Text

Enclosure 4-2 to NOC-AE-13002986, Risk-Informed Closure of GSI-191 Volume 2 Probabilistic Risk Analysis, Page 1 of 256 Through Page 135 of 256
	ML13175A235
Person / Time
Site:	South Texas
Issue date:	06/06/2013
From:	Wakefield D, Dante Johnson; South Texas, ABSG Consulting
To:	; Office of Nuclear Reactor Regulation
References
	NOC-AE-13002986, GSI-191 STP-RIGSI191-V02, Rev 1
	Download: ML13175A235 (136)
	v • d • e

NOC-AE-1 3002986 ENCLOSURE 4-2 Risk-Informed Closure of GSI-191 Volume 2 Probabilistic Risk Analysis

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2 Probabilistic Risk Analysis Determination of Change in Core Damage Frequency and Large Early Release Frequency due to GSI-191 Issues Document: STP-RIGSI 191-VO2 Revision: 1 Date: June 6, 2013 Prepared by:

Donald Wakefield, ABSG Consulting Inc.

David Johnson, ABSG Consulting Inc.

Reviewed by:

Ernie J. Kee, South Texas Project Zahra Mohaghegh, Soteria Consultants Seyed A. Reihani, Soteria Consultants Rick Grantom, South Texas Project Approved by:

Steve Blossom, South Texas Project Page 1 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Notes on Revision 1 This document supplements information provided in the GSI-191 PRA analysis/assessment [8],

the analysis of record. The purpose of the revision is to provide support for the request for additional information related to the STPNOC January 31, 2013, Risk-Informed GSI-191 Closure License Submittal [9]. The risk metrics shown in this document are consistent with the risk metrics given in Reference 8.

Page 2 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I 1 Purpose and Scope The purpose of this assessment is to determine the change in the core damage frequency and large early release frequency due to the potential effects of GS1-191 phenomena at STP. The change in core damage frequency and large early release frequency is determined by comparing the results of two models: one with no source material capable in the containment capable of producing any GSI-191 effects and one representing the current plant conditions that includes both fibrous insulation that might be liberated following a LOCA and latent material found in the containment.

The results of the comparison become one input to an assessment of the significance of the GSI-1 91 issue at STP. The assessment of the significance uses the framework specified in Regulatory Guide 1.174.

Page 3 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 2 Method 2.1 Quantification Considerations The PRA model developed to support the consideration of GSI-191 phenomena has been developed from the approved PRA model for STP, Revision 7.1 (Reference 1). This approved model builds on a legacy of previous PRA models used for risk informed applications and other regulatory requirements. Revision 7.1 is the current manifestation benefiting from investments in PRA at STP dating back 25 years.

The PRA model developed to address GSI-1 91 concerns does differ from Revision 7.1, however. These modifications are discussed fully below. Key differences include:

Revision 7.1 is designed to yield estimates of the core damage frequency and Level 2 plant damage state frequencies. Success criteria developed to support Revision 7.1 addressed whether at least the minimum equipment was available to satisfy key functions. For example, for long term heat removal in scenarios involving recirculation, the model asks whether the minimum contingent of fan coolers or RHR is available. To address the GSI-191 phenomena, it is necessary to determine specific combinations of plant equipment availability. The number of pumps taking suction from the sump influences the approach velocity of containment water at the screens. This velocity is a key parametric value in describing the interaction of debris laden water with the screens.

In addition, injection flow can influence in-vessel phenomena. The GSI-191 PRA model includes the determination of the number of pumps taking suction from the sump, rather than only determining whether at least the minimum number of pumps is available to provide adequate core injection and cooling. One modeling change was the addition of the determination of the status of the high head safety injection pumps to the large LOCA response model; the status of these pumps do not influence the likelihood of core damage directly, but they could influence the approach velocity of the sump water at the screens.

Revision 7.1, as is common in PWR PRAs, does require the operators to switch over to hot leg injection per procedures and training late in response to a large LOCA to prevent significant boron precipitation. Moreover, Revision 7.1 requires this switchover to occur without differentiating between hot leg and cold leg breaks, a conservative approach.

Revision 7.1 does not require this late switchover for medium LOCAs. This requirement was added to the medium LOCA response model for the GSI-191 PRA. In addition, the GSI-1 91 model only requires switchover to be accomplished for cold leg breaks.

" Both Revision 7.1 and the GSI-191 PRA use the information contained in NUREG 1829 as a basis for the characterization of the frequency of small, medium and large LOCAs.

The two models, however, use the information derived from NUREG 1829 differently.

Revision 7.1 uses information as developed by Idaho National Laboratory to characterize the prior distributions for small, medium and large LOCA frequencies. This is essentially a top-down use of the NUREG 1829 information. The GSI-191 PRA uses the framework developed in NUREG 1829 in a hybrid plant-specific characterization of LOCA frequencies. The primary LOCA frequency characterization is based on a Page 4 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 top-down interpretation of the results of NUREG 1829. The bottom-up portion of the analysis provided a consistent basis for the assignment of the relative failure likelihoods for specific welds and is necessary to support location-specific characterization of LOCAs. Additional discussion of the characterization of initiating event frequency is found in Reference 2 and Reference 3.

During a review of Revision 7.1, a modeling error resulting in the overestimation of the core damage frequency and the large early release frequency at STP was identified (CR 12-31272).

The specific error imposed a dependency on EAB HVAC that is not correct. The specific 480V load center that was modeled in error actually has no dependency on EAB HVAC. This conservative modeling error was carried over into the PRA models developed to address GS1-191 issues. Actually, the specific 480V load center in question has no role in the response to medium or large LOCAs. Since the plant response models of interest are limited to medium and large LOCAs, the error does not significantly impact the determination of changes in core damage frequency or large early release frequency due to GSI-191 phenomena.

The error discussed above will affect values of CDF and LERF. Correcting the error will result in a lower CDF and LERF values.

2.2 Computer Input/Output The PRA models used in the determination of the change in core damage frequency and large early release frequency were derived from STP PRA Revision 7.1. Specific model changes are documented in Appendix A and Appendix B of this assessment.

Page 5 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 3 Assumptions Assumptions remain the same as those in the Revision 7.1 model. However, modeling changes necessary for this study are made and documented in the body of the analysis.

Key assumptions made in the PRA evaluations for GSI-1 91 are as follows:

1. Boron precipitation is assumed possible for medium LOCA, even though we believe this is not true due to the refill of the RCS within 1 or 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , even for the largest size range of the MLOCA category.

2. Unanalyzed pump state combinations not explicitly analyzed by CASA GRANDE are assumed to result in sump blockage with a failure probability of 1.0.

3. The assumption that a mission of time 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is conservative for GSI-1 91 evaluations is justified by arguing that this assumption conservatively increases the change in core damage frequency caused by GSI-191 phenomena; i.e., if pump failures after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months do not already lead to core damage then the GSI-191 phenomena have a greater base success sequence frequency at risk of becoming core damage.

4. The CASA GRANDE models assume containment systems are successful (containment purge isolation, isolation of small containment penetrations, that at least two of six fan coolers operate, and that CCW is available to the RHR heat exchangers) for purposes of evaluating sump failure probabilities. This is assumed justified because the failure of such systems is either relatively low frequency or has minimal impact on the computed failure probabilities.

5. Steam line break sequences will not challenge the pressurizer PORVs to open even if the high pressure injection pumps are not secured due to the relatively low shutoff head of the HHSI pumps at STP. This assumption was also made in Version 7.1 of the STP PRA. This explains why steamline breaks resulting in the need for sump recirculation are particularly low in frequency at STP.

6. For medium and large break LOCAs In the base PRA model and in the base model with GSI-191 phenomena considered, the failure to switch over to hot leg injection as directed by procedures is assumed to result in core damage due to boron precipitation for cold leg breaks only. Hot leg breaks are assumed to not require hot leg switchover after 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . The potential for boron precipitation prior to 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months is evaluated by CASA GRANDE for both cold leg and hot leg breaks.

7. Uncertainties: The variable distributions for most phenomena of interest are sampled inside CASA GRANDE. The PRA model is then passed the probabilities of failure from GSI-191 phenomena. The only uncertainty instead captured by the uncertainty Page 6 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 distribution of the failure probabilities is that caused by the shape of the LOCA break exceedance frequency curves. The LOCA frequency uncertainties sampled in the PRA uncertainty analysis are assumed independent of the probabilities of failure from the uncertainty analysis of CASA GRANDE.

8. A key parameter of the CASA GRANDE is the status of the number of pumps running and taking suction from the sumps. It is assumed sufficient to evaluate the failure probabilities from CASA GRANDE in the PRA by considering only the pump state combination and the size of the break. Other variations on the sequences are assumed less important and are not distinguished.

9. We assume that the NUREG-1829 LOCA frequencies apply.

10. The split of cold leg versus hot leg breaks is assumed in the PRA to be the same as that modeled in CASA GRANDE for each break range when summed over all breaks modeled in CASA GRANDE. The highest cold leg fraction for the three break sizes is assumed in the PRA for all break ranges; i.e., they do not differ significantly between break ranges, but they are also not a 50-50 split. The cold leg fractions for LLOCA =.256 and for MLOCA are.381

11. We assumed credit for pump train symmetry when reducing the pump state combination to those analyzed; if only one spray pump train is available, it does not matter which specific single spray pump train it is.

12. The charging pumps at STP are assumed to too low of flow rate capacity to affect the GSI-191 analysis.

13. Pre-existing containment leaks are assumed small enough as to not affect the GSI-191 phenomena due to lower containment back pressure.

14. One out of three each from HHSI and LHSI pumps is assumed required for mitigation of medium LOCAs.

15. If just one LHSI pump train is aligned for hot leg recirculation and it is to the broken RCS loop, we assume that this is a failure of hot leg recirculation due to flow diversion.

16. Assumed that one HHSI pump operating in hot leg recirculation (as opposed to one higher capacity LHSI pump) is not sufficient to avoid boron precipitation affects for cold leg breaks.

Page 7 of 256

South Texas Project Risk-Informed GSI-1 91 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 4 Results A comparison of the mean values of the distributions used to characterize the initiating event frequencies for medium and large LOCAs in Revision 7.1 and the GSI-191 PRAs is shown in Table 4-1. Transient induced LOCAs are not included in these frequencies.

Table 4-1 Comparison of Medium and Large LOCA Initiating Event Frequencies (mean values, year 1)

STP PRA Revision 7.1 GSI-191 PRA Small LOCA 3.45x10-4 1.59xlOd0 Medium LOCA 4.93x10 4 3.05xl 0-4 Large LOCA 1.34x10 5.20xl 05 A summary comparison of the results of the three PRA models (STP PRA Revision 7.1, the GSI-1 91 PRA - Base Case, and GSI-1 91 PRA - with GSI-1 91 Phenomena) is shown in Table 4-2. The GSI-191 PRA - Base Case represents a hypothetical STP plant with all fibrous insulation removed. The results in this table were generated using the sample mean outputs from a Monte Carlo simulation of each initiating event and split fraction in a single point estimate of the PRA sequence models; i.e., only the sample means were used in the quantification of sequence frequencies through the event trees. The individual sequence quantification cutoff used during quantification was 1.Ox.10 1 4 per year. For the GSI-191 PRA point estimate quantifications, the same approach was used. However, only the small LOCA, medium LOCA, and large LOCA sequence frequencies were reevaluated as the LOCA initiator frequencies have changed. The contributions from the other initiating events in the STP PRA were assumed to be the same as in STP PRA Revision 7.1 because the impact of GSI-191 phenomena on those initiators is negligible. As a result of the 1.Ox10-14 per year cutoff applied, the aggregated amount truncated for medium and large LOCA initiators was 6.7x. 10-9 per year.

Table 4-2 Comparison of Core Damage Frequency and Large Early Release Frequency (mean values, year"1)

STP PRA Revision GSI-191 PRA - Base GSI-191 PRA -

7.1 Case (without (with GSI-191 GSI-191 Phenomena)

Phenomena)

Core Damage 7.80x10-6 9.20x10-6 9.21x10-6 Frequency Large Early Release 5.73x10-7 5.78x10-7 5.78x10-7 Frequency The changes in core damage frequency and large early release frequency are derived by comparing the results from the GSI-191 PRA (with GSI-191 Phenomena) to those of the GSI-191 Base Case, without GSI-191 phenomena:

Change in core damage frequency: 1.09x10-8 per year.

Page 8 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Change in large early release frequency: 8.6x10 1 2 per year.

These CDF and LERF changes are very small. To better understand the robustness of this conclusion, an uncertainty analysis was performed. Since only the medium and large LOCA initiating events potentially are affected by GSI-191 phenomena, only these initiating events were included in the Monte Carlo uncertainty analysis; i.e., and not all the other initiating events modeled in the STP PRA. Of interest are the uncertainty distributions for the differences in CDF and LERF contributions from these two initiating events. A single initiating event batch was constructed that considers medium and large LOCAs for both the core damage and large early release end states (i.e., with an added containment event tree) and considering separately GSI-1 91 phenomena. The list of initiating events consider in the single batch are listed below in Table 4-3.

By including these eight initiating events in the same batch and applying the sampled data variables each trial to all eight initiating events, proper correlation of the sampled data is preserved. The trial initiating event results are then summed by end state. Also, the results for each trial are saved so that differences between the total end state frequencies for each trial can also be computed, again preserving the correlation between the end states. All split fractions used in the medium and large LOCA event trees are recalculated each trial. The sequence frequency cutoff used in the Monte Carlo simulation was increased to lx10,12 per year to speed up the calculation time.

Table 4-3 Initiating Events Considered in Uncertainty Analysis Initiating Event ID Description End State Medium LOCAs evaluated for success or core damage CDF W/

MLOCA with GSI-191 phenomena included GSI-191 Medium LOCAs evaluated for release categories with LERF MLOCA2 GSI-191 phenomena included W/GSI-191 Large LOCAs evaluated for success or core damage CDF W/

LLOCA with GSI-191 phenomena included GSI-191 Large LOCAs evaluated for release categories with GSI-LERF LLOCA2 191 phenomena included W/GSI-191 CDF W/O Medium LOCAs evaluated for success or core damage GSI-191; BASE MLBASE without GSI-191 phenomena included CASE LERF W/O Medium LOCAs evaluated for release categories without GSI-191, BASE ML2BAS GSI-191 phenomena included CASE CDF W/O Large LOCAs evaluated for success or core damage GSI-191, BASE LLBASE without GSI-191 phenomena included CASE LERF W/O Large LOCAs evaluated for release categories without GSI-191, BASE LL2BAS GSI-191 phenomena included CASE The results are provided in Table 4-4 for core damage frequency (CDF) and Table 4-5 for large early release frequency (LERF). The uncertainty distribution for the difference in core damage Page 9 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I frequency attributed to GSI-1 91 phenomena has a mean value of 1.Oxl 0-8 per year. This is consistent with the mean point estimate difference of 1.09x1 08 per year, reported above. The uncertainty analysis allows us to conclude that we are 95% confident that the difference is less than 4.6x1 08 per year. The uncertainty distribution for the difference in large early release frequency attributed to GSI-191 phenomena has a mean value of 1.4x1 0-12 per year. This difference is smaller than the mean point estimate difference of 8.6x10-12 per year, reported above. The uncertainty analysis result is likely affected by the assumed sequence cutoff of 1.Ox10i12 per year. However, the maximum sample output for the LERF difference is only 1.Ox10-l1 per year and this is unlikely to be affected significantly by the assumed quantification cutoff. This provides assurance that the mean difference in the LERF is also very small.

