster) 4kV Bus 2 (02) TB/MC fail (failure of CST emergency makeup to main condenser (MOV-64-31),
two circulating water pumps, all three circulating water booster pumps, and vacuum priming pump)
Instru. Air (IG) TB/MC fail (SJAE assumed to fail) 120V Vital Bus (VC) and 120V Instru. Bus (IC) TB/MC fail (SJAE assumed to fail)
Service Water (SR) TB/MC fail (failure of pump cooling for circulating water pumps)
The following ATWS-transient initiators also impact TB (Turbine Bypass & Main Condenser):
Initiator Imnact AMS TB/MC fail (MSIV closure)
AFWMS TB/MC fail (MSIV closure is assumed to occur for loss of FW initiator)
APCLP TB/MC fail (loss of power to 4KV Buses 1 and 2)
AGRLP TB/MC fail (loss of power to 4KV Buses 1 and 2)
ASW TB/MC fail (see SW impact above)
TB Split Fraction Rules:
TBFAIL (INIT=AMS) + (INIT=AFWMS) +
(-01=S) + (-02=S) + (SW=F) + (-IG=S) + ((-IC=S) * (-VC=S))
Note that the -01 =S rule or the -02=S rule covers initiators APCLP and AGRLP.
TBBASE 1 We assume that TB has all support systems available for other transient initiators and support system combinations. Note that we use TBBASE even when TB is degraded by the failure of IC alone or VC alone (TBFAIL is used when both IC and VC fail).
Top Event: RP - Recirculation Pump Trip RP General Notes:
a The recirculation pump trip signal shares components with ARI (top event AR). Thus, top event RP is evaluated both "independent' of AR and *dependent" of AR success or failure. The AR support systems also support RP.
RP Split Fractions:
RPFAIL ((-VC=S) + (DI=F)) * ((4C=S) + (D2=F))
RP is guaranteed to fail whenever a "divisional' power supply fails to both logic divisions.
RPAF (AR=B) * ((-IC=S) + (D2=F))
RPBF (AR=B) * ((-VC=S) + (D1=F))
RP is evaluated independent of AR when AR is bypassed in the event tree. The RP logic is degraded to a single logic division (RPAFIRPBF) whenever one power supply fails.
RPBASE (AR=B)
If the above rules for RPFAIL and RP1 F do not apply, the base case RP split fraction (fully redundant logics) is applied since all support systems are success. RP is evaluated independent of AR when AR is bypassed in the event tree.
Note: The RP split fractions below are used for situations where RP is asked dependent on AR success or failure.
RPARAF (AR=F) ^ ((4C=S) + (D2=F))
RPARBF (AR=F) ((-VC=S) + (D1=F))
RP is evaluated dependent on AR failure when the logics are degraded to a single logic division (i.e., RPARAF or RARBF) whenever one power supply fails.
RPARAS (AR=S) * ((-IC=S) + (D2=F))
RPARBS (AR=S) ' ((-VC=S) + (DI =F))
RP is evaluated dependent on AR success when the logics are degraded to a single logic division (i.e., RPARAS or RARBS) whenever one power supply fails.
RPARF (AR=F)
If the above rules for RPARAF/ RPARBF and RPARAS/ RPARBS do not apply, the base case split fraction (fully redundant logics) is applied since all support systems are success. RP is evaluated dependent on AR failure.
RPARS (AR=S)
If the above rules for RPARAF/ RPARBF and RPARAS/ RPARBS do not apply, the base case split fraction (fully redundant logics) is applied since all support systems are success. RP is evaluated dependent on AR success.
RPFAIL I If none of the above rules apply, the RPFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: FT- Feedwater Pump Trip FT General Notes:
D The feedwater pump trip logic is dependent on the following support systems.
Support System Failure Impact on FT 24V ECCS Battery A (top event VI) FT fails 125V Bus DC-1 (top event Dl) FT fails 24V ECCS Battery B (top event V2) FT fails 125V Bus DC-2 (top event D2) FT fails RPV ECCS Level channels 72A and 72B FT fails Note: The logic for FT is a "two-of-two" logic design. Thus, failure of one of the DC support systems guarantees failure of FT. Also, we take no credit for manual operator action to trip the feedwater pumps during ATWS events.
FT Split Fractions:
FTSUCC (INIT=AFWMS) + (INIT=APCLP) + (INIT=AGRLP)
We assume that the feedwater pump trip is not required for initiating events where feedwater is lost at time zero.
These include loss of feedwater transients where the MSIVs are assumed to close (INIT=AFVvMS), and loss of offsite power events (INIT=APCLP and INIT=AGRLP). No credit is taken for other situations involving loss of feedwater (e.g., random failure of TBCCW) since the loss of feedwater may be delayed well past the time at which the feedwater pump trip is required for reactor pressure mitigation.
FTFAIL (VI=F) + (DI=F) + (V2=F) + (D2=F) + (LV=F)
In addition to VI, D1, V2 and D2, we assume that failure of the ECCS low level signal (top event LV) also fails FT.
This is because FT uses the ECCS analog trip devices 72A and 72B which are also used for LV. We assume that FT is completely dependent on LV because of the common cause failure of the common level devices.
FTBASE I The base case split fraction is used for all remaining cases since all support systems are success.
Engineering Report
- Enteigy REPORT No. VY-RPT-05-00 10 l Revision 0 l Page l 154 l of l 303 l Top Event: FW- Feedwater System FW General Notes:
0 Single support system impacts are assumed for FW:
Support System Failure Impact of Feedwater 4kV Bus 1 (01) FW fails, FW pumps A & B fail, aux. oil pump for pump C fails, Cond. pump A fails.
4kV Bus 2 (02) FW fails, FW pump C fails, Cond. pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31.
125V DC-1 (DI) FWfails, loss of Bus 1 (01).
125V DC-2 (D2) FW fails, loss of Bus 2 (02).
120V Vital Bus (VC) FW fails, loss of power to FW reg. valves, including low flow valve.
120V Instru. Bus (IC) FW fails, loss of pumps A,B,C.
Instru. Air (IG) FW fails, loss of air to FW reg. valves, including low flow valve.
TBCCW MM FW fails, loss of cooling for FW and Cond. pumps A,B,C.
Service Water (SVW FW fails due to TBCCW failure (captured as TBCCW support system).
Note: FW is independent of FT since FT is bypassed in the ATWS event tree structure whenever FW is asked (i.e., when turbine bypass is success, TB=S). Because FW is only asked after TB success, the FW rules are the same as the "FW with TB=S' rules developed for the Transient event tree.
FW Split Fraction Rules:
FWFAIL (-1=S) + (-02=S) + (-VC=S) + (-IC=S) + (-IG=S) + (-TW=S) +
(SW=F) + (INIT=AFWMS)
Note that this rule is redundant in that most of these support system failures would cause failure of TB, hence the event tree structure would bypass top event FW.
FWBASE (TB=S)
This is the transient FW split fraction for use when TB is success and all other FW support systems are success.
FWFAIL I If none of the above rules apply, the FWFAIL rule will ensure a conservative result and assist in checking the validity of the results.
II Engineering Report I17tery REPORT No. VY-RPT-05-0011O l Revision 0 l Page l 155 l of l 303 Top Event: PR- Pressure Relief forATWS PR General Notes:
o PR models SRV/SV opening to provide reactor pressure relief during an ATWS condition. Top event PR evaluates use of the Safety Relief Valves (SRVs) and Spring Safety Valves (SSVs) to accomplish pressure relief of the Reactor Coolant System during ATWS event sequences. PR has no support systems. For ATWS we assume that a total of any four valves must open.
o Top Event PR is only evaluated when the MSIVs close (i.e., either TB is failed or FW fails to maintain water level above the MSIV closure setpoint) since pressure control is otherwise accomplished by turbine bypass to the main condenser. PR success relies upon prior success of the Recirculation Pump Trip (top event RP) in conjunction with feedwater pump trip (top event FT) to limit the reactor pressure/power increase transient.
PR Split Fraction Rules:
PRBASE 1 There are no support systems for the "mechanical" opening (overpressure relief function) of the SRVs and SVs.
Ton Event: SL - StandbV Liquid Control Iniection SL General Notes:
a The Standby Liquid control System has the following support system impacts:
0 The RWCU valves are considered because the model assumes that RWCU must isolate in order to ensure SLC success (i.e., one RWCU MOV must close).
SLC is dependent on manual initiation. We assume that the time available for operator action depends the suppression pool heatup rate, hence on whether the MSIVs are open or closed. With the MSIVs open and main condenser available (TB success), we assume the operator has one hour to initiate SLC injection. With TB failure, we assume that the operator must initiate SLC in six minutes.
Support System Failure Impact on SLC 480V MCC-8B (associated w/top event A3) SLC pump B, squib valve B, and RWCU MOV-15 480V MCC-9B (associated w/top event A4) SLC pump A, squib valve A, and RWCU MOV-68 125V DC-2 (D2) RWCU MOV-18 SL Split Fraction Rules:
These split fractions are used when the main condenser is not available and reactor steam is being discharged to the suppression pool. Hence, the values for these split fractions reflect the six minute operator action HEP.
SLCADF (TB=F) * ((A3=S) * (A4=F)) * (D2=F)
SLCBDF (TB=F) * ((A3=F) * (A4=S)) * (D2=F)
Turbine bypass is unavailable. One SLC pump/squib valve/RWCU isolation valve division is unavailable because one power division (Bus 3 or Bus 4) has failed, and closure capability of MOV-1 8 is unavailable due to D2 failure.
SLCAF (TB=F) * ((A3=S) * (A4=F))
SLCBF (TB=F) * ((A3=F) * (A4=S))
Turbine bypass is unavailable. One SLC pump/squib valveIRWCU isolation valve division is unavailable because one power division (Bus 3 or Bus 4) has failed.
SLCBS (TB=F)
Turbine bypass is unavailable, but all SLC support systems are success.
Note: The split fractions below are used when the MSIVs are open and the main condenser is available.
Hence, reactor steam is NOT being discharged to the suppression pool and the values for these split fractions reflect the one hour operator action HEP.
SLADF (TB=S) * (A3=F) * (A4=S) * (D2=F)
SLBDF (TB=S) * (A3=S) * (A4=F)* (D2=F)
Turbine bypass is success, one SLC pump/squib valve/RWCU isolation valve division is unavailable because one power division (Bus 3 or Bus 4), and closure capability of MOV-18 is unavailable due to D2 failure.
SLAF (TB=S) * (A3=F) - (A4=S)
SLBF (TB=S) * (A3=S) * (A4=F)
Turbine bypass is success, one SLC pump/squib valveIRWCU isolation valve division is unavailable because one power division (Bus 3 or Bus 4) has failed.
SLBASE (TB=S)
Turbine bypass is success, and all SLC support systems are success.
SLFAIL I If none of the above rules apply, the SLFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: IA - InhibitADS IA General Notes:
a This is the operator action to inhibit automatic initiation of ADS. There are no support systems, and we assume that the time available to accomplish IA does not depend on whether HPCI/RCIC injection is available (e.g., to delay the ADS low level initiation). Thus, IA is independent of all other top events and the base case IA split fraction is always used.
IA Split Fraction Rules:
IABASE I
ToP Event: ED - Emergency RPV Depressurization ED General Notes:
o This is the operator action to Emergency Depressurize the RPV on Heat capacity Temperature Limit (HCTL). For ATWS events with the MSIVs closed, we assume that the suppression pool will heatup rapidly and that the HCTL will be reached. This top event is dependent on support systems for remote manual operation of the SRVs and associated pilot solenoid valves.
a We assume that ED requires long-term operation of the SRVs, hence we require success of the containment gas nitrogen supply (top event CG). The only other support systems for ED are 125V DC-1 and DC-2. Given the system design, failure of both DC power sources is required to fail the depressurization function (fail all SRVs). DC-2 supplies the "normal" control power to each SRV solenoid valve. Upon failure of DC-2, control power to each solenoid valve will automatically transfer to DC-1 via de-energized relay K1 1A, B, C and D.
ED Split Fraction Rules:
These rules are similar to the AD rules in the Transient event tree.
EDFAIL (-CG=S) + ((Dl=F) * (D2=F))
The EDFAIL split fraction is used when containment nitrogen supply system (CG) has failed, or when both 125vdc power supplies (DI and D2) to SRV solenoid valves has failed.
EDDA (Dl=F)
EDDB (D2=F)
ED is degraded when one 125vdc power supply, eitherDI (EDDA) or D2 (EDDB), has failed.
EDBASE I The EDBASE split fraction is used for all other cases where all support systems are available/success.
Engineering Report Top Event: LC- RPVLevel/Power Control- OperatorAction LC General Notes:
0 This top event includes operator actions related to levelpower control. It includes the following specific operator actions:
- 1. Terminate and prevent injection before RPV depressurization (HEP basic event identifier LCATWS1 FL).
AND
- 2. Lower reactor water level to TAF or below until enough SLC is injected to shutdown the.reactor and restore water level after SLC injection to assure adequate boron mixing (HEP basic'event identifier LCATWS2FL).
The failure rates for these operator actions are summed to obtain the base case split fraction value, which is used for all cases of LC evaluation.
LC is a model of the operator action, there are no support systems modeled, and the base case LC split fraction is used. There is no fault tree needed to support split fraction development.
LC SDlit Fraction Rules:
LCBASE I
Engineering Report Top Event: Li - RPVLow Pressure Injection - OperatorAction LI General Notes:
3 Li models the operator action to manually initiate low pressure injection after RPV depressurization.
Manual initiation is necessary to assure core cooling because LI is only asked in the event tree after LC succeeds in Oterminating and preventing injection before RPV depressurization".
o Li only models the operator action. There are no support systems modeled, and the base case LIBASE split fraction is used for all cases where Li is evaluated.
LI Split Fraction Rules:
LIBASE I
ToP Event: CN - Condensate System (Low Pressure Iniection)
CN General Notes:
CN is evaluated in the event tree structure for cases where turbine bypass is success (TB=S) and feedwater has failed (FW=F), and for cases where turbine bypass has failed (TB=F) and feedwater is bypassed (FW=B). However, when TB=S and FW=F, the failure of FW is assumed to cause MSIV closure and subsequent failure of TB. Thus, we need rules to cover two cases:
- 1. TB unavailable and FW=F.
- 2. TB unavailable and FW=B.
The support system impacts for CN are as follows:
Support System Failure Impact of CN 4kV Bus 1 (01) CN Pump A fails 4kV Bus 2 (02) CN Pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31) 125V DC-2 (02) CN fails (02 failure) 120V Vital Bus (VC) CN fails (no power to FW reg. valves)
Instru. Air (IG) CN fails (no air to FW reg. valves)
TBCCW (TIN) CN fails (no pump motor cooling)
CN Split Fraction Rules:
CNFAIL (-02=S) + (-VC=S) + (4G=S) + (-TW=S) + (INIT=APCLP)
+ (INIT=AGRLP) + (INIT=AFWMS)
This split fraction is assigned when the support systems for Condensate fail. CN is also assumed unavailable when the initiators are APCLP, AGRLP and AFWMS.
CNIF (-O1 =S)
Failure of 4kV Bus I (-01 =S) degrades the CN model. This rule applies when CN is not already failed (see CNFAIL) and is evaluated independently of FW.
CNBASE (FW=B) + (-IC=S)
CN is asked independent of FW when FW is bypassed by the event tree structure or when FW is guaranteed failure by support system failures. This occurs only when (FW=B) or (-IC=S). This rule applies when CN is not already failed (see CNFAIL) and is evaluated independently of FW.
CNFWFI (FW=F)
The CNFWNFI rule covers cases where CN is asked dependent on FW. CN is asked dependent on FW only when TB is initially successful, but then FW fails which causes MSIV closure and the loss of TB. Thus, the CNFWF1 split fraction (which assumes TB failure) is appropriate.
CNFAIL I
If none of the above rules apply, the CNFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: IP- Primary Containment Integrit, IP General Notes:
0 Top event IP is asked in order to establish whether the containment is intact when the hard-piped vent from torus air space is used to prevent over-pressurization (VT=S). Integrity of containment is a necessary condition in order for the operator to control and maintain sufficient pressure in the containment in support of continued operation of LPCI or Core Spray pumps taking suction from the suppression pool at elevated temperature.
o Failure of containment integrity is defined to include failures in the containment boundary that allow leakage in excess of that which would prevent maintaining overpressure sufficient to satisfy the NPSH-r or the LPCI and Core Spray pumps at elevated suppression pool temperature. The leakage sources are divided into two principal categories:
o Isolation valve failures: These are related to the failure of the isolation valves in containment penetration lines or failure of the isolation signals or power to close these valves.
o Pre-existing failures: These are failures primarily related to hatches, electrical penetration assemblies (EPAs), and other containment leakage paths not associated with failure of isolation valves to close.
IP Split Fraction Rules IPIG (IG=F)+((VC=F)*(IC=F))
This split fraction is used when both the 'inboard" and "outboard' isolation valves fail due to support system failures.
The 'inboard' and 'outboard' valves for the PCAC system require instrument air (IG) for normal operation.
The isolation valves will fail CLOSED on interruption of air supply pressure. The 'inboard' isolation valves are dependent on Vital Bus (VC) 120vac, and the 'outboard' isolation valves are dependent on Instrument Bus (IC) 120vac. These isolation valves will fail CLOSED on loss of control power.
Inboard torus-to-RB vacuum breaker SB-16-19-11A requires Vital Bus (VC), while the SB-16-19-11 B vacuum breaker requires Instrument Bus (IC). These valves will fail OPEN on loss of air pressure or electric power. Note that the outboard torus-to-RB swing-check valves are in-series with the air-operated vacuum breakers, hence failure of the air-operated vacuum breakers to close does not necessarily cause failure of containment isolation.
IPVAC (VC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-1lA fails due to failure of the Vital Bus (VC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated IPIAC (IC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-1 6-19-11 B fails due to failure of the Instrument Bus (IC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated
IPBASE I No other support system failures affect the containment isolation system. Thus, the base case (all support systems available) split fraction applies to all sequences not captured by one of the previous rules.
Top Event: LP - Low Pressure Coolant Injection LP General Notes:
For ATWS scenarios, we assume that low pressure injection systems must be manually initiated and controlled by the operator (see top event LC). Thus, the LPFAIL split fraction here includes the term (-
Pl=S) instead of the (SIGF) term contained in the corresponding rule in the Transient event tree. PI is the only portion of the automatic initiation signal that the operator cannot override, hence PI failure is assumed to fail LP.
Support System Impacts on LP The impact of single support system failures on LP is as follows. Note that the min. flow valve in each LPCI loop (MOV-16AN16B) is maintained normally open and success of the LPCI loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume LPCI success does not depend on the min. flow valve hardware or the associated power supply.
Support System Failure Impact on LPCI 125V DC-I (Dl) RHR Pumps C and D fail; degraded injection valve ECCS signal.
125V DC-2 (D2) RHR Pumps A and B fail; degraded injection valve ECCS signal.
4kV Bus 3 (A3) RHR Pumps C and D fail; injection valve ECCS signal not degraded.
4kV Bus 4 (A4) RHR Pumps A and B fail; injection valve ECCS signal not degraded.
RRU7 (R7) No impact assumed based on room heatup assessment.
RRU8 (R8) No impact assumed based on room heatup assessment.
Service Water (SW) No impact assumed based on room heatup assessment. Also, RHR pump seal and bearing cooling via SW/RBCCW assumed not needed for injection mode.
RBCCW (RW) No impact; RHR pump seal and bearing cooling via RBCCW assumed not needed for the injection mode function.
Low Pressure Interlock (PI) Failure of capability to manually open low pressure injection MOVs.
LP Split Fraction Rules:
LPFAIL (-PI=S) + ((DI=F) + (A3=F)) * ((D2=F) + (A4=F))
The LPFAIL rule covers all support system failure combinations which guarantee failure of LP.
LP2VA (DI=F)
LP2VB (D2=F) l LPCI configuration will be 2 pump failure with degraded LPCI injection valve logic given DC-i (LP2VA) or DC-2 (LP2VB) failure.
LP2FA (A3=F)
LP2FB (A4=F)
LPCI configuration will be 2 pump failure without degraded LPCI injection valve logic given failure of 4KV AC Bus 3 (LP2FA) or AC Bus 4 (LP2FB) failure.
LPBASE I LPCI base case reliability is applied when all support systems are successful and Pi has not failed.
Top Event: CS - Core Spra, CS General Notes:
The rules for CS are the same as those developed for the Transient event tree except for the SIGF term.
Like LP, we assume that the operator must initiate and control CS (see top event LP) and that he cannot override the Low pressure Interlock (PI) signal and open low pressure injection valves.
Support System Impacts on CS The impact of single support system failures on CS is as follows. Note that the min. flow valve in each CS loop (MOV-5A/5B) is maintained normally open and success of the CS loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume CS success does not depend on the min. flow valve hardware or the associated power supply.
Support System Failure Impact on LPCI 125V DC-I (Dl) fails CS Loop B fails - Pump B and MOV-11B/12B.
125V DC-2 (02) fails CS Loop A fails - Pump A and MOV-1 1All2A.
4kV Bus 3 (A3) fails CS Loop B fails - Pump B and MOV-11B/12B.
4kV Bus 4 (A4) fails CS Loop A fails - Pump A and MOV-11A/12A.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW/RW fail No impact on Core Spray.
Low Pressure Interlock (PI) Failure of capability to manually open low pressure injection MOVs.
CS Split Fraction Rules:
CSFAIL (-PI=S) + ((DI=F) + (A3=F)) * ((D2=F) + (A4=F))
The CSFAIL split fraction accounts for all combinations of support system failures which fail both trains of Core Spray.
CSA4F ((A4=F) + (D2=F)) * ((A3=S) * (DI=S))
The CSA4F split fraction accounts for all support system failures which fail CS Train A, where CS Train B is available because of successful support systems.
CSA3F ((A3=F) + (Dl=F)) * ((A4=S) * (D2=S))
The CSA3F split fraction accounts for all support system failures which fail CS Train B, where CS Train A is available because of successful support systems.
CSBASE 1 If none of the earlier rules apply, then all CS support systems are available and we evaluate CS failure probability based on both CS trains being available (base case).
Top Event: RM - Recover Main Condenser RM General Notes:
a Recovery of the main condenser for reactor heat removal is assumed to involve the following two operator actions:
- 1. Restoration of the main condenser during an ATWS with successful SLC injection and level/power control, and
The HEPs forthese two operator actions are summed to obtain the RMATBS split fraction value (see rule below).
o We credit recovery of the main condenser providing that all support systems are success.
The support systems needed to recover the condenser are the same as top event TB (Turbine Bypass & Main Condenser):
Support System Failure Impact on TB/Main Condenser 4kV Bus 1 (01) TB/MC fail (failure of auxiliary oil pump, one circulating water pump, and steam packing exhauster) 4kV Bus 2 (02) TB/MC fail (failure of CST emergency makeup to main condenser (MOV-64-31),
two circulating water pumps, all three circulating water booster pumps, and vacuum priming pump) 120V Vital Bus (VC) TBIMC fail (SJAE assumed to fail) 120V Instru. Bus (IC) TB/MC fail (SJAE assumed to fail)
Instru. Air (IG) TB/MC fail (SJAE assumed to fail)
Service Water (SW) TB/MC fail (failure of pump cooling for circulating water pumps)
RM Split Fraction Rules:
RMATBS (01=S) * (02=S) * (SW=S) * (IG=S) * ((IC=S) + (VC=S))
The base case ATWS split fraction (RMATBS) is used whenever all support systems for the main condenser are available. This split fraction includes the operator error rate for the ATWS conditions.