Table 4-4 Uncertainties in Core Damage Frequency from Medium and Large LOCAs (Samples = 1228)

Uncertainty Sample 5%

50%

95%

Sample Mean Percentiles Minimum Maximum GSI-191 PRA - Base Case (without 0605

-06 GSI-191 Phenomena) 8.13x10°9 1.94x108 3.84x10°7 7.31x10°6 1.53x10 1.49x10 GSI-191 PRA - (with 0

00706 06 GSI-191 Phenomena) 8.13x10°9 1.95x10°8 3.86x10-7 7.36 xl0 1.54x10°5 1.50x10° Change in CDF (WITH GSI-191 Phenomena

- BASE CASE) 0 5.43x1011 2.12x10" 4.59 xl0" 1.59x10-°7 1.0Ox10 Table 4-5 Uncertainties in Large Early Release Frequency from Medium and Large LOCAs (Samples = 1228)

Uncertainty Sample 5%

50%

95%

Sample Mean Percentiles =>

Minimum Maximum GSI-191 PRA - Base Case (without GSI-191 Phenomena) 0 0

9.86xl01 2.99xl0" 6.62xl0" 5.65x101° GSI-191 PRA - (with GSI-191 Phenomena) 0 0

9.86 xl0 11 2.99 xl 0° 9 6.62 x10° 9 5.66 x10 1 ° Change in LERF (WITH GSI-191 phenomena - BASE CASE) 0 0

0 0

1.14xl0 1.39x0" Table 4-6 displays the GSI-191, Fussell-Vesely contributors to the core damage frequency from medium and large LOCAs. All other GSI-191 related split fractions have zero contributions.

In-core flow blockage split fractions (i.e., Top Event FLBK) all have zero split fraction values and hence no importance to core damage frequency. Split fractions BORML and BORLL consider the potential for boron precipitation caused core flow blockage from cold leg breaks, given failure of hot leg switchover during long term sump recirculation. Their split fraction values are governed by the cold leg fractions and not by the probability of plugging prior to the required Page 10 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 time of hot leg recirculation switchover. The assumption that these sequences result in core damage due to long term boron precipitation is likely conservative for medium LOCAs because the RCS is likely to refill eventually, thereby ending further boron precipitation.

The importance of Split Fraction BLL1S for boron precipitation caused flow blockage indicates the contribution for large LOCAs when hot leg switchover is successful and for the most likely pump state combination; i.e., Pumps State 1. The equivalent split fraction for medium LOCAs has zero occurrence probability and therefore does not appear. Split Fractions BLL9S and BLL22S represent boron precipitation caused flow blockage for lower frequency pump combination state conditions; i.e., States 9 and 22, respectively.

Split Fractions SULL1, SULL22, SULL9, SULL26, and SULL43 represent the sump and strainer plugging failures following a large LOCA for the five different Pump Combination States 1, 9, 22, 26, and 43, respectively. The rather low conditional probabilities of sump or strainer failures for each pump combination state accounts for the rather low Fussell-Vesely importance measures.

Split Fraction SUMPZ represents the potential for sump and strainer failure mechanisms for all pump combination states that are not explicitly analyzed or bounded. Conservatively, a split fraction value of 1.0 was used for all 48 of these pump combination states. Clearly, a more detailed evaluation of these pump combination states in CASA GRANDE would reduce the evaluated impact of the GSI-191 phenomena. Since core damage is conservatively assumed for all such unevaluated pump combination states in top event SUMP, there are no added impacts for top events FLBK or BORON for these same pump combination states Split Fractions HLEGA, HLEGB, and HLEGAB also appear on the high ranking Fussell-Vesely importance contributors. These split fractions represent failures to successfully switch from cold leg to hot leg recirculation for different classes of sequences. The GSI-191 phenomena are not directly captured by these importance measures. Rather, the occurrence of boron caused core flow blockage is increased in probability, for cold leg breaks if hot leg switchover fails. This is the reason for including them in the table.

Table 4-7 displays some of the key sequences contributing to core damage frequency from medium and large LOCAs when the GSI-191 phenomena are included. There are many sequences that contribute so only some illustrative ones are listed. They are presented ranked by frequency with the sequence ranking shown to the left.

The first five sequences are the highest frequency sequences involving medium LOCAs. The first three of these are undergoing preventative maintenance on one train of ECCS at the time of the break, which occurs on a different RCS loop from that undergoing maintenance. One train of ECCS fails and a second one is diverted out the broken loop when aligned for hot leg recirculation. The failure of the two trains of ECCS during recirculation means that hot leg recirculation switchover fails. The third train of ECCS is left aligned to cold leg recirculation in accordance with procedures. Core damage occurs because of excessive boron precipitation in that fraction of the medium LOCA break frequency which is in the cold legs. There are no sequences of this type with the break in loop C because of a modeling assumption. The operators are assumed to preferentially align trains A and B for hot leg recirculation keeping Train C aligned for cold leg recirculation. Therefore, flow from train C is never lost out the break for hot leg recirculation.

Page 11 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Sequences ranked 4 and 5 are similar to the above except that there is initially no planned maintenance at the time of the break. Instead, an independent failure occurs in a LHSI pump train that is not aligned to the broken loop.

Rather than include additional variations on similar sequences, the table then skips to the next medium LOCA sequences in which the key split fractions from the importance ranking in Table 4-6 appear.

The sequence ranked 13th, involves a medium LOCA with the break in RCS Loop A. There is no planned maintenance but with one train lost, a second LHSI pump train fails to be switched over; i.e., Split Fraction HLEGB fails. Again there is excessive boron precipitation which results in core damage for the fraction of the break frequency involving cold leg breaks.

The sequence ranked 14th, involves a medium LOCA with the break in RCS Loop B. There is no planned maintenance but with one train lost, a second LHSI pump train fails to be switched over; i.e., split fraction HLEGA fails. Again there is excessive boron precipitation which results in core damage for the fraction of the break frequency involving cold leg breaks.

Sequences ranked 46, 47, and 48 are the highest ranked large LOCA sequences that contribute to core damage. They are exactly analogous to the three highest medium LOCAs except that they are initiated by large LOCAs.

The sequence ranked 2 3 1st, involves a medium LOCA with the break in RCS Loop D. No EECS loop is aligned to RCS Loop D. There is no planned maintenance at the time of the break. In this sequence there is a failure to switchover to hot leg recirculation from either Train A or B; i.e., Split Fraction HLEGAB fails). The C train of LHSI is left aligned for cold leg recirculation.

Again there is excessive boron precipitation which results in core damage for the fraction of the break frequency involving cold leg breaks.

The sequences ranked 2 7 0 th and 2 7 1st are also the fourth and fifth highest ranked large LOCA sequence resulting in core damage. The break occurs in RCS Loop B in both of these sequences. There is no planned maintenance at the time of the break, but different sets of pumps are initially running at the start of the accident. Train A of LHSI pump fails. This fails two trains of LHSI from being aligned for hot leg recirculation. Train C is left aligned for cold leg recirculation. Again, without hot leg recirculation switchover, there is eventual excessive boron precipitation which results in core damage for the fraction of the break frequency involving cold leg breaks. Sequences ranked 46, 47, 48, 270, and 271 are the five highest ranked sequences to core damage from large LOCAs.

The sequence ranked 4 2 8 h, involves a large LOCA with the break in RCS Loop D. Therefore, ECCS flow is not aligned to the broken loop. There is also no planned maintenance at the time of the break. All three ECCS train are available. However, in this sequence, excessive boron precipitation occurs prior to the time of hot leg recirculation; i.e., split fraction BLL1S fails. Split Fraction BLL1S corresponds to Pump Combination State 1 in which all three trains of HHSI, LHSI, and containment spray are available to be aligned to the sump for recirculation. The "S" in split fraction name BLL1 S indicates that this is for the sequence that hot leg recirculation would have been successful if core flow blockage did not occur earlier in the sequence. Again there is excessive boron precipitation which results in core damage for the fraction of the break frequency involving cold leg breaks. This fraction is accounted for in the value of Split Page 12 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Fraction BELL1S. This is the highest ranked sequence involving core damage for the pump state combinations analyzed by CASA GRANDE.

The sequence ranked 7 9 7th, involves a medium LOCA with the break in RCS Loop D.

Therefore, ECCS flow is not aligned to the broken loop. There is planned maintenance on ECCS Train A at the time of the break. Independently, the cold leg injection check valve on ECCS Train B fails to open. This is assumed to take out the HHSI and LHSI pumps on Train A.

The pump state combination is, therefore, one HHSI, one LHSI, and two trains of containment spray available. This combination is not analyzed as one of the CASA GRANDE runs and so is conservatively assigned a sump plugging value of 1.0; i.e., Split Fraction SUMPZ=1.0 fails. This is the highest ranked sequence involving core damage for the unanalyzed pump state combinations.

The sequence ranked 8 3 9th, involves a large LOCA with the break in RCS loop D. Therefore, ECCS flow is not aligned to the broken loop. There is no planned maintenance at the time of the break. The pump state combination is, therefore, three HHSI, three LHSI, and three trains of containment spray available. This combination is analyzed as Case 1 of the CASA GRANDE runs; i.e., Split Fraction SULL1=2.45E-04 fails. This is the highest ranked sequence involving sump strainer failure leading to core damage for any pump state combination.

The sequence ranked 2 7 5 4th, involves a large LOCA with the break in RCS Loop D. Therefore, ECCS flow is not aligned to the broken loop. There is planned maintenance on ECCS Train B at the time of the break. The pump state combination is, therefore, two HHSI, two LHSI, and two trains of containment spray available. This combination is analyzed as Case 22 of the CASA GRANDE runs; i.e., Split Fraction SULL22=1.32E-3 fails. This is the second highest ranked sequence involving sump strainer failure leading to core damage.

The sequence ranked 8,2 3 6th, involves a large LOCA with the break in RCS loop D. Therefore, ECCS flow is not aligned to the broken loop. There is no planned maintenance at the time of the break. Train A of LHSI fails independently. The pump state combination is, therefore, three HHSI, two LHSI and three trains of containment spray available. Hot leg recirculation succeeds using ECCS Train B. This pump state combination is analyzed as Case 9 of the CASA GRANDE runs; i.e., Split Fraction BLL9S=1.82E-3 fails. There is excessive boron precipitation which results in core damage for the fraction of the break frequency involving cold leg breaks.

The cold leg fraction is included in the value of Split Fraction BLL9S. This is the second highest ranked sequence involving boron precipitation leading to core damage of the five pump state combinations explicitly analyzed by CASA GRANDE.

Of the three other split fractions ranked in Table 4-6 (i.e., BLL22S, SULL26, and SULL43), the highest ranking sequences involving failure of any one of them had frequencies less than 1 E-1 2 per year. None are in the top 15,000 sequences ranked.

Page 13 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table 4-6 GSI-191Contributors; Split Fraction Importance to Medium and Large LOCA CDF RANK Split Top Fussell-RAW SF Value Description Fraction.

Event Vesely Importance 1

BORML BORON 9.13E-01 2.4818 3.81E-01 BORON BLOCKAGE: MLOCA CL FRACTION GIVEN HLEG=F, NO GSI ISSUES 2

HLEGA HLEG 2.74E-02 19.8590 1.45E-03 TRAIN A HOT LEG RECIRCULATION FAILS 3

HLEGB HLEG 2.62E-02 19.0410 1.45E-03 TRAIN B HOT LEG RECIRCULATION FAILS 4

BORLL BORON 1.03E-02 1.0300 2.56E-01 BORON BLOCKAGE:

LLOCA CL FRACTION GIVEN HLEG=F, NO GSI 1091 ISSUES 5

SUMPZ SUMP 5.49E-03 1.0 1.0 SUMP PLUGGING ALL UNANALYZED PUMP STATES LARGE AND MEDIUM LOCAS 6

BLL1S BORON 2.09E-03 4.0100 6.93E-04 BORON BLOCKAGE:

LLOCA, PUMP STATE 1, HLEG=S, WITH GSI-191 ISSUES 7

HLEGAB HLEG 1.94E-03 35.3780 5.66E-05 TRAIN A,B HOT LEG RECIRCULATION FAILS 8

SULL1 SUMP 7.35E-04 4.0006 2.45E-04 SUMP PLUGGING:

PUMP STATE 1, LARGE LOCA 9

SULL22 SUMP 1.99E-04 1.1505 1.32E-03 SUMP PLUGGING:

PUMP STATE 22, LARGE LOCA Page 14 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSII91-V02 Revision 1 Table 4-6 GSI-191Contributors; Split Fraction Importance to Medium and Large LOCA CDF (Continued)

RANK Split Top Fussell-RAW SF Value Description Fraction Event Vesely Importance 10 BLL9S BORON 9.25E-05 1.0508 1.82E-03 BORON BLOCKAGE:

LLOCA, PUMP STATE 9, HLEG=S, WITH GSI-191 ISSUES 11 BLL22S BORON 5.07E-06 1.0676 7.50E-05 BORON BLOCKAGE:

LLOCA, PUMP STATE 22, HLEG=S, WITH GSI-191 ISSUES 12 SULL26 SUMP 1.10E-06 1.0011 9.55E-04 SUMP PLUGGING:

PUMP STATE 26, LARGE LOCA 13 SULL43 SUMP 9.27E-07 1.0002 4.44E-03 SUMP PLUGGING:

PUMP STATE 43, LARGE LOCA Page 15 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table 4-7 Medium and Large LOCA Sequences Ranked to Core Damage Rank IE/SF Value Sequence Event Descriptions; IE and SFs Sequence

% of Frequency CDF 1

MLOCA 3.05E-04 Medium LOCA 1.9433E-007 13.13 BRKSA 2.50E-01 STEAM LINE BREAK FRACTION, LOOP A TMEECA 7.50E-03 PLANNED MAINTENANCE TRAIN B PBZ 1.OOE+00 SI COMMON TRAIN B HBZ 1.OOE+00 HIGH HEAD SAFETY INJECTION TRAIN B LBZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN B CS3AC 9.91 E-01 CONTAINMENT SPRAY -

RECIRCULATION RBZ 1.OOE+00 SI RECIRCULATION TRAIN B OFFSZ 1.OOE+00 OPERATORS SECURE ALL CONTAINMENT SPRAY FOR LATE RECIRCULATION HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORML 3.81E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 2

MLOCA 3.05E-04 Medium LOCA 1.9431E-007 13.13 BRKSB 2.50E-01 STEAM LINE BREAK FRACTION LOOP B TMEEBC 7.50E-03 PLANNED MAINTENANCE TRAIN A PAZ 1.OOE+00 SI COMMON TRAIN A HAZ 1.OOE+00 HIGH HEAD SAFETY INJECTION TRAIN A LAZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN A CS4AB 9.92E-01 CONTAINMENT SPRAY -

RECIRCULATION RAZ 1.OOE+00 SI RECIRCULATION TRAIN A OFFSZ 1.OOE+00 OPERATORS SECURE ALL CONTAINMENT SPRAY FOR LATE RECIRCULATION HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORML 3.81 E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 3

MLOCA 3.05E-04 Medium LOCA 1.9429E-007 13.13 BRKSA 2.50E-01 STEAM LINE BREAK FRACTION LOOP A TMEEAB 7.50E-03 PLANNED MAINTENANCE TRAIN C PZZ 1.OOE+00 SI COMMON TRAIN C HCZ 1.0OE+00 HIGH HEAD SAFETY INJECTION TRAIN C LCZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN C CS2AE 9.92E-01 CONTAINMENT SPRAY -

RECIRCULATION RCZ 1.OOE+00 SI RECIRCULATION TRAIN C HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORML 3.81E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION Page 16 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table 4-7 Medium and Large LOCA Sequences Ranked to Core Damage (Continued)

Rank IE/SF Value Sequence Event Descriptions; IE and SFs Sequence

% of Frequency CDF 4

MLOCA 3.05E-04 Medium LOCA 3.0362E-008 2.05 BRKSB 2.50E-01 STEAM LINE BREAK FRACTION LOOP B TMEBCA 2.67E-01 NO MAINTENANCE TRAINS A&C RUNNING LAA 4.51 E-03 LOW HEAD SAFETY INJECTION TRAIN A CSIAA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION HLEGZ 1.00E+00 SI HOT LEG RECIRCULATION BORML 3.81E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 5

MLOCA 3.05E-04 Medium LOCA 3.0276E-008 2.05 BRKSB 2.50E-01 STEAM LINE BREAK FRACTION LOOP B TMEBBC 2.66E-01 NO MAINTENANCE TRAINS B&C RUNNING LAA 4.51 E-03 LOW HEAD SAFETY INJECTION TRAIN A CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORML 3.81E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 13 MLOCA 3.05E-04 Medium LOCA 9.8898E-009 0.67 BRKSA 2.50E-01 STEAM LINE BREAK FRACTION LOOP A TMEBCA 2.67E-01 NO MAINTENANCE TRAINS A&C RUNNING CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION HLEGB 1.45E-03 SI HOT LEG RECIRCULATION BORML 3.81 E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 14 MLOCA 3.05E-04 Medium LOCA 9.8823E-009 0.67 BRKSB 2.50E-01 STEAM LINE BREAK FRACTION LOOP B TMEBCA 2.67E-01 NO MAINTENANCE TRAINS A&C RUNNING CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION HLEGA 1.45E-03 SI HOT LEG RECIRCULATION BORML 3.81 E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 46 LLOCA 5.20E-06 Large LOCA 2.2180E-009 0.15 BRKSA 2.50E-01 STEAM LINE BREAK FRACTION LOOP A TMEECA 7.50E-03 PLANNED MAINTENANCE TRAIN B PBZ 1.OOE+00 SI COMMON TRAIN B HBZ 1.OOE+00 HIGH HEAD SAFETY INJECTION TRAIN B LBZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN B Page 17 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Table 4-7 Medium and Large LOCA Sequences Ranked to Core Damage (Continued)

Rank IE/SF Value Sequence Event Descriptions; IE and SFs Sequence

% of Frequency CDF CS3AC 9.91 E-01 CONTAINMENT SPRAY -

RECIRCULATION RBZ 1.OOE+00 SI RECIRCULATION TRAIN B HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORLL 2.56E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 47 LLOCA 5.20E-06 Large LOCA 2.2179E-009 0.15 BRKSB 2.50E-01 STEAM LINE BREAK FRACTION LOOP B TMEEBC 7.50E-03 PLANNED MAINTENANCE TRAIN A PAZ 1.00E+00 SI COMMON TRAIN A HAZ 1.00E+00 HIGH HEAD SAFETY INJECTION TRAIN A LAZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN A CS4AB 9.92E-01 CONTAINMENT SPRAY -

RECIRCULATION RAZ 1.OOE+00 SI RECIRCULATION TRAIN A HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORLL 2.56E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 48 LLOCA 5.20E-06 Large LOCA 2.2176E-009 0.15 BRKSA 2.50E-01 STEAM LINE BREAK FRACTION LOOP A TMEEAB 7.50E-03 PLANNED MAINTENANCE TRAIN C PZZ 1.OOE+00 SI COMMON TRAIN C HCZ 1.OOE+00 HIGH HEAD SAFETY INJECTION TRAIN C LCZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN C CS2AE 9.92E-01 CONTAINMENT SPRAY -

RECIRCULATION RCZ 1.OOE+00 SI RECIRCULATION TRAIN C HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORLL 2.56E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 231 MLOCA 3.05E-04 Medium LOCA 3.8576E-010 0.03 BRKSD 2.50E-01 STEAM LINE BREAK FRACTION LOOP D TMEBCA 2.67E-01 NO MAINTENANCE TRAIN A&C RUNNING CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION HLEGAB 5.66E-05 SI HOT LEG RECIRCULATION BORML 3.81E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 270 LLOCA 5.20E-06 Large LOCA 3.4655E-010 0.02 BRKSB 2.50E-01 STEAM LINE BREAK FRACTION LOOP B TMEBCA 2.67E-01 NO PLANNED MAINTENANCE TRAINS A&

C RUNNING LAA 4.51 E-03 LOW HEAD SAFETY INJECTION TRAIN A CS1AA 9.87E-01 CONTAINMENT SPRAY -

Page 18 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table 4-7 Medium and Large LOCA Sequences Ranked to Core Damage (Continued)

Rank IE/SF Value Sequence Event Descriptions; IE and SFs Sequence

% of Frequency CDF RECIRCULATION HLEGZ 1.00E+00 SI HOT LEG RECIRCULATION BORLL 2.56E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 271 LLOCA 5.20E-06 Large LOCA 3.4557E-010 0.02 BRKSB 2.50E-01 STEAM LINE BREAK FRACTION LOOP B TMEBBC 2.66E-01 NO MAINTENANCE TRAINS B&C RUNNING LAA 4.51 E-03 LOW HEAD SAFETY INJECTION TRAIN A CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION HLEGZ 1.OOE+00 SI HOT LEG RECIRCULATION BORLL 2.56E-01 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 428 LLOCA 5.20E-06 Large LOCA 2.1137E-010 0.01 BRKSD 2.50E-01 STEAM LINE BREAK FRACTION LOOP D TMEBCA 2.67E-01 NO MAINTENANCE TRAINS A&C RUNNING CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION BLL1S 6.93E-04 BORON PRECIPITATION FOLLOWING SUMP RECIRCULATION 797 MLOCA 3.05E-04 Medium LOCA 8.0237E-01 1 0.01 BRKSD 2.50E-01 STEAM LINE BREAK FRACTION LOOP D TMEEBC 7.50E-03 PLANNED MAINTENANCE TRAIN A S138BA 1.56E-04 S138 PATH B PAZ 1.OOE+00 SI COMMON TRAIN A HAZ 1.OOE+00 HIGH HEAD SAFETY INJECTION TRAIN A HBZ 1.OOE+00 HIGH HEAD SAFETY INJECTION TRAIN B LAZ 1.00E+00 LOW HEAD SAFETY INJECTION TRAIN A LBZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN B CS4AB 9.92E-01 CONTAINMENT SPRAY -

RECIRCULATION RAZ 1.OOE+00 SI RECIRCULATION TRAIN A SUMPZ 1.OOE+00 SUMP STRAINER DURING RECIRCULATION 839 LLOCA 5.20E-06 Large LOCA 7.4708E-011 0.01 BRKSD 2.50E-01 STEAM LINE BREAK FRACTION LOOP D TMEBCA 2.67E-01 NO MAINTENANCE TRAINS A&C RUNNING CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION SULL1 2.45E-04 SUMP STRAINER DURING I

I_ RECIRCULATION 2,754 LLOCA 5.20E-06 Large LOCA 1.1504E-011 0.00 Page 19 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table 4-7 Medium and Large LOCA Sequences Ranked to Core Damage (Continued)

Rank IE/SF Value Sequence Event Descriptions; IE and SFs Sequence

% of Frequency CDF BRKSD 2.50E-01 STEAM LINE BREAK FRACTION LOOP D TMEECA 7.50E-03 PLANNED MAINTENANCE TRAIN B PBZ 1.OOE+00 SI COMMON TRAIN B HBZ 1.OOE+00 HIGH HEAD SAFETY INJECTION TRAIN B LBZ 1.OOE+00 LOW HEAD SAFETY INJECTION TRAIN B CS3AC 9.91 E-01 CONTAINMENT SPRAY -

RECIRCULATION RBZ 1.OOE+00 SI RECIRCULATION TRAIN B SULL22 1.32E-03 SUMP STRAINER DURING RECIRCULATION 8,236 LLOCA 5.20E-06 Large LOCA 2.4617E-012 0.00 BRKSD 2.50E-01 STEAM LINE BREAK FRACTION LOOP D TMEBCA 2.67E-01 NO MAINTENANCE TRAINS A&C RUNNING LAA 4.51 E-03 LOW HEAD SAFETY INJECTION TRAIN A CS1AA 9.87E-01 CONTAINMENT SPRAY -

RECIRCULATION BLL9S 1.82E-03 BORON PRECIPITATION FOLLOWING I

I_ SUMP RECIRCULATION Page 20 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 5 References

1. "Medium Loss of Coolant Accident (LOCA) Event Tree (MLOCA, LTMLOCA, PDSML),"

Revision 7, prepared by Mary Anne Billings and Chase Gilmore for South Texas Project Electric Generating Station, Probabilistic Risk Assessment, June 18, 2012.

2. Volume 3 CASA GRANDE Analysis: STP Document STI Number Is 33650532.

3. Popova, E., and D. Morton (2012, May). Uncertainty modeling of LOCA frequencies and break size distributions for the STP GSI-191 resolution. Technical report, The University of Texas at Austin, Austin, TX.

4. Jan F. Grobbelaar, "Human Reliability Analysis Update," May 1, 2006, prepared by Scientech for South Texas Project.

5. Wakefield, D.J., et al., "RISKMAN TM, Celebrating 20+ Years of Excellence!," presented at PSAM10, Seattle, Washington, June 7-10, 2010.

6. ASME RA-Sa-2009, Addenda to ASME/ANS RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2, 2009.

7. STP Nuclear Operating Company, "South Texas Project, Units 1 and 2, Docket Nos. STN 50-498, STN 50-499," Response to NRC Requests for Additional Information on STPNOC Proposed Risk Managed Technical Specifications (TAC Nos. MD 2341 &

MD 2342), February 28, 2007, NOC-AE-07002112.

8. "PRA Analyses/Assessments," OPGP05-ZE-0001, PRA-1 3-001, Rev. 0.

9. NOC-AE-13002954/STI 33648174.

Page 21 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 6 Description of Sequences Introduced by GSI-191 Phenomena The GSI-191 phenomena apply for accident sequences that, following RCS injection of the RWST contents, require sump recirculation for successful mitigation. The specific LOCA classes modeled in the STP PRA and requiring sump recirculation are described in Section 11.

Early on in the assessment of GSI-191 phenomena it was determined that the only sequence classes requiring sump recirculation that would be affected are medium LOCAs (2"-6" diameter breaks) and large LOCAs (>6" diameter breaks).

Changes to the STP PRA models to accommodate the assessment of GSI-191 phenomena were therefore restricted to the sequence models for these two initiating events. The STP PRA already includes the modeling of injection and sump recirculation functions in response to medium and large LOCAs. However, it was necessary to revise the plant sequence model so that the status of all pumps taking suction from the sump during recirculation would be known so that the plant conditions under which the GSI-191 phenomena are defined. Further discussion of pump state combinations is provided in Section 9. Similarly, the status of containment systems were also changed to be evaluated prior to the sequence models questioning sump recirculation events. This allows the sump pool temperature and containment pressures to be known at the start of sump recirculation and following. A further discussion of containment system states is provided in Section 10.

The specific GSI-191 failure mechanisms of interest are those described in Reference 2, namely:

1. Strainer AP>NPSH,,,,.*,,

2. Strainer AP >

,,cu for Structural Failure

3. Strainer Void Fraction, F,od Ž 0.02

4. Core Fiber Load > Cold Leg Break Fiber Limit for Boron Precipitation, Prior to Switchover to Hot Leg Recirculation

5. Core Fiber Load >_ Hot Leg Break Fiber Limit for Boron Precipitation, Prior to Switchover to Hot Leg Recirculation

6. Core Fiber Load > Cold Leg Break Fiber Limit for Flow Blockage

7. Core Fiber Load > Hot Leg Break Fiber Limit for Flow Blockage Failure Mechanisms 1, 2, and 3 are grouped into a failure probability represented in the PRA via Top Event SUMP. Failure Mechanisms 4 and 5 are grouped into a failure probability represented in the STP PRA by Top Event BORON. Finally, Failure Mechanisms 6 and 7 are grouped into a failure probability represented in the STP PRA by Top Event FLBK.

Page 22 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 The plant response models following sump recirculation swap-over were then modified to question new event tree Top Events SUMP, FLBK, and BORON. A detailed description of the modified plant response models for medium and large LOCAs is provided in Appendix A.

The only scenarios identified as arising from GSI-191 phenomena that result in core damage are initiated by break sizes assigned to large LOCAs. The increase in core damage frequency due to GSI-191 phenomena is small, 1.09x10-8 per year. The added sequences predominately involve an intact, isolated containment, with containment heat removal so that the increase in large early release frequency is very small, less than 1x10-11 per year.

As indicated in Table 4-3, above, the dominate GSI-1 91 issue leading to core damage is associated with the increased likelihood of exceeding the cold leg fiber limit for boron precipitation. Loss of NPSH at the sump strainer is a small contribution by comparison.

Page 23 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 7 Comparison to Regulatory Guide 1.174 Metrics Regulatory Guide 1.174 provides numerical guidelines to characterize the core damage frequency, the frequency of large early release and the changes in core damage frequency and large early release. These measures are used as input to the risk-informed process judging the acceptability of the plant change. Regulatory Guide 1.174 defines changes judged to be 'very small' to be characterized by the following:

The baseline core damage frequency does not 'significantly exceed' 10-4 per year.

The change in core damage frequency is less than 10-6 per year.

The baseline large early release frequency does not 'significantly exceed' 10-5 per year.

The change in large early release frequency is less than 107 per year.

Changes that meet all these requirements are said to be in 'Region I1l'. The inclusion of GSI-191 phenomena into the STP PRA yields results that are characterized as being in Region Ill, thereby implying that these phenomena result in 'very small changes' in these risk metrics.

Regulatory Guide 1.174 also requires consideration of risk from 'all modes and all initiators'.

The STP risk models consider all initiators; e.g., a comprehensive set of internal event initiators, fires, seismic and internal flooding. Only medium and large LOCAs were found to potentially be affected by GSI-191 phenomena, so the effort described here is focused on these initiators.

Additional discussion of other initiators involving recirculation is found in Section 11, below.

Only internal initiators are considered further; the contribution of medium and large LOCAs from external events, such as seismic activity, is negligibly small.

The risk models employed consider explicitly only Modes 1 and 2. Although not explicitly modeled, the assessment is bounding for Modes 3 and 4, when the primary system is still pressurized. Modes 5, 6, and 'Defueled' do not contribute to GSI-191 phenomena scenarios as the primary system is depressurized. Procedures instruct the operators to disable containment spray shortly after entering Mode 5 on cool down. On startup, sprays are enabled upon entering Mode 4.

Page 24 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 8 On the Representation of Scenarios Beyond 24 Hours The STP PRA adopts the common convention in PRA that specifies a 24-hour mission time for active equipment. The rationale for this accepted convention is the assumption that it appropriately balances the likelihood of active system failures after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months with the additional resources that might become available and the longer response times that would characterize most 'late' failures.

Some of the GSI-191related phenomena could manifest over a time frame that extends beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The impacts of such phenomena are fully represented in the GSI-191PRA. All failures predicted by CASA GRANDE are incorporated into the PRA.

The interface between CASA GRANDE and the PRA-the specification of the conditional likelihood of failure due to any of the GSI-191 phenomena-is characterized by the status of the pump trains taking suction from the sumps. The pump train status is determined by their availability over the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Any core damage events that are caused by GSI-1 91 phenomena are in addition to core damage events from other causes, such as failure of all vessel injection or failure of decay heat removal. From this point of view, the addition of GSI-191 phenomena to the PRA model can be viewed as potentially resulting in otherwise 'success' sequences in the absence of the GSI-191 phenomena going to core damage when such phenomena is considered. Therefore, any overestimation of success sequence frequencies that result from omitting active system failures after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months would result in an overestimate of GSI-191 phenomena related core damage frequency. We believe, based on the rationale behind the conventional 24-hour mission time for active equipment, that this effect is small.

CASA GRANDE analyses indicate that the conditional likelihood of failure due to GSI-191 phenomena can be greater for cases involving less than three pump trains available as compared to the case of all trains available. These analyses were performed assuming that any unavailable train became unavailable at the beginning of the scenario. Although pump failures can occur after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the loading of the debris on the sump strainers is well established by 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , when the interface conditions between CASA GRANDE and the PRA are defined.

The debris loading conditions on the strainers would therefore not be affected by active system failures after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Active system failures occurring after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months would most likely affect a single pump train. Such failure would actually reduce the strainer approach velocities thereby reducing the potential for sump and strainer failures. Active system failures affecting multiple trains would likely affect all pump trains thereby causing core damage, in the absence of GSI-191 affects.

For GSI-191 phenomena that potentially manifest downstream of the strainers, a key consideration of whether core damage occurs is the timing of switchover to hot leg injection.

For cold leg breaks, the PRA currently requires switchover to be successful and this action would occur within 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (Reference 4). Active system failures following successful switchover are included in the PRA via the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time assumption. Any such failure is not a GSI-191 issue. For hot leg breaks, successful switchover to hot leg injection is not required. Any active system failures occurring after hot leg switchover or later are also not Page 25 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 downstream of the strainers GSI-191 issues. Therefore, any train failures after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months would not significantly impact the conditional likelihood of core damage due to GSI-1 91 phenomena.

Page 26 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 9 On the Frequency of Success States Involving Different Numbers of Pumps Operating The STP PRA model developed for the GSI-191 project (GSI-191 PRA) identifies the number of pumps operating during both the injection and sump recirculation phases within each sequence.