RMFAIL I Recovery of the main condenser is assumed to fail for all remaining cases (RMFAIL) because one or more support systems are unavailable. Also, if the RMATBS rule does not apply, the RMFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Engineering Report Top Event: OT- OperatorAction to Initiate Torus Coolinq OT General Notes:
0 This top event models the operator action to initiate torus cooling for ATWS scenarios. This action is different than the HEP used to initiate torus cooling for Transient events (in top event TC), since the suppression pool heatup will be much more rapid for ATWS scenarios. Since OT models only the operator action, we have a single split fraction applicable to all ATWS cases.
OT Split Fraction Rules:
OTBASE 1
ToP Event: TC - Torus Cooling TC General Notes:
The operator action to initiate torus cooling was evaluated in top event OT. Thus, top event TC evaluates the success/failure of hardware only. Note that we use the same split fractions as were used for Transients, even though the Transient split fractions included manual initiation in top event TC. This is conservative for ATWS because we are 'double accounting' the operator initiation HEP (i.e., we have already considered it in OT), but this double counting is not significant since the operator error rate for Transients is very low (1E-06).
Support System Impacts on TC Torus Cooling (top event TC) is dependent on Low Pressure Coolant Injection (top event LP) due to shared RHR equipment. The impact of single support system failures on TC are as follows:
Support System Failure Impact on Torus Cooling 125V DC-I (D1) RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
125V DC-2 (D2) RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
4kV Bus 3 (A3) RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
4kV Bus 4 (A4) RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
RRU7 (R7) No impact on equipment is assumed based on room heatup assessment.
RRU8 (R8) No impact on equipment is assumed based on room heatup assessment.
Service Water (SW) RHR Pumps A, C & B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode), RHRSW Pumps A, C & B, D fail due loss of service water suction.
RBCCW (RW) fails RHR Pumps A, C & B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode). No impact on RHRSW pumps.
Low Pressure Interlock (PI) No impact on TC function is assumed.
TC Split Fraction Rules:
TCFAIL (SW=F) + ((DI=F) + (A3=F)) ^ ((D2=F) + (A4=F))
This rule captures all cases for which support system failures will fail both trains of TC.
TC3FA ((LP=B)+( (-Pl=S))*((D1 =F)+(A3=F))
TC3FB ((LP=B)+( (-PI=S))*((D2=F)+(A4=F))
Single loop TC with 2 RHRSW pump and 1 RHR pump available, D1 (D2) or A3(A4) unavailable.
TCBASE (LP=B) + (-PI=S)
TC split fractions TC3F and TCBASE evaluate TC independent of LP. The LPFAIL rule (see top event LP) defines the cases where LP is guaranteed to fail by support system failures.
Note: The only support system failure which appears in the LPFAIL rule and does not guarantee failure of TC is
(-P1=S). Because Pi failure guarantees failure of LP, TC is being evaluated independent of LP for these cases. LP can also be *bypassed" in the ATWS event tree because other injection systems, such as condensate (CN) can satisfy the RPV inventory function, consequently TC is evaluated (independently).
Therefore, we have also included the (LP=B) portion of the rule. The above rules for TC3F, and TCBASE capture these cases.
Note: If TC3FA, TC3FB, and TCBASE split fractions do not apply, TC must be evaluated 'dependent' upon the success or failure of LP. The following *dependent' LP/TC split fractions were developed to cover the various support system states given LP success /failure.
TCLS7A (LP=S)*(D1 =F)
TCLS7B (LP=S)'(D2=F)
TC failure given LP success when either D1 (TCLS7A) or D2 (TCLS7B) has failed.
TCLS6A (LP=S)*((A3=F))
TCLS6B (LP=S)'((A4=F))
TC failure given LP success when either A3 (TCLS6A) or A4 (TCLS6B) has failed.
TCLPS5 (LP=S)
TC failure given LP success when all support systems are available/successful TCLF7A (LP=F)*((DI=F))
TCLF7B (LP=F)*((D2=F))
TC failure given LP failure when either D1 (TCLF7A) or D2 (TCLF7B) has failed.
TCLF6A (LP=F)*((A3=F))
TCLF6B (LP=F)*((A4=F))
TC failure given LP failure when either A4 (TCLF6A) orA3 (TCLF6A) has failed.
TCLPF5 (LP=F)
TC failure given LP failure when all support systems are available/successful.
TCFAIL I If none of the above rules apply, the TCFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: VT- Torus Vent (hard-piped vent from torus airspace)
VT General Notes:
a The ATWS event tree structure only evaluates the torus vent (VT) when the reactor is successfully shutdown by SLC. Therefore, the transient base case split fraction is assumed to apply to these ATWS cases.
a Torus vent valve (TVS-86) is "normally" closed and requires manual action to open the valve and enable the use of the venting path with rupture disc. For ATWS type transients with successful SLC, we assume that the valve can be operated remotely from the control room if 480V MCC-7A (associated w/ 4kV Bus 2) is available, or the valve can be operated locally. Local operation is assumed possible because there is sufficient time before the vent path would be needed. Also, in this Level 1 event tree, venting is performed to prevent core damage, therefore, the Reactor Building is assumed to remain habitable to perform the local operation.
VT Split Fraction Rules:
VTTRBS I Local manual operation of the vent valve is assumed, therefore, there are no AC power support systems needed and the VTTRBS (Vent-Torus-Transient-Base-Case) split fraction is assigned for ATWS type transients with successful SLC.
Attachment F Event Tree (LOCALG)
z - "q o r- X mo
'-X
~C.)
a, tm Xtm
- L.
Top Event Description Name CR i CONTROL ROD INJECTION - REACTOR SHUTDOWN VS VAPOR SUPPRESSION SYSTEM LP LPCI SYSTEM Cs I LOW PRESSURE CORE SPRAY SYSTEM TC j TORUS COOLING SYSTEM VT TORUS HARD-PIPED VENT FOR LEVEL 1 ANALYSIS IP PRIMARY CONT. INTEGRITY FOR LEVEL 1 ANALYSIS AI ALTERNATE CORE COOLING SYSTEM, CRD, CONDENSATE TRANSFER, AND CST REFILL Initiator
= LLOCA (Large LOCA)
Modified Endstate Binning Rules - Large LOCA CONFIG#1 (model VYCOP2A)
.~~~. ......... ...... . ............-
Bin Rule IIIC (CS=F)
LOCA sequences with loss of injection. Core damage occurs with the reactor at low pressure.
CONFIG#2 (model VYCOP2)
Bin Rule IIIC (CS=F)+(IP=F)
LOCA sequences with loss of injection. For sequences where LPCI and Core Spray are initially available, injection failure occurs due to inadequate NPSH if containment isolation is unsuccessful (IP=F). Core damage occurs with the reactor at low pressure.
Top Event: CR - Control Rods Insert CR General Notes:
None.
CR Split Fraction Rules:
CRBASE I CR is considered to be independent of all other systems, hence the base case split fraction is used for all cases, i.e., CR has no support systems.
Engineering Report Ent-A- Enfergy REPORT No. VY-RPT-05-001 10 I Revision 0 Page 1 180 l of 1 303 1 Top Event: VS - Vapor Suppression VS General Notes:
a VS models the capability of the torus to drywell vacuum breakers to remain closed, thus forcing delivery of the drywell steam to the suppression pool via the vent header and downcomers.
VS Split Fraction Rules:
VSBASE I Like top event CR, VS has no support systems. Therefore, VS is assumed independent of all other systems.
ToP Event: IP - Primary Containment Integritk IP General Notes:
a Top event IP is asked in order to establish whether the containment is intact when the hard-piped vent from torus air space is used to prevent over-pressurization (VT=S). Integrity of containment is a necessary condition in order for the operator to control and maintain sufficient pressure in the containment in support of continued operation of LPCI or Core Spray pumps taking suction from the suppression pool at elevated temperature.
0 Failure of containment integrity is defined to include failures in the containment boundary that allow leakage in excess of that which would prevent maintaining overpressure sufficient to satisfy the NPSH-r or the LPCI and Core Spray pumps at elevated suppression pool temperature.
The leakage sources are divided into two principal categories:
3 Isolation valve failures: These are related to the failure of the isolation valves in containment penetration lines or failure of the isolation signals or power to close these valves.
0 Pre-existina failures: These are failures primarily related to hatches, electrical penetration assemblies (EPAs), and other containment leakage paths not associated with failure of isolation valves to close.
IP Split Fraction Rules IPIGL (IG=F)+((VC=F)*(IC=F))
This split fraction is used when both the "inboard" and 'outboard' isolation valves fail due to support system failures.
The "inboard" and Ooutboard" valves for the PCAC system require instrument air (IG) for normal operation.
The isolation valves will fail CLOSED on interruption of air supply pressure. The "inboard" isolation valves are dependent on Vital Bus (VC) 120vac, and the "outboard" isolation valves are dependent on Instrument Bus (IC) 120vac. These isolation valves will fail CLOSED on loss of control power.
Inboard torus-to-RB vacuum breaker SB-16-19-11A requires Vital Bus (VC), while the SB-16-19-11B vacuum breaker requires Instrument Bus (IC). These valves will fail OPEN on loss of air pressure or electric power. Note that the outboard torus-to-RB swing-check valves are in-series with the air-operated vacuum breakers, hence failure of the air-operated vacuum breakers to close does not necessarily cause failure of containment isolation.
IPVACL (VC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-11A fails due to failure of the Vital Bus (VC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated IPIACL (IC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-11B fails due to failure of the Instrument Bus (IC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated
IPBASL I No other support system failures affect the containment isolation system. Thus, the base case (all support systems available) split fraction applies to all sequences not captured by one of the previous rules.
Top Event: LP - Low Pressure Coolant Injection LP General Notes:
D The min. flow valve in each LP loop (MOV-16A116B) is maintained normally open and success of the LP loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume LPCI success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on LP 125V DC-I (Dl) fails RHR Pumps C and D fail; degraded injection valve ECCS signal.
125V DC-2 (02) fails RHR Pumps A and B fail; degraded injection valve ECCS signal.
4kV Bus 3 (A3) fails RHR Pumps C and D fail; injection valve ECCS signal not degraded.
4kV Bus 4 (A4) fails RHR Pumps A and B fail; injection valve ECCS signal not degraded.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW fails No impact assumed based on room heatup assessment. Also, RHR pump seal and bearing cooling via SW/RBCCW assumed not needed for injection mode.
RBCCW (RW) fails No impact; RHR pump seal and bearing cooling via RBCCW assumed not needed for the injection mode function.
ECCS Signal (SIG) fails Assumed to cause failure of LP for large break LOCA event (*).
(*) Success of the automatic ECCS actuation signal is assumed to be necessary for success of LPCI and Core Spray. For the Large LOCA, we take no credit for operator action to manually initiate ECCS after failure of the automatic initiation signal (top event Ol in the Auxiliary Support State Event Tree). The following Macro establishes whether the signal is failed based on failures of: Pi (Low Pressure Interlock), DW (Drywell Pressure),
LV (RPV Level) and PS (RPV Pressure). These individual signals are evaluated probabilistically in the Auxiliary Support State Event Tree.
SIGF: (-PI=S) + (-DW=S) * ((-LV=S) + (-PS=S))
Initiating Event Impact of LP For the large LOCA initiating event, we assume that the break is located on the "A' recirculation loop and disables the A loop (pumps A and C) of LPCI. Always assuming that the break is recirculation loop A is done to simplify the model. Because the frequency of a large break LOCA is low and does not significantly contribute to the total risk of core damage, this assumption is reasonable. A future model upgrade would be to assign half of the initiating event frequency to each recirculation loop if more rigor is needed. With the large break LOCA in recirculation loop A, we assume that LPCI loop A is guaranteed failure. Because of the large break-assumed system degradation, special 'large break LOCA split fractions" have been generated to account for associated LPCI system failure probability (reliability) for use in the evaluation of large break events. The above list of support system impacts is revised for the large LOCA as follows:
System/Event Assumed Impact on LPCI Large LOCA Loop A RHR Pumps A and C assumed failed.
125V DC-I (DI) fails RHR Pump D fails; degraded injection valve ECCS signal. Pump B in Loop B ok.
125V DC-2 (D2) fails RHR Pump B fails; degraded injection valve ECCS signal. Pump D in Loop B ok.
4kV Bus 3 (A3) fails RHR Pump D fails; injection valve ECCS signal not degraded. Pump B in Loop B ok.
4kV Bus 4 (A4) fails RHR Pump B fails; injection valve ECCS signal not degraded. Pump D in Loop B ok.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW fails No impact assumed based on room heatup assessment. Also, RHR pump seal and bearing cooling via SW/RBCCW assumed not needed for injection mode.
RBCCW (RW) fails No impact; RHR pump seal and bearing cooling via RBCCW assumed not needed for the injection mode function.
ECCS Signal (SIG) fails All LPCI fails given large break.
LP Split Fraction Rules:
SIGF: (-PI=S) + (-DW=S) * ((-LV=S) + (-PS=S))
SIGF macro is applied as described above. Failure of the ECCS signal is assumed to fail all of LP for the large break LOCA initiating event. Operator action to 'back-up' a failed ECCS signal is not credited for large break because we assume that there is insufficient time for the operator to respond for the large break LOCA event.
LPFAIL (SIGF) + ((D1=F) * (D2=F)) + ((D1=F) * (A4=F)) + ((D2=F) * (A3=F)) + ((A3=F) * (A4=F))
Based on the above impacts, LPCI is considered failed any time failure of a combination of support system divisions occurs.
LPL3VA DI=F LPL3VB D2=F Split fraction LPL3VA(VB) applies to large break LOCA where three pumps fail and the ECCS signal to injection valve MOV 27A(B) is degraded. Two pumps A & C or B & D fail because of the LOCA break location assumption. Pump A(D) fails when D1 =F, Pump B(C) fails when D2=F.
LPL3FA A3=F LPL3FB A4=F Split fraction LPL3FA(B) involves large break LOCA where three pumps fail and there is no degradation of the injection valve ECCS signal. Pumps A & C or B & D fail because of our LOCA assumption. Pump A (D) fails when A4=F, Pump B(C) fails when A3=F.
LPL2F I This split fraction rule covers all remaining large LOCA cases where two pumps are assumed to be disabled due to the LOCA location of Loop A. All support systems are available, and the LPL2F essentially becomes the LPCI
'base case' model for large break (2 LP pumps in Loop B are available).
Engineering Report 4%Enter~gy REPORT No. VY-RPT-05-00110 l Revision 0l Page l 185 l of 303 Top Event: CS - Core Spray CS General Notes:
The min. flow valve in each CS loop (MOV-5A/5B) is maintained normally open and success of the CS loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume CS success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on CS Support System Impact on CS 125V DC-I (Dl) fails CS Loop B fails- Pump B and MOV-11B/12B.
125V DC-2 (D2) fails CS Loop A fails - Pump A and MOV-1 IAI12A.
4kV Bus 3 (A3) fails CS Loop B fails - Pump B and MOV-11 B/12B.
4kV Bus 4 (A4) fails CS Loop A fails - Pump A and MOV-1 IA/12A.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW/RW fail No impact on Core Spray.
ECCS Signal (SIG) fails Assumed to cause failure of CS for large break LOCA event (*).
(*) Refer to top event LP above for summary of no credit for operator action to backup a failed ECCS signal for large break LOCA.
CS Split Fraction Rules:
CSFAIL (SIGF) + ((DI=F) + (A3=F)) * ((D2=F) + (A4=F))
The CSFAIL split fraction accounts for all combinations of support system failures which fail both trains of Core Spray. Note that the 'SIGF macro rule in CSFAIL is the same as that defined by the Macro SIGF earlier under top event LP.
CSA4F ((A4=F) + (D2=F)) * ((A3=S) * (Dl=S))
The CSA4F split fraction accounts for all support system failures which fail CS Train A, where CS Train B is available because of successful support systems.
CSA3F ((A3=F) + (DI=F)) * ((A4=S) * (D2=S))
The CSA3F split fraction accounts for all support system failures which fail CS Train B, where CS Train A is available because of successful support systems.
CSBASE I If none of the earlier rules apply, then all CS support systems are available and we evaluate CS failure probability based on both CS trains being available (base case).
Af Engineering Report Enterg'y REPORT No. VY-RPT-05-0011O l Revision 0 l Page l 186 l of l 303 Top Event: TC- Torus Cooling TC General Notes:
Support System Impacts on TC In general, Torus Cooling (top event TC) is dependent on Low Pressure Coolant Injection (top event LP) due to shared RHR equipment. The impact of single support system failures on TC are as follows:
Support System Impact on RHR 125V DC-I (Dl) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
125V DC-2 (D2) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
4kV Bus 3 (A3) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
4kV Bus 4 (A4) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
RRU7 (R7) fails No impact on equipment is assumed based on room heatup assessment.
RRU8 (R8) fails No impact on equipment is assumed based on room heatup assessment.
SW fails RHR Pumps A, C & B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode), RHRSW Pumps A, C & B, D fail due loss of service water suction.
ECCS Signal (SIG) fails No impact on TC function is assumed.
Large LOCA Loop A No impact on TC function is assumed.
TC Split Fraction Rules:
TCFAIL ((SW=F) * (-AW=S)) + ((D1=F) + (A3=F)) * ((D2=F) + (A4=F))
This rule captures all cases for which support system failures will fail both trains of TC. Note that we credit use of AW as an alternative to SW.
TC3FA (SIGF)*((DI =F)+(A3=F))
TC3FB (SIGF)*((D2=F)+(A4=F))
Single loop TC with 2 RHRSW pump and I RHR pump available, Dl (D2) or A3(A4) unavailable.
TCBASE (SIGF)
TC split fractions TC3FA(B) and TCBASE evaluate TC independent of LP. The LPFAIL rule (see top event LP) defines the cases where LP is guaranteed to fail by support system failures. Some of the same support system combinations that fail LP also fail TC and are accounted for in the TCFAIL rule. The only support system failure which appears in the LPFAIL rule and does not guarantee failure of TC is SIGF. Because SIGF guarantees
failure of LP, TC is being evaluated independent of LP for these cases. The above rules for TC3FA(B), and TCBASE capture these cases.
Note: If TC3FA(B) and TCBASE split fractions do not apply, TC must be evaluated 'dependent' upon the success or failure of LP. The following *dependent' LPITC split fractions were developed to cover the various support system states given LP success /failure.
TCLS4A (LP=S)*((D1=F))
TCLS4B (LP=S)*((D2=F))
TC failure given LP success when either D1 (TCLS4A) or D2 (TCLS4B) have failed.
TCLS3A (LP=S)*((A3=F))
TCLS3B (LP=S)*((A4=F))
TC failure given LP success when either A3 (TCLS3A) or A4 (TCLS3B) have failed.
TCLPS1 (LP=S)
TC failure given LP success when all support systems are available/successful TCLF4A (LP=F)*((Dl=F))
TCLF4B (LP=F)*((D2=F))
TC failure given LP failure when either D1 (TCLF4A)or D2 (TCLF4B) have failed.
TCLF3A (LP=F)*((A3=F))
TCLF3B (LP=F)*((A4=F))
TC failure given LP failure when either A4 (TCLF3A) orA3 (TCLF3B) have failed.
TCLF1 (LP=F)
TC failure given LP failure when all support systems are available/successful.
TCFAIL I If none of the above rules apply, the TCFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: VT- Torus Vent (hard-piped vent from torus air space)
VT General Notes:
Support System Impacts on TC a Torus vent valve (TVS-86) is 'normally' closed and requires manual action to open the valve and enable the use of the venting path with rupture disc. For the large LOCA initiating event, we assume that TSV-86 must be opened remotely from the control room. Local operator action to open this valve is not credited because of the potential for a harsh environment, even though venting takes place in Level 1 before core damage occurs. The power source needed for remote opening of TSV-86 is 480V MCC-7A (associated w/ 4kV Bus 2).
VT Split Fraction Rules:
VTLCBS (02=S)
The VTLCBS split fraction evaluates the reliability of the torus vent when power from MCC-7A/Bus2 (top event
- 02) available/successful and remote operator action can accomplish opening of TSV-86.
VTFAIL 1 VTFAIL split fraction is assigned since power from Bus 2 has failed. We conservatively assume no recovery of the power source or local operation of the valve, thus VT is assumed to be guaranteed failure.
Engineering Report
-- Enteqy REPORT No. VY-RPT-05-001 10 j Revision 0 PageI 189 jof 303 Top Event: Al- Alternate Injection (Long Term Injection)
Al General Notes:
0 Top event Al is used to account for potential (late) effects of high suppression pool temperature (i.e., TC=F) on injection systems that take suction from the pool (i.e., LP and CS). The effects of high pool temperature on pump seal and bearing cooling were not considered in the evaluation of top events LP and CS. Also, the operator action to control containment pressure after the torus vent opens was not considered in top event VT.
Al Split Fraction Rules:
AIFAIL 1 For large LOCA initiating events, Al assumes no credit for injection systems which take suction from outside containment. These include CRD, Condensate, Condensate Transfer (injection via Core Spray or LPCI injection lines), RHRSW or Firewater (injection via the RHR cross-tie). These systems either do not have adequate capacity or would require manual action to align for injection (for which we assume insufficient time is available) during a large break scenario.
Engineering Report
- Entery REPORT No. VY-RPT-05-001 10 Revision 0 Page j 190 of 303
Engineering Report E-E r7gy. REPORT No. VY-RPT-05-001 10 I Revision 0 l Page 1 191 l of 1 303 1 Attachment G Event Tree (LOCA MD)
Engineering Report a Entergy REPORT No. VY-RPT-05-00 10 l Revision 0 l Page l 192 l of l 303 l w - 7 ;; ; :T -'F :; -
wz - V
- z H
,,,4 t:
nx
-i- - -
-1 - - -.1.-.'1..1 0
I-C wa, U
0
-j E
Top Event Nam e Description CR CONTROL ROD INJECTION - REACTOR SHUTDOWN VS VAPOR SUPPRESSION SYSTEM DS DRYWELL SPRAY SYSTEM USED IN LOCASM AND LOCAMED OD MANUAL DEPRESSURIZATION USED FOR VAPOR SUPPRESSION ALTERNATIVE HP HPCI SYSTEM FW FEEDWATER SYSTEM AD AUTOMATIC DEPRESSURIZATION SYSTEM (ADS)
LP LPCI SYSTEM CS LOW PRESSURE CORE SPRAY SYSTEM CN CONDENSATE SYSTEM TC TORUS COOLING SYSTEM RM RECOVERY OF MAIN CONDENSER VT TORUS HARD-PIPED VENT FOR LEVEL 1 ANALYSIS IP PRIMARY CONT. INTEGRITY FOR LEVEL 1 ANALYSIS AI ALTERNATE CORE COOLING SYSTEM, CRD, CONDENSATE TRANSFER, AND CST REFILL Initiators:
D MLOCA (Medium LOCA) a IORV (Inadvertent Opening of Relief Valve)
SORV (Stuck Open Relief Valve)
Modified Endstate Binning Rules - Medium LOCA CONFIG#1 (model VYCOP2A)
Bin -Rule IIIC (CN=F) + (VT=B) * (AI=F)
LOCA sequences with loss of injection. Core damage occurs with the reactor at low pressure.
CONFIG#2 (model VYCOP2)
Bin Rule IIIC (CN=F) + (VT=B) * (AI=F) + (((RM=S) (AI=F)) + (TC=S)) * (IP=F) ((LP=S) + (CS=S))
LOCA sequences with loss of injection. For sequences where LPCI and Core Spray are initially available, injection failure occurs due to inadequate NPSH if containment isolation is unsuccessful (IP=F). Core damage occurs with the reactor at low pressure.
Top Event: CR - Control Rods Insert CR General Notes:
None.
CR Split Fraction Rules:
CRBASE I CR is considered to be independent of all other systems, hence the base case split fraction is used for all cases, i.e., CR has no support systems.
Engineering Report
~En terogy REPORT No. VY-RPT-05-001 10 I RevisionnO Page1 1961 of 1 1 Top Event: VS - Vapor Suppression VS General Notes: None.
VS Split Fraction Rules:
VSSUCC (INIT=IORV) + (INIT=SORV)
Although the inadvertent opening of an SRV (IORV) and stuck open SRV (SORV) both use the medium LOCA event tree, these events vent steam directly to the torus water volume, and therefore do not require vapor suppression via the downcomers.
VSBASE I Like top event CR, VS has no support systems. Therefore, VS is assumed independent of all other systems.
Top Event: DS - Drvwell Spray DS General Notes:
Top event DS considers the use of drywell sprays as a means of vapor suppression when top event VS fails. Rigorous modeling of DS must consider potential dependencies between DS and latertop events LP and TC (due to common RHR equipment in the LPCI, Torus Cooling and Drywell Spray modes). Also, rigorous treatment would consider the dependence between operator actions to initiate drywell sprays and to depressurize the RPV (see top event OD), since both actions are designed to limit the containment pressure/temperature rise. To simplify the modeling of top event dependencies, we conservatively take no credit for DS as a means of vapor suppression. However, the medium LOCA event tree (and other event trees) were constructed with Top Event DS as a place holder if the drywell function is ever re-evaluated and credited in the future. Note that because of equipment functional dependencies with the RHR LP injection function and RHR torus cooling function as mentioned earlier, we judge that crediting the drywell spray function will have marginal benefit to the model results. More importantly, crediting DS in addition to LP and TC would add complication to the model which should be considered against the marginal benefit.
DS SpIit Fraction Rules:
DSFAIL I DS is not credited, therefore, the guaranteed failure split fraction is assigned.
I gEngineering Report
- E tenegy REPORT No. VY-RPT-05-0011 l Revision 0 Page 198 l of 303 Top Event: OD - Manual RPV Depressurization for Containmenf Pressure Control OD General Notes:
OD models operator depressurization of the RPV via the SRVs (discharging to the suppression pool) as a means of mitigating the containment pressure rise for LOCA (Medium or Small) sequences with vapor suppression failure (stuck-open vacuum breakers). We assume that OD requires long-term operation of the SRVs, hence we require success of the containment gas nitrogen supply (top event CG). The only other support systems for OD are 125V DC-I and DC-2. Given the system design, failure of both DC power sources is required to fail the depressurization function (fail all SRVs). DC-2 supplies the 'normal" control power to each SRV solenoid valve. Upon failure of DC-2, control power to each solenoid valve will automatically transfer to DC-1 via de-energized relay K1 1A, B. C and D.
OD Split Fraction Rules:
ODFAIL (-CG=S) + ( (D1=F) * (D2=F))
OD is guaranteed to fail when CG fails or when both DC-I and DC-2 fail.
ODMLDA (D1=F)
ODMLDB (D2=F)
Split fraction ODMLDA(B) applies the operator action HEP associated with Medium LOCA events when Division 1(2) of DC power has failed.
ODMLBS I Split fraction ODMLBS applies the operator action HEP associated with Medium LOCA events when all support systems are available.
Top Event: HP - High Pressure Coolant Injection HP General Notes:
In the Medium LOCA event tree, HPCI is evaluated independent of RCIC because RCIC is not credited in the evaluation of Medium LOCA events. HPCI has only two support systems, 125V DC-1 and 120V Vital Bus. We also assume that HPCI must be manually initiated and controlled and there is no credit for automatic initiation on low RPV level or high drywell pressure signals. Also, we note that although the HPCI fault tree model and split fraction values include 'failure of auto suction transfer from CST to torus' as a failure mode, the contents/olume of the CST is not challenged (suction transfer judged not needed according to MAAP analyses, refer to Transient rule descriptions) and this failure mode is thus a slightly conservative aspect of the fault tree and event tree models.
Support System Failure Impact:
Support System Impacts on HP DC-1 fails HPCI fails VC fails HPCI auto suction transfer from CST to torus fails (requires manual operator action for HP success)
HP Split Fraction Rules:
HPFAIL (Di=F) + (-CI=S) + (A3=F)
Note that we assume that HPCI requires long-term power from DC-I (i.e., battery charging), hence HP fails if either DI, C1 (battery charging) or A3 (ac power for battery charging to DC-1) fail.
HPVCF (-VC=S)
This split fraction represents the HPCI system failure probability when the 120V Vital Bus fails and the auto suction transfer is initiated manually.
HPBASE 1 HPCI base case with all support systems available.
Engineering Report kE:
~~7 Jtergy REPORT No. VY-RPT-05-001 10 I Revision 0 l Page 1 200 l of l 303 l Top Event: FW- Feedwater Svstem FW General Notes:
The support system impacts assumed for FW are:
Support System Impacts on FW 4kV Bus 1 (01) FW fails, FW pumps A & B fail, aux. oil pump for pump C fails, Cond. pump A fails.
4kV Bus 2 (02) FW fails, FW pump C fails, Cond. pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31.
125V DC-1 (Dl) , FW fails, loss of Bus 1 (01).
125V DC-2 (D2) FW fails, loss of Bus 2 (02).
120V Vital Bus (VC) FW fails, loss of power to FW reg. valves, including low flow valve.
120V Instru. Bus (IC) FW fails, loss of pumps A,B,C.
Instru. Air (IG) FW fails, loss of air to FW reg. valves, including low flow valve.
TBCCW (MM) FW fails, loss of cooling for FW and Cond. pumps A,B,C.
FW Split Fraction Rules:
FWFAIL (-O1=S) + (-02=S) + (-VC=S) + (-IC=S) + (-IG=S) + (-TW=S)
Note that no rules were written to cover D1 =F or D2=F, because the event tree structure bypasses top event 01 or 02 (01=B or 02=B) when DI or D2 fail. These cases are captured by the -01=S and -02=S rules. Note also that the Medium LOCA initiator is assumed not to cause failure of FW (i.e., the LOCA is not in the feedwater piping).
FWTBBS I This is the split fraction for FW with Turbine Bypass (TB) not unavailable (MSIVs are assumed closed) and with all other support systems available. The MSIVs are assumed closed (and turbine bypass/main condenser not available) because the initiating event is a Medium LOCA.
Engineering Report
- Entergy REPORT No. VY-RPT-05-001 10 I Revision 0 =Page201 j of 303 Top Event: AD - RPV Depressurization System AD General Notes:
Top event AD (RPV depressurization for use of low pressure injection) is evaluated independent of top event OD (manual depressurization for vapor suppression) because AD is not evaluated in the Medium LOCA event tree structure if OD is bypassed or successful.
1 We assume that the ADS function has been inhibited by the operator (per EOPs), hence AD is a manual action, not automatic. This makes the AD model identical to the OD model except that the operator action involves different circumstances (i.e., is expected to have a different operator error rate).
Similar to OD, we assume that AD requires long-term operation of the SRVs, hence we require success of the containment gas nitrogen supply (top event CG). The only other support systems for AD are 125V DC-1 and DC-2. Given the system design, failure of both DC power sources is required to fail the depressurization function (fail all SRVs). DC-2 supplies the 'normal" control power to each SRV solenoid valve. Upon failure of DC-2, control power to each solenoid valve will automatically transfer to DC-1 via de-energized relay K1 1A, B, C and D.
AD Split Fraction Rules:
ADFAIL (-CG=S) + ((D1=F) * (D2=F))
AD is guaranteed to fail when CG fails or when both DC-1 and DC-2 fail.
ADMDA (DI=F)
ADMDB (D2=F)
Split fraction ADMDA(B) applies the operator action HEP associated with RPV depressurization during Medium LOCA events when division D1 (02) of DC power has failed.
ADMBS I Split fraction ADMBS applies the operator action HEP associated with RPV depressurization during Medium LOCA events when all support systems are available.
I Engineering Report
- telg)/ REPORT No. VY-RPT-05-00110 Revision 0 l Page l 202 l of l 303 Top Event: IP - Primary Containment Inteqriti IP General Notes:
D Top event IP is asked in order to establish whether the containment is intact when the hard-piped vent from torus air space is used to prevent over-pressurization (VT=S). Integrity of containment is a necessary condition in order for the operator to control and maintain sufficient pressure in the containment in support of continued operation of LPCI or Core Spray pumps taking suction from the suppression pool at elevated temperature.
Failure of containment integrity isdefined to include failures in the containment boundary that allow leakage in excess of that which would prevent maintaining overpressure sufficient to satisfy the NPSH-r or the LPCI and Core Spray pumps at elevated suppression pool temperature. The leakage sources are divided into two principal categories:
Isolation valve failures: These are related to the failure of the isolation valves in containment penetration lines or failure of the isolation signals or power to close these valves.
a Pre-existina failures: These are failures primarily related to hatches, electrical penetration assemblies (EPAs), and other containment leakage paths not associated with failure of isolation valves to close.
IP Split Fraction Rules IPIG (IG=F)+((VC=F)h(IC=F))
This split fraction is used when both the 'inboard' and 'outboard" isolation valves fail due to support system failures.
The 'inboard' and 'outboard" valves for the PCAC system require instrument air (IG)for normal operation.
The isolation valves will fail CLOSED on interruption of air supply pressure. The 'inboard' isolation valves are dependent on Vital Bus (VC) 120vac, and the outboard" isolation valves are dependent on Instrument Bus (IC) 120vac. These isolation valves will fail CLOSED on loss of control power.
Inboard torus-to-RB vacuum breaker SB-16-19-11A requires Vital Bus (VC), while the SB-16-19-11 B vacuum breaker requires Instrument Bus (IC). These valves will fail OPEN on loss of air pressure or electric power. Note that the outboard torus-to-RB swing-check valves are in-series with the air-operated vacuum breakers, hence failure of the air-operated vacuum breakers to close does not necessarily cause failure of containment isolation.
IPVAC (VC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-llA fails due to failure of the Vital Bus (VC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated IPIAC (IC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-1 B fails due to failure of the Instrument Bus (IC)120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated
Engineering Report AEntergy REPORT No. VY-RPT-05-001 10 l Revision 0 l Page l 203 l of l 303 l IPBASE 1 No other support system failures affect the containment isolation system. Thus, the base case (all support systems available) split fraction applies to all sequences not captured by one of the previous rules.
Eft Engineering Report w~Entergoy REPORT No. VY-RPT-05-0011O I Revision 0 Page 1 204 l of l 303 l Top Event: LP - Low Pressure Coolant Iniection LP General Notes:
= The min. flow valve in each LPCI loop (MOV-16A/16B) is maintained normally open and success of the LPCI loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume LPCI success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on LP Support System Impacts on LP 125V DC-I (D1) fails RHR Pumps C and D fail; degraded injection valve ECCS signal.
125V DC-2 (D2) fails RHR Pumps A and B fail; degraded injection valve ECCS signal.
4kV Bus 3 (A3) fails RHR Pumps C and D fail; injection valve ECCS signal not degraded.
4kV Bus 4 (A4) fails RHR Pumps A and B fail; injection valve ECCS signal not degraded.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW fails No impact assumed based on room heatup assessment. Also, RHR pump seal and bearing cooling via SW/RBCCW assumed not needed for injection mode.
RBCCW (RW) fails No impact; RHR pump seal and bearing cooling via RBCCW assumed not needed for the injection mode function.
ECCS Signal (SIG) fails Failure of the ECCS signal and failure to manually initiate low pressure pumps are assumed to cause failure of LPCI (and CS) for the Medium LOCA event.
Failure of the signal and manual backup action is handled in the SIGF rule (*).
Medium LOCA Event No impact on the number of available LP loops (both loops available, no degradation assumed).
(*) Success of either the automatic ECCS actuation signal or manual action to backup a failed signal are credited in the evaluation of LPCI and Core Spray for Medium LOCA events. For the Medium LOCA, we take credit for operator action to manually initiate ECCS after failure of the automatic initiation signal (top event Ol in the Auxiliary Support State Event Tree), providing that the PI (low pressure interlock) was successful. Signal and operator action top events are evaluated probabilistically in the Auxiliary State Support Event Tree: PI (Low Pressure Interlock), DW (Drywell Pressure), LV (RPV Level), PS (RPV Pressure) and 01 (operator action).
The combination of individual signals and operator action success or failure is evaluated before LPCI (and before Core Spray) using the SIGF Macro rule shown below. If the ECCS signal fails because of failure of the PI signal, we assume that this prevents the operator from initiating low pressure injection (will not be able to open injection valves). However, if the ECCS signal fails because of LV, PS or DW signal failures, the operator (01) can still manually initiate the low pressure systems.
SIGF: (-P1=S) + ((-DW=S) * ((4-V=S) + (-PS=S))) * (-OI=S)
LP Split Fraction Rules:
LPFAIL (SIGF) + ((DI=F) + (A3=F)) * ((D2=F) + (A4=F))
The LPFAIL rule covers all support system failure combinations which guarantee failure of LP.
LP2VA (DI=F)
LP2VB (D2=F)
LPCI configuration will be 2 pump failure with degraded LPCI injection valve logic given DC-1 (LP2VA) or DC-2 (LP2VB) failure.
LP2FA A3=F LP2FB A4=F LPCI configuration will be 2 pump failure without degraded LPCI injection valve logic given failure of 4KV AC Bus 3 (LP2FA) or AC Bus 4 (LP2FB) failure.
LPBASE (-SIGF) * (DI=S) * (A3=S) I (D2=S)* (A4=S)
LPCI base case reliability is applied when all support systems are successful and SIGF has not failed.
LPFAIL I If none of the above rules apply, the LPFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: CS - Core Spray System Support System Impacts on CS The impact of single support system failures on CS is as follows. Note that the min. flow valve in each CS loop (MOV-5A/5B) is maintained normally open and success of the CS loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume CS success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on CS 125V DC-I (DI) fails CS Loop B fails - Pump B and MOV-11B/12B.
125V DC-2 (D2) fails CS Loop A fails - Pump A and MOV-1 1A/12A.
4kV Bus 3 (A3) fails CS Loop B fails - Pump B and MOV-11B/12B.
4kV Bus 4 (A4) fails CS LoopAfails- Pump A and MOV-11A/12A.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW/RW fail No impact on Core Spray.
ECCS Signal (SIG) fails Assumed to cause failure of CS for large break LOCA event (*).
(*) Refer to top event LP above for summary of the SIGF rule.
CS Split Fraction Rules:
CSFAIL (SIGF) + ((DI=F) + (A3=F)) I ((D2=F) + (A4=F))
Both divisions of CS are guaranteed to fail when the ECCS signal fails or all support systems fail.
CSA4F ((A4=F) + (D2=F)) * ((A3=S) * (DI=S))
This is a train-specific split fraction, which applies the reliability of CS division B when AC Bus 4 or DC Bus 2 fail, but AC Bus 3 and DC Bus 1 are success.
CSA3F ((A3=F) + (DI=F)) * ((A4=S) * (D2=S))
This is a train-specific split fraction, which applies the reliability of CS Division A when AC Bus 3 or DC Bus 1 fail, but AC Bus 4 and DC Bus 2 are both success.
CSBASE I CS base case reliability is applied when the above rules are not satisfied.
Top Event: CN - Condensate Svstem (Low Pressure Injection)
CN General Notes: None.
Support System Imnacts on CN 4kV Bus 1 (01) CN Pump A fails 4kV Bus 2 (02) CN Pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31) 125V DC-2 (D2) CN fails (02 failure) 120V Vital Bus (VC) CN fails (no power to FW reg. valves)
Instru. Air (IG) CN fails (no air to FW reg. valves)
TBCCW (MWM CN fails (no pump motor cooling)
CN Split Fraction Rules:
CNFAIL (-02=S) + (-VC=S) + (4IG=S) + (-TW=S)
This split fraction is assigned when the support systems for Condensate fail. No rule is written for D2=F since 02 is bypassed in the event tree structure when D2=F. This is captured by the -02=S rule.
CN1F (-01 =S)
CNBASE (FW=B) + (-IC=S)
CN is asked independent of FW when FW is bypassed by the event tree structure or when FW is guaranteed failure by support system failures. This occurs only when (FW=B) or (-01=S) or (-IC=S). Failure of 4kV Bus I (-
01 =S) degrades the CN model. Thus we have the above two split fraction case, CN1 F and CNBASE. These rules apply when CN is not already failed (see CNFAIL) and is asked independently of FW.
CNFWS1 (FW=S)
Condensate System fails given Feedwater succeeds (TBCCW unavailable).
CNFWF1 (FW=F)
Condensate System fails given Feedwater fails (TBCCW unavailable).
CNFAIL 1 If none of the above rules apply, the CNFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Ton Event: TC- Torus Cooling TC General Notes: None.
Support System Impacts on TC In general, Torus Cooling (top event TC) is dependent on Low Pressure Coolant Injection (top event LP) due to shared RHR equipment. The impact of single support system failures on TC are as follows:
Support System Impacts on TC 125V DC-I (Dl) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
125V DC-2 (D2) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
4kV Bus 3 (A3) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
4kV Bus 4 (A4) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
RRU7 (R7) fails No impact on equipment is assumed based on room heatup assessment.
RRU8 (R8) fails No impact on equipment is assumed based on room heatup assessment.
SW fails RHR Pumps A, C & B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode), RHRSW Pumps A, C & B, D fail due loss of service water suction.
ECCS Signal (SIG) fails No impact on TC function is assumed.
Medium LOCA No impact on TC function is assumed.
TC Split Fraction Rules:
TCFAIL ((SW=F) * (-AW=S))) + ((DI=F) + (A3=F)) I ((D2=F) + (A4=F))
This rule captures all cases for which support system failures will fail both trains of TC. Note that we credit use of AW as an alternative to SW and RW.
TC3FA ((LP=B)+(SIGF))*((D1=F)+(A3=F))
TC3FB ((LP=B)+(SIGF))*((D2=F)+(A4=F))
Single loop TC with 2 RHRSW pump and 1 RHR pump available, D1 (D2) or A3(A4) unavailable.
TCBASE (LP=B) + (SIGF)
TC split fractions TC3FA(B) and TCBASE evaluate TC independent of LP. The LPFAIL rule (see top event LP) defines the cases where LP is guaranteed to fail by support system failures. Some of the same support system combinations that fail LP also fail TC and are accounted for in the TCFAIL rule. The only support system failure which appears in the LPFAIL rule and does not guarantee failure of TC is SIGF. Because SIGF guarantees failure of LP, TC is being evaluated independent of LP for these cases. LP can also be 'bypassed" in the Medium
LOCA event tree because other injection systems can satisfy the RPV inventory function, consequently TC must still be evaluated (independently). Therefore, we have also included the (LP=B) portion of the rule. The above rules for TC3FA(B), and TCBASE capture these cases. I Note: If TC3FA(B) and TCBASE split fractions do not apply, TC must be evaluated 'dependent' upon the success or failure of LP. The following 'dependent" LP/TC split fractions were developed to cover the various support system states given LP success /failure.
TCLS7A (LP=S)*(DI =F)
TCLS7B (LP=S)y(D2=F)
TC failure given LP success when either DI (TCLS7A) or D2 (TCLS7B) has failed.
TCLS6A (LP=S)*((A3=F))
TCLS61B (LP=S)*((A4=F))
TC failure given LP success when either A3 (TCLS6A) or A4 (TCLS6B) has failed.
TCLPS5 (LP=S)
TC failure given LP success when all support systems are available/successful TCLF7A (LP=F)*((Dl=F))
TCLF7B (LP=F)'((D2=F))
TC failure given LP failure when either Dl (TCLF7A) or D2 (TCLF7B) has failed.
TCLF6A (LP=F)*((A3=F))
TCLF6B (LP=F)*((A4=F))
TC failure given LP failure when either A4 (TCLF6A) orA3 (TCLF6A) has failed.
TCLPF5 (LP=F)
TC failure given LP failure when all support systems are available/successful.
TCFAIL 1 If none of the above rules apply, the TCFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: RM - Recover Main Condenser RM General Notes:
This top event models recovery of the main condenser. We do not credit RM for Medium LOCA initiating events.
However, the Medium LOCA event tree is also used for IORV and SORV initiators (which include Transient initiators where the relief valves fail to close). For IORV and SORV initiators, we only credit RM if all support systems for the main condenser are available. See top event TB in the Transient event tree for a description of these support systems.
RM Split Fraction Rules:
RMBASE ((INIT=IORV)+(INIT=SORV)) I (01=S) * (02=S) * (SW=S) * (IG=S)
- ((IC=S) + (VC=S))
The base case split fraction (RMBASE) is used whenever the initiator is IORV or SORV and all support systems for the main condenser are available.
RMFAIL I Recovery of the main condenser is assumed to fail for all remaining cases (RMFAIL) because one or more support systems are unavailable. Also, if the RMBASE rule does not apply, the RMFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: VT- Torus Vent (hard-piped vent from torus air space)
VT General Notes:
Support System Impacts on TC Torus vent valve (TVS-86) is "normally' closed and requires manual action to open the valve and enable the use of the venting path with rupture disc. For the Medium LOCA initiating event, we assume that TSV-86 must be opened remotely from the control room. Local operator action to open this valve is not credited because of the potential for a harsh environment, even though venting takes place in Level 1 before core damage occurs. The power source needed for remote opening of TSV-86 is 480V MCC-7A (associated w/ 4kV Bus 2).
VT Split Fraction Rules:
VTLCBS (02=S)
The VTLCBS split fraction evaluates the reliability of the torus vent when power from MCC-7A/Bus2 (top event
- 02) available/successful and remote operator action can accomplish opening of TSV-86.
VTFAIL 1 VTFAIL split fraction is assigned since power from Bus 2 has failed. We conservatively assume no recovery of the power source or local operation of the valve, thus VT is assumed to be guaranteed failure.
To, Event: Al- Alternate Injection (Long term Iniection)
Al General Notes: None.
Al Split Fractions:
AISUCC (CN=S)
The Medium LOCA event tree takes credit for CN as an injection system. Because CN takes suction from outside containment, CN is not affected by high suppression pool temperature or loss of NPSH due to failure to control venting. Thus, we assign guaranteed success to Al whenever CN has succeeded earlier in the event tree.
AIFAIL (INIT=MLOCA)
This rule guarantees failure of Al for Medium LOCA initiators which do not satisfy the AISUCC or AINPSH rule.
No credit is taken for "extemal" injection systems such as CRD, Condensate Transfer, RHRSW or Firewater for Medium LOCAs. This is based on the assumption that these systems would not be made available in a reasonable amount of time.
Because the Medium LOCA event tree is also used for IORV and SORV initiators, we use the following split fraction rules for IORV/SORV transient sequences.
AISUCC (RM=S) * ((LP=S) + (CS=S))
The AISUCC rule accounts for sequences where LP has succeeded earlier in the event tree, and where continued success of LP (at high suppression pool temperatures) is assured by RW or AW cooling.
AISBO (((A3=F) * (A4=F)) + ((-RW=S) * (-AW=S))) * ((-02=S) + ((LP=F) * (CS=F)))
AISBO is used when neither CRD nor CT is available for injection. CRD fails due to either motive power failure or failure of cooling via RBCCW (RVV and alternate cooling (AV). CT fails due to motive power failure or lack of an injection path via LP or CS.
AICTAF (((A4=F)+(D2=F))*(RW=S))*((-(02=S))+((LP=F)*(CS=F)))
AICTBF (((A3=F)+(D1=F))*(RW=S))*((-(02=S))+((LP=F)*(CS=F)))
AICTAF(BF) is used when only 1 CRD pump is available for alternate injection. It is conservatively assumed that CRD pump operation requires that RBCCW (RVW) be available. Only 1 CRD pump is available because either Bus 3 (AICTAF) or Bus 4 (AICTBF) power is a success, and component cooling via RBCCW is success. CT has failed because Bus 2 is not success (-02=S) or the injection paths via LP and CS have failed.