The CASA GRANDE models develop the failure probabilities for each of the GSI-191 phenomena for a specified list of sequence conditions. A key attribute of these sequence conditions is the number of ECCS pumps specified as operating in both the injection and sump recirculation phases. For medium and large LOCAs where the containment spray pumps are actuated, conceptually there are at least 64 different combinations of such pump states; i.e., there may be 0, 1, 2, or 3 pumps operating for each of the HHSI pumps, the LHSI pumps and the containment spray pumps; i.e., 4x4x4=64 combinations. Conceivably, we could have identified 29 = 512 pump states if each pump was substantially different and the flows to the three sumps were asymmetrical. However, at STPEGS, the flows to each sump are symmetrical and the pump types are all judged essentially the same; i.e., the pump flow characteristics of the three LHSI pumps are the same. For these reasons, the simpler approach adopting 64 states was taken.

Considering the operator actions directed by procedures, the situation is actually more complicated. Early in the accident sequences, the operators are directed to turn off one train of containment spray if initially all three are running to conserve RWST water inventory for the remaining pumps. Later in the accident sequence, after containment pressure drops below 6.5 psig and the Technical Support Center (TSC) determines that containment iodine levels are sufficiently low (i.e., estimated at 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the break for the design basis large LOCA event), all containment spray pumps are shut off. The operators are very likely to successfully perform these actions but there is also some probability that they do not. Further, the timing of these operator actions may affect the assessed evaluation of the GSI-191 phenomena issues.

Fortunately not all of these EECS pump combinations needed be considered. The study team recognizes that some cases can be bounded by others; e.g., the result for two HHSI pumps operating is likely bracketed by one or three operating; i.e., the failure probability for the two HHSI pumps running case likely lies between the failure probabilities for one pump operating and three pumps operating cases. Another basis for choosing the pump combinations to evaluate is to assess their frequency of occurrence. The GSI-1 91 PRA model provides a tool to do this. For this exercise we are interested only in those sequences which, in the absence of the GSI-191 phenomena, are mapped to success rather than to core damage. By restricting the sequences to success conditions, those pump combinations which lead to core damage even without considering the GSI-191 phenomena are eliminated. The STP PRA models for this exercise involve only MLOCA and LLOCA events because only in those events is sump recirculation at issue and the containment spray pumps are expected to be actuated by a high containment pressure condition.

Table 9-1 presents the results from three sensitivity cases evaluated using the GSI-191 PRA model with no impact from the GSI-191 phenomena. The sequence quantification was run with a cutoff value of 1.O0xl0- 14 per year. In each sensitivity case the success end state was divided into 64 different sub-bins according to the possible combinations of the nine different ECCS pumps of interest. The status of the charging pumps, on the other hand, is not tracked in the Page 27 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSII91-V02 Revision 1 STP PRA and not believed to provide sufficient flow to be of interest in this evaluation. The status of each pump is dependent on the availability of the pump itself, its RWST and containment sump suction valves, and associated supporting systems. It is not dependent on the break loop location since whether the LHSI or HHSI pump injects to the RCS is not relevant to the flow rates from the three sumps. The sump flow rate is the key parameter in evaluating the GSI-191 phenomena.

The first sensitivity evaluates the sequences when the operators do not act early (Top Event OSF=F) or late (Top Event OFFS=F) to secure the containment spray pumps. In this sensitivity, the most likely pump state (H3L3S3SUCC) involves all three HHSI, LHSI, and spray pumps operating. The next most likely state is when one ECCS train is disabled (such as for planned maintenance) and two trains of HHSI, LHSI and spray pumps are available. The next most likely pump states involve just single pump train failures of HHSI, LHSI, or spray pump trains. All other successful pump state combinations are less likely than the total core damage frequency from the MLOCA and LLOCA initiating events; i.e., CDF. CDF from medium and large LOCAs only is not a pump combination state but is included in Table 9-1 for ease of comparison. There are many different ECCS pump successful combinations with some frequency above 4x10 1 3 though less than the CDF frequency. All other pump combinations not shown in the first three columns were assessed as having zero frequency. Not all such pump combinations occur because some pumps must operate to prevent core damage and we are restricting the pump state combination frequencies to success sequences.

The second sensitivity run is similar to the first except that the operators are assumed to have secured one train of spray early in the injection phase if all three spray trains are initially running. This reduces the number of pump state combinations with non-zero frequency. It also changes the most likely pump combinations since now there are no pump combination states with all three trains of spray operating. The most likely pump combination state involves three HHSI pumps, three LHSI pumps, and two spray pumps operating; i.e., the same as in the first sensitivity except that one train of spray is secured. The next most likely is when one ECCS train is disabled (such as for planned maintenance) and two trains of HHSI, LHSI, and spray pumps are available. In this state only two trains of spray are running initially so that they are both left running. The next most likely pump states involve just single pump train failures of either HHSI or LHSI pump trains with the third spray train being secured. With a frequency just less than the core damage frequency, is one additional pump state involving failure of one train of ECCS with an added spray pump train failure. All other pump state combinations in this sensitivity are individually less likely than the total core damage frequency from MLOCA and LLOCA; i.e., CDF. There are some pump states combinations with individual frequencies above 8x10 1 3 but less than the CDF frequency. The number of such pump state combinations is lower than in the first sensitivity shown in the first two columns of Table 9-1 because there are none which have all three spray pumps operating. All other pump state combinations not shown in the second sensitivity were assessed as having zero frequency.

The third sensitivity run is similar to the first except that the operators are assumed to secure all three trains of spray approximately 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the break in accordance with procedures.

This assumption greatly reduces the number of pump state combinations with non-zero frequency. It also changes the most likely pump combinations since now there are no pump combination states with any trains of spray operating. The most likely pump combination state involves three HHSI pumps, three LHSI pumps, and zero spray pumps operating; i.e., the same as in the first sensitivity run except that all trains of spray are secured. The next most likely is Page 28 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I when one ECCS train is disabled (such as for planned maintenance) and two trains of HHSI and LHSI and all spray pumps are secured. The next most likely pump states involve just single pump train failures of either HHSI or LHSI with again all spray pump trains secured. All other successful pump state combinations are less likely than the total core damage frequency from MLOCA and LLOCA; i.e., CDF in the table. There are many different ECCS pump successful combinations with some frequency above 3x10-13 though less than the MELT frequency. All other pump combinations not shown in the third sensitivity were assessed as having zero frequency for this sensitivity.

Another way to look at this set of results from the three sensitivity runs is to consider them as time sequenced. The first sensitivity run defines the frequency of pump states during early injection before the operators secure one of three operating spray trains. The second sensitivity defines the frequency of pump states later during injection after the operators secure one of three operating spray trains. This condition would persist through sump recirculation switchover up until 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the break. Finally the third sensitivity run defines the frequency of pump states assuming the operators act to secure all spray trains after 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . One deviation from this time sequencing of pump states is that when assessing whether the pump trains are operating, both the RWST suction and sump recirculation valves are required for pump operability in all three sensitivity runs. If the first sensitivity truly represented only the conditions during early injection, then failures of the sump valves would not be counted. This consideration has a minor impact on the results, however.

Results from the first sensitivity case only in Table 9-1 were used in the mapping of CASA GRANDE result cases to pump state combinations. Pump State Combinations 1, 9, 22, 26, and 43 are evaluated explicitly in CASA GRANDE. We then conservatively bound other combinations of specific pumps failing by choosing one of the five CASA GRANDE evaluated cases. Different pump combination states may be identified as bounding for strainer failures as opposed to in-vessel failures caused by GSI-191 phenomena. Typically a bounding case is one that has greater strainer flow and debris to a given strainer than the pump state being evaluated. For pump combination states that could not be easily bounded and for very low frequency pump combination states (i.e., 48 pump state combinations in all), the GSI-191 phenomena were assumed to cause core damage in all associated sump recirculation sequences.

Page 29 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis R1-GSI191-V02 Revision I Table 9-1 Frequency of Success Sequence Pump Combination States; No Impact of Break Location from MLOCA and LLOCAs Only; Model GSI-191 PRA; Bounding Case for Vessel Failure Secure One Spray Pump Early Only (OSI=S and OFFS=F)

Total:

Frequency CASA CASA H3L3S2SUCC 2.67E-04 GRANDE GRANDE Run-Case 1 Run-Case 1 CASA CASA H2L2S2SUCC 8.64E-06 GRANDE GRANDE Run-Case Run-Case 22 22 Case 22 Case 9 H3L2S2SUCC 3.53E-06 Case 1 Case I H2L3S2SUCC 1.97E-06 Case 22 Case 9 CDF 1.47E-6 H2L2SISUCC 7.12E-07 Case 22 Case 22 H3L3S1SUCC 7.53E-08 Case 26 Case 26 H2L1S2SUCC 5.69E-08 Case 22 Case 9 HILISISUCC 4.11E-08 CASA CASA HIL2S2SUCC 3.29E-08 GRANDE GRANDE Run-Case Run-Case 26 26 Case 22 Case 9 H3LIS2SUCC 3.26E-08 CASA CASA H1L3S2SUCC 2.71 E-08 GRANDE GRANDE Run-Case Run-Case 43 43 Page 30 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table 9-1 Frequency of Success Sequence Pump Combination States; No Impact of Break Location (Continued) n from MLOCA and LLOCAs Only; Model GSI-191 PRA; MFF=G191MC (Continued)

Bounding Bounding Secure One Spray Pump Early Case for Case for Only (OSI=S and OFFS=F)

Strainer Vessel Failure Failure Total:

Frequency Case 26 Case 26 H3L3SOSUCC 9.77E-09 CASA CASA H2L1S1SUCC 4.66E-09 GRANDE GRANDE Run-Case 9 Run-Case 9 Case 9 Case 9 H1L2S1SUCC 3.40E-09 Case 22 Case 9 HILISOSUCC 2.56E-09 HiLjSk = i HHSI TRAINS S, j LHSI

TRAINS, k SPRAY TRAINS Case 1 Case 9 H1LIS2SUCC 1.53E-09 Not Not bounded H2L2SOSUCC 1.19E-09 bounded Not Not bounded H3L2SISUCC 9.80E-10 bounded Not Not bounded H2L3SISUCC 5.39E-10 bounded Not Not bounded H3L2SOSUCC 1.25E-10 bounded Not Not bounded H2L3SOSUCC 6.95E-1 1 bounded Not Not bounded HOL3S2SUCC 5.90E-1 1 bounded Not Not bounded HOL1S1SUCC 3.36E-11 bounded Not Not bounded HOL2SISUCC 1.98E-1 1 bounded Page 31 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table 9-1 Frequency of Success Sequence Pump Combination States; No Impact of Break Location (Continued)

Contribution from MLOCA and LLOCAs Only; Model GSI-191 PRA; MFF=G191MC (Continued)

I Bounding Bounding Secure One Spray Pump Early Case for Case for Only (OSI=S and OFFS=F)

Strainer Vessel Failure Failure I

I Total:

Frequency Not bounded Not bounded HOL2S2SUCC I1.57E-1 1 Not Not bounded H3LISISUCC 7.59E-12 bounded Not Not bounded H1L3S1SUCC 6.18E-12 bounded Not Not bounded H2L1SOSUCC 6.16E-12 bounded Not Not bounded HOL1SOSUCC 5.27E-12 bounded Not Not bounded H1L2SOSUCC 3.01E-12 bounded Not Not bounded H3L1SOSUCC 9.85E-13 bounded I

Not Not bounded HIL3SOSUCC 8.02E-13 bounded Not Not bounded bounded Not Not bounded bounded Not Not bounded bounded Not Not bounded bounded Not Not bounded bounded Page 32 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I Table 9-1 Frequency of Success Sequence Pump Combination States; No Impact of Break Location (Continued)

Contribution from MLOCA and LLOCAs Only; Model GSI-191 PRA; MFF=G191MC (Continued)

I Bounding Bounding Secure One Spray Pump Early Case for Case for Only (OSI=S and OFFS=F)

Strainer Vessel Failure Failure Total:

Frequency Not Not bounded bounded Not Not bounded bounded Not Not bounded bounded Not Not bounded bounded II Page 33 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 10 On the Slams of Containment Systems The GSI-1 91 PRA model incorporates the probabilities of sump blocking, fuel blockage, and boron precipitation as a function of the number and types of High Head Safety Injection (HHSI),

Low Head Safety Injection (LHSI), and containment spray pumps operating. The number of pumps operating both in the injection phase when debris in the containment is transported to the sumps and in the sump recirculation phase when the number of pumps operating determines the approach velocity at the sump strainers are of interest. The GSI-191 PRA model focuses on MLOCA and LLOCA events because only in those events is sump recirculation at issue and the containment spray pumps are expected to be actuated by a high containment pressure condition. For small LOCAs, the containment sprays are not actuated.

The status of three other containment system top events are questioned in the early response MLOCA event tree; i.e., purge line isolation (Top Event CP), smaller containment isolation lines (Top Event CI), and the response of the reactor containment fan coolers (Top Event CF).

Conceivably, these three top event states could impact the GSI-1 91 issues by changing the containment back pressure, or altering the sump pool temperatures during sump recirculation.

Table 10-1 provides the results of medium and large LOCA success sequence frequency contributions divided among sequence groups representing different states of these three top events plus a fourth top event appearing in the LTMLOCA event tree; i.e., RX which stands for component cooling to the RHR heat exchangers used to cool the sump. Only MLOCA or LLOCA sequences not already assigned to core damage in the absence of the GSI-191 phenomena are considered in these totals because only those sequences are candidates to be reassigned to core damage when the GSI-191 phenomena are considered. The values in Table 10-1 were generated using the event trees in model GSI-191 PRA with mean values collected in a Monte Carlo master frequency file (G1 91 MC). The sequence quantification cutoff selected was lx10 1 4 per year.

Table 10-1 shows that the by far the most likely outcome of the containment function top events is that all are successful; i.e., that the purge line (CP=S) and smaller containment penetrations (CI=S) all isolate, that at least 2 of the 6 containment fan coolers operate to remove decay heat from the containment (CF=S) and that component cooling water is available to the RHR heat exchangers (RX=S). Therefore, this state of the containment systems is generally assumed in CASA GRANDE when developing the GSI-191 issue failure probabilities.

The second ranked containment system function success state involves failure of smaller containment isolation lines (CI=F) and success of both the purge lines to isolate (CP=S) and of the fan coolers to function (CF=S). By far the largest contributor to small containment isolation failure is that of a pre-existing containment leak; i.e., 98.6%per the STP PRA evaluation of Top Event Cl. Such leaks are too small to affect the containment response in any measureable way.

For other containment isolation failures (i.e., 1.4% of the total failure probability) yet still less than equivalent 3-inch diameter lines that fail to isolate (i.e., excluding pre-existing leaks), the frequency is then only 1.6x10-8 year; (i.e.,1.1 x10 6 x.014=1.6 x10-8 per year). This frequency is already just a fraction of the success state frequency from medium and large LOCA, and of the core damage frequency from these events. Also, such small size containment isolation failures are not expected to significantly impact the containment response.

Page 34 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 The next containment function state (SRXF) considers the failure of component cooling to any of the RHR heat exchangers through which a LHSI pump is operating in the sump recirculation mode and injecting into the RCS. Since these sequences still successfully avoid core damage, for this containment state at least one LHSI pump must be operating in the recirculation mode injecting through an intact loop into the RCS, and two or more containment fan coolers are being relied on to provide containment and sump water cooling. Since at least two containment fan coolers are successful, not all three trains of component cooling water are failed. The frequency of such sequences is only 1.55x1 07 per year which is less than 0.1% of the total success bin frequency. Consequently, the impact of such sequences relying on the containment fan coolers for heat removal is small. Further, since the containment fan coolers also depend on component cooling water, the most likely success sequences of this type involve loss of component cooling water to one train of RHR (whose LHSI pump train still successfully injects sump water to the RCS), maintenance on a second ECCS train (i.e., maintenance assumed to also fail that same train of CCW), and failure of the third LHSI train to inject to the RCS because of losing flow out the break. RCS injection by the LHSI train which loses RHR cooling still protects the core so long as the sump temperatures are limited by the fan coolers. The point is that the third LHSI train whose flow is diverted through the break is still cooling the sump water since its train has not lost CCW to the RHR heat exchanger. While such sequences are conservatively counted in the above total for SRXF, the actual frequency in which only the fan coolers are providing cooling is even lower.