AICTBS (RW=S) I ((-02=S) + ((LP=F) I (CS=F)))
AICTBS is for the configuration of 2 CRD pumps available for alternate injection with no CT pump capability. CT is failed because either 1) failure of LP and CS is assumed to fail the injection paths or 2) power via Bus 2 (02) is unavailable. Both CRD pumps are available because both 4kV Buses 3 and 4 are available.
AICRBS (((A3=F) * (A4=F)) + (-RW=S)) * ((02=S) * ((LP=S) + (CS=S)))
AICRBS is used for configurations where both CT pumps are available but neither of the CRD pumps is available.
CT pumps have power from Bus 2 and at least one injection path via LP or CS is available. CRD pumps have failed either from lack of motive power from Bus 3 and Bus 4 or from failure or RBCCW.
AICRAF ((A4=F)+(D2=F))*((02=S)k((LP=S)+(CS=S)))*(RW=S)
AICRBF ((A3=F)+(DI=F))*((02=S)*((LP=S)+(CS=S)))*(RW=S)
AICRAF(BF) is used when both CT pumps and only 1 CRD pump are available for alternate injection. Only 1 CRD pump is available because either Bus 3 (AICRAF) or Bus 4 (AICRBF) power is success and component cooling via RBCCW is success (satisfied by the above rule). Both CT pumps are available because support systems are success (Bus 2) and an injection pathway to the RPV via LPCI or Core Spray is success.
AIBASE ((02=S) * ((LP=S) + (CS=S))) * (RW=S)
AIBASE is used when both CT pumps and both CRD pumps are available for alternate injection. All support systems needed by CRD and CT are success. CT requires the injection pathway to the RPV via LPCI or Core Spray, which is success.
AIFAIL 1 If none of the above rules apply, the AIFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Engineering Report I--Entergay REPORT No. VY-RPT-05-001 10 Revision 0 Page l214 l of 303 Attachment H Event Tree (LOCA-SM)
Engineering Report
- Entersg REPORT No. VY-RPT-05-001 10 Revision 0 l Page l 215 l of l 303 l 1UDU.!...z .. 11 E
am a,
w U.
Top Event Name Description CR CONTROL ROD INJECTION - REACTOR SHUTDOWN VS VAPOR SUPPRESSION SYSTEM DS DRYWELL SPRAY SYSTEM USED IN LOCASM AND LOCAMED OD MANUAL DEPRESSURIZATION USED FOR VAPOR SUPPRESSION ALTERNATIVE HP HPCI SYSTEM RC RCIC SYSTEM FW FEEDWATER SYSTEM AD AUTOMATIC DEPRESSURIZATION SYSTEM (ADS)
LP LPCI SYSTEM CS LOW PRESSURE CORE SPRAY SYSTEM CN CONDENSATE SYSTEM TC TORUS COOLING SYSTEM RM RECOVERY OF MAIN CONDENSER VT TORUS HARD-PIPED VENT FOR LEVEL 1 ANALYSIS IP PRIMARY CONT. INTEGRITY FOR LEVEL 1 ANALYSIS AI ALTERNATE CORE COOLING SYSTEM, CRD, CONDENSATE TRANSFER, AND CST REFILL Initiator:
= SLOCA(Small LOCA)
Modified Endstate Binning Rules - Small LOCA CONFIG#1 (model VYCOP2A)
Bin Rule-ID (CN=F) + ((VT=B) * (AI=F))
Sequences with loss of all injection. Core damage occurs with the reactor at low pressure.
CONFIG#2 (model VYCOP2)
Bin Rule -
ID (CN=F) + ((VT=B) * (AI=F)) + (((RM=S)* (AI=F)) + (TC=S)) * (IP=F) ((LP=S) + (CS=S))
Sequences with loss of all injection. For sequences where LPCI and Core Spray are initially available, injection failure occurs due to inadequate NPSH if containment isolation is unsuccessful (IP=F).Core damage occurs with the reactor at low pressure.
Top Event: CR - Control Rods Insert CR General Notes:
None.
CR Split Fraction Rules:
CRBASE 1 CR is considered to be independent of all other systems, hence the base case split fraction is used for all cases, i.e., CR has no support systems.
Ton Event: VS - Vapor Suppression VS General Notes: None.
VS Split Fraction Rules:
VSBASE 1 Like top event CR, VS has no support systems. Therefore, VS is assumed independent of all other systems.
Top Event: OD - Manual RPV Depressurization for Containment Pressure Control OD General Notes:
The split fraction rules for OD are similar for Small and Medium LOCAs. The only difference is that the split fraction values account for the greater time available for operator action for the small LOCA.
OD models operator depressurization of the RPV via the SRVs (discharging to the suppression pool) as a means of mitigating the containment pressure rise for LOCA (Medium or Small) sequences with vapor suppression failure (stuck-open vacuum breakers). We assume that OD requires long-term operation of the SRVs, hence we require success of the containment gas nitrogen supply (top event CG). The only other support systems for OD are 125V DC-1 and DC-2. Given the system design, failure of both DC power sources is required to fail the depressurization function (fail all SRVs). DC-2 supplies the 'normal' control power to each SRV solenoid valve.
Upon failure of DC-2, control power to each solenoid valve will automatically transfer to DC-I via de-energized relay K1 A, B, C and D.
OD Split Fraction Rules:
ODFAIL (-CG=S) + ( (DI=F) * (D2=F))
OD is guaranteed to fail when CG fails or when both DC-1 and DC-2 fail.
ODSLDA (DI=F)
ODSLDB (D2=F)
Split fraction ODSLDA(B) applies the operator action HEP associated with Small LOCA events when one Division 1 (2) of DC power has failed.
ODSLBS 1 Split fraction ODSLBS applies the operator action HEP associated with Small LOCA events when all support systems are available.
Top Event: HP - Hiqh Pressure Coolant Injection HP General Notes:
Support system failure impact on HPCI is as follows:
Support System Failure Impact on HPCI DC-1 fails HPCI fails VC fails HPCI auto suction transfer from CST to torus fails (requires manual operator action for HP success)
HP Split Fraction Rules:
HPFAIL (DI=F) + (-CI=S) + ((A3=F) * (-A3R))
HP is guaranteed failure when DC-1 fails HP also fails if the battery charger fails (long term DC power, top event CI), or if AC power is unavailable to the charger, A3 fails and is not recovered, A3R.
HPVCF (-VC=S)
Failure of VC fails HPCI auto suction transfer from CST to torus. This requires manual operator action for HP success HPBASE I
Top Event RC - Reactor Core Isolation Coolina RC General Notes:
The small LOCA tree structure evaluates RCIC (RC) after HPCI (HP). RC is therefore dependent on HP when HP is asked first since we account for potential common cause mechanisms between the RC and HP turbine-driven pumps. Note that RC is only evaluated in the event tree structure after HP fails. (If HPCI is success, the event tree structure does not evaluate RCIC. Thus, the only way that RC could be asked independent of HP is if HP was guaranteed failure by support system failures.,
The operator action for initiation and control of HPCI and RCIC is also assumed to be a completely dependent action.
The support system impacts for RC are:
Support System Failure Impact on RCIC 125V DC-2 (D2) RC fails (no MOV motive power, etc.)
120V Vital Bus (VC) RC fails (loss of flow controller power) 24V ECCS Battery B (V2) Failure of the automatic function to transfer suction from CST to torus (requires manual operator action for success)
Note that there are no other auto signal requirements for RC since we assume that the operator must manually initiate the system.
RC Split Fraction Rules:
RCFAIL (D2=F) + (-VC=S) + (-C2=S) + (A4=F)
The RCFAIL split fraction accounts for the failure of RC which occurs when DC-2 fails or when VC fails. Note that we assume long-term success of RCIC. This requires that the DC-2 battery is receiving charge (top event C2 battery charging) and that AC power (top event A4) is available to the charger.
RCV2F ((DI=F) + (-C1=S) + (A3=F)) * (-V2=S)
Split fraction RCV2F evaluates RCIC independent of HPCI when the 24V ECCS battery B (V2) failed (V2 failure degrades RCIC by failing the auto suction transfer). This independent split fraction is applied when the support systems of HPCI (D1, C1 and A3) have failed, thus HPCI is guaranteed failure and RCIC is evaluated independently. Note that we assume long-term success of HPCI and that is the reason for HPCI failure when C1 and A3 fail.
RCBASE (DI=F) + (-CI=S) + (A3=F)
Split fraction RCBASE evaluates RCIC independent of HPCI when all RCIC support systems are success. This independent split fraction is applied when the support systems of HPCI (DI, Cl and A3) have failed, thus HPCI is guaranteed failure and RCIC is evaluated independently.
The split fractions below address the case where RC is asked dependent on HP and HP failed randomly (HP support systems were success) . Note that there are no rules for HP=S since RC is bypassed in the event tree structure when HP=S as noted above.
RCHPF2 (HP=F) I (-V2=S)
RCHPF2 evaluates the RCIC failure probability given HPCI random failure when RCIC is degraded because of failure of the auto suction transfer (V2 failed).
RCHPFI (HP=F)
RCHPF1 evaluates the RCIC failure probability given HPCI random failure when all RCIC support systems are available (base case configuration).
RCFAIL I If none of the above rules apply, the RCFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: FW- Feedwater System (high Pressure injection)
FW General Notes:
Top event FW in the Small LOCA Event Tree is the same as top event FW in the Medium LOCA and Transient event trees with the following exceptions:
a FW is guaranteed failure for transient initiators TFWMS, TLP, TD1, TD2, TSW (SW failure leads to TW failure which, is assumed to fail Feedwater pump cooling).
a FW success does not require a hotwell makeup source of water for transients events where TB is available.
Support System Failure Impact of Feedwater 4kV Bus 1 (01) FW fails, FW pumps A & B fail, aux. oil pump for pump C fails, Cond. pump A fails.
4kV Bus 2 (02) FW fails, FW pump C fails, Cond. pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31.
125V DC-1 (DI) FW fails, loss of Bus 1 (01).
125V DC-2 (D2) FW fails, loss of Bus 2 (02).
120V Vital Bus (VC) FW fails, loss of power to FW reg. valves, including low flow valve.
120V Instru. Bus (IC) FW fails, loss of pumps A,B,C.
Instru. Air (IG) FW fails, loss of air to FW reg. valves, including low flow valve.
TBCCW (OV) FW fails, loss of cooling for FW and Cond. pumps A,B,C.
FW Split Fraction Rules:
FWFAIL (-01=S) + (-02=S) + (-VC=S) + (-IC=S) + (-IG=S) + (-TW=S)
Note that no rules were written to cover DI =F or D2=F, because the event tree structure bypasses top event 01 or 02 (01=B or 02=B) when Dl or D2 fail. These cases are captured by the -01=S and -02=S rules. Note also that the Small LOCA initiator is assumed not to cause failure of FW (i.e., the LOCA is not in the feedwater piping).
FWTBBS I This is the split fraction for FW with Turbine Bypass (TB) unavailable (MSIVs are assumed closed) and with all other support systems available. The MSIVs are assumed closed (and turbine bypass/main condenser not available).
Top Event: AD - RPV DePressurization System AD General Notes:
0 For evaluation of AD in the Small LOCA event tree, the only difference between the Small and Medium LOCA is in the time available for operator action. An "S" is used in the AD split fraction names to identify applicability to 'Small' LOCA.
D Top event AD (RPV depressurization for use of low pressure injection) is evaluated independent of top event OD (manual depressurization for vapor suppression) because AD is not evaluated in the Small LOCA event tree structure if OD is bypassed or successful.
o We assume that the ADS function has been inhibited by the operator (per EOPs), hence AD is a manual action, not automatic. This makes the AD model identical to the OD model except that the operator action involves different circumstances (i.e., is expected to have a different operator error rate).
0 Similar to OD, we assume that AD requires long-term operation of the SRVs, hence we require success of the containment gas nitrogen supply (top event CG). The only other support systems for AD are 125V DC-1 and DC-2. Given the system design, failure of both DC power sources is required to fail the depressurization function (fail all SRVs). DC-2 supplies the 'normal' control power to each SRV solenoid valve. Upon failure of DC-2, control power to each solenoid valve will automatically transfer to DC-1 via de-energized relay KI1A, B, C and D.
AD Split Fraction Rules:
ADFAIL (-CG=S) + ((DI=F) * (D2=F))
AD is guaranteed to fail when CG fails or when both DC-1 and DC-2 fail.
ADSDA (DI=F)
ADSDB (D2=F)
Split fraction ADSDA(B) applies the operator action HEP associated with RPV depressurization during Small LOCA events when Division 1 (2) of DC power has failed.
ADSBS I Split fraction ADSBS applies the operator action HEP associated with RPV depressurization during Small LOCA events when all support systems are available.
Top Event: IP- PrimaryContainmentIntegrity IP General Notes:
Top event IP is asked in order to establish whether the containment is intact when the hard-piped vent from torus air space is used to prevent over-pressurization (Vr=S). Integrity of containment is a necessary condition in order for the operator to control and maintain sufficient pressure in the containment in support of continued operation of LPCI or Core Spray pumps taking suction from the suppression pool at elevated temperature.
Failure of containment integrity is defined to include failures in the containment boundary that allow leakage in excess of that which would prevent maintaining overpressure sufficient to satisfy the NPSH-r or the LPCI and Core Spray pumps at elevated suppression pool temperature. The leakage sources are divided into two principal categories:
a Isolation valve failures: These are related to the failure of the isolation valves in containment penetration lines or failure of the isolation signals or power to close these valves.
Pre-existing failures: These are failures primarily related to hatches, electrical penetration assemblies (EPAs), and other containment leakage paths not associated with failure of isolation valves to close.
IP Split Fraction Rules IPIG (IG=F)+((VC=F)*(IC=F))
This split fraction is used when both the 'inboard" and 'outboard' isolation valves fail due to support system failures.
The Inboard" and 'Outboard' valves for the PCAC system require instrument air (IG) for normal operation.
The isolation valves will fail CLOSED on interruption of air supply pressure. The "inboard" isolation valves are dependent on Vital Bus (VC) 120vac, and the 'outboard' isolation valves are dependent on Instrument Bus (IC) 120vac. These isolation valves will fail CLOSED on loss of control power.
Inboard torus-to-RB vacuum breaker SB-16-19-1I1A requires Vital Bus (VC), while the SB-16-19-11 B vacuum breaker requires Instrument Bus (IC). These valves will fail OPEN on loss of air pressure or electric power. Note that the outboard torus-to-RB swing-check valves are in-series with the air-operated vacuum breakers, hence failure of the air-operated vacuum breakers to close does not necessarily cause failure of containment isolation.
IPVAC (VC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-IlA fails due to failure of the Vital Bus (VC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated
IPIAC (IC=F)
This split fraction is used when torus-to-RB vacuum breaker SB-16-19-1B fails due to failure of the Instrument Bus (IC) 120vac power supply. Note that the outboard torus-to-drywell swing-check valve is in-series with the air-operated vacuum breakers, hence failure of the air-operated IPBASE I No other support system failures affect the containment isolation system. Thus, the base case (all support systems available) split fraction applies to all sequences not captured by one of the previous rules.
Engineering Report Top Event: LP - Low Pressure Coolant Iniection LP General Notes:
The min. flow valve in each LPCI loop (MOV-16A/16B)is maintained normally open and success of the LPCI loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume LPCI success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on LP Support System Failure Impact of LP 125V DC-I (D1) fails RHR Pumps C and D fail; degraded injection valve ECCS signal.
125V DC-2 (02) fails RHR Pumps A and B fail; degraded injection valve ECCS signal.
4kV Bus 3 (A3) fails RHR Pumps C and D fail; injection valve ECCS signal not degraded.
4kV Bus 4 (A4) fails RHR Pumps A and B fail; injection valve ECCS signal not degraded.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW fails No impact assumed based on room heatup assessment. Also, RHR pump seal and bearing cooling via SW/RBCCW assumed not needed for injection mode.
RBCCW (RW) fails No impact; RHR pump seal and bearing cooling via RBCCW assumed not needed forthe injection mode function.
ECCS Signal (SIG) fails Failure of the ECCS signal and failure to manually initiate low pressure pumps are assumed to cause failure of LPCI (and CS). Failure of the signal and manual backup action is handled in the SIGF rule.
LP Split Fraction Rules:
SIGF: (-PI=S) + ((-DW=S) *((-LV=S) + (-PS=S))) * (-I=S)
This is the Marco rule for developing the failure logic if the ECCS signal. The SIGF macro is used below in the rules for LPCI and later for Core Spray. The ECCS signal is made up of a combination of low pressure interlock (PI), drywell high pressure (DMW, low reactor level (LV), low reactor pressure (PS). The operator (01) can also fail to Bbackup a failed signal provided that the signal did not fail due to PI.
LPFAIL (SIGF) + ((Dl=F) + (A3=F)) * ((D2=F) + (A4=F))
All of LPCI is guaranteed to fail when the ECCS signal fails or all support systems fail.
Ae yEngineering Report Difeq EJ REPORT No.V-RPT-5011 Revision 0 l Page l 229 l of l 7303 LP2VA (DI=F)
LP2VB (D2=F)
LPCI configuration will be 2 pump failure with degraded LPCI injection valve logic given DC-1 (LP2VA) or DC-2 (LP2VB) failure.
LP2FA (A3=F)
LP2FB (A4=F)
LPCI configuration will be 2 pump failure without degraded LPCI injection valve logic given failure of 4KV AC Bus 3 (LP2FA) orAC Bus 4 (LP2FB) failure.
LPBASE (-SIGF)* (DI=S) * (A3=S) (D2=S) * (A4=S)
LPCI base case reliability is applied when all support systems are successful and the SIGF has not failed.
LPFAIL I If none of the above rules apply, the LPFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: CS - Core Sprav System CS General Notes:
a The min. flow valve in each CS loop (MOV-5A15B) is maintained normally open and success of the CS loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume CS success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on CS Support System Failure Impact of CS 125V DC-I (DI) fails CS Loop B fails - Pump B and MOV-1 B/12B.
125V DC-2 (D2) fails CS Loop A fails - Pump A and MOV-1 IAM12A.
4kV Bus 3 (A3) fails CS Loop B fails - Pump B and MOV-11B/12B.
4kV Bus 4 (A4) fails CS Loop A fails - Pump A and MOV-1 1A/12A.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW/RW fail No impact on Core Spray.
ECCS Signal (SIG) fails Assumed to cause failure of CS for large break LOCA event (*).
(*) Refer to top event LP above for summary of the SIGF rule.
CS Split Fraction Rules:
CSFAIL (SIGF) + ((DI=F) + (A3=F)) * ((D2=F) + (A4=F))
Both divisions of CS are guaranteed to fail when the ECCS signal fails or all support systems fail.
CSA4F ((A4=F) + (D2=F)) * ((A3=S) * (Dl=S))
This is a train-specific split fraction, which applies the reliability of CS division B when AC Bus 4 or DC Bus 2 fail, but AC Bus 3 and DC Bus 1 are success.
CSA3F ((A3=F) + (DI=F)) * ((A4=S) * (D2=S))
This is a train-specific split fraction, which applies the reliability of CS Division A when AC Bus 3 or DC Bus 1 fail, but AC Bus 4 and DC Bus 2 are both success.
CSBASE I CS base case reliability is applied when the above rules are not satisfied.
Engineering Report Top Event: CN- Condensate System (Low Pressure Injection)
CN General Notes: None Support System Failure Impact of CN 4kV Bus 1 (01) CN Pump A fails 4kV Bus 2 (02) N Pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31 125V DC-2 (D2) CN fails (02 failure) 120V Vital Bus (VC) CN fails (no power to FW reg. valves)
Instru. Air (IG) CN fails (no air to FW reg. valves)
TBCCW (TW) CN fails (no pump motor cooling)
CN Split Fraction Rules:
CNFAIL (-02=S) + (-VC=S) + (4G=S) + (-TW=S)
This split fraction is assigned when the support systems for Condensate fail. No rule is written for D2=F since 02 is bypassed in the event tree structure when D2=F. This is captured by the -02=S rule.
CN is asked independent of FW when FW is bypassed by the event tree structure or when FW is guaranteed failure by support system failures. This occurs only when (FW=B) or (-01=S) or (-IC=S). Failure of 4kV Bus 1 (-
01 =S) degrades the CN model. Thus we have the following two split fraction case, CN1 F and CNBASE. These rules apply when CN is not already failed (see CNFAIL) and is asked independently of FW.
CNIF (-01=S)
Condensate system is degraded (one pump fails) when 4KV Bus 1 fails.
CNBASE (FW=B) + (-IC=S)
All other cases involve FW=F (CN is only asked after FW=F) with CN dependent on FW. All support systems for FW and CN have been accounted for by previous rules. The next two rules below (CNFWF1 and CNFWF2) apply to cases where CN is dependent on FW; success (CNFWS1) or failure (CNFWFl).
CNFWFI (FW=F) * ((-TB=S) + (INIT=TMS))
Condensate System fails given Feedwater fails (TBCCW unavailable).
CNFWF2 (FW=F) I (TB=S)
Condensate System fails given Feedwater fails (TBCCW available).
CNFAIL I If none of the above rules apply, the CNFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Engineering Report
- Enfter~ REPORT No. VY-RPT-05-O01 10 l Revision 0 Page l 233 J of l 303 l Top Event: TC- Torus Cooling TC General Notes:
Support System Impacts on TC In general, Torus Cooling (top event TC) is dependent on Low Pressure Coolant Injection (top event LP) due to shared RHR equipment. The impact of single support system failures on TC are as follows:
Support System Failure Impact on Torus Cooling 125V DC-I (Dl) fails RHR Pumps C& D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
125V DC-2 (D2) fails RHR Pumps A & Bfail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
4kV Bus 3 (A3) fails RHR Pumps C &Dfail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
4kV Bus 4 (A4) fails RHR Pumps A & Bfail; RHRSW Pumps A & Cfail; TC Loop A MOVs fail.
RRU7 (R7) fails No impact on equipment is assumed based on room heatup assessment.
RRU8 (R8) fails No impact on equipment is assumed based on room heatup assessment.
SW fails RHR Pumps A, C& B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode), RHRSW Pumps A, C & B, D fail due loss of service water suction.
ECCS Signal (SIG) fails No impact on TC function is assumed.
Small LOCA No impact on TC function is assumed.
TC Split Fraction Rules:
TCFAIL ((SW=F) * (-AW=S))) + ((D1=F) + (A3=F)) * ((D2=F) + (A4=F))
This rule captures all cases for which support system failures will fail both trains of TC. Note that we credit AW (which considers recovery of service water and use of the Alternate Cooling Mode) as a backup to SW in top event TC for Transient events.
TC3FA ((LP=B)+(SIGF))*((D1=F)+(A3=F))
TC3FB ((LP=B)+(SIGF))y((D2=F)+(A4=F))
Single loop TC with 2 RHRSW pump and 1 RHR pump available, D1 (D2) or A3(A4) unavailable.
TCBASE (LP=B) + (SIGF)
TC split fractions TC3FA(B) and TCBASE evaluate TC independent of LP. The LPFAIL rule (see top event LP) defines the cases where LP is guaranteed to fail by support system failures. Some of the same support system combinations that fail LP also fail TC and are accounted for in the TCFAIL rule. The only support system failure which appears in the LPFAIL rule and does not guarantee failure of TC is SIGF. Because SIGF guarantees failure of LP, TC is being evaluated independent of LP for these cases. LP can also be Obypassed' in the Small
Engineering Report E ntergy REPORT No. VY-RPT-05-0011O l Revision 0 lPage l 234 l of l 303 LOCA event tree because other injection systems can satisfy the RPV inventory function, consequently TC must still be evaluated (independently). Therefore, we have also included the (LP=B) portion of the rule. The above rules for TC3FA(B), and TCBASE capture these cases.
Note: If TC3FA(B) and TCBASE split fractions do not apply, TC must be evaluated 'dependent" upon the success or failure of LP. The following *dependent' LP/TC split fractions were developed to cover the various support system states given LP success /failure.
TCLS7A (LP=S)*(Di =F)
TCLS7B (LP=S)^(D2=F)
TC failure given LP success when either DI (TCLS7A) or D2 (TCLS7B) has failed.
TCLS6A (LP=S)*((A3=F))
TCLS6B (LP=S)h((A4=F))
TC failure given LP success when either A3 (TCLS6A) or A4 (TCLS6B) has failed.
TCLPS5 (LP=S)
TC failure given LP success when all support systems are available/successful TCLF7A (LP=F)-((D1=F))
TCLF7B (LP=F)*((D2=F))
TC failure given LP failure when either D1 (TCLF7A) or D2 (TCLF7B) has failed.
TCLF6A (LP=F)*((A3=F))
TCLF6B (LP=F)*((A4=F))
TC failure given LP failure when eitherA4 (TCLF6A) orA3 (TCLF6A) has failed.
TCLPF5 (LP=F)
TC failure given LP failure when all support systems are available/successful.
TCFAIL I If none of the above rules apply, the TCFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: RM- Recover Main Condenser RM General Notes:
For Small LOCA events, we credit recovery of the main condenser providing that all support systems are success.
The support system failures for top event TB (Turbine Bypass & Main Condenser) are as follows:
Support System Failure Impact on TB/Main Condenser 4kV Bus 1 (01) TB/MC fail (failure of auxiliary oil pump, one circulating water pump, and steam packing exhauster) 4kV Bus 2 (02) TB/MC fail (failure of CST emergency makeup to main condenser (MOV-64-31),
two circulating water pumps, all three circulating water booster pumps, and vacuum priming pump) 120V Vital Bus (VC) TB/MC fail (SJAE assumed to fail) 120V Instru. Bus (IC) TB/MC fail (SJAE assumed to fail)
Instru. Air (IG) TB/MC fail (SJAE assumed to fail)
Service Water (SMW TB/MC fail (failure of pump cooling for circulating water pumps)
RM Split Fraction Rules:
RMBASE (01=S) I (02=S) I (SW=S) I (IG=S) * ((IC=S) + (VC=S))
The base case split fraction (RMBASE) is used whenever all support systems for the main condenser are available. For AC power, we require that either 01 and 02 are available (01=S
- 02=S), or that both 01 and 02 are recovered (01 R
- 02R). We credit recovery of offsite power for RM because > 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> exists to establish heat removal with the main condenser before containment is threatened by overpressure, and before suppression pool temperature increase would threaten continued operation of LP/CS pumps.
RMFAIL I Recovery of the main condenser is assumed to fail for all remaining cases (RMFAIL) because one or more support systems are unavailable. Also, if the RMBASE rule does not apply, the RMFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Top Event: VT- Torus Vent (hard-piped vent from torus airspace)
VT General Notes:
Support System ImDacts on TC Torus vent valve (TVS-86) is *normally" closed and requires manual action to open the valve and enable the use of the venting path with rupture disc. For the Small LOCA initiating event, we assume that TSV-86 must be opened remotely from the control room. Local operator action to open this valve is not credited because of the potential for a harsh environment, even though venting takes place in Level 1 before core damage occurs. The power source needed for remote opening of TSV-86 is 480V MCC-7A (associated w/ 4kV Bus 2).
VT Split Fraction Rules:
VTLCBS (02=S)
The VTLCBS split fraction evaluates the reliability of the torus vent when power from MCC-7A/Bus2 (top event
- 02) available/successful and remote operator action can accomplish opening of TSV-86.
VTFAIL I VTFAIL split fraction is assigned since power from Bus 2 has failed. We conservatively assume no recovery of the power source or local operation of the valve, thus VT is assumed to be guaranteed failure.
To, Event: Al- Alternate Iniection Al General Notes:
The Al rules for Small LOCA are the same as those used for IORV initiators, except that the Small LOCA rule for AISUCC includes the term (FW=S) + (HP=S) + (RC=S) + (CN=S). This is because these systems can satisfy the long-term (up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) core cooling function for small LOCAs (but not for Medium LOCAs). The Al split fraction rules for Small LOCA are also the same as those used in the Transient event tree, except the small LOCA (and IORV) rules do not credit CRD as a high pressure injection source when AD fails. This is reflected in the Small LOCA event tree structure which guarantees failure of Al (bypasses Al) when AD=F. For completeness, the Al rules for Small LOCA are provided below.
Al Split Fraction Rules:
AISUCC (FW=S) + (HP=S) + (RC=S) + (CN=S) + (RM=S) * ((RW=S) + (AW=S)) I (LP=S)
The AISUCC rule accounts for sequences where systems that take suction from sources other than the suppression pool (and thus not subject to suppression pool heatup) are successful. This is the (FW=S) + (HP=S)
+ (RC=S) + (CN=S) portion of the rule. The remaining portion of the rule (RM=S) * ((RW=S) + (AW=S)) * (LP=S) is for sequences when LP has succeeded earlier in the event tree, and where continued success of LP (at high suppression pool temperatures) is assured by RW or AW cooling. Note that this rule only applies when RM=S because loss of NPSH is a concern when VT=S. (RM=S implies that venting was not needed for decay heat removal.)
AISBO (((A3=F) ^ (A4=F)) + ((-RW=S) * (-AW=S))) * ((-02=S) + ((LP=F) * (CS=F)))
AISBO is used when neither CRD nor CT is available for injection. CRD fails due to either motive power failure or failure of cooling via RBCCW (RW) and alternate cooling (AWA). CT fails due to motive power failure or lack of an injection path via LP or CS.
AICTAF (((A4=F)+(D2=F))*(RW=S))*((.(02=S))+((LP=F)h(CS=F)))
AICTBF (((A3=F)+(DI =F))*(RW=S))*((-(02=S))+((LP=F)^(CS=F)))
AICTAF(BF) is used when only 1 CRD pump is available for alternate injection. It is conservatively assumed that CRD pump operation requires that RBCCW (RWA) be available. Only 1 CRD pump is available because either Bus 3 (AICTAF) or Bus 4 (AICTBF) power is a success, and component cooling via RBCCW is success. CT has failed because Bus 2 is not success (-02=S) or the injection paths via LP and CS have failed.
AICTBS (RW=S) * ((-02=S) + ((LP=F) * (CS=F)))
AICTBS is for the configuration of 2 CRD pumps available for alternate injection with no CT pump capability. CT is failed because either 1) failure of LP and CS is assumed to fail the injection paths or 2) power via Bus 2 (02) is unavailable. Both CRD pumps are available because both 4kV Buses 3 and 4 are available.
AICRBS (((A3=F) * (A4=F)) + (-RW=S)) * ((02=S) * ((LP=S) + (CS=S)))
AICRBS is used for configurations where both CT pumps are available but neither of the CRD pumps is available.
CT pumps have power from Bus 2 and at least one injection path via LP or CS is available. CRD pumps have failed either from lack of motive power from Bus 3 and Bus 4 or from failure or RBCCW.
AICRAF ((A4=F)+(D2=F))*((02=S)*((LP=S)+(CS=S)))*(RW=S)
AICRBF ((A3=F)+(DI=F))y((02=S)*((LP=S)+(CS=S)))*(RW=S)
AICRAF(BF) is used when both CT pumps and only I CRD pump are available for alternate injection. Only 1 CRD pump is available because either Bus 3 (AICRAF) or Bus 4 (AICRBF) power is success and component cooling via RBCCW is success (satisfied by the above rule). Both CT pumps are available because support systems are success (Bus 2) and an injection pathway to the RPV via LPCI or Core Spray is success.
AIBASE ((02=S) * ((LP=S) + (CS=S))) * (RW=S)
AIBASE is used when both CT pumps and both CRD pumps are available for alternate injection. All support systems needed by CRD and CT are success. CT requires the injection pathway to the RPV via LPCI or Core Spray, which is success.
AIFAIL 1 If none of the above rules apply, the AIFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Attachment I Event Tree (FLOODS)
Engineering Report 7Etergy REPORT No. VY-RPT-05-001 10 l Revision 0 l Page l 240 l of 303l 11- - - - - - - T?-C;-., z P Z q r,F r. r f.,", Dr r F C.F.-
- ! 0.ll -,- r x - A F.r-V- (- 7, ,i ; IK, . !, r f ?i -
i - 5R a
- It I
V I
I I
a!
et tI us
- 4 I I U-ui I I clo rU.
0 t,
0 iIfh j LI-k, ii
.. ,._., ..... . A... .. _
_____________________ ________________I
Top Event Name Description CR CONTROL ROD INJECTION - REACTOR SHUTDOWN AM ATWS MITIGATION (SIMPLIFIED)
LA LPCI PUMPS IN LOOP A LB LPCI PUMPS IN LOOP B TB TURBINE BYPASS MODEL SO SRVS FAIL TO OPEN ON DEMAND SC SRVS FAIL TO CLOSE AFTER SUCCESSFUL OPEN FW FEEDWATER SYSTEM RC RCIC SYSTEM HP HPCI SYSTEM AD AUTOMATIC DEPRESSURIZATION SYSTEM (ADS)
CA CORE SPRAY TRAIN A CB CORE SPRAY TRAIN B VA LPCI INJECTION PATH - LOOP A VALVES VB LPCI INJECTION PATH - LOOP B VALVES CN CONDENSATE SYSTEM TCA TORUS COOLING TRAIN A TCB TORUS COOLING TRAIN B RM RECOVERY OF MAIN CONDENSER VT TORUS HARD-PIPED VENT FOR LEVEL 1 ANALYSIS IP PRIMARY CONT. INTEGRITY FOR LEVEL 1 ANALYSIS AICD ALTERNATE CORE COOLING SYSTEM, CRD, CONDENSATE TRANSFER, AND CST AICD REFILL AICT ALTERNATE CORE COOLING SYSTEM, CRD, CONDENSATE TRANSFER, AND CST AIT AREFILL_ _
CE _ ON _ _Y MCN_ _ S TA R N_
AI ALTERNATE CORE COOLING SYSTEM, CRD, CONDENSATE TRANSFER, AND CST Al REFILL
ise-
-=-En tergy t Engineering Report REPORT No. VY-RPT-05-00110 j Revision 0 l Page l242 l of l 303 l Initiators:
D RBTRF1 FLOOD EVENT REACTOR BUILDING TORUS ROOM DUE TO ISOLABLE SERVICE WATER PIPE BREAK a RBNEF1 FLOOD EVENT REACTOR BUILDING NE ECCS CORNER ROOM - SERVICE WATER PIPE BREAK a RBSEF1 FLOOD EVENT REACTOR BUILDING SE ECCS CORNER ROOM DUE TO SERVICE WATER PIPE BREAK a R303F1 FLOOD EVENT REACTOR BLDG EL 303 DUE TO SERVICE WATER FLDPLY PIPE BREAK a RBRCUF FLOOD EVENT REACTOR BUILDING NW UPPER RCIC ROOM EL 232 DUE TO FIRE WATER PIPE BREAK 0 RBTRF4 FLOOD EVENT INTORUS ROOM DUE TO CST PIPE BREAK a R280F1 FLOOD EVENT REACTOR BUILDING EL 280 DUE TO SERVICE WATER PIPE BREAK a TBCWF FLOOD EVENT TURBINE BUILDING DUE TO CIRC. WATER PIPE BREAK a INTSWF FLOOD EVENT IN INTAKE STRUCTURE SERVICE WATER PUMP ROOM a RBR3FI FLOOD EVENT REACTOR BUILDING EL 252 NORTH DUE TO SERVICE WATER PIPE BREAK D RBR3F2 FLOOD EVENT REACTOR BUILDING EL 252 NORTH DUE TO FIRE WATER PIPE BREAK a DGBF2 AUX STEAM, POTABLE WATER PIPE BREAK IN DG B ROOM a TBHVF FLOOD EVENT TB-HVAC ROOM AND FRONT OFFICE BLDG DUE TO SERVICE WATER PIPE BREAK a TBSWF FLOOD EVENT TURBINE BUILDING DUE TO SERVICE WATER AND FIRE WATER PIPE BREAKS a DGAF2 AUX STEAM, POTABLE WATER PIPE BREAK IN DG A ROOM a DGAF1 FLOOD EVENT IN DG-A ROOM DUE TO SERVICE WATER PIPE BREAK a DGBF1 FLOOD EVENT IN DG-B ROOM DUE TO SERVICE WATER PIPE BREAK a RTRFR2 Unisol. SW brk. on RB Side of V18 a RTRFT2 Unisol. SW Brk on TB Side of VI 8 a R280F2 SPRAY EVENT REACTOR BLDG EL 280 NORTH SIDE DUE TO CORE SPRAY PIPE BREAK a CSTF FLOOD EVENT AT CONDENSATE STORAGE TANK AND VALVE ENCLOSURE a WMACHF FLOOD EVENT WATER TREATMENT AND MACH SHOP AREA DUE TO CLEARWELL RUPTURE a AOGCNF FLOOD EVENT IN THE AOG BUILDING DUE TO CONDENSATE PIPE FAILURE a INTCWF FLOOD EVENT IN INTAKE STRUCTURE CIRC. WATER PUMP ROOM a RBNEF2 FLOOD EVENT REACTOR BUILDING NE ECCS CORNER ROOM - CST LINE BREAK a R280F4 SPRAY EVENT REACTOR BUILDING EL 280 SOUTH SIDE DUE TO CORE SPRAY/RBCCW PIPE BREAK a FOBF1 FLOOD EVENT IN FRONT OFFICE BLDG DUE TO FIRE WATER PIPE BREAK a RBR4FI FLOOD EVENT REACTOR BUILDING EL 252 SOUTH DUE TO FIRE WATER PIPE BREAK a RBSEF2 FLOOD EVENT REACTOR BUILDING SE ECCS CORNER ROOM - CST LINE BREAK a DGOPF FLOOD EVENT IN DG FUEL OIL TRANSFER PUMP HOUSE a RBTRF3 FLOOD EVENT REACTOR BUILDING TORUS ROOM DUE TO FIRE WATER PIPE BREAK AT EL. 213 a DISCHF FLOOD EVENT IN DISCHARGE STRUCTURE DUE TO CIRC. WATER PIPE BREAK a R280F5 FLOOD EVENT REACTOR BUIILDING EL. 280 DUE TO FIRE WATER PIPE BREAK a RBTRF2 FLOOD EVENT REACTOR BUILDING DUE TO UN-ISOLABLE SERVICE WATER PIPE BREAK AT EL. 303,280,252 AND TORUS ROOM
° CTWF FLOOD EVENT AT WEST COOLING TOWER DUE TO CIRC. WATER PIPE BREAK a CTEF FLOOD EVENT AT EAST COOLING TOWER DUE TO CIRC. WATER PIPE BREAK a RBR4F2 SPRAY EVENT REACTOR BUILDING EL 252 SOUTH/EAST DUE TO RBCCW PIPE BREAK
° R280F3 SPRAY EVENT REACTOR BUILDING EL 280 EAST SIDE DUE TO RBCCW PIPE BREAK a RB345F RB EL. 345 STEAM BREAK AFFECT ON CONDUIT
Aft eEngineering Report EnfTe f REPORTNo.W-RPT-05-O0110 Revision 0 Page l 244 of 303 Modiied Endstate Binning Rules - FLOODS CONFIG#1 (model VYCOP2A)
Bin -~' Rule - - - -' - '
SUCCESS ((TB=S) ((FW=S) + (RC=S) + (HP=S))) + (((FW=S) + (RC=S) + (HP=S) + (CA=S) +
(CB=S) + (LA=S) * (VA=S)) + ((LB=S) * (VB=S)) + (CN=S)) I ((TCA=S) + (TCB=S) +
(((RM=S) + (VT=S)) * ((AICD=S) + (AICT=S) + (RC=S) + (HP=S) + FW=S) + (CN=S)))))
Decay heat removal is satisfied rather via turbine bypass (no challenge to containment from loss of heat removal) or turbine bypass has failed, thus reactor heat must be removed by the containment cooling systems. Core injection can be satisfied by either high pressure or low pressure systems.
IIIC (SC=F) *(((LA=F) + (VA=F)) * ((LB=F) + (VB=F)) (CA=F) * (CB=F) * (CN=F) + (VT=B)
+ ((AICD=F) * (AICT=F))) + (((RM=S) * (AICD=F) (AICT=F)) + (TCA=S) + (TCB=S))
(IP=F) * (((LA=S) * (VA=S)) + ((LB=S) * (VB=S)) + (CA=S) + (CB=S))
This captures sequences where ADS has been successful to reduce reactor pressure but a relief valve fails to re-close (SC=F), followed by loss of all injection. Core damage occurs with the reactor at low pressure.
CONFIG#2 (model VYCOP2)
Bin :Rule -
SUCCESS ((TB=S) ((FW=S) + (RC=S) + (HP=S))) + (((FW=S) + (RC=S) + (HP=S) + (CN=S)) *
((TCA=S) + (TCB=S) + (((RM=S) + (VT=S)) I ((AICD=S) + (AICT=S) + (RC=S) + (HP=S)
+ (FW=S) + (CN=S))))) + (((CA=S) + (CB=S + ((LA=S) *(VA=S)) + ((LB=S) * (VB=S)))*
((((TCA=S) + (TCB=S)) * (IP=S)) + (((RM=S) + (VT=S)) * ((AICD=S) + (AICT=S) +
(RC=S) + (HP=S) + (FW=S) + (CN=S)))))
Decay heat removal issatisfied rather via turbine bypass (no challenge to containment from loss of heat removal) or turbine bypass has failed, thus reactor heat must be removed by the containment cooling systems. Core injection can be satisfied by either high pressure or low pressure systems. LPCI and Core Spray will fail if there is inadequate NPSH resulting from failure to maintain containment overpressure.
Loss of containment overpressure will occur if primary containment isolation fails (IP=F) Loss off containment overpressure isalso assumed if torus venting.
IIIC (SC=F) * (((LA=F) + (VA=F)) * ((LB=F) + (VB=F)) *(CA=F) (CB=F) I (CN=F) + (VT=B)
+ ((AICD=F) * (AICT=F))) + (((RM=S) * (AICD=F ) * (AICT=F)) + (TCA=S) + (TCB=S))
- IP=F) * (((LA=S) * (VA=S)) + ((LB=S) * (VB=S)) + (CA=S) + (CB=S))
This captures sequences where ADS has been successful to reduce reactor pressure but a relief valve fails to re-close (SC=F), followed by loss of all injection. LPCI and Core Spray will fail if there is inadequate NPSH resulting from failure to maintain containment overpressure. Loss of containment
overpressure will occur if primary containment isolation fails (IP=F) Loss off containment overpressure is also assumed if torus venting via the hard-piped vent is initiated (VTmS). Core damage occurs with the reactor at low pressure.
Top Event: CR - Control Rods Insert CR General Notes:
None.
CR Split Fraction Rules:
CRBASE I CR is considered to be independent of all other systems, hence the base case split fraction is used for all cases, i.e., CR has no support systems.
Engineering Report I- Entergy REPORT No. VY-RPT-05-001 10 l Revision 0 l Page l 247 l of l 303 l Top Event: AM - ATWS Mitigation AM General Notes: None.
AM Split Fraction Rules:
AMFAIL (Dl =F)+(D2=F)+(A3=F)+(A4=F)+(PI=F)+(LV=F)
AMBASE 1
Top Events: LA/LB - LPCI Trains and A and B LPCI General Notes:
a The min. flow valve in each LPCI loop (MOV-16A116B) is maintained normally open and success of the LPCI loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume LPCI success does not depend on the min. flow valve hardware or the associated power supply.
Support System Impacts on LPCI 125V DC-I (DI) fails RHR Pumps C and D fail; degraded injection valve ECCS signal.
125V DC-2 (D2) fails RHR Pumps A and B fail; degraded injection valve ECCS signal.
4kV Bus 3 (A3) fails RHR Pumps C and D fail; injection valve ECCS signal not degraded.
4kV Bus 4 (A4) fails RHR Pumps A and B fail; injection valve ECCS signal not degraded.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW fails No impact assumed based on room heatup assessment. Also, RHR pump seal and bearing cooling via SW/RBCCW assumed not needed for injection mode.
ECCS Signal (SIG) fails Failure of the ECCS signal and failure to manually initiate low pressure pumps are assumed to cause failure of LPCI (and CS). Failure of the signal and manual backup action is handled in the PSIGF rule.
LP Split Fraction Rules:
PSIGF (-(DW=S))*((-LV=S))+(-PS=S)))*(-(OI=S))
The macro SIGF models ECCS actuation either by automatic signals from the drywell (DW) and RPV (LV and PS) or by the operator action to initiate LPCI.
To, Event: LA - LPCI Train A LAFAIL (INIT=RBR3FI)+(INIT=RBNEFI)+(INIT=RBNEF2)
LA is assumed to be a guaranteed failure based on the impact of the above flooding initiating events.
LAFAIL (IOA=F) I ((INIT=R303F1) + (INIT=R280F1) +(INIT=R280F5) + (INIT=RBR3F2) +
(INIT=RBR4F + (INIT=RBTRF1) + (INIT=RTRFR2) + (INIT=RTRFT2) + INIT=RBTRF3) +
(INIT=RBRCUF) + (INIT=RBSEFI))
LA is assumed to be a guaranteed failure base on the impacts of the above flooding initiating events if the operator fails to isolate the break within approximately 1%2hours (IOA) to prevent flooding of ECCS Comer Room A.
LAFAIL PSIGF Failure of both automatic ECCS signals and operator manual actions to initiate LPCI will result in guaranteed failure of LA.
LAFAIL ((A4=F) + (D2=F)) * ((A3=F) + (DI=F))
This models a guaranteed failure of LPCI Train A due to both a failure of AC or DC power of Division 2 (Pump A) and Division 1 (Pump C).
LAI PF (A4=F) + (D2=F) + (A3=F) + (DI=F)
This models a failure of one pump in Train A due to either a failure of AC or DC Power of Division 2 (Pump A) or of Division I (Pump C).
LABASE (A4=S) * (D2=S) * (A3=S) I DI=S)
This models the base case of LPCI Train A with all support systems available.
LAFAIL I Top Event: LB - LPCI Train B LBFAIL (INIT=RBSEFI) + (INIT=RBSEF2)
LB is assumed to be a guaranteed failure based on the impact of the above flooding initiating events.
LBFAIL (IOA=F) I ((INIT=R303F1) + (INIT=R280F1) + (INIT=R280F5) + (INIT=RBR3FI) +
(INIT=RBR3F 2) + (INIT=RBR4FI) + (INIT=RBTRF1) + (INIT=RTRFR2) +
(INIT=RTRFT2) + (INIT=RBTRF3) + (INIT = RBRCUF)+(INIT=RBNEFl))
LA is assumed a guaranteed failure of the above flooding initiating events if the operator fails to isolate the break within approximately 1%A hours (IOA) to prevent flooding of ECCS Corner Room B.
LBFAIL PSIGF
FAM Engineering Report
-Enterg REPORTNo.VY-RPT-05-0011 l Revision0 lPage l 250 l of l 303 Failure of both automatic ECCS signals and operator manual actions to initiate LPCI will result in guaranteed failure of LB.
LBFAIL ((A4=F) + (D2=F)) * ((A3=F) + (Dl=F))
This models a guaranteed failure of LPCI Train A due to both a failure of AC or DC power of Division 2 (Pump B)and Division 1 (Pump D).