The next most likely containment state is when the containment is completely isolated but at least two fan coolers do not operate to provide containment heat removal; i.e. bin SCPSCISCF.

Recall that since sequences in this bin are successful, decay heat removal via the RHR heat exchangers operating in sump recirculation must be successful. Since the frequency of this containment system state is just less than 1x10-8 per year (i.e., a fraction of the core damage frequency) and the presence of one to three trains of RHR decay heat removal is assured, the impact of success sequences involving loss of all fan coolers on the sump pool temperatures is judged to be of low significance.

Page 35 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I The final two ranked containment system states involve failure of both small containment isolation along with failure of the fan coolers (i.e., CI=F and CF=F) or failure of the large purge line to successfully isolate (CP=F). These two states are each of such low frequency that they cannot significantly impact the assessment of GSI-191 issues.

Table 10-1 Containment Function States within Success Bin (results do not include GSI-191 effects)

BINS (Quantified)*

Bin Summary Description SCPSCISCFS 2.81 E-04 CP,CI,CF=S AND SEQUENCE SUCCESS SCPSCIFCFS 1.12E-06 CI=FAILED AND SEQUENCE SUCCESS MELT 1.60E-07 MELT SEQUENCES SRXF 1.55E-07 RX=FAILED WITH SEQUENCE SUCCESS SCPSCISCFF 9.88E-09 CF=FAILED AND SEQUENCE SUCCESS SCPSCIFCFF 3.59E-1 1 CI=FAILED*CF=FAILED AND SEQUENCE SUCCESS SCPF 1.56E-1 1 CP=F and SEQUENCE SUCCESS SUCC 2.82E-04 TOTAL MLOCA AND LLOCA SUCCESS FREQUENCY

- I ne quantiTication was performed assuming an individual sequence cutoff Of 1 E-14 per year Page 36 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 11 On the Frequency of Success States Involving Different Initiators and Numbers of LHSI Pumps Operating The STP PRA considers a large number of internal initiating events many of which may result in successful sump recirculation as a means of successfully avoiding core damage. In support of the GSI-191 project, a summary of these sequences is provided in Table 11-1. Frequencies of successful sump recirculation are provided for the following categories:

" RCP Seal LOCAs Isolable Smalls LOCAs (pressurizer power operated relief valve [PORV] path)

" Small LOCAs (not isolable)

Medium LOCAs Feed and Bleed Sequences

" Large LOCAs Steamline Breaks inside Containment Leading to Need for Sump Recirculation Unisolated Letdown Line ATWS (successful recirculation following ATWS)

Many different initiating events can contribute to specific categories above; e.g., feed and bleed sequences resulting in successful sump recirculation can occur from any of a number of initiating events. The sequence group feature of RISKMANTM was used to define the sequence logic that would identify those sequences that are members of one of the above categories, involve sump recirculation, and end in successful sump recirculation. As an example, for the category feed and bleed; the sequence logic must satisfy OB=S*N2=S where Top Event OB=S represents successful feed and bleed cooling, Top Event N2=S, means the sequence requires recirculation from the sump, and the sequence must eventually be mapped to the SUCCESS end state instead of to a core damage state. Similar logic is used for all the above groups.

Note that some of the above sequence group frequencies may overlap. For example, feed and bleed sequences or RCP seal LOCAs may be initiated by sequences that begin with steam line breaks inside containment. Steam line breaks inside containment may lead to pressurizer PORV challenges caused by a safety injection signal and resulting high head safety injection pumps actuating in response to the RCS overcooling. At other PWRs. the pressurizer PORVs may be challenged because the mass addition causes RCS pressure relief prior to termination of the safety injection. However, at STP this is not the case because the HHSI pumps have a shutoff head of approximately 1,500 psi. It is still possible that the mass addition would eventually lead to RCS overpressure as the RCS gradually heats up, but this occurs much more Page 37 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 slowly, providing ample time for operator intervention at STP. The STP PRA assumes that such steam line breaks would not cause a pressurizer PORV challenge. Instead the sump recirculation sequences initiated by steam line breaks inside containment at STP occur due to subsequent RCP seal LOCAs or, if auxiliary feedwater fails, then successful feed and bleed cooling.

The sequence group categories listed above and in Table 11-1 are sorted in decreasing order of successful sump recirculation frequency. These are the groups of sequences that can potentially transfer to core damage when the GSI-191 phenomena are considered; e.g., sump plugging, air ingress, fuel flow blockage, etc. These results were mostly obtained from the Revision 7.1 STP PRA model using point estimate split fraction values and a quantification cutoff of 1.0x1 014 per year. The medium (MLOCA) and large LOCA (LLOCA) sequence group frequencies were evaluated from a revised model developed to support the GSI-191 project.

The MLOCA and LLOCA initiators were given special consideration since they are the focus of the GSI-191 project. The STP PRA model was restructured to allow the status of all nine ECCS pumps to be tracked in each sequence. Further, the RCS break sizes for these two initiators are large enough that even though a LHSI pump may be operating in the sump recirculation mode, the pump flow may not be injected into the RCS. Rather, it may be diverted out the break in the broken loop to containment, never entering the reactor vessel. To evaluate the potential for GSI-191 phenomena, the total pump flow from the sump is most important consideration, whether or not the pump flow is injected into the RCS. Therefore, the frequencies provided in Table 11-1 are for trains of LHSI operating even if flow from one of the pumps is diverted out the break. The MLOCA and LLOCA results in Table 11-1 were obtained from the restructured STP PRA model and quantified with split fractions derived from Monte Carlo means and a sequence quantification cutoff of 1.0x1 0-14 per reactor year.

Table 11-1 also breaks down the contribution to these category frequencies as to whether there is one, two, or three trains of LHSI pumps operating in the sump recirculation mode. Logic was appended to the total category frequency logic in order to collect the results by number of LHSI pump trains operating. For example, the logic for three trains of LHSI pumps operating that must be satisfied to map the sequence to three trains operating would be LA=S*LB=S*LC=S where the Top Events LA, LB, and LC represent the three trains of LHSI pumps in the STP PRA. Generally more than 95% of the total sequence group frequency involves successful operation of all three LHSI pumps and the frequency of just one LHSI pump operating is a tiny

(-0.001) fraction of the total sequence group frequency.

Page 38 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table 11-1 Revision 7.1 Sequence Group Frequencies Involving Sump Recirculation GROUP ID FREQUENCY (PER SEQUENCE GROUP DESCRIPTION, ALL REACTOR YEAR)

MAPPED TO SUCCESS END STATES SE 2.48E-03 RCP SEAL LOCA SE1 2.42E-05 1 TRAIN LHSI=S, RCP SEAL LOCA SE2 3.89E-04 2 TRAINS LHSI=S, RCP SEAL LOCA SE3 2.05E-03 3 TRAINS LHSI=S, RCP SEAL LOCA ILOCA 8.40E-04 ISOLABLE SMALL LOCA, ISOLATION NOT CREDITED FOR SUCCESS SEQUENCES ILOCA1 5.46E-07 1 TRAIN LHSI -ISOLABLE SMALL LOCA ILOCA2 3.86E-05 2 TRAINS LHSI=S,ISOLABLE SMALL LOCA ILOCA3 7.96E-04 3 TRAINS LHSI=S,ISOLABLE SMALL LOCA SLOCA 3.28E-04 SMALL LOCA SLOCAl 2.12E-07 1 TRAIN LHSI=S, SMALL LOCA SLOCA2 1.50E-05 2 TRAINS LHSI=S, SMALL LOCA SLOCA3 3.1OE-04 3 TRAINS LHSI=S, SMALL LOCA PR 1.05E-05 NON-ISOLABLE PORV LOCA - CREDIT FOR BLOCK VALVE CLOSURE TAKEN PR1 2.33E-07 1 TRAIN LHSI=S, NON-ISOLABLE PORV LOCA-CREDIT FOR BLOCK VALVE CLOSURE TAKEN PR2 2.67E-06 2 TRAINS LHSI=S, NON-ISOLABLE PORV LOCA-CREDIT FOR BLOCK VALVE CLOSURE TAKEN PR3 7.50E-06 3 TRAINS LHSI=S, NON-ISOLABLE PORV LOCA-CREDIT FOR BLOCK VALVE CLOSURE TAKEN MLOCA 2.78E-04 MEDIUM LOCA MLOCA1 1.33E-07 1 TRAIN LHSI=S, MEDIUM LOCA MLOCA2 8.56E-06 2 TRAINS LHSI=S, MEDIUM LOCA MLOCA3 2.65E-04 3 TRAINS LHSI=S, MEDIUM LOCA OB 5.08E-06 FEED AND BLEED OB1 5.31 E-09 1 TRAIN LHSI=S, FEED AND BLEED OB2 2.29E-07 2 TRAINS LHSI=S, FEED AND BLEED OB3 4.84E-06 3 TRAINS LHSI=S, FEED AND BLEED Page 39 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table 11-1 Revision 7.1 Sequence Group Frequencies Involving Sump Recirculation (Continued)

GROUP ID FREQUENCY (PER SEQUENCE GROUP DESCRIPTION, ALL REACTOR YEAR)

MAPPED TO SUCCESS END STATES LLOCA 4.67E-06 LARGE LOCA LLOCA1 0.OOE+00 1 TRAIN LHSI=S, LARGE LOCA LLOCA2 1.62E-07 2 TRAINS LHSI=S, LARGE LOCA LLOCA3 4.51 E-06 3 TRAINS LHSI=S, LARGE LOCA SLBI 1.18E-07 STEAMLINE BREAKS INISDE CONTAINMENT SLBI1 1.05E-11 1 TRAIN LHSI=S, STEAMLINE BREAK INSIDE CONTAINMENT SLBI2 6.78E-09 2 TRAINS LHSI=S, STEAMLINE BREAK INSIDE CONTAINMENT SLBI3 1.11E-07 3 TRAINS LHSI=S, STEAMLINE BREAK INSIDE CONTAINMENT LI 8.05E-09 LETDOWN UNISOLATED LI1 7.50E-09 1 TRAIN LHSI=S, LETDOWN UNISOLATED L12 4.14E-10 2 TRAINS LHSI=S, LETDOWN UNISOLATED L13 1.34E-10 3 TRAINS LHSI=S, LETDOWN UNISOLATED ATWSRECIRC 1.01E-09 ATWS SUCCESS ATWSRRC1 0.OOE+00 ATWS SUCCESS 1 TRAIN RECIRCULATION ATWSRRC2 7.88E-1 1 ATWS SUCCESS 3 TRAIN RECIRCULATION ATWSRRC3 9.28E-10 ATWS SUCCESS 1 TRAIN RECIRCULATION Page 40 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSII91-V02 Revision 1 12 On the Consideration of Different Hazard Groups A nuclear power plant can experience a broad range of initiating events. Simply speaking, an initiating involves any potential occurrence that could disrupt plant operations to a degree that a response by the plant and/or the operating staff is required to avoid an undesired outcome. For the undesired outcomes of core damage or large early release and with the plant originally producing power, an initiating event would cause disruption of power production. Successful mitigation would require managing power production (for example, tripping the reactor),

pressure control (for example, operation of safety valves), inventory control (for example, use of safety injection) and heat removal (for example, use of auxiliary feedwater with atmospheric dump).

Initiating events, or initiators, can be characterized as originating from two hazard groups:

internal hazards and external hazards.

This section describes how each hazard group in Reference 6 has been considered in the evaluation of GSI-191 phenomena at STP.

Internal hazards include system failures or phenomena that originate within the plant. Internal initiators can further be characterized as internal events, internal plant fires and internal plant flooding.

External hazards include those phenomena that originate outside of the plant. Examples include external flooding, external fires, seismic events, extreme metrological events, landslide, tsunami, and aircraft crash. The consideration of external hazards begins with the characterization of the hazard potential and frequency and proceeds, if the hazard potential and frequency are found to warrant further analysis, to the direct plant impact due to realization of the hazard. That damage is then combined with the plant response model resulting in an integrated understanding of the impact of the external event.

The PRA can be thought of as an organized set of scenarios. Each scenario begins with an initiating event includes a representation of the response of the plant and operators to that initiating event. The identification of relevant PRA elements therefore begins with a consideration of the initiators included in the PRA.

Selection criteria are established to characterize the PRA scenarios. The scenarios of interest in an evaluation of GSI-191 must meet four criteria:

1. The scenario response model for the initiator includes taking credit for recirculation to provide core cooling.

2. The scenario involves the potential to liberate a significant amount of insulation inside primary containment.

3. The scenario includes a mechanism that transports the liberated insulation debris to the sump(s).

Page 41 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1

4. In the absence of GSI-1 91 phenomena, the scenario would have been evaluated as successfully terminated.

A plant-specific evaluation is necessary in the evaluation of the PRA against these criteria. This evaluation is done for both internal and external hazards.

12.1 Internal Hazards (Part 2 of Reference 6)

Initiating events belonging to the internal hazard group include internal events, internal flooding, and internal fires.

12.1.1 Internal Events The internal events that are explicitly considered in the STP PRA are:

1. RCP Seal LOCA

2. Very Small LOCA

3. Non-Isolable Small LOCA

4. Isolable Small LOCA

5. Open SRV (one)

6. Open SRV (two or more)

7. Medium LOCA

8. Large LOCA

9. Steam Line Break inside Containment

10. Steam Line Break outside Containment

11. Other LOCAs

12. Other Transient Initiators Including Support System Failure Initiators The last item listed is not strictly speaking an initiator. What this item represents is the collection of transient initiators, such as loss of feedwater or loss of offsite power, which includes feed-and-bleed as a potential success path, or results in a transient induced LOCA that requires recirculation from the containment sump. The frequency of these initiators leading to scenarios involving successful sump recirculation are presented in Section 11.

Initiators 1 through 5 involve modest openings in the primary system. These events do not meet the Necessary Criteria 2 and 3. Groups 1 through 4 result in only a modest amount of Page 42 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I insulating material being liberated (with the amount associated with Group 1 small). Small and very small LOCAs, by definition, do not result in spray initiation, so they lack a mechanism to transport material to the sump. Initiators 5 and 6 involve the opening of pressurizer SRVs. One SRV opening is equivalent to a small LOCA, so the above argument holds for this group also.

In other words, Necessary Conditions 2 and 3 are not satisfied for Initiator 5. In addition, engineering analysis indicates that the location of the SRVs is such that a relatively small amount of target insulation is found near the SRVs. This would mean that Necessary Condition 2 is not met for either Initiator 5 or 6. In summary, Initiators 1 through 6 do not result in conditions necessary to result in GSI-191 phenomena.

Initiators 7 and 8 (medium and large LOCAs) involve plant responses that potentially meet all three necessary conditions. These initiators are therefore retained for further evaluation.

Initiators 9 through 12 include consideration of sump recirculation for those sequences involving feed-and-bleed, RCP seal LOCAs do to loss of seal cooling, or a stuck open PORV whose flow is directed to the PRT which eventually overpressurizes. In the same way that Group 1, RCP seal LOCA initiators were screened, so are the transient induced seal LOCA from Initiators 9 through 12. For feed-and-bleed and stuck open PORV scenarios, engineering assessments indicate that little insulation material is found in the vicinity of the pressurizer relief tank (PRT) rupture disk, so that little material would be made available to potentially be transported to the containment sumps (Necessary Condition 2). In addition, the containment sprays will not actuate for Initiators 10, 11, and 12 so that no transport mechanism will be available to transport any liberated material to the sumps (Necessary Condition 3). Initiators 9 through 11 are screened from further evaluation at STP as they do not meet Necessary Conditions 2 and 3.

Initiator Groups 9 through 11 do not result in conditions necessary to result in GSI-191 phenomena. In addition, at STP, the high head injection pump shutoff head is below the pressure necessary to inadvertently open the PORV, reducing the likelihood of inducing a stuck open PORV.

Initiator 11 considers other LOCAs inside containment. At STP, the RHR system is wholly within containment, so that under the very unlikely conditions of an interfacing system pressurization, the RHR piping could become overpressurized. The consequences of this unlikely scenario are bounded by the scenarios explicitly considered.