LBIPF ((A3=F) + (DI=F) + (A4=F) + (D2=F)) * ((INIT=RBR3FI) + (INIT=RBNEFI) +
(INIT=RBNEF2))
This models a failure of one pump in Train B due to either a failure of AC or DC Power of Division 2 (Pump A) or of Division 1 (Pump C).
LBBASE (A3=S) * (DI=S) * (A4=S) * (D2=S) * ((INIT=RBR3FI) + (INIT=RBNEFI) +
(INIT=RBNEF2))
This models the base case of LPCI Train B with all support systems available.
LBLAFI (LA=F) * (A4=S) * (D2=S) (A3=S) * (Dl=S)
This models the conditional probability that Train Bfails, given Train Afailure, with all support systems available.
LBLASI (LA=S) * (A3=S) (DI=S) * (A4=S) *(D2=S)
This models the conditional probability that Train Bfails, given Train A success, with all support systems available.
LBLAF2 (LA=F) * ((A4=F) + (D2=F) + (A3=F) + (DI1F))
This models the conditional probability that Train Bfails, given Train Afailure, with a failure of either Division 1 or Division 2 support systems. .
LBLAS2 (LA=S) * ((A4=S) * (D2=S) + (A3=S) * (D1=S))
This models the conditional probability that Train B fails, given Train A success, with a failure of either Division 1 or Division 2 support systems. .
LBFAIL I
Top Event: TB - Turbine Bypass/Main Condenser Support System Failure Impact on TB 4kV Bus 1 (01) TB/MC fail (failure of auxiliary oil pump, one circulating water pump, and steam packing exhauster) 4kV Bus 2 (02) TB/MC fail (failure of CST emergency makeup to main condenser (MOV-64-31), two circulating water pumps, all three circulating water booster pumps, and vacuum priming pump)
Instru. Air (IG) TB/MC fail (SJAE assumed to fail) 120V Vital Bus (VC) and 120V Instru. Bus (IC) TB/MC fail (SJAE assumed to fail)
Service Water (SW) TB/MC fail (failure of pump cooling for circulating water pumps)
TB Split Fraction Rules:
TBFAIL (IOA=F) ' (INIT=RTRFR2)
TB is assumed to fail for the above initiating event if the operator fails to restore SW to the Turbine Building (10A).
TBFAIL (INIT=AOGCNF) + (INIT=CSTF) + (INIT=CTEF) + (INIT=CTWF) + (INIT=DISCHF) +
(INIT=TBCWF) + (INIT=FOBFI) + (INIT=INTCWF) + (INIT=RBRCUF) + (INIT=RBNEF2)
+ (INIT=RBSEF2) + (INIT= RTRFT2)
TB is assumed to fail following the above flooding initiating events.
TBFAIL (CR=F) + (OS=F) + (401=S)) + (-(02=S)) + (SW=F) + (4IG=S)) + ((4IC=S)) * (-(VC=S)))
TB is guaranteed to fail based on failure of the above support system failures.
TBBASE (01 =S) * (02=S) * (SW=S) * (IG=S) * ((IC=S) + (VC=S))
This models the probability of TB failure given all support systems are available.
Note: We use TBBASE even when TB is degraded by the failure of IC alone or VC alone (TBFAIL is used when both IC and VC fail).
TBFAIL 1
Top Event: SO - Safetv/Relief Valves Open SO General Notes:
0 SO models opening of the SRVs/SVs for the pressure relief function.
SO Split Fraction Rules:
SOBASE I SRVWSV opening to satisfy the pressure relief function has no support systems.
ToP Event: SC - Safety/Relief Valves Close SC General Notes:
Given the demand to open the SRVs/SVs in top event SO, top event SC models the failure probability of the SRVs/SVs to close.
SC SDlit Fraction Rules:
SCBASE I SRV closing after successful pressure relief function has no support systems.
Top Event: FW- Feedwater System (high pressure injection)
FW General Notes:
None Support System Failure Impact of Feedwater 4kV Bus 1 (01) FW fails, FW pumps A & B fail, aux. oil pump for pump C fails, Cond.
pump A fails.
4kV Bus 2 (02) FW fails, FW pump C fails, Cond. pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31.
125V DC-1 (DI) FW fails, loss of Bus 1 (01).
125V DC-2 (D2) FW fails, loss of Bus 2 (02).
120V Vital Bus (VC) FW fails, loss of power to FW reg. valves, including low flow valve.
120V Instru. Bus (IC) FW fails, loss of pumps A,B,C.
Instru. Air (IG) FW fails, loss of air to FW reg. valves, including low flow valve.
TBCCW (TVV) FW fails, loss of cooling for FW and Cond. pumps A,B,C.
FW Split Fraction Rules:
FWFAIL (INIT=AOGCNF) + (INIT=CSTF) + (INIT=TBCWF) + (INIT=FOBFI) + (INIT=RBRCUF) +
(INIT=RBTRF4) + (INIT=RBNEF2) + (INIT=RBSEF2) + (INIT=RBR3F2)
FW is assumed to fail for any of the above initiating events.
FWFAIL (CR=F) + (-(O1=S)) + (-(02=S)) + (-(VC=S)) + (-(IC=S)) + (-(IG=S))+(-(TW=S))
FW is assumed to fail following failure of the above support systems.
FWTBBS ((TB=F) * (01=S) * (02=S) * (VC=S) * (IC=S) * (IG=S) * (TW=S))
When FW is not guaranteed failure by the FWFAIL rule, then the FW split fraction depends on whether TB is failed. When TB fails, then the FWTBBS split fraction is used. Because TB succeeds for all other cases, the FWBASE split fraction (below) is used.
FWBASE ((TB=S) * (O1=S) I (02=S) * (VC=S) * (IC=S) * (IG=S) * (TW=S))
FW base case with all support systems available.
FWFAIL I Top Event: RC - Reactor Core Isolation Coolin, RC General Notes:
= Because RC is asked before HP in the FLOODS tree, RC is always independent of HP.
Support System Failure Impact on RCIC 125V DC-2 (D2) RC fails (no MOV motive power, etc.)
120V Vital Bus (VC) RC fails (loss of flow controller power) 24V ECCS Battery B (V2) Failure of the automatic function to transfer suction from CST to torus (requires manual operator action for success)
Note There are no other auto signal requirements for RC since we assume that the operator must manually initiate the system. The operator action for initiation and control of HPCI and RCIC is also assumed to be a completely dependent action.
RC Split Fraction Rules:
RCFAIL (INIT=R303F1) + (INIT=R280F1) + (INIT=R280F5) + (INIT=RBR3FI) + (INIT=RBR3F2) +
(INIT=RBR4F1) + (INIT=RBTRFI) + (INIT=RTRFR2) + (INIT=RTRFT2) +
(INIT=RBTRF3) + (INIT=RBTRF4) + (INIT=RBRCUF) + (INIT=RBNEF1) +
(INIT=RBSEFI)
RC is assumed to be a guaranteed failure due to the flooding impacts of the above initiating events or because the initiating event is a break in the RCIC system.
RCFAIL (IOA=F) * ((INIT=RBNEF2) + (INIT=RBSEF2))
RC is assumed to fail for the above initiating events if the operator fails to isolate the break within approximately 30 minutes to prevent flooding of the RCIC system.
RCFAIL (D2=F) + (4C2=S)) + ((A4=F) ' (-A4R)) + (4VC=S)) + (SC=F) + (CR=F)
RC is guaranteed failure when DC-2 fails. RC also fails if the battery charger fails (long term DC power, top event C2), or if AC power is unavailable to the chargers, A4 fails and is not recovered, A4R. Failure of the 120V Vital Bus (VC) will also fail RCIC.
RCV2F (-V2=S)
Failure of 24 V ECCS power V2 degrades the reliability of RC by failing the auto suction transfer function.
RCBASE (D2=S) * (C2=S) ((A4=S) + (A4R)) * (VC=S) I (V2=S)
The above models the base case RC failure probability with all support systems available.
RCFAIL I
Top Event: HP - High Pressure Coolant Injection HP General Notes:
None.
Support System Failure Impact on HPCI DC-1 fails HPCI fails VC fails HPCI auto suction transfer from CST to torus fails (requires manual operator action for HP success)
HP Split Fraction Rules:
HPFAIL (INIT=R303F1) + (INIT=R280F1) + (INIT=R280F5) + (INIT=RBR3FI) + (INlT=RBR3F2) +
(INIT=RBR4FI) + (INIT=RBTRFI) + (INIT=RTRFR2) + (INIT=RTRFT2) +
(INIT=RBTRF3) + (INIT=RBTRF4) + (INIT=RBRCUF) + (INIT=RBNEFI) +
(INIT=RBSEFI)
RC is assumed to be a guaranteed failure due to the flooding impacts of the above initiating events or because the initiating event is a break in the HPCI system HPFAIL (IOA=F)y((INIT=RBNEF2) + (INIT=RBSEF2))
RC is assumed to fail for the above initiating events if the operator fails to isolate the break within approximately 30 minutes to prevent flooding of the HPCI system.
HPFAIL (Dl=F) + (-(C1=S)+((A3=F)h-A3R))+(CR=F)
HP is guaranteed failure when DC-1 fails. HP also fails if the battery charger fails (long term DC power, top event Cl), or if AC power is unavailable to the charger, A3 fails and is not recovered, A3R.
HPBASE (RC=B) + ((D2=F) + (4C2=S)) + ((A4=F) * (-A4R))) I ((DI=S) * (CI=S) * ((A3=S) +
(A3R)) * (VC=S))
HP is evaluated independent of RC if RC is bypassed or RC fails due to a failure in one of its support systems. All HP support systems are available.
HPVCF (RC=B) + ((D2=F) + (-(C2=S)) + ((A4=F) * (-A4R))) * ((DI=S) * (CI=S) * ((A3=S) +
(A3R)) * (-(VC=S))
HP is evaluated independent of RC if RC is bypassed or RC fails due to a failure in one of its support systems. All HP support systems are available with the exception that Vital AC (VC) has failed.
Engineering Report is Entergy i0 REPORT No. VY-RPT-05-001 10 Revision 0 l Page l 259 l of l 303 l i
HPRCF2 (RC=F) * (-(V2=S))
This models the dependent failure probability of HPCI given failure of Vital AC (VC) a random (not support system) failure of RCIC HPRCF1 (RC=F) * (V2=S)
This models the dependent failure probability of HP given that RC has failed randomly and V2 is successful.
HPFAIL I If none of the above rules apply, the HPFAIL rule will ensure a conservative result and assist in checking the validity of the results.
im Engineering Report tei gy REPORT No. VY-RPT-05-00110 l Revision 0 Page 260 l of l303 Top Event: AD - RPV Depressurization AD General Notes:
0 AD models manual depressurization of the RPV via the SRVs (discharging to the suppression pool) as a means of reducing RPV pressure to allow injection of low pressure systems. We assume that AD requires long-term operation of the SRVs, hence we require success of the containment gas nitrogen supply (top event CG). The only other support systems for AD are 125V DC-1 and DC-2.
Given the system design, failure of both DC power sources is required to fail the depressurization function (fail all SRVs). DC-2 supplies the 'normal" control power to each SRV solenoid valve. Upon failure of DC-2, control power to each solenoid valve will automatically transfer to DC-1 via de-energized relay K1 1A, B, C and D.
0 Top event SC models the failure to close of an SRV following a required opening. Failure to dose results in RPV inventory loss similar to that of an MLOCA, resulting in reduced operator time to perform AD.
AD SPlit Fraction Rules:
ADFAIL (-CG=S) + ((Dl=F) * (D2=F))
RPV depressurization is guaranteed to fail if the above support system failure combinations occur.
ADSDA (-(SC=F)) * (DI=F)
This models the failure probability of AD, given a degraded condition resulting from failure of Division 1 of DC power. SRVs have either not been challenged or have successfully closed following opening.
ADSDB (-(SC=F)) * (D2=F)
This models the failure probability of AD, given a degraded condition resulting from failure of Division 2 of DC power. SRVs are closed, either not being challenged or successfully closing following opening.
ADSBS (-(SC=F)) * ((CG=S) I (DI=S) * (D2=S))
This models the base case probability of AD (all support systems available). SRVs are closed, either not being challenged or successfully dosing following opening.
ADMDA (SC=F) I ((DI=F))
This models the failure probability of AD, given a degraded condition resulting from failure of Division I of DC power. One or more SRV has failed to dose after opening.
ADMDB (SC=F) I ((D2=F))
Engineering Report fEergy p REPORT No. VY-RPT-05-001 10 l Revision 0 l Page l 261 l of l303 l
.A This models the failure probability of AD, given a degraded condition resulting from failure of Division 2 of DC power. One or more SRV has failed to close after opening.
ADMBS (SC=F) * ((CG=S) * (DI=S) * (D2=S))
This models the base case probability of AD (all support systems available) with one or more SRV has failing to close after opening.
ADFAIL I
Top Event: IP - Primary Containment Integrity IP General Notes:
D Top event IP is asked in order to establish whether the containment is intact when the hard-piped vent from torus airspace is used to prevent over-pressurization (VT=S). Integrity of containment is a necessary condition in order for the operator to control and maintain sufficient pressure in the containment in support of continued operation of LPCI or Core Spray pumps taking suction from the suppression pool at elevated temperature.
o Failure of containment integrity is defined to include failures in the containment boundary that allow leakage in excess of that which would prevent maintaining overpressure sufficient to satisfy the NPSH-r or the LPCI and Core Spray pumps at elevated suppression pool temperature. The leakage sources are divided into two principal categories:
Isolation valve failures: These are related to the failure of the isolation valves in containment penetration lines or failure of the isolation signals or power to close these valves.
o Pre-existinq failures: These are failures primarily related to hatches, electrical penetration assemblies (EPAs), and other containment leakage paths not associated with failure of isolation valves to close.
IP Split Fraction Rules IPIGL (IG=F) + ((VC=F)*(IC=F))
This split fraction is used when both the 'A" and "B" air-operated vacuum breakers fail due to support system failures. The 'A' and 'B' vacuum breakers both require instrument air (IG). The "A" vacuum breakers require Vital Bus (VC), while the "B" vacuum breakers require Instrument Bus (IC). Note that check-valve vacuum breakers are in-series with the air-operated vacuum breakers, hence failure of the air-operated vacuum breakers to close does not necessarily cause failure of containment isolation.
IPVACL (VC=F)
This split fraction is used when both the "A' air-operated vacuum breakers fail due to failure of Vital Bus (VC). Note that check-valve vacuum breakers are in-series with the air-operated vacuum breakers, hence failure of the air-operated IPIACL (IC=F)
This split fraction is used when both the 'B" air-operated vacuum breakers fail due to failure of Instrument Bus (IC). Note that check-valve vacuum breakers are in-series with the air-operated vacuum breakers, hence failure of the air-operated IPBASL I
Engineering Report No other support system failures affect the containment isolation system. Thus, the base case (all support systems available) split fraction applies to all sequences not captured by one of the previous rules.
Engineering Report in Entergy REPORT No. VY-RPT-05-001 10 I Revision 0 1Page 264 of303 Top Events: CA/CB - Core Sprav General Notes:
None.
Support System Impacts on CA/CB 0 The impact of single support system failures on CA/CB are as follows. Note that the min. flow valve in each CS loop (MOV-5A/5B) is maintained normally open and success of the CS loop does not depend on successful closure of the associated min. flow valve. Therefore, we assume CS success does not depend on the min. flow valve hardware or the associated power supply.
Support System Failure Impact of CA/CB 125V DC-I (D1) fails CB fails - Pump B and MOV-1 18/1 2B.
125V DC-2 (D2) fails CA fails - Pump A and MOV-11AM12A.
4kV Bus 3 (A3) fails CB fails - Pump B and MOV-1IB/12B.
4kV Bus 4 (A4) fails CA fails - Pump A and MOV-1 1A/M 2A.
RRU7 (R7) fails No impact assumed based on room heatup assessment.
RRU8 (R8) fails No impact assumed based on room heatup assessment.
SW/RW fail No impact on Core Spray.
ECCS Signal (SIG) fails Failure of the ECCS signal and failure to manually initiate low pressure pumps are assumed to cause failure of LPCI (and CS). Failure of the signal and manual backup action is handled in the VSIGF rule.
CA Split Fraction Rules:
VSIGF (qPI=S))+((-(DW=S))^((-LV=S))+(-(PS=S)))*(-(OI=S)))
PSIGF macro models ECCS actuation either by automatic signals from the drywell (DW) and RPV (LV and PS), Low Pressure Interlock (PI) or operator action to initiate LPCI.
CAFAIL (INIT=R280F2)+(INIT=RBR3FI )+(INIT=RBNEFI )+(INIT=RBNEF2)
For the above initiating events, CA is assumed to be a guaranteed failure due to the fact that the flood either originates within CS Train A or the flood directly impacts CS Train A.
CAFAIL (IOA=F) * ((INIT=R303F1) + (INIT=R280F1) + (INIT=R280F5) + (INIT=RBR3F2) +
(INIT=RBR4FI) + (INIT=RBTRFI) + (INIT=RTRFR2) + (INIT=RTRFT2) +
(INIT=RBTRF3) + (INIT=RBRCUF) + (INIT=RBSEFI))
The above initiating events will fail CA in the event that operators fail to isolate the break within approximately 1 %1hours to prevent flooding of the ECCS corner room.
CAFAIL (A4=F)+(D2=F)+(VSIGF)
CA is guaranteed to fail when AC or DC power fails or signals fail.
CABASE (A4=S) * (D2=S)
This represents the probability of CA failure with all support systems available.
CAFAIL 1 CB Split Fraction Rules CBFAIL (INIT=R280F4)+(INIT=RBSEFI)+(INIT=RBSEF2)
For the above initiating events, CB is assumed to be a guaranteed failure due to the fact that the flood either originates within CS Train B or the flood directly impacts CS Train B.
CBFAIL IOA=F) * ((INIT=R303F1) + (INIT=R280F1) + (INIT=R280F5) + (INIT=RBR3FI) +
(INIT=RBR3F 2) + (INIT=RBR4Fl) + (INIT=RBTRFl) + (INIT=RTRFR2) +
(INIT=RTRFT2) + (INIT=RBTRF3) + (INIT=RBRCUF) + (INIT=RBNEFI))
The above initiating events will fail CB in the event that operators fail to isolate the break within approximately 1 1/2 hours to prevent flooding of the ECCS corner room.
CBFAIL (A3=F) + (DI=F) + (VSIGF)
CB is guaranteed to fail when AC or DC power fails or signals fail. .
CBCAF (CA=F) I (A4=S) I (D2=S) (-(INIT=R280F2)) * (-(INIT=RBR3FI)) * ((INIT=RBNEFI))
(I NIT=RBNEF2))
This models the conditional probability of CB (with all support systems available) failure given that CA has failed randomly, that is, CA did not fail due to support system failures or flooding impacts.
CBBASE ((A4=F) + (D2=F) + (INIT=R280F2) + (INIT=RBR3FI) + INIT=RBNEFI) +
(INIT=RBNEF2)) * ((A3=S) * (DI=S))
This models the base case failure probability for CB where either support system failures or flooding impacts have resulted in guaranteed failure of CA.
CBFAIL I
Top Events: VANVB LPCI Iniection Path - Loop A/B Valves General Notes:
None VA Split Fraction Rules:
VAFAIL (INIT=RBR3FI)
VA assumed to be a guaranteed failure for the above initiating event.
VAFAIL ((DI=F) * (D2=F)) + (VSIGF)
VA will be guaranteed to fail on loss of both Division I and 2 of DC power and loss of signals. VSIGF models both automatic signals and also operator action to initiate LPCI Loop A.
VADF (DI=F) + (D2=F)
If either Division I or 2 of DC power fail, VA is degraded due to the impact on either Train A or B logic relays.
VABASE (DI=S) * (D2=S)
This models the base case failure probability of VA with both systems of DC power available.
VAFAIL 1 VB Split Fraction Rules:
VBFAIL (INIT=RB345F) + (INIT=RBR4F2)
VB is assumed to be a guaranteed failure for the above initiating events.
VBFAIL ((DI=F) * (D2=F))+(VSIGF)
VB will be guaranteed to fail on loss of both Division 1 and 2 of DC power and loss of signals. VSIGF models both automatic signals and also operator action to initiate LPCI Loop B.
Engineering Report
- Entergyj REPORT No. VY-RPT-05-0011 Revision 0 Page 267 l of l 303 VBBASE ((DI=S) * (D2=S) * (INIT=RBR3FI))
This models failure of VB, independent of VA, with both divisions of DC power available. For initiating event RBR3F1, VA has failed due to the impact of flooding.
VBDF ((DI=F) + (D2=F)) * (INIT=RBR3FI)
This models failure of VB, independent of VA, with one division of DC power available. For initiating event RBR3F1, VA has failed due to the impact of flooding.
VBVAFI ((VA=F) I (DI=S) * (D2=S))
This models the dependent failure of VB, following a random failure of VA, with both systems of DC power available.
VBVAF2 (VA=F) * ((DI=F) + (D2=F))
This models the dependent failure of VB, following a random failure of VA, with VA/VB systems degraded by the failure of one division of DC power.
VBVASI ((VA=S) * (DI=S) * (D2=S))
This models the dependent failure of VB, following success of VA, with both systems of DC power available.
VBVAS2 (VA=S) * ((Dl=F)+(D2=F))
This models the dependent failure of VB, following success of VA, with VA/VB systems degraded by the failure of one division of DC power.
VBFAIL 1
Top Event: CN - Condensate System (low pressure injection)
CN General Notes:
None Support System Failure Impact of CN 4kV Bus 1 (01) CN Pump A fails 4kV Bus 2 (02) CN Pumps B & C fail, also fails hotwell emergency makeup valve MOV 64-31) 125V DC-2 (D2) CN fails (02 failure) 120V Vital Bus (VC) CN fails (no power to FW reg. valves)
Instru. Air (IG) CN fails (no air to FW reg. valves)
TBCCW (TM CN fails (no pump motor cooling)
CN Split Fraction Rules:
CNFAIL (INIT=AOGCNF) + (INIT=CSTF) + (INIT=TBCWF) + (INIT=FOBFI) + (INIT=RBR3F2) +
(INIT=RBRCUF) + (INIT=RBTRF4) + (INIT=RBNEF2) + (INIT=RBSEF2)
For the above initiating events, CN is assumed to be a guaranteed failure due to the fact that the flood either originates within CN or the flood directly impacts CN.
CNSUCC (FW=S)
Since feedwater is dependent on the operation of the condensate system for success, FW success implies CN success.
CNFAIL (CR=F)+(402=S))+(-(VC=S))+(-(IG=S))+(4TW=S))
Failure of the above support systems guarantee failure of CN due to control systems failures or cooling to the condensate pumps..
CNIF (401=S))
This models the failure probability of CN, with the system degraded by the failure of Bus 1, resulting in the failure of Pump A.
CNBASE (-(IC=S))
Engineering Report
-= Enfergy REPORT No. VY-RPT-05-001 10 l Revision 0 l Page l 269 l of l 303 l The FLOODS event tree structure asks CN only after FW=F. Thus, CN is independent of FW only when FW is guaranteed failure by support system failures. The only support system failures that fail FW and not CN are -O1=S (Bus 1 fails, which degrades CN, split fraction CN1F) and -IC=S (Instrument Bus fails FW but does not degrade CN, split fraction CNBASE).
CNFWFI (FW=F) * (4TB=S))
The above models the dependent failure probability of CN following the failure of feedwater (FVV) and failure of turbine bypass (TB).
CNFWF2 (FW=F) * (TB=S)
The above models the dependent failure probability of CN following the failure of feedwater (FW) and success of turbine bypass (TB).
CNFAIL I
Top Events: TCAJrCB - Torus Cooling Loops A/B General Notes:
None.