So, from the point of view of potentially meeting the three requirements for enabling GSI-191 phenomena, only medium and large LOCAs are retained from the internal events group of initiators for further evaluation.

12.1.2 Internal Plant Fires (Part 4 of Reference 6)

No internal fires were identified that lead directly to a loss of primary coolant. Fire induced transients leading to opening of the pressurizer PORV or reactor vessel head vents, or any of the transient induced LOCAs defined in Initiator Group 12 - other transient initiators, including support system failure initiators, are, in principle, possible. The same arguments discussed above for internal events also apply to these. These scenarios are screened from further consideration because they do not meet Necessary Conditions 2 and 3. Further consideration of internal fires with respect to GSI-1 91 phenomena is therefore not warranted.

Page 43 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSIl 191 -V02 Revision 1 12.1.3 Internal Plant Floods (Part 3 of Reference 6)

Internal flooding represents a hazard that, as far as GSI-191 phenomena are concerned, is identical to Initiator Group 12 - other transients or support system failures. Similar to the arguments for internal plant fires, internal flooding scenarios are screened from further consideration because they do not meet Necessary Conditions 2 and 3.

12.2 External Hazards (Parts 5, 7, 8, and 9 of Reference 6)

The STP PRA evaluated a spectrum of external hazards and screened them for inclusion in the quantitative analysis. Most were screened from further analysis. Others, such as high winds, cannot result directly in primary system leaks and so they do not meet Necessary Conditions 2 and 3.

For seismic events, a common, perhaps conservative, assumption is that for even modest accelerations, one or more instrument tubes may fail resulting in the equivalent of a very small LOCA. This family of seismic scenarios is screened based on failure to meet Necessary Conditions 2 and 3. The robust nature of the primary system, all Class I, makes other seismically induced LOCAs requiring sump recirculation (i.e., equivalent to medium or large LOCAs) very unlikely. Such LOCAs are of very small frequency. In addition, while small, medium or large LOCAs are possible at sufficiently high accelerations, the common PRA assumption is that redundant components are fully correlated. Under this assumption, for example, a medium LOCA on one primary loop would be assumed to be accompanied by medium LOCA on all other loops. The result is that seismically induced medium and large LOCAs are modeled as being excessive LOCAs-which have no success sequences by definition. Since the goal of the risk-informed GSI-191 effort is to evaluate the frequency of scenarios, otherwise identified as successfully terminated, that fail due to GSI-191 phenomena, then Necessary Criteria 4 is not met, as these scenarios would be mapped to failure.

For modest accelerations, the bounding assumption of a small or very small LOCA does not trigger GSI-1 91 phenomena as they would not meet Necessary Criteria 2 or 3. Scenarios involving larger accelerations are of very small frequency.

12.3 Conclusion Medium and large LOCAs from internal events only are retained for further consideration with respect to core damage resulting from GSI-191 phenomena.

Page 44 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191-V02 Revision 1 13 On the Disposition of Findings and Observations from Peer Review Reference 6 documents the status of the findings and observations identified for the STP PRA.

Reference 6 documents the response to RAIs associated with STP's proposed risk managed technical specifications. All but three findings and observations were determined to be closed.

The three not fully closed were determined not to be relevant to the STP risk managed technical specification submittal. These three have been determined also not to be relevant to the risk-informed resolution of GSI-191.

Table 2 from Reference 7 is reproduced below.

Page 45 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1

.F&O.

LIEVEL.OQ 055 TEX Is HR-06 A

There is no process developed in the HRA to perform a systematic There is no documented process, however part of model signoff is a Closed examination of dependent human actions, credited on individual review of PRA accident sequences to ensure that they accurately sequences.

reflect the plant and that no errors such as this finding describe exist.

As part of the risk ranking, sensitivity analysis on operator actions arE Current HRA practices generally require a systematic process to identify, also performed and are described in the risk ranking procedure.

assess and adjust dependencies between multiple human errors in the Selected sequences (down to 1E-11) were re-reviewed as a result of same sequence, including those in the initiating events, this finding, and no instances of linked operator actions that are not accurately quantified could be found. STP accident sequences are dominated (>90%) by single operator actions with equipment failure or multiple (e.g., common cause) equipment failures.

The Revision 5 PRA model HRA notebook provides the necessary guidelines to perform a dependency analysis of human actions contained in the STP accident sequences.

B, limited review of the INEEL database for diesel generators and DA-01B The common cause MGL parameters are based on outdated generic data, -heck valves was performed. No significant changes were identified Closed available at the time of the IPE. The common cause analysis included plan 'or the current diesel generator common cause factors given the specific screening of generic common cause events and mapping to plant "actors currently in use. The check valve review indicated that the specific system sizes, but does not include any plant specific collection of ractice of not modeling common cause failure of fresh water check common cause data.

/alves is valid. Based on this review, the INEEL database was not reviewed for the STPREV4 update. A complete review of the NEEL common cause failure (CCF) database has been completed i upport of the Revision 5 PRA model. No change to the STP MGL arameters was required.

A previous review of common cause factors for motor-operated valves was completed for the STP_1996 model.

Page 46 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GS 19 1 -V02 Revision 1 F&.0 055 ID)

ILEVIEL*-. OF SIGNI4FICANCE OBS0TE'XT".

-PANT*RESPONSE

'S2AAýTqS DA-03 B

There is no specific guidance document developed for the data analysis.

In general, generic data sources have not been used for data update Closed The data analysis notebook and IPE data analysis sections provide since the original IPE. Operating experience data is reviewed for guidance for the data analysis. But, the component boundaries were not every model update and a decision on update based on plant defined, the method used for plant data collection and analysis was not operating experience is made. Initiating event data update for described, and the generic data sources used for the 1999 model update STP 1999 used the latest NRC NUREG on initiating event were not presented in the notebook.

frequencies for data update as described in the IE notebook. As generic sources are published (such as the IE data), they are reviewed for inclusion in the PRA as part of the model update process. As a generic source is identified, a tracking CR is generated under an update CR to review the data for applicability to the current or next PRA model. General component boundaries for use in data collection have been developed and are contained in the STPREV5 Data notebook.

HR-07 B

It is not apparent that the use of sequence timing in the development of Sequence timing is included in all plant specific operator response Closed HEPs is done. The HEPs were based on operator interviews, for which actions in the PRA. The time availabilities listed on each HRA the input and output information is not available for this review. The worksheet. This time is based upon the identified need for the action available documentation for sequence timing is simplistic. The reference (a cue, plant conditions, etc.) and the time to damage once the for the timing is not stated. Whether the "available time" was subdivided condition occurs. For example, feed and bleed is based upon the into fractions for diagnosis, action, and execution is not documented in the time available once steam generator low level occurs until the steam analysis. The time for the first "cue" is not stated. The only available data generator inventory is essentially gone (dryout). The worst case time is the time from reactor trip to the time of the undesired event, is used in almost all cases. Loss of offsite power recovery uses time of failure modeling (e.g., for EDGs). The Rev. 5 HRA update provides detailed timing information.

QU-02 B

The Level 1 quantification summary document provides the top Additional sequence detail has included in the Revision 4 update.

Closed sequences and the contribution to CDF from individual initiators and Numerous sensitivity studies are performed and documented to initiator groups. It also provides a comparison of results between the support GQA risk ranking.

current model and the previous version of the PRA model.

The summary document does not, however, provide any sensitivity analyses for the PRA model.

Further, textual descriptions are provided in the summary for only a few of the top sequences and should be included for more of the important sequences.

The above are important aspects to examine in order to gain a full understanding of the results.

Page 47 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSII91-V02 Revision 1 F&O OBS ID LEVEL 0F SIGNIFICANCE OBS TEXT IPPLA-NT RE~l.OPN§E STATUS QU-03 B

Uncertainty analysis was performed by using RISKMAN. The statistical Key sources of uncertainty have been identified and selected Closed parameters such as mean, variance and 5th, 50th and 95th percentile sensitivity studies to bound these assumptions are described in the were calculated (CNAQ 01-17305-1, Uncertainty Analysis for STP 1999).

Uncertainty Analysis notebook.

Five sensitivity studies were performed and the results were documented (OPGP01-ZA-0304, PSA Risk Ranking Sensitivity Study).

However, there is no evidence that the causes of uncertainty in the model (e.g., associated with data, modeling assumptions, success criteria analyses, etc.) were studied and were linked to the sensitivity analysis ST-01 B

The ISLOCA analysis does not consider probabilistic failure of pipes and There is a misunderstanding the South Texas interfacing systems Closed other components.

LOCA model. The STP RHR system is contained entirely within the containment building. Any failure of the RHR piping within the The fault tree includes "success events" for the rupture of the RHR HX containment building with a concurrent overpressure event from the tubes or the RHR pump seals. The assumption is that failure of the RHR RCS will result in a LOCA inside containment. For this reason, seals or RHR HX will relieve pressure in the system thus preventing the failure of the RHR piping is not considered. This event is similar to ISLOCA pipe failure. This is not substantiated and may be not true. The the LOCAs already modeled and not included in the interfacing pressure relief provided by these failure paths are not sufficient to reduce systems LOCA analysis.

pressure in the event of the complete check valve failure.

An interfacing system LOCA at STP that results in a containment Probability of pipe rupture should address the design margins in the pipe, bypass can only result from an RCS pressure boundary failure AND:

as indicated in NUREG/CR-5102 and other documents.

1: Failure of RHR heat exchanger tubes such that the overpressure event carries over into the CCW system, or; 2. Failure of the The method used in the PRA increases the probability of certain valve containment isolation check valves for the LHSI trains. The most failures by a factor of 10 to account for the higher pressure. No basis or likely scenario quantified is the failure of the RHR heat exchanger ustification for this approach is provided.

tubes with consequential failure of the CCW system outside containment with failure of the operator to isolate. Operator action to isolate the CCW system after tube failure (value equal to 0.1) or isolation of the LHSI piping after piping failure is considered in the model. Failure of the RHR heat exchanger tubes serves to direct an interfacing systems LOCA to the CCW system. Success of the heat exchanger tubes challenges the LHSI piping.

Page 48 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 F&O OBS ID LEVEL'OV SIlGkNIFICA$t OBS TEXT PLANT7RESpONSE STATUS SY-06 B

Justification for not modeling Power Conversion System (PCS) (Main Justification for not crediting PCS should be added to the STPREV Modeling issue Feedwater, Condensate, and steam dump to the condenser) was not General Transient notebook. PCS does not significantly reduce core is closed.

provided. It is not typical among other similar PWR PRAs to have damage frequency at STP based on a sensitivity study.

Update of excluded the PCS from the scope of modeled systems.

notebook remains, but is not required for RMTS.

S-03 C

Reactor trip is not modeled for several of the initiating events, including the At a high level, the likelihood of reactor trip failure and MLOCA Closed SGTR and MLOCA. In the case of the SGTR initiating event, this has occurrence is approximately 1E-10. With successful safety injection, been identified as an open item in the SGTR Notebook documentation no core damage would be expected. Based on frequency, inclusion (page v of FNTLSGTR.DOC, Rev. 1, 4/30/97). However, in the case of of reactor trip failure (ATWS) in Medium LOCA is not necessary.

the MLOCA, no justification for its deletion is provided. Generic analyses Inclusion of reactor trip failure for other LOCA initiating events is still have shown that trip is required at the lower end of the medium LOCA under review, but reactor trip failure during LOCAs would not be risk break range, especially for the case of MLOCA without auxiliary feedwater significant because of the low frequency of occurrence. Reactor trip available because the amount of borated RWST water that can be was added to SLOCA and SGTR event trees in the Revision 5 PRA injected into the RCS is limited.

model update.

DA-04 C

Although generic and plant specific databases are available for use, the Creating a direct link to data used in the original IPE for select Closed data sources used for the generic database is not easily traceable. The variables has been noted in past updates. In general, the data in the generic data used for the Bayesian update in the current model update current PRA is based on an extensive data update for the 1994 has been updated few times since the first PRA model was developed, model update and is documented in that data notebook. Since the 1996 update, the link to data is documented in the data analysis notebook and also noted in the PRA data module.

HR-0l C

Pre-initiator operator errors are included in the model and the method for The screening method currently in use is not described well in the Closed quantifying these error rates is sufficiently documented in the IPE.

documentation. In general, each system notebook contains a review However, there is no written evidence of a systematic approach for of all plant procedures with a potential to affect the system as identifying which pre-initiator errors to include in the model, modeled in the PRA. The effect of the procedure is identified during the review and modeled as appropriate (see the AFW system).

Potential miscalibration for actuation systems is included in the reactor protection notebook. Miscalibration of individual sensors is implicitly included in the component failure rate if applicable. The HRA update process for STPREV5 includes a complete pre-initiato analysis.

Page 49 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I F&O LEVEL OF OBS ID I SIGNIFICANCE ".

OBS TEXT

-ý PLANZR~EONQM§E

,STATUPS SY-01 C

Formal guidance describing the current process for updating and revising The current STP fault tree models and system notebooks are used tc Partial fault trees was not found. In addition, guidance for generic modeling train new PRA engineers. As part of the training cycle, new assumptions (e.g., when to model diversion flow paths), naming engineers are given responsibility for several of the system model Remaining conventions or standard component failure modes was not found.

notebooks and associated documentation. However, the suggestion action to is well founded in that a guide for new and recently qualified PRA develop engineers will ensure consistent standards for fault tree models.

guidance does System modeling guidance is expected to be complete prior to the not affect next PRA model update.

implementatior of RMTS SY-03 C

Simplified schematics (piping & instrumentation diagrams) of systems P&lDs were included with the model up until Revision 3 (STP 1999). Closed showing system boundaries were not found during the review.

Given the flexibility of LAN access to P&IDs, etc, and concerns abou maintaining marked-up drawings current, these drawing were removed from the system notebooks. The descriptions in the notebooks concerning boundaries are sufficient for a qualified reviewer/analyst to mark up the P&IDs if necessary. P&ID references are contained in the PRA system notebooks.

SY-05 C

No evidence was found that operating experience with each system was Operating experience review is incorporated in the GOA process. A Closed reviewed to ensure that important system characteristics were modeled PRA member is also a member of the GQA working group. Actual appropriately.

review experience indicates questions concerning operating experience effects on the PRA model is being incorporated into the changes are reviewed for impact on system model. The Database o Inputs provides the evidence of operating experience review.

TH-02 C

The IPE system notebooks include reference to room heat-up analyses Added as an action for the REV 5 model Open that were performed using an STP code called HEATUP. No documentation of this code was available for the peer review. The Documentation HEATUP analyses appear to still be the basis for the current PRA room issue with no cooling modeling decisions for some rooms. If this is the case, the impact to analyses, including documentation of the HEATUP code capabilities and implementatior limitations, should be retrieved and retained with the PRA documentation.

of RMTS.

Page 50 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I F&O LEVEL-OF OBSID SIGNIFIC;ANCEI L

OBS TEXT PL*

ANT RESPONSE..

STATUS SY-04 D

No evidence that a search for plant specific failure modes was performed A guidance document for reviewing MR failures is not necessary.

Closed for PRA updates subsequent to the IPE. STP PRA staff indicates that The PRA staff sits on the MR expert panel and reviews all MR feedback from Maintenance Rule operating experience has been factored failures for inclusion in the PRA. Each failure is coded as PSAFF (a into the PRA as a means of capturing plant-specific failures.

PSA functional failure), kept for general PRA data update, or not applicable to PRA. Given the emphasis in the ASME standard on guidance documents, and the expectation for qualifying new data analysts, guidance for data analysis has been added to the Rev. 5 data notebook.

Page 51 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSII91-V02 Revision I Appendix A: Detailed Description of Medium and Large LOCA Sequence Models A.1 Introduction The information regarding description of events and the Event Sequence Diagram were taken from the South Texas Project Electric Generating Station Level 2 Probabilistic Safety Assessment and Individual Plant Examination Revision 7.1. This information was then modified to describe the sequence logic for both the GSI-191 Base model (i.e., with GSI-191 assumed to lead to zero failures) and the GSI-191 model itself; i.e., with the GSI-191 phenomena considered. Both the base model and GSI-191 model contain the restructured event sequence models needed for the GSI-191 project. The Base model assumes the GSI-191 failure mechanisms to be set to zero probability of occurrence. The GSI-191 model is similar to the Base model, except that the added failure mechanisms specific to GSI-191 (e.g., sump plugging) have been incorporated specifically for the STP plant. The same RISKMAN model, GSI-191 PRA, is used to represent both the Base model and GSI-191 model. Model GSI-191 PRA is the same as Revision 7.1 of the STP model for all but the medium LOCA and large LOCA plant response models. The initiating event frequencies for the small LOCA, medium LOCA, and large LOCA initiating event frequencies have also been changed specifically for the GSI-191 project.