Support System Impacts on TCArTCB a In general, Torus Cooling (top event TC) is dependent on Low Pressure Coolant Injection (top event LP) due to shared RHR equipment. The impact of single support system failures on TC are as follows:
Support System Failure Impact on Torus Cooling 125V DC-I (DI) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
125V DC-2 (D2) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
4kV Bus 3 (A3) fails RHR Pumps C & D fail; RHRSW Pumps B & D fail; TC Loop B MOVs fail.
4kV Bus 4 (A4) fails RHR Pumps A & B fail; RHRSW Pumps A & C fail; TC Loop A MOVs fail.
RRU7 (R7) fails No impact on equipment is assumed based on room heatup assessment.
RRU8 (R8) fails No impact on equipment is assumed based on room heatup assessment.
SW fails RHR Pumps A, C & B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode), RHRSW Pumps A, C & B, D fail due loss of service water suction.
RBCCW (RW) fails RHR Pumps A, C & B, D fail due to loss of seal and bearing injection water cooling (assumed needed for long term TC mode). No impact on RHRSW pumps.
ECCS Signal (SIG) fails No impact on TC function is assumed.
TCA Split Fraction Rules:
TCAFL (INIT=DGAFI) + (INIT=R303F1) + (INIT=R280F1) + (INIT=RBR3FI) + (INIT=RBTRFI)
+ (INIT=RTRFR2 + (INIT=RBNEFI) + (INIT=RBNEF2)
For the above initiating events, TCA is assumed to be a guaranteed failure due to the fact that the flood either originates within TC Train A or the flood directly impacts TC Train A.
TCAFL (IOA=F) * ((INIT=R280F5) + (INIT=RBR3F2) + (INIT=RBR4FI) + (INIT=RTRFT2) +
(INIT=RBTRF 3) + INIT=RBRCUF) + (INIT=RBSEFI))
Engineering Report
- Entergy , _
REPORT No. VY-RPT-O5-O 10 l Revision 0 Page l 271 l of1 303l The above initiating events will fail TCA in the event that operators fail to isolate the break within approximately 1 2hours to prevent flooding of the ECCS comer room.
TCAFL ((SW=F) * ((AW=S))) + (D2=F) + (A4=F) + (LA=F)
TCA will be guaranteed to fail in the event that the above combinations of support systems fail.
TCABS ((SW=S) + (AW=S)) * (A4=S) * (D2=S) * (LA=S)
The above models the base case failure probability of TCA with all support systems available.
TCAFL I TCB Split Fractions TCBFL (INIT=DGBFI) + (INIT=RBSEFI) + (INIT=RBSEF2) + (INIT=RTRFR2)
For the above initiating events, TCB is assumed to be a guaranteed failure due to the fact that the flood either originates within TC Train B or the flood directly impacts TC Train B.
TCBFL (IOA=F) * ((INIT=R303FI) + (INIT=R28OFl) + (INIT=R280F5) + (INIT=RBR3FI) +
(INIT=RBR3F 2) + (INIT=RBR4FI) + (INIT=RBTRFI )+ (INIT=RTRFT2) +
(INIT=RBTRF3) + (INIT=RBRCUF)+(INIT=RBNEF1))
The above initiating events will fail TCB in the event that operators fail to isolate the break within approximately 1 % hours to prevent flooding of the ECCS corner room.
TCBFL ((SW=F) * (-(AW=S))) + (A3=F )+ (DI=F) + (LB=F)
TCB will be guaranteed to fail in the event that the above combinations of support systems fail.
TCBTAF ((TCA=F) I (A4=S) * (D2=S) * (LB=S) * (-(INIT=DGAFI)) * (41NIT=R303F1)) * (-
(INIT=R280F1) )* (-(INIT=RBR3FI)) * (-(INIT=RBTRFI)) I (-(INIT=RBNEFI)) * (-
(INIT=RBNEF2)))
The above model the failure of TCB independent of TCA. Failure of TCA was guaranteed due to failure of support systems or as the result of the flooding impact.
TCBTAF (TCA=F) * (A4=S) * (D2=S) * (LB=S)
The above model the failure of TCB independent of TCA but dependent on LB success.. Failure of TCA was guaranteed due to failure of support systems or as the result of the flooding impact.
Engineering Report 7Entergy ,
REPORT No. VY-RPT-05-001 10 Revisions l Page 1 272 1 of 1 303 1 a
TCBBS ((TCA=F) * ((SW=S) + (AW=S)) * (A3=S) * (D1=S) * (LB=S))
The above models the failure probability of TCB dependent on the failure of TCA but dependent on success of LB. TCA has failed randomly and all support systems are available.
TCBFL I
Top Event: RM - Recover Main Condenser RM General Notes:
0 For flooding events, we credit recovery of the main condenser providing that all support systems are success. The support system failures for top event TB (Turbine Bypass & Main Condenser) are assumed as follows:
Support System Failure Impact on TB/Main Condenser 4kV Bus 1 (01) TB/MC fail (failure of auxiliary oil pump, one circulating water pump, and steam packing exhauster) 4kV Bus 2 (02) TB/MC fail (failure of CST emergency makeup to main condenser (MOV-64-31), two circulating water pumps, all three circulating water booster pumps, and vacuum priming pump) 120V Vital Bus (VC) TB/MC fail (SJAE assumed to fail) 120V Instru. Bus (IC) TB/MC fail (SJAE assumed to fail)
Instru. Air (IG) TB/MC fail (SJAE assumed to fail)
Service Water (SR) TB/MC fail (failure of pump cooling for circulating water pumps)
RM Split Fraction Rules:
RMFAIL (INIT=AOGCNF) + (INIT=CSTF) + (INIT=FOBFI) + (INIT=TBHVF) + (INIT=TBCWF) +
(INIT=TBSWF ) + (INIT=INTCWF) + (INIT=DGAFI)+ (INIT=DGBFI) + (INIT=RTRFT2)
RM is assumed to be a guaranteed failure due to the impacts of the above flooding initiating events.
RMFAIL (CR=F)
RM is assumed to fail on failure to scram (CR)
RMBASE (((01=S) * (02=S)) + (OIR
- 02R)) * (SW=S) * (IG=S) * ((IC=S) + (VC=S))
The base case split fraction (RMBASE) is used whenever all support systems for the main condenser are available. For AC power, we require that both 01 and 02 are available (01=S
- 02=S), or that both 01 and 02 are recovered (01 R
- 02R). We credit recovery of offsite power for RM because > 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> exists to establish heat removal with the main condenser before containment is threatened by overpressure.
RMFAIL I Recovery of the main condenser is assumed to fail for all remaining cases (RMFAIL) because one or more support systems are unavailable.
Engineering Report i-- Entergy REPORT No. VY-RPT-05-00 10 l Revision 0 l Page l 274 l of l303 l d
Top Event: VT- Torus Vent (hard-Piped vent from torus airspace)
VT General Notes:
Torus vent valve (TVS-86) is 'normally" closed and requires manual action to open the valve and enable the use of the venting path with rupture disc. For floods, we assume that the valve can be operated remotely from the control room if 480V MCC-7A (associated w/ 4kV Bus 2) is available, or the valve can be operated locally. Local operation is assumed possible because there is sufficient time before the vent path would be needed (12 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). Also, in this Level 1 event tree, venting is performed to prevent core damage, therefore, the Reactor Building is assumed to remain habitable to perform the local operation.
VT Split Fraction Rules:
VTTRBS I Local manual operation of the vent valve is assumed, therefore, there are no AC power support systems needed and the VTTRBS.
Engineering Report aE ntfergy I.
REPORT No. VY-RPT-05-00 10 l Revision 0 l Page l 275 l of l303 l h
Top Event: AICD- Altemate Injection Usinq the CRD System General Notes a CRD is a low capacity high pressure system that can be used as an alternate source of RPV injection in the event that all other sources of injection have failed. Alternate injection provides an adequate source of makeup, provide the following conditions are met:
(a) The RPV has been successfully depressurized using ADS.
(b) Early injection has been successfully been accomplished by higher capacity systems (LP, CS or CN).
(c) Decay heat removal is being accomplished by either recovery of the main condenser (RM) or by containment venting (VT).
Support System Failure Impact on AICD RBCCW The CRD pumps fail due to loss of pump lube oil cooling.
4 kV Bus 3 (A3) Loss of CRD Pump B 4 kV Bus 4(A4) Loss of CRD Pump A 125V DC-1 Loss of CRD Pump B 125V DC-2 Loss of CRD Pump A AICD Split Fraction Rules AICDFL (IOA=F )* ((INIT=R303FI) + (INIT=R280F1) + (INIT=R280F5) + (INIT=RBR3FI) +
(INIT=RBR3F2) + (INIT=RBR4Fi) + (INIT=RBTRFl) + (INIT=RTRFR2) +
(INIT=RTRFT2) + (INIT=RBTRF3) + (INIT=RBTRF4) + (INIT=RBRCUF) +
(INIT=RBNEFI) + (INIT=RBSEFl))
The above initiating events are conservatively assumed to fail AICD in the event that operators fail to initially isolate the break, even though the elevation may be well below the elevation of the CRD pumps.
AICDFL (INIT=CSTF) + (INIT=RBTRF4) + (INIT=RBNEF2) + (INIT=RBSEF2)
The above initiating events are assumed to guarantee failure of AICD.
AICDFL ((A3=F) + (DI=F)) * ((A4=F) + (D2=F)) + ({RW=S)) + (CR=F)
AICD is guaranteed to fail with the above combinations of support system failures..
AICDFL (AD=F)
A Engineering Report
--Enfeigy t j REPORT No.VY-RPT-05-0O11O Revision 0 Page 276 of 303 Although the CRD system is a high pressure system, its limited capacity will likely prevent adequate injection if operators fail to depressurize the RPV.
AICDFL ((LA=F) + (VA=F)) * ((LB=F)+(VB=F)) * (CA=F) * (CB=F) * (CN=F)
Injection using the CRD system is only credited for late scenarios, where the decay heat removal requirements are reduced. Therefore, low pressure injection must initially be accomplished by one of the pressure systems questioned above.
AICDAF ((A3=S) * (Dl=S)) I ((RW=S)) * ((A4=F) + (D2=F))
This models AIDC when CRD Train A has failed due to support system failure.
AICDBF ((A4=S) I (D2=S)) * ((RW=S)) * ((A3=F) + (DI=F))
This models AIDC when CRD Train B has failed due to support system failure.
AICDBS (A4=S) * (D2=S) * (A3=S) * (DI=S) * (RW=S)
The above models the AICD base case with all support systems available.
I AICDFL I
Top Event: AICT- Alternate Injection Using the Condensate Transfer System General Notes CST is a low pressure system that can be used as an alternate source of RPV injection in the event that all other sources of injection have failed. Alternate injection provides an adequate source of makeup, provide the following conditions are met:
(a) The RPV has been successfully depressurized using ADS.
(b) Early injection has been successfully been accomplished by higher capacity systems (LP, CS or CN).
(c) Decay heat removal is being accomplished by either recovery of the main condenser (RM) or by containment venting (VT).
Support System Failure Impact on AICT 4 kV Bus 2 (02) Loss of CST Pumps A and B Injection Pathways CST injection requires an injection pathway to the RPV using either the LPCI or Core Spray systems.
AICT Split Fraction Rules AICTFL (UA=F) * ((INIT=FOBFI) + (INIT=TBHVF) + (INIT=DGAFI) + (INIT=DGBFI) +
INIT=R303F1) + (INIT=R280F1) + (INIT=R280F5) + (INIT=RBR3FI) + (INIT=RBR3F2) +
(INIT=RBTRFI) + (INIT=RT RFR2) + (INIT=RTRFT2) + (INIT=RBTRF3) +
(INIT=RBRCUF) + (INIT=RBNEFl) + (INIT=RBSEFI) + (INIT=RBR4F1))
The above initiating events are conservatively assumed to fail AICD in the event that operator ultimate action (UA) fails to initially isolate the break. Because of the higher elevation of the CST pumps relative to the CRD pumps, operators will have a longer time to isolate the break and prevent CST pump failure.
AICTFL (INIT=CSTF) + (INIT=TBCWF) + (INIT=TBSWF) + (INIT=RBTRF4) + (INIT=RBNEF2)
+ (INIT=RBSEF2)
The above flooding initiating events are assumed to guarantee failure of alternate injection using the CST system.
AICTFL (CR=F) + (-(02=S)) + (AD=F) + (CTPATHF)
Failure of Bus 2 (02) fails motive power to both CST pumps. Since these are low pressure pumps, the RPV must be depressurized (AD) for successful injection.
AICTAB (02=S) * (AD=S)
Base case failure probability of AICT with all supports systems available and successful ADS.
Engineering Report A-Enfergy 9 REPORT No. VY-RPT-05-001 10 l Revision 0 l Page l278 l of l 303 l AICTFL I
Top Event: Al - Operators Successfully Control Containment Pressure (NPSH)
Al General Notes:
0 If injection is maintained by either LPCI or Core Spray, taking suction from the torus, along with decay heat removal being accomplished by torus venting (VT), containment overpressure must be maintained to provide adequate NPSH to these pumps. In these scenarios, successful Al requires both containment isolation (IP), operator action to control venting and successful operation of one of the LPCI or CS pumps.
Al Split Fraction Rules AIFAIL 1 If none of the above rules apply, the AIFAIL rule will ensure a conservative result and assist in checking the validity of the results.
Attachment J PRA Quality
The following manifests the quality of the Vermont Yankee PSA models used in performing the risk assessment crediting containment overpressure on NPSH requirements for RHR system and Core Spray system pumps:
- Level of detail in PSA
- Maintenance of the PSA
- Comprehensive Critical Reviews J.1 LEVEL OF DETAIL The Vermont Yankee PSA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events.
The PSA model (Level 1 and Level 2) used for the containment overpressure risk assessment was the most recent internal events risk model for the Vermont Yankee plant (Revision VY04R1). This current model is an updated version of the model used in the 1993 individual plant examination and reflects the VY configuration and extended power uprate design changes, and SBO/Vemon Tie evaluation as of September 2004. The VY model adopts the large event tree / small fault tree approach and uses the support state methodology, contained in the RISKMAN code, for quantifying core damage frequency.
The PSA model has been updated several times since the IPE due to the following.
- Equipment performance - As data collection progresses, estimated failure rates and system unavailability data change.
- Plant configuration changes - Plant configuration changes are incorporated into the PSA model.
- Modeling changes - The PSA model is refined to incorporate the latest state of knowledge and recommendations of industry peer reviews.
The PSA model contains the following modeling attributes.
J.1.1 Initiating Events The Vermont Yankee at-power PSA explicitly models a large number of internal initiating events:
- General transients
- Support system failures
- Internal Flooding events The initiating events explicitly modeled in the Vermont Yankee at-power PSA are summarized in Table J-
- 1. The number of internal initiating events modeled in the Vermont Yankee at-power PSA is similar to the majority of U.S. BWR PRAs currently in use.
J.1.2 System Models The Vermont Yankee at-power PSA explicitly models a large number of frontline and support systems that are credited in the accident sequence analyses. The Vermont Yankee systems explicitly modeled in the Vermont Yankee at-power PSA are summarized in Table J-2. The number and level of detail of plant
systems modeled in the Vermont Yankee at-power PSA is equal to or greater than the majority of U.S.
J.1.3 Operator Actions The Vermont Yankee at-power PSA explicitly models a large number of operator actions:
- Pre-Initiator actions
- Post-initiator actions
- Recovery Actions
- Dependent Human Actions Over one hundred operator actions are explicitly modeled. Given the large number of actions modeled in the Vermont Yankee at-power internal events PSA, a summary table of the individual actions modeled is not provided here.
The human error probabilities for the actions are modeled with accepted industry HRA techniques and include input based on discussion with plant operators, trainers, and other pertinent personnel.
The VY PSA includes an explicit assessment of the dependence of post-initiator operator actions. The approach used to assess the level of dependence between operator actions is based on the method presented in the Handbook of Human Reliability Analysis, NUREG/CR-1278.
The number of operator actions modeled in the Vermont Yankee at-power PSA, and the level of detail of the HRA, is equal to or greater than many U.S. BWR PRAs currently in use.
J.1.4 Common Cause Events The Vermont Yankee at-power PSA explicitly models a large number of common cause component failures. More than 500 common cause terms are included in the VY PSA. Given the large number of CCF terms modeled in the Vermont Yankee at-power internal events PSA, a summary table of them is not provided here. The number and level of detail of common cause component failures modeled in the Vermont Yankee at-power PSA is equal to or greater than the majority of U.S. BWR PRAs currently in use.
J.1.5 Level 2 PSA The Vermont Yankee Level 2 has been updated to incorporate insights from the independent peer review and the NEI Guidelines, NEI 00-02, on PRA Peer Review. The analysis is designed to calculate the LERF frequency consistent with NRC Regulatory Guidance (e.g. Reg. Guides 1.174 and 1.177) and the PSA Application Guide.
A separate Level 2 model was created that linked the Transient, LOCA and Flooding initiators to the containment (CET) event tree. The linking of the flooding events to the containment event tree is new to this model, not having been incorporated in previous VY models. This enhancement required new frontline macros to be applied to the CET split fraction rules and endstate definitions.
in Engineering Report EntergY REPORT No. VY-RPT-05-0011 O Revision 0 lPage 283 1of 303 The following aspects of the Level 2 model reflect the more than adequate level of detail and scope:
- 1. Dependencies from Level 1 accidents are carried forward directly into the Level 2 by transfer of sequences to ensure that their effects on Level 2 response is accurately treated.
- 2. Virtually all phenomena identified by the NRC and industry for inclusion in BWR Mark I Level 2 analyses are treated explicitly within the model.
- 3. The model truncation is sufficiently low to be consistent with the NEI PRA Peer Review Guidelines for Risk-Informed Applications.
J.2 MAINTENANCE OF PSA Approximately every two refueling outages, a formal review of the VY PSA model is performed to evaluate whether, or not, the model continues to reflect the plant design and operating procedures, refer to procedure ENN-DC-1 51 [Reference L-5]. The review shall encompass the following areas:
- 5) All major design changes implemented since the last PSA update. The review shall include implemented design changes and other material.
- 6) Maintenance Rule unavailability data for impacts on current fault tree unavailability assumptions.
- 7) Maintenance Rule Functional Failure (MRFF) reliability data to determine if any component failure rates require updating.
- 8) Review recent plant scram history, and update initiating event types / frequencies if warranted.
- 9) Review TS changes, calculations, and recent industry experience for possible impact on the PSA models and update modeling if warranted.
- 10) Review EOP/SAGs and other operating procedure changes/training, and modify human error rates and / or modeling, if warranted.
Significant changes identified in the areas listed above may be implemented in the model at the time the change occurs if their impact is significant enough to warrant implementation (i.e., interim PSA model updates)
J.2.1 History of Vermont Yankee PSA Models The Vermont Yankee PSA model and documentation has been maintained living and is routinely updated to reflect the current plant configuration following refueling outages and to reflect the accumulation of additional plant operating history and component failure data.
The Vermont Yankee PSA has been updated five times since the original IPE.
The PSA models are routinely implemented and studied by plant PSA personnel in the performance of their duties. Potential model modifications/enhancements are itemized and maintained for further investigation and subsequent implementation, if warranted.
0% Engineering Report
- EnterYj REPORT No. VY-RPT-05-0110 Revision 0 l Page l 284 l of l I30 Each supporting element of the Vermont Yankee PSA is documented, typically in a stand-alone report.
Each analysis element is reviewed by cognizant personnel and comments reconciled before final approval.
Formal comprehensive model reviews are discussed in Section L.3.
J.3 COMPREHENSIVE CRITICAL REVIEWS The Vermont Yankee PSA model has benefited from the following comprehensive technical reviews:
- PSA Model Peer Review
- External reviews during the development of the IPE (not discussed here)
PSA Model Peer Review The Vermont Yankee internal events PSA received a formal industry PRA Peer Review in September 2000.
[Reference C-3] The purpose of the PRA Peer Review process is to provide a method for establishing the technical quality of a PSA for the spectrum of potential risk-informed plant licensing applications for which the PSA may be used. The PRA Peer Review process uses a team composed of PSA and system analysts, each with significant expertise in both PSA development and PSA applications. This team provides both an objective review of the PSA technical elements and a subjective assessment, based on their PSA experience, regarding the acceptability of the PSA elements. The team uses a set of checklists as a framework within which to evaluate the scope, comprehensiveness, completeness, and fidelity of the PSA products available.
The Vermont Yankee review team used the Revision A-3 NEI draft "Probabilistic Risk Assessment (PRA)
Peer Review Process Guidance" dated June 2, 2000 as the basis for the review. [Reference-2]
The general scope of the implementation of the PRA Peer Review includes review of eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PSA including internal events, internal flooding, and containment performance, with focus on large early release frequency (LERF). The eleven technical elements are shown in Tables J-3 through J-5.
The comments from the PRA Peer Review were prioritized into four categories A-D based upon importance to the completeness of the model. All comments in Categories A and B (recommended actions and items for consideration) were identified to Vermont Yankee as priority 'items to be resolved in the next model update. The comments in Categories C and D (good practices and editorial) are potential enhancements and remain for consideration in future updates of the Level I and 2 PSA models.
All of the 'A' and 'B' priority PRA Peer Review comments have been addressed by VY and incorporated into the VY PSA model as appropriate.
Engineering Report The Peer Review Certification identified the following strengths and areas of improvements for the VY PSA model:
- Containment Capabilty: The Vermont Yankee containment failure analysis represents a state of the art analysis of the containment strength and failure probability. A detailed plant specific analysis developed by Chicago Bridge and Iron supported the analysis. The documentation was detailed, traceable and available for review.
- Interfacing System LOCA: A realistic plant specific evaluation of the interfacing system LOCA frequency was prepared. The model was well documented and provided a systematic process identification and evaluation of potential containment bypass paths.
- Maintenance Unavailability and Failure Rate Analysis: The maintenance unavailability incorporated in the PRA was based on an excellent review and analysis of plant-specific data.
Plant component failure date had also been recently evaluated at the time of the review.
- Tier 2 System Analysis Documentation: Vermont Yankee has maintained Tier 2 notebooks for the system analyses containing extensive background material. This information source proved useful to the reviewers, and is a valuable resource for the PRA staff.
- System Dependencies: Although there was no single system dependency matrix, the system dependencies were clearly presented for each system in the system analysis notebook.
- Human Reliability Analysis: The Vermont Yankee PRA included a comprehensive treatment of human reliability. This included extensive incorporation of pre-initiator actions and a solid and calculations for post-initiators
- Spatial Dependencies: Internal flooding and HVAC dependencies were systematically evaluated and documented. Plant-specific analyses supporting the models and modeling assumptions were provided.
- Level 2 Analysis: The Level 1/Level 2 interface, including the plant damage state and containment event tree end state definitions, was very detailed. The full spectrum of severe accident phenomena listed in the ASME PRA Draft Standard was considered in the Level 2 evaluation.
- Maintenance and Update Process: VY follows the ENN-DC-151 PSA Maintenance and Update is used to maintain VY PSA model current.
AtEngineering Report A-Enfersfl EY REPORT No. VY-RPT-05-0011o Revision 0 Page 286 of 303 Recommended Areas of Imgrovement The Peer Review Certification identified the following areas of Improvement of the VY PRA:
- PRA Guidance: The lack of guidance documents was cited as a weakness for most of the technical elements examined as part of this review. In some areas (e.g., elements SY, HR, L2 and AS), the documentation has sufficient detail as to provide a certain level of guidance. But the reviewers agreed that the development of guidance documents, if followed and maintained, can be an important element in maintaining the quality of the PRA.
Resolution:
The ENNE fleet has developed and utilizes standardized practice guidance for documentation of PSA model elements, which will be used in planned future updates of the Vermont Yankee PSA model in accordance with procedure ENN-DC-151.