The event trees presented have been largely revised to identify the status of the High Head Safety Injection (HHSI), Low Head Safety Injection (LHSI), and containment spray pumps at the time of injection and sump recirculation for sequences that may be susceptible to GSI-191.

Further, the LOGIC of the medium LOCA event trees has been generalized to make the set also applicable to large LOCAs.

A.2 Medium LOCA Event Model Overview The medium LOCA initiating event applies to those reactor coolant system (RCS) pressure boundary breaks with blowdown rates equivalent to pipe breaks between approximately 2 and 6 inches in diameter. In support of the GSI-191 project, this model has been enhanced to enable it to also model large LOCAs; i.e., greater than 6 inches in diameter up to the double-ended guillotine breaks in the RCS loops. Selected inserts are provided to explain where model differences occur for large LOCAs.

The reactor coolant flowing through the break is sufficient to remove core decay heat without any additional cooling required via the steam generators. Therefore, the most important system function to be included in modeling plant response is an adequate supply of makeup flow to replace the coolant inventory lost through the break. In this range of ruptures, it is possible for two cases to occur. The break could be at the smaller end of the break spectrum where RCS pressure remains relatively high; e.g., a stuck-open pressurizer safety valve at a 2.3-inch diameter. In this case, RCS pressure could remain above the LHSI pump design pressure during the initial blowdown phase. Thus, successful accident mitigation requires operation of the HHSI pumps to account for those pipe breaks in the smaller medium LOCA range. For the larger size medium LOCA breaks, it is assumed that the event sequence would closely resemble the large break LOCA cases where rapid RCS depressurization occurs. In these Page 52 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I events, operation of the LHSI pumps is required to account for a situation in which HHSI makeup flow is limited by the HHSI pump run-out characteristics.

The HHSI system success criteria for medium LOCAs are bounded in the plant response model by requiring one of the three pump trains to deliver injection flow to an intact RCS loop. If the HHSI pumps cannot maintain adequate coolant inventory with the RCS at high pressure, operator actions may rapidly depressurize the RCS by overcooling the primary system with the steam generators. The rapid depressurization may enable RCS pressure to be reduced below the shutoff head of the LHSI pumps, which could then still provide sufficient RCS makeup.

However, for all medium LOCA sizes within the defined range, we conservatively require success of at least one HHSI pump for high pressure injection and omit credit for this rapid depressurization alternative. One of the three LHSI pump trains can provide adequate makeup flow for the full range of medium LOCA break sizes, if RCS pressure is reduced below approximately 250 psig. The centrifugal charging pumps alone are not modeled, since, by medium LOCA definition, they do not supply adequate RCS makeup; however, it is acknowledged that charging pumps could possibly be used in conjunction with HHSI and LHSI to control RCS inventory and pressure.

Once the medium LOCA initiating event occurs, pressurizer pressure quickly drops to the low pressurizer pressure setpoint, and a reactor trip signal would be generated at 1,870 psig. A safety injection (SI) signal will be generated when pressurizer pressure reaches 1,869 psig or when containment pressure reaches 3.0 psig, actuating all safety-related equipment. With pressurizer pressure and level dropping and containment pressure increasing, operator response for diagnosing the LOCA situation would occur early in the transient.

Also at this time, the SI actuation would isolate the main feedwater system as well as initiate auxiliary feedwater to provide steam generator makeup. Main steam isolation will occur as a result of a high-2 containment pressure condition at 3.0 psig. The reactor trip and the void formation from the blowdown phase would function to keep the reactor in a subcritical state, in addition to the borated injection water. Although the accumulators will inject when RCS pressure decreases below approximately 600 psig, the volume of water injected is not sufficient for long-term coolant inventory control. The effect of accumulator injection is to provide an intermediate makeup supply for limiting peak cladding temperatures during the transition from HHSI injection to LHSI injection. If the accumulators fail to inject, some transient fuel cladding damage may occur, but no significant fuel damage is expected before RCS pressure falls below 300 psig. For the purposes of medium LOCA quantification, failure of all accumulators is assumed to lead to core damage, regardless of the success of HHSI and LHSI functions. For large LOCAs, two of the three accumulators are required to inject into an intact loop, again regardless of the success of HHSI and LHSI functions.

Once RCS makeup is established, operator actions may be required to reduce RCS pressure below the LHSI design pressure for continued RCS makeup. If the break is small enough, RCS pressure remains above the LHSI shutoff head. Larger medium LOCAs and all large LOCA breaks are likely to cause rapid RCS depressurization so that LHSI can quickly inject.

Therefore, for large LOCAs, HHSI injection is not required for successful inventory control.

Successful sump recirculation requires the containment sump valves to open and the Residual Heat Removal (RHR) heat exchanger to be available for establishing long-term cooling. To account for the possibility that the RHR heat exchangers are not available to provide cooling to Page 53 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 at least one operating LHSI pump train, the Reactor Containment Fan Coolers (RCFC) are modeled to determine long-term cooling success as an alternative cooling mechanism to the RHR heat exchangers. Credit for the RCFCs to provide heat removal is assumed to still require at least one LHSI pump operating in the sump recirculation mode; i.e., operation of just one HHSI pump with no LHSI is assumed insufficient Normal steam generator cooling is not necessary in the medium LOCA event, since, by definition, core decay heat is removed by the medium LOCA break. Steam generator cooling is not modeled for medium LOCAs or large LOCAs.

The medium LOCA early tree also evaluates the status of containment isolation functions (Top Events CP for the purge lines and Cl for smaller, normally open containment isolation lines) and the reactor containment fan coolers (Top Event CF), for containment heat removal.

A.3 Medium LOCA Event Sequence Diagram The preceding paragraphs briefly describe the plant systems and operator responses after a medium LOCA, as generalized for a large LOCA event. Each event sequence ends in stable long-term recirculation cooling at low pressure or a core damage state. The following section briefly describes each event modeled in the generalized medium LOCA ESD, shown in Figure A.3-1. The event numbers correspond to the numbered event blocks in the original IPE Figure as modified to accommodate the changes for this study. The success criteria for each event block are provided in Table A.3.-1. This section has been modified for the GSI-191 project, both in substance and to generalize the ESD to apply to both medium and large LOCAs.

The events are described largely as they appear from left to right along the most likely success path on Page 1, and then continuing on Page 2. The remaining events on failure sequences are described at the end of A.3. The corresponding top events in the MLOCA event tree appear above the associated ESD events. ESD events without such top events are not modeled in the event trees. The generalized medium LOCA event tree has also been greatly modified from that in Revision 7.1 as discussed later on in Section A.4.

Event I - Reactor Trip. The first event block models the response of the reactor protection system to automatically shut down the reactor. Success from this block indicates that a sufficient number of control rods have been automatically inserted to bring the reactor to a subcritical state. Major pieces of equipment included in this event block are the analog trip signal transmitters, the reactor protection logic channels, the reactor trip breakers, the control rod drive mechanisms, and the control rods. For the medium and large LOCA initiating events, the major inputs to the reactor protection logic are generated from low pressurizer pressure and high containment pressure. Failure of this event block indicates that reactor trip has not occurred. Subsequent events along this failure path would be contained in the ESD for initiating events during which the reactor trip fails; i.e., Anticipated Transients without SCRAM (ATWS).

Event 2 - ESFAS. This event questions the engineered safety features actuation system (ESFAS) to diagnose the medium or large LOCA as a SI actuation condition and to generate the necessary control signals to ESF equipment. Major pieces of equipment included in this event block are the analog signal transmitters, the solid state protection system (SSPS), the ESFAS logic channels, and the master and slave relay circuits that Page 54 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 transmit the output actuation signals. The pressurizer low pressure signal is the primary input for a MLOCA or LLOCA initiating event. A containment high pressure signal is also expected after a short time delay. Failure of ESFAS requires the operators to manually initiate the SI signal (Event 3) and/or start injection and cooling water systems, and to manually isolate important containment penetrations. The ESF-generated safety injection signal causes the following isolations:

Turbine Trip. Implies that all signals and equipment (i.e., all turbine throttle valves and turbine governor valves close) necessary to shut off steam flow to the main turbine are successful.

Letdown Line Isolation. Implies that at least one of two letdown isolation valves closes upon receipt of the ESFAS signal.

Main Feedwater (MFW) Isolation. Valves close on medium LOCA as a result of reactor trip and Low Tavg setpoint being reached from the overall effects of feedwater flow characteristics and steam generator shrink.

Containment Isolation Phase A. All components and equipment assigned for Phase A isolation successfully isolate.

Containment Ventilation Isolation. All ventilation equipment assigned to isolate is successful.

Event 27. This event represents the automatic isolation of all normally open "large" containment penetrations (2_ 3-inch diameter) before or at the time of vessel failure. The containment penetrations of particular concern are the large containment supplementary purge lines. Success of this event implies that there is no immediate venting of fission products, and that the RCFCs are capable of removing heat and radioactivity from the containment atmosphere through the condensation process, while also preserving water inventory in the containment. Failure of this event implies there is an immediate venting of the fission products in the containment atmosphere. With at least one of the containment purge lines unisolated, the containment remains atmospheric limiting some of the margin for NPSH.

Event 28. This event models the automatic isolation of the containment penetrations that connect the containment atmosphere to the outside atmosphere, that are open before or at the time of reactor vessel failure, and have a flow area less than an equivalent 3-inch diameter hole. The penetrations explicitly considered in the analysis of this event include:

Containment Radiation Monitor Sampling Lines Pressurizer Relief Tank (PRT) Vent Line PRT Post-Accident Sampling Reactor Coolant Drain Tank (RCDT) Vent Line Page 55 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 RCDT to Liquid Waste Penetration Space (LWPS) Holdup Tank Flow Path Containment Normal Sump Drain Line Seal Return and Letdown Line Event 3 - Manual Safety Injection or Manual Start. This event block is associated with block 2 whenever ESFAS fails to generate a safety injection signal. Operator action to manually actuate safety injection or to manually start equipment required to mitigate the effects of a medium or large LOCA are modeled in the ESD for ESFAS failures.

Success of this block indicates that all necessary equipment starts and that isolation signals are available. The failure path from this block is mapped to early core damage, because neither HHSI nor LHSI flow is available to make up for the inventory lost through the medium or large LOCA.

Event 4 - MSIV Closure. This event tracks the signals to automatically close the main steam isolation valves (MSIV) after the reactor trip signals are generated from a potential high-high containment pressure condition. Success of this event block indicates that all four MSIVs close automatically in response to these signals. This isolates the steam generators from the main turbine and the steam dumps, and it decouples operation of these components from affecting subsequent plant cooldown. Failure of this event block indicates that at least two MSIVs remain open. The effects from this failure are bounded in the ESD by assigning the failure path to a condition where full-rated steam flow can be removed from each steam generator. If the MSIVs and either the main turbine fails to trip or the steam dumps stick open, an additional signal for automatic MSIV closure will be generated from low compensated steam line pressure. To keep the medium and large LOCA ESD logic structure as simple as possible, this additional signal has been conservatively omitted in the excessive secondary heat removal scenarios. Beginning in Revision 7.1 and included in the GSI-191 project model, the MSIV closure model has been expanded to include the possibility that one MSIV may fail to close and that the feedwater isolation and control bypass valves may both fail to close on that same line; i.e., leading to an excessive cooldown without requiring the failure to close of a second MSIV. The logic involving the MSIVs and feedwater isolation valves are now modeled in a separate Top Event SGI instead of as part of Top Event TT. Successful turbine trip (Block 5) and steam dump closure (Block 6) will also limit the cooldown from this added failure combination.

Event 5 - Turbine Trip. This block questions the response of the turbine trip mechanisms to provide the control signals to close all turbine throttle valves and turbine governor valves. Successful departure from this event block indicates that the turbine throttle valves and turbine governor valves or combinations of these valves have closed to isolate all four high pressure turbine steam inlet lines. Major pieces of equipment in this event block are the turbine trip logic circuitry, the turbine throttle valve and governor valve hydraulic pressure dump valves, and the high pressure turbine throttle and governor valves. The primary turbine trip signal is initiated from the open reactor trip breakers; however, several redundant turbine and generator trip signals are produced as Page 56 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 reactor power decreases. Failure of this block indicates that steam continues to flow through the main turbine. The impact from this failure is bounded in the medium and large LOCA ESD by a rapid cooldown condition in which full steam demand remains immediately after the reactor has tripped. In the event that turbine trip also fails following a large LOCA, the ESD transfers to Event Block 29. For medium LOCAs, the ESD instead first considers the potential for pressurized thermal shock conditions.

Event 6 - Steam Dump Closed. The medium or large LOCA break flow is sufficient to remove core decay heat. However, if RCS average temperature is above the no-load setpoint when the turbine trips, the steam dumps will receive an automatic signal to open. The steam dump control system will automatically reclose the valves when Tavg falls below the no-load setpoint. Success of Event Block 6 indicates that the steam dump valves successfully reclose (or remain closed) to limit RCS cooldown from steam flow to the main condenser. The success path models a condition in which RCS cooldown and depressurization are controlled by the medium or large LOCA break flow into the containment. Failure of this event block occurs if at least one steam dump valve sticks fully open. Since the MSIVs have failed to close in the scenarios where Event Block 6 is asked, the effects from steam dump failures are bounded in the medium or large LOCA ESD by assigning the failure path to a rapid overcooling condition. Although this condition is less severe than that caused by failure to trip the main turbine, the ESD logic structure is simplified by combining both overcooling scenarios.

Event 29 - Injection Common to LHSI and Accumulator. This event models questions whether the cold leg injection check valves S138A, S138B, and S138C are open. These valves are common to the LHSI, HHSI, and the RCS accumulators' injection flow paths. Success of this block indicates that the three valves are open and able to provide a pathway for their respective trains. In the event tree, a separate top event is used to represent each of the three injection paths. The failure path of this block is mapped directly to early core damage, because only insufficient amounts of water can be injected into the core. If containment spray also fails, the resulting plant damage state is designated as a "dry" condition because no water is injected into the containment sump from the HHSI, LHSI, or containment spray.

Event 30 - Accumulator Injection. The accumulators provide the initial injection into the RCS. This block contains the three accumulators in the ECCS. The accumulators each discharge into one of the RCS cold legs in loop A, B, or C. Success of this block, for a large LOCA, requires at least two of three accumulators inject into an intact RCS loop. Failure of this top event indicates two or more accumulators fail to inject into the RCS. For a medium LOCA, success requires just one of the three accumulators inject into an intact RCS loop. The failure path of this block is mapped directly to early core damage, because only insufficient amounts of water can be injected into the core. If containment spray also fails, the resulting plant damage state is designated as a "dry" condition because no water is injected into the containment sump from the HHSI, LHSI, or containment spray.

Event 8 - RWST/ECCS Common. The RWST provides the borated water supply for makeup to the RCS. The HHSI, LHSI, and containment spray pumps take suction from the RWST. This event block also includes the common suction piping and valves for Page 57 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 each train of the HHSI, LHSI, and containment spray pumps. Success of the block indicates that the RWST and the common equipment are available. The failure path from this block is mapped directly to early core damage, because no water can be injected into the RCS to make up for the inventory lost through the large LOCA break.

The resulting plant damage state is designated as a "dry" condition because no water is injected into the containment sump from the HHSI, LHSI, or containment spray.

Event 17 - Containment Spray. This event block questions the availability of flow from the containment spray pumps. It is used in the medium or large LOCA ESD to determine whether RWST water is delivered to the containment sump for post-melt debris bed cooling. For the GSI-1 91 project model, the event representing the availability of containment spray injection has been moved up to the early response trees. The status of all three train spray trains is tracked by a single, multi-state top event, CS. For core damage scenarios, if RWST water is injected from the HHSI, LHSI, or CS pumps, the core debris will be flooded, and the resulting plant damage state is designated as a "wet" condition. If no RWST water is injected before or after core damage occurs, only the normal RCS inventory and water from the accumulators are available in the containment. These plant damage states are designated as "dry" conditions. Success of this block indicates that at least one CS train delivers flow to the containment spray headers. This flow may not be adequate for core debris cooling after vessel breach. Subsequent containment pressure control is evaluated for each core damage scenario in the late response event tree and in the Level 2, CET tree.