- Dependence of Human Actions: There did not seem to be any systematic check to Insure that where multiple human actions are included in a scenario, the potential dependence between these actions had been considered. One significant scenario, containing potential dependence between human actions (the third highest In core damage frequency) was Identified by the reviewers (see Fact and Observation sheet QU-6). A sensitivity quantification (e.g., set all human actions to 0.1) is commonly performed as part of the PRA quantification process to confirm that the CDF frequency Is not being understated by treating multiple human failure probabilities as independent events.
Resolution:
Dependencies between human actions were examined and documented In Vermont Yankee Dependent HEP Assessment". All of the dynamic operator actions modeled in the VY PRA were Included in this assessment. The approach used to judge the level of dependence between operator actions was based on dependency level categories and conditional probabilities developed in the 'Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications* NUREG/CR-1278. NUREG/CR-1278 identifies five levels of dependence: ZD (zero dependence), LD (low dependence), MD (moderate dependence), HD (high dependence),
and CD (complete dependence). Based on the NUREG/CR-1278, Time, Function, and Spatial attributes were used to determine the level of dependence between operator actions within an accident sequence.
These attributes were used to develop qualitative criteria (rules) that were used to assign the level of dependence (CD, HD, MD, LD, ZD) between the operator actions. Quantitative values associated with the level of dependence were assigned and used In a quantitative sensitivity assessment. These updated dependencies resulted In increase In CDF of 0.61%, compared to the base model. Based on the 5E-07 threshold it can be concluded that this negligible change did not justify the need for a permanent model change.
- IndeDendent Review Process: There Is little documentation of any Independent review associated with most documents. A documented process calling for a review by a qualified, Independent analyst should be added to the PRA maintenance procedure. This would Improve the quality of the PRA.
If Engineering Report En 4eg REPORTNo.VY-RPT-05-0011O l Revision 0 Page l 287 l of l 303 Resolution The PRA update procedure calls for the undertaking and documentation of an independent review of modeling changes and evaluations, and this has been Implemented for all PRA updates.
- Generic Initiating Event Data: The generic sources of LOCA and loss of offsite power frequencies referenced in the PRA are outdated. More recent data is available in NUREG/CR-5750 (LOCAs) and NUREG/CR-5496 (LOSP) and should be incorporated during he next PRA update.
Resolution Initiating event frequencies were reviewed and updated as documented in 2002 (ref: TVermont Yankee Nuclear Power Station PRA Initiating Event Frequency Update - 2002 Notebook"), as well as in the 2004 (ref: Technical Evaluation TE-2004-015, VY04 - PSA Base Model Update for 20041).
- Success Criteria Traceability: Documentation of the accident sequence model success criteria and their bases should be improved. There are notebooks containing some of the necessary documentation, although no clear roadmap Is provided linking MAAP calculations and other supporting analyses to the accident sequence model.
Resolution In 2002 the PSA success criteria were reviewed and documented, definitions clarified and references identified.
- System Modeling: The system models were graded as capable of supporting risk significant evaluations, but the review team had difficulty reaching consensus on this grade as there were a number of areas identified that should be Improved to make the models more flexible and easier to use for applications. The Vermont Yankee PRA uses a number of modeling simplifications that reduce the capabilities of the RISKMAN program to produce potentially Insightful reports (e.g.
basic event Importance, system Importance). For example, taking advantage of model symmetries reduces the of split fractions that need to be quantified and simplified the event tree Input, but skews the basic event Importance results (see F&O Sys-14). Also, there is an optional conditional split fraction replacement logic Input that allows the software to associate the correct basic event Importance (for a class of scenarios) that has not been developed In the Vermont Yankee model (see F&OSys-13). These modeling simplifications had distinct advantages when PRA software and personal computers were less powerful, but should be removed to take advantage or all the reporting features.
Resolution Symmetric split fractions have been developed for all multi-train top events as part the 2004 EPU RISKMAN model (VY04R1).
- Common Cause Parameters: Common cause failures are modeled extensively and appropriately In the PRA, but the data source for the common cause failure parameters is outdated. New data available through the NRC and INEEL need to be incorporated In the PRA as part of the next update. This Is critical due the importance of common cause failures with respect to CDF.
AEngineering Report
- ~Ente gi~ REPORTNo.VY-RPT-05-0110 Revision 0 Page 1 288 of 303 Resolution As part of the PSA 2002 update a review of the Common Cause Failure (CCF) parameters presented in NUREG-5497 was performed and the results compared with the values used in the VY PSA model. It was concluded that the values utilized in the Vermont Yankee PSA model remain appropriate and there is not a strong basis for replacing our current common cause factors with those provided in NUREG-5497 at this time.
- Presentation and Intervetation of Results: The presentation of PRA results should be expanded to assist in developing insights. Additional reports could be generated with the current model (e.g., initiator contribution to CDF), and the model should be requantified with the "save sequence cutoff" reduced to include a higher percentage of total CDF in the split fraction and top event Importance reports. It Is also suggested that the LERF results be requantified as part of the PRA update.
Resolution The cutoff values for importance calculations have been reduced from the original IPE. LERF results are included In all major PSA model updates.
- Uncertainty Analysis: No data uncertainty analysis has been performed for the current Vermont Yankee PRA. A documented analysis In this area may provide additional Insights Into the PRA results. It is again noted that the current structure of the model makes the uncertainty calculation engine of the RISKMAN PRA software ineffective. Many of the basic event failure rates loaded into the program are point estimates. The model simplifications Identified in F&Os SY-13 (CSF replacement) and SY-14 (symmetry) also need to be addressed before the RISKMAN uncertainty engine can be used effectively.
Resolution F&Os SY-13 and SY-14 were resolved and implemented in models VYOO and VY04, respectively.
The uncertainty associated with the core damage frequency was estimated using Monte Carlo techniques Implemented in RISKMAN for the base case model W04RI. Results Include mean, 5th, 50th, and 95th percentile values. These values reflect the uncertainties associated with the data distributions used in the analysis.
- Maintenance and Update Process: The PRA update procedure was in a draft form at the time of the review. As mentioned under "PRA Strengths", It Is the opinion of the review team that the Vermont Yankee PRA staff is headed In the direction with this procedure. It Is mentioned here to emphasize the importance of addressing the review comments and finalizing this procedure in the near future.
Resolution The VY PSA Update Procedure was completed and was utilized for the VY 2002 PRA Update and subsequent updates. This procedure has since been replaced by an Entergy fleet procedure ENN-DC-151 PSA Maintenance and Update.
^ Engineering Report EI REPORT No. VY-RPT-05-0011 o Revision 0 Page 289 of 303 Maior Chanaes since Original IPE Submittal:
The following major changes have been incorporated in the Vermont Yankee PSA model since the original IPE submittal.
I. Updated HEP Values HEP values were updated to reflect the following changes since the original IPE:
- Plant modifications and Extended Power Uprate.
- 2. Modifications to operator training.
- 3. Flooding Events Modeling Significant changes were made to the modeling of flooding events to reflect enhancements to operating procedures and evaluation of component vulnerability to flooding.
- 4. Main Station Battery Chargers A plant upgrade was made to the Main Station Battery Charges to provide 100% redundancy and improve reliability forthe 125 VDC Main Station Batteries and DC buses DC-1 and DC-2.
This upgrade consisted of the following:
- Adding a new 125 VDC charger, designated BC-1-1D, dedicated to 125 VDC bus DC-2. This charger will be identical to the existing chargers, except for some small electronics parts on circuit cards.
- Dedication of the existing battery charger BC-1-1C, formerly called the 'swing charger', to 125 VDC bus DC-1.
- All 4-battery chargers are modeled. If either, or both, aligned battery chargers fail, its corresponding backup charger Is questioned. It is conservatively assumed that operator failure to'align one backup charger will also guarantee failure to align the other backup charger.
- Removal of the load shed feature from each of the 480 VAC feeder breakers to the three existing battery chargers. Consistent with this modification, there will be no load-shed feature on the feeder breaker to the new battery charger. Removal of the load shed feature eliminates the need for plant operators to restore the battery charges following a loss of normal power event. This results in the elimination of LNP specific split fractions for C1 C2.
Note: The original IPE model took no credit is taken for alignment of the swing charger (BC 1C)In the event that one of the two normally aligned battery chargers.
The original LPCI fault tree did not model the recirculation loop discharge valves as a Ofailure mode of the associated LPCI subsystem. This was questioned during the W AE inspection (May/June 1997) because not including the recircirculation loop isolation valves appeared different from other PRA studies and could under-estimate the total failure probability of LPCI for some LOCA events.
Depending on the postulated break size and location (particularly a large, suction side break), LPCI flow to the Intact loop could short-circuit the core by flowing through the RPV lower plenum and out the break if the intact loop discharge valve is not closed. Thus, failure to close the intact recirculation loop discharge valve could be a LPCI subsystem failure mode for some events and should be considered in the model.
The LPCI fault tree has been revised to include failure of the recirculation loop discharge valves as a failure mode of the associated LPCI subsystem for all events. Including these valves for all events is a conservative but reasonable approach based on the following:
- 6. Modification to OS rules to better reflects operating procedures.
Automatic isolation of non-essential SW loads was implemented to satisfy conservative design basis criteria. Based on our review, this modification has little effect on the 'best estimate' IPE analysis which is not limited to design basis.
Service water valves SW-20, SW-19A and SW-19B were modified to automatically close when SW header pressure (as measured in the ECCS comer rooms) decreases below 50 PSIG for greater than 27 seconds. Sustained low SW header pressure is indicative of a loss of normal power event (LNP) which causes all operating SW pumps to stop and only two SW pumps to automatically restart. When postulating conservative design basis assumptions of single active pump failure and no credit for operator action, only one operating pump may be subject to damage from run-out flow, and flow to critical components (EDGs) may be deficient. Automatic isolation of non-essential cooling loads will quickly increase the SW system flow resistance, limit pump run-out, and allow time for operators to manually start other pumps if needed. The original plant design required control room operators to manually Isolate the non-essential loads if a loss of normal power (LNP) event occurred.
- 7. Symmetric split fraction values.
The PRA models many multi-train systems as single top event. The original IPE often used the same split fraction to model a top event where one train was degraded or failed due to support system failures. This provided accurate CDF values, but did not always accurately reflect the risk importance of specific components or trains. An update to the PRA model was performed to create train specific split fractions for all top events.
- 8. Updated generic failure rate data for selected components.
The failure rates of selected components for which generic failure rates were applied were updated to reflect more recent industry data. In the LPCI ISLOCA (Interfacing System LOCA) analysis, the probability for the LPCI check valve LCV-46A leakage failure was inadvertently doubled. The correct failure probability for LCV-46A is 7.45E-04/yr, (IPE Section 3.2.36) but the value used In the model was 1.48E-03/yr.
A Engineering Report Enter8YI REPORTNo.VY-RPT-05-0011O0 Revision 0 Page 291 l of 303l Using the correct check valve failure probability, the frequency of the LCPI ISLOCA initiating event was reduced by approximately 30%. The total annual ISLOCA frequency (for LPCI, CS, and SDC) changed from 2.29E-07/yr to 1.71 E-07/yr, a reduction of 25%. There were no other model changes required to correct this error.
- 9. ARI/RPT Instrumentation New ARI/RPT instrumentation was Installed to satisfy the ATWS Rule equipment diversity requirements. The diverse equipment installed by this EDCR included new reactor level and reactor pressure transmitters, alarm relay modules and relays and modification of two existing water level transmitter loops. The intent of the design upgrade is to diversify the ATWS mitigation equipment (ARI/RPT) from Reactor Protection System (RPS) equipment so as to reduce the likelihood of common mode failures between both systems.
- 10. Modification to Feedwater/Condensate (FWCN) System The original Feedwater/Condensate model conservatively credited only the low feedwater low flow valve as an Injection path for power levels below 10 percent power, when in fact success could also be achieved though either of the main Feedwater control valves. A modification was made to the FWCN model to credit either of the main Feedwater regulation valves, in addition to the low flow valve, for power levels below 10 percent power.
- The 24V ECCS batteries were removed.
- The 24V DC battery chargers were replaced with 24V DC converters.
- 12. Containment N2 System A large portion of the Containment Air System piping in the Drywell Is NNS/non-seismic and is assume to fail in a seismic event. To meet A46/SUAG program commitments, a seismically designed backup system has been Installed (EDCR 98-405). This system consists of 2 high pressure N2 cylinders regulated to feed the SRV accumulators when normal N2 system pressure degrades. This modification was added to the N2 systems model.
- 13. Improvement Inthe Service Water Recovery model Changes were made to the AW top event fault tree to include an improved SW recovery model, in place of the estimated recovery factor that was being used. The recovery model reflects operator response to a variety of system failure modes. The SW recovery model was based upon the Vermont Yankee LOSW initiating event fault tree analysis.
- 14. Effects associated with the Extended Power Uprate (EPU)
The Extended Power Uprate (EPU) for Vermont Yankee was reviewed to determine the net impact on the risk profile associated with Vermont Yankee operation at an Increase in power level to 1912 MWt ( Ref: Identification of Risk Implications Due to Extended Power Uprate at Vermont Yankee, ERIN Engineering and Research, Inc., by Letter C16603001-5585, dated August 26, 2003 ). This involved the identification and review of plant and procedural changes, plus changes to the risk spectrum due to changes in the plant response.
- 15. Review of deterministic thermal hydraulic calculations using the MAAP computer code at the proposed increased power level indicated that the number of times that an SRV would be expected to cycle open/closed would increase by approximately 15%. This increased cycling would increase the probability that an SRV would fail to re-close. Using this Information, the stuck open relief valve probabilities given a transient initiator for the individual SRVs was increased a similar amount.
- 16. Vermont Yankee installed an additional spring safety valve (SSV) to provide additional overpressure capacity to satisfy ASME code requirements at the proposed increased power level. Top event fault trees SO (i.e., *Safety/Relief Valves Fail to Open') and PR (i.e., *Pressure Relief System - ATvVS Mitigation) were revised to incorporate the addition of this new valve.
- 17. Update of RPS Fault Tree Model The VY 2004 PSA model update incorporated an update of the scram failure probabilities using NUREG/CR-5500, Vol.3, "Reliability Study: General Electric Reactor Protection System, 1984-1995",
May 1999. This report documents an analysis of the safety-related performance of the reactor protection system (RPS) at U.S. General Electric commercial reactors during the period 1984 through 1995. The General Electric RPS designs covered in the unavailability estimation included those with relay-based trip systems. The fault tree developed for this design assumed a BWR/4 plant - virtually Identical to that used at VY.
- 18. Updated IEfrequencies.
Initiating event frequencies were reviewed and updated as documented in 2002 (ref: "Vermont Yankee Nuclear Power Station PRA Initiating Event Frequency Update - 2002 Notebook"), as well as In the 2004 (ref: Technical Evaluation TE-2004-015, "VY04 - PSA Base Model Update for 2004."
This evaluation documents changes made to reflect a new understanding of the SBO event sequence, specifically to treatment of the Vernon Tie).
- 19. Revision of Human Error Probabilities (HEPs) was incorporated in the VY PSA model. The Verrnont Yankee risk profile, like other plants, is dependent on the operating crew actions for successful accident mitigation. The success of these actions Is in turn dependent on a number of performance shaping factors. The performance-shaping factor that is principally influenced by the power uprate is the time available within which to detect, diagnose, and perform required actions. The higher power level results in reduced times available for some actions. To quantify the potential impact of this performance shaping factor, deterministic thermal hydraulic calculations using the MAAP computer code was used to re-quantify a number of the HEPs used in the Vermont Yankee PSA model.
J.4 PSA QUALITY
SUMMARY
The quality of modeling and documentation of the Vermont Yankee PSA models has been demonstrated by the foregoing discussions on the following aspects:
- Level of detail InPSA
- Maintenance of the PSA
- Comprehensive Critical Reviews The Vermont Yankee Level 1 and Level 2 PRAs provide the necessary and sufficient scope and level of detail to allow the calculation of CDF and LERF changes due to the risk assessment crediting the use of containment overpressure evaluating the NPSH requirements for emergency core cooling and containment heat removal pumps.
Table J-1 INITIATING EVENTS FOR VERMONT YANKEE PSA Initiator ID Description T Transient (MSIVs and Feedwater Available)
TMS MSIV Closure Transient (Feedwater Available)
TFWMS MSIV Closure Transient with Loss of Feedwater TLP Loss of Off-Site Power Transient LLOCA Large LOCA MLOCA Medium LOCA SLOCA Small LOCA A ATWS for Transient type "T" AMS AiWS for Transient type "TMS" AFWMS ATWS for Transient type 'TFWMS" ALP ATWS for Transient type 'TLP" TD1 Loss of 125 V DC Bus 1 TD2 Loss of 125 V DC Bus 2 TA3 Loss of 4,160 V AC Bus 3 TA4 Loss of 4,160 VACBus 4 TSW Loss of Service Water IORV Inadvertent Opening Relief Valve SORV Stuck Open Relief Valve ISLOCA Interfacing Systems LOCA (48 unique IEs)
LOCAOC LOCA Outside Containment (24 unique lEs)
Floods Internal Flooding initiators (39 unique IEs)
Table J-2 VERMONT YANKEE PSA SYSTEMS Event Tree System Name Top Event High Pressure Coolant Injection HP, EH Low Pressure Coolant Injection LP Low Pressure Core Spray CS Reactor Core Isolation Cooling RC, EH ECCS Actuation System:
Reactor Low Level LV Reactor Low Pressure PS Drywell pressure DW Reactor Low Pressure Permissive Pi Auto Depressurization AD Manual Depressurization OD Emergency Depressurization ED Shutdown Cooling System Containment Spray System DS, SD Containment Vent System VT Suppression Pool Cooling System TC, HR Main Steam Isolation Standby Liquid Control System SL Control Rod Drive Alternate Injection Al Feedwater and Condensate System FW, CN Turbine Bypass and Main Condenser TB, RM Station Service Water SW RHR Service Water DS, TC Reactor Building Closed Cooling Water RW AC Electric Distribution 4 kV AC Bus 1 and Bus 2 01,02 4 kV AC Bus 3 and Bus 4 B3, B4 Diesel Generator DG-1-1A and DG-1-1B GA, GB Vernon Tie VN
Table J-2 VERMONT YANKEE PSA SYSTEMS l Event Tree System Name Top Event 120 V Instrument AC IC 120 V Vital AC VC 125V and 24V DC Electric Distribution Short-Term 125V DC Power (DC-1 and DC-2) DI, D2 Long-Term 125V DC Power (DC-1 and DC-2) C1, C2 Alternate DC Power (DC-1 AS and DC-2AS) S1, S2 24V DC ECCS Battery Panels A and B V1, V2 Station Instrument Air System IG Containment N2 System CG Firewater Injection System Al Loss of Drywell RRU Cooling - Initiating Event Turbine Building Closed Cooling Water TW Vapor Suppression VS Pressure Relief System PR SV/SRVs Fail to Open SO SRVs Fail to Reclose SC ARI and RPT Alternate Rod Insertion AR Recirculation Pump Trip RP Reactor Protection System CR, SE, SM Feedwater Pump Trip on High Rx Level FT Primary Containment Isolation IS External Injection Using RHR-SW VR, CF Alternate Cooling Mode Using RHR-SW AW Refill of Condensate Storage Tank Al Condensate Transfer System as Alternate Injection Al
Table J-3 PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL I PRA ELEMENT CERTIFICATION SUB-ELEMENTS Initiating Events
- Guidance Documents for Initiating Event Analysis
- Groupings
- LOCA
- Support System/Special
- ISLOCA
- Break Outside Containment
- Internal Floods
- Subsumed Events
- Data
- Documentation Accident Sequence Evaluation
- Guidance on Development of Event Trees (Event Trees)
- Event Trees (Accident Scenario Evaluation)
- SBO
- LOCA
- ATWS
- Special
- ISLOCANBOC
- Internal Floods
- Success Criteria and Bases
- Interface with EOPs/AOPs
- Accident Sequence Plant Damage States
- Documentation
Table J-3 PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL I PRA ELEMENT CERTIFICATION SUB-ELEMENTS Thermal Hydraulic Analysis
- Guidance Document
- Best Estimate Calculations (e.g., MAAP)
- Generic Assessments
- FSAR - Chapter 15
- Room Heat Up Calculations
- Documentation System Analysis
- System Analysis Guidance Document(s)
(Fault Trees)
- System Models
- Structure of models
- Level of Detail
- Success Criteria
- Nomenclature
- Data (see Data Input)
- Dependencies (see Dependency Element)
- Assumptions
- Documentation of System Notebooks
Table J-3 PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL I PRA ELEMENT CERTIFICATION SUB-ELEMENTS Data Analysis
- Guidance
- Component Failure Probabilities
- System/Train Maintenance Unavailabilities
- Common Cause Failure Probabilities
- Unique Unavailabilities or Modeling Items
- AC Recovery 2.0 Scram System
- Repair and Recovery Model
- SORV
- BOP Unavailability
- Pipe Rupture Failure Probability
- Documentation Human Reliability Analysis
- Guidance
- Pre-Initiator Human Actions
- Identification
- Analysis
- Quantification
- Post-Initiator Human Actions and Recovery
- Identification
- Analysis
- Quantification
- Dependence among Actions
- Documentation
Table J-3 PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL I PRA ELEMENT CERTIFICATION SUB-ELEMENTS Dependencies
- Guidance Document on Dependency Treatment
- Intersystem Dependencies
- Treatment of Human Interactions (see also HRA)
- Treatment of Common Cause
- Treatment of Spatial Dependencies
- Walkdown Results
- Documentation Structural Capability
- Guidance
- RPV Capability (pressure and temperature)
- ATWS
- Containment (pressure and temperature)
- Reactor Building
- Pipe Over-pressurization for ISLOCA
- Documentation Quantification/Results
- Guidance Interpretation
- Computer Code
- Simplified Model (e.g., outset model usage)
- Dominant Sequences/Cutsets
- Non-Dominant Sequences/Cutsets
- Recovery Analysis
- Truncation
- Uncertainty
- Results Summary
Engineering Report
'!Entergy tw REPORTNo.VY-RPT-05-0011IO Revision 0 l Page l 301 l of l 303 l i
Table J-4 PRA CERTIFICATION TECHNICAL ELEMENTS FOR LEVEL 2 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Containment Performance Analysis
- Guidance Document
- Success Criteria
- LIIL2 Interface
- Phenomena Considered
- Important HEPs
- Containment Capability Assessment
- End state Definition
- LERF Definition
- Documentation
Table J-5 PRA CERTIFICATION TECHNICAL ELEMENTS FOR MAINTENANCE AND UPDATE PROCESS PRA ELEMENT l CERTIFICATION SUB-ELEMENTS Maintenance and Update Process
- Guidance Document
- Input - Monitoring and Collecting New Information
- Model Control
- PSA Maintenance and Update Process
- Evaluation of Results
- Re-evaluation of Past PSA Applications
- Documentation
REFERENCES
[J-1] Vermont Yankee PSA Dependent HEP Assessment, Rev. 0, February 20, 2001.
[J-2] Probabilistic Risk Assessment (PRA) Peer Review Process Guidance", Rev. A-3 (Draft), NEI, June 2, 2000.
[J-3] Vermont Yankee PRA Peer Review Certification Report, GE Document BWROGIPRA-2000-03, November 2000.
[J-4] Letter from USNRC (D.H. Dorman) to D.A. Reid (VY), Vermont Yankee Nuclear Power Station Individual Plant Examination (IPE) Intemal Events (TAC No. M74484), dated February 9,1996.
jJ-5] Entergy Nuclear Northeast, PSA Maintenance and Update", Procedure ENN-DC-1 51, Rev. 0, 07/31/03.