Event 7 - Reactor Pressure Vessel (RPV) Pressure above LHSI Shutoff Pressure.

The medium LOCA initiating event category includes a range of RCS breaks with flow rates equivalent to those from ruptures of piping approximately 2 inches to 6 inches in diameter. At the smaller end of this range, the RCS blowdown is extended long enough to require HHSI injection flow to maintain coolant level above the core before pressure decreases below the LHSI pumps shutoff head. At the larger end of the medium LOCA range, RCS pressure decreases very rapidly, and only LHSI injection flow is required to maintain coolant inventory. This event block is used as a flag in the medium or large LOCA ESD to note the differences in plant response for this range of break sizes. The success path from this block occurs if the medium LOCA is relatively small and there is no overcooling scenario. Subsequent events in this path require operation of the HHSI pumps for makeup during the transition blowdown and later operation of the LHSI pumps when pressure falls below their shutoff head. The failure path from this event block occurs if the medium LOCA is relatively large so that HHSI is not required. This event is always failed for large LOCAs. This path bypasses HHSI operation and requires rapid injection from the LHSI pumps. As a bounding treatment of medium LOCA events for this study, the event trees conservatively include only the success path requirements from this block; i.e., HHSI is required for all ranges of the medium LOCA breaks. For the entire range of large LOCAs, the HHSI pumps are not required.

Event 31 - Operators Secure third train of containment spray. If the RCS is not intact as indicated by containment conditions then the operators are directed to procedure OPOP05-EO-EO10, LOSS OF REACTOR OR SECONDARY COOLANT, The procedure then directs the operators that if all three spray pumps are injecting, to secure one train of containment to conserve RWST water. This event does not directly enter Page 58 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191-V02 Revision I the sequence logic for success criteria. It is included for subsequent sensitivity analysis should it be necessary to consider. Currently, the CASA GRANDE models assume credit for this action whenever three trains of spray are initially operating.

The following descriptions refer to events on Page 2 of the ESD, at Entry Point A.

Event 9 - HHS1. If the initiating event is near the small end of the medium LOCA range, injection flow from the HHSI pumps is required to maintain coolant level above the core until RCS pressure decreases sufficiently to allow LHSI pump operation. For large LOCAs, HHSI flow is assumed unnecessary to prevent core damage. Nevertheless this event is asked to determine the extent of sump flow at the time of sump recirculation.

For medium LOCAs, the ESD applies a simplified bounding model for HHSI response.

Although the break may be small enough to require HHSI operation, the bounding flow rate is unlikely to exceed the makeup capacity from a single HHSI pump. Therefore, success of this event block requires just one train of the three HHSI pumps to supply injection during the blowdown phase of these events. The failure path from Event Block 9 in the ESD includes alternative operator responses to rapidly depressurize the RCS for injection from the LHSI pumps. However, we shall see later that these alternatives paths to avoid the need for HHSI are not modeled in the medium or large LOCA event trees.

Event 10 - LHSI. All event scenarios modeled in the medium or large LOCA ESD eventually requires injection from the LHSI pumps. Three different types of scenarios reduce RCS pressure below the LHSI shutoff head (300 psig) and are as follows:

The initiating event may be for large LOCAs or at the large end of the medium LOCA size range. The RCS will rapidly depressurize, and LHSI flow is required to maintain coolant inventory throughout the event.

The initiating event may be at the small end of the medium LOCA size range, but insufficient HHSI flow is available to maintain coolant inventory above the core during the extended RCS blowdown. The operators respond to either overcool the RCS through the steam generators or to open additional RCS relief valves to reduce RCS pressure for LHSI injection.

The initiating event may be in the small-to-intermediate range of the medium LOCA sizes, and sufficient HHSI flow is available to maintain inventory during the blowdown phase of the event. A bounding model is used in the ESD for these intermediate medium LOCA events. Although HHSI flow is sufficient to keep the core flooded, RCS pressure continues to fall. The HHSI pumps eventually reach runout flow conditions at a discharge pressure of approximately 600 psig. The ESD model bounds plant response for these events by requiring subsequent flow from the LHSI pumps to stabilize coolant level at low RCS pressure.

Success of this event block indicates that flow is available from at least one LHSI pump train to its corresponding RCS cold leg. The success path continues to model actions for switchover to low pressure recirculation flow when the RWST is drained. Failure of this block occurs if no flow is available from the LHSI pumps. All failure paths are mapped to eventual core damage from Page 59 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 loss of coolant inventory. The timing and containment conditions for each failure scenario depend on the specific preceding plant responses being modeled.

Event 11 - Automatic Low Pressure Recirculation Switchover. This event represents automatic actions to initiate ECCS pump suction switchover to the emergency containment sumps upon low-low RWST level concurrent with a safety injection signal. Manual actions are not considered. Sump switchover initiates the recirculation phase of the medium or large LOCA with the HHSI, LHSI, and CS pumps taking suction from the emergency containment sumps. Success of this block implies that the automatic recirculation switchover signals are available. Subsequent blocks question the availability of the individual ECCS pump train recirculation suction valves.

Since sump recirculation flow is the only available method to maintain RCS inventory and stable core cooling, failure of this block indicates that core damage will occur after the contents of the RWST are injected. The failure path is mapped to late core damage at low RCS pressure. The resulting plant damage states are designated as "wet" conditions, because RWST water is delivered to the containment sump before core damage occurs.

Event 12 - Recirculation Sump Valves. Successful recirculation switchover will require success of the AC-powered recirculation sump valves to actuate open and the operators to close the RWST isolation valves. The LHSI pumps may also be required to be restarted if they were stopped earlier in the medium LOCA event. This event block models operation of the ECCS pump train suction valves from the containment sumps.

Success indicates that at least one of these valves is open to provide recirculation flow from a running ECCS pump train. The failure path from this block occurs if all three sump suction paths remain closed or if the sump suction paths on those ECCS trains which are operating remain closed. The consequences from these valve failures are identical to those from failure of Event Block 11.

Event 13 - RWST Suction Isolation. The operators are instructed to manually close all three RWST motor-operated suction valves after the recirculation sump suction valves open. If any one of the RWST suction valves remains open after switchover, and its associated check valve fails to close, a path from the containment sump to the RWST, the mechanical auxiliary building, and, subsequently, to the outside environment, is established. The success path from this event block indicates that all three RWST suction lines are closed. The failure path is mapped to late core damage at low RCS pressure. The resulting plant damage state is designated as a "wet" condition because the RWST water is injected into the containment sump before core damage occurs.

Subsequent analysis indicates that failure to isolate the RWST suction valves does not affect sump recirculation (Updated Final Safety Analysis Report (UFSAR)

Section 6.3.2.2). However, this failure mode is retained in Revision 7.1 and in the GSI-191 project model.

Event 32 - Secure all Containment Spray Pumps.. This event represents a manual operator action to secure all trains of containment spray; per procedure OPOP05-EO-EO10, LOSS OF REACTOR OR SECONDARY COOLANT, Steps 16 and Step 16c when containment pressure falls below 6.5 psig and the TSC concurs. The same procedure notes that it may be necessary to run containment spray for up to Page 60 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after sump recirculation switchover in order to reduce containment Iodine levels sufficiently before TSC concurrence would be obtained. This event is added because reducing the flow through the containment strainers reduces the potential for strainer clogging issues. For the current GSI-191 project, this action is always assumed successful. It is included in the model as a means for performing sensitivity analyses on the operator action failure probability. Note that by procedure, only those trains of containment spray operating during the injection phase are to be aligned for sump recirculation prior to this action.

Event 33 - No Sump Failure. This event represents the GSI-191 sump clogging issues specifically related to the sump strainers; i.e., sump plugging resulting in insufficient flow, loss of NPSH, pump cavitation caused by air ingress, or strainer collapse by excessive loading. The sump failure probability is a function of many variables but mainly of the number of ECCS pumps drawing suction from each sump. The remaining GSI-191 issues are represented by later events.

Event 34 - Hot-leg Switchover. This event block was included in the Revision 7.1 ESD for large LOCAs but not for medium LOCAs. It has been added here for the GSI-191 project and applied to both medium LOCAs and large LOCAs. This event requires the operators to align at least one low head safety injection train to the associated RCS hot leg in accordance with procedure OPOP05EOES14, TRANSFER TO HOT LEG RECIRCULATION. At least one low head recirculation train is to remain injecting to the associated cold leg; all other trains are aligned to their associated hot leg. Hot leg recirculation is required approximately 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after a design basis large LOCA, in order to prevent boron precipitation in the reactor vessel which could impede or block the effectiveness of long term recirculation, thus leading to core degradation. Failure of this function is assumed to increase the probability of core damage owing to boron precipitation. Only cold leg breaks are assumed susceptible to a loss of core cooling caused by boron precipitation.

Event 35 - In-Vessel Flow Blockage. This event represents the GSI-1 91 sump clogging issue associated with excessive plugging, within the reactor vessel, of the coolant flow path to the core fuel tubes. The failure probability is a function of the number of pumps trains operating from the sump during recirculation. Failure of this event is assumed to lead to core damage.

Event 36 - No Boron Plugging. This event represents the recently added GSI-1 91 issue associated with boron precipitation sufficient to prevent extended core cooling.

The failure probability is a function of the number of pumps trains operating from the sump during recirculation and on the success or failure of hot leg switchover. Failure of this event is assumed to lead to core damage. Only cold leg breaks are assumed susceptible to a loss of core cooling caused by boron precipitation.

Not shown on the ESD are a number of other actions directed by STP procedures that are not credited in the STP PRA, nor in the modified STP PRA models developed for evaluation of the GSI-191phenomena. These actions provide a source of defense in depth to the analysis performed. In the event of a loss of sump recirculation (i.e., failure of Events 11, 12, 13, 33, 35, or 36), the operators would be directed to procedure OPOP05-EO-EC1 1, "LOSS OF Page 61 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 EMERGENCY COOLANT RECIRCULATION". Step 6 of this procedure directs the operators to add borated makeup to the RWST via the CVCS blender. Step 30 also directs that alternate sources be used to provide makeup to the RWST; e.g., using a centrifugal charging pump.

Step 39 directs the operators to check with the technical support center for potential other recovery actions. Further, Steps 24 and 36 direct the operators to place the RHR system in service if the Technical Support Center (TSC) concurs. We also note that as a planned response to any LOCA, procedure OPOP05-EO-ES13, "TRANSFER TO COLD LEG RECIRCULATION", Step 8 also directs the operators to begin makeup to the RWST. Each of these actions may prove effective in mitigating a loss of sump recirculation. However, none of the actions listed in this paragraph are credited in the current analysis.

Event 14 - RHR Heat Exchangers. When using the LHSI pumps for sump recirculation cooling, the RHR heat exchangers are normally used to remove core decay heat. This event block models this heat removal function, and includes the individual component cooling water (CCW) supply and return valves for the RHR heat exchangers. Success occurs if the CCW supply and return valves are open, and core decay heat is transferred to the CCW system. Failure of this event block implies that flow is available from the operating LHSI pumps, but insufficient core decay heat is being removed through the RHR heat exchangers for long-term stable core cooling.

Event 15 - RCFCs. Analyses have indicated that the RCFCs can provide an alternative method for removing core decay heat during sump recirculation cooling scenarios. The LHSI pumps are used to circulate water through the core and back to the containment sump through the LOCA flow path. The RCFCs remove heat from the saturated containment atmosphere, and thus remove heat from the containment sump water and the core. Success of this block implies that a sufficient number of RCFCs are operating with their cooling water aligned to the CCW system to provide long-term core cooling. If neither the RHR heat exchangers nor the RCFCs are available for recirculation cooling, it may be possible to use the steam generators.

Analyses are not currently available to determine the effectiveness of heat transfer through the steam generators during MLOCA or large LOCA recirculation flow conditions. It is expected that coolant would remain at the level of the RCS loops, and the steam generator tubes would be at least partially drained. For effective heat transfer, the operators would have to maintain the secondary side of the steam generators at nearly atmospheric conditions by holding open the steam generator PORVs or by reopening the MSIVs and the steam dumps. Only the motor-driven AFW pumps and the startup feedwater pump could supply makeup flow under these conditions. Long-term makeup to the AFWST or the condenser hotwell would be required if an atmospheric steam relief path were kept open. To keep the medium or large LOCA ESD as simple as possible, these alternative steam generator cooling possibilities are not modeled. Therefore, failure of this event block is mapped directly to late core damage at low RCS pressure. The resulting plant damage states are designated as "wet" conditions, because RWST water is injected into the containment sump before core damage occurs. Not shown on the ESD but considered in both the Revision 7.1 and GSI-191 project models, is that the RCFCs are only effective for containment heat removal if the containment purge lines (i.e., Event 27 - Purge Isolation, described earlier) are closed. Also, core heat removal is only credited via the Page 62 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 RCFCs if the LHSI pumps are operating in the sump recirculation mode albeit without RHR heat exchanger cooling. No credit for core cooling is taken for sump recirculation using the HHSI pumps alone in the sump recirculation mode, even with RCFCs operating.

The next event refers back to page 1 of the ESD, when all injection fails because of a failure of ESFAS. Core damage is assumed to result but the question is whether the RWST is still injected automatically via the containment spray pumps. The other events on this portion of the ESD have been previously described.

Event 16 - SSPS/SEQ Common. If the automatic and manual safeguards actuation signals have failed, this event block questions availability of the SSPS logic cabinets and the bus load sequencers to process separate input and output signals for automatic containment spray system startup. If both the logic cabinets and the load sequencer cabinets are available, the containment high-3 pressure condition that occurs at the time of core damage can provide automatic spray system start signals, even though other ECCS equipment has not been automatically or manually started. Success of this event block indicates that the automatic containment spray start signals are available. The failure path from this event block is mapped to early core damage at high RCS pressure.

The resulting plant damage state is designated as a "dry" condition, because no RWST water is injected into the containment sump from the HHSI, LHSI, or CS systems.

Originally this event was represented by Top Event SS. In Revision 7.1 and retained in the GSI-191 project model, the SSPS system is now modeled by top events SPR and SPS in the EPONSITE, support event tree.

The next event refers back to Page 1 of the ESD when all LHSI fails in the injection phase.

Core damage is assumed but the question is whether at least one HHSI pump is available to inject the RWST.

Event 18 - One HHSI. This event is similar to that for Event 9. The success criteria for large LOCAs and the bounding models used for medium LOCAs assign this failure path to eventual core damage, because the HHSI pumps cannot supply adequate coolant makeup flow at runout for these events. However, HHSI injection can deliver RWST water into the containment sump to determine whether the resulting plant damage state is designated as a "wet" or "dry" condition for core debris cooling. Success of this event block indicates that at least one HHSI pump delivers sufficient RWST injection flow. The event success path is mapped to a "wet" plant damage state. Failure of this block occurs if no HHSI pump delivers flow. The failure path continues to evaluate whether the containment spray pumps deliver water into the sump after core damage occurs.

The next event refers back to Page 1 of the ESD when the failure to close the MSIVs and turbine trip failure following a medium LOCA leads to a PTS challenge. The other events on this flow path have been previously described.

Event 19 - RPV Integrity. If the reactor trips, but the main turbine fails to trip, and the MSIVs remain open, the plant will experience a rapid and severe overcooling condition.

Subsequent injection from the HHSI pumps will partially restore RCS pressure following a medium LOCA. This failure mode is not modeled for large LOCAs. The effects from Page 63 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I these conditions are bounded in the medium and large LOCA ESD by questioning whether the reactor vessel survives this potential pressurized thermal shock (PTS) challenge; i.e., via Top Event VI. If the RPV integrity is compromised to the point of failure, then core melt is likely resulting in an excessive LOCA scenario. Event Block 19 success implies that the reactor vessel remains intact during this transient. The success path continues to the transition cooldown and depressurization portion of the ESD corresponding to an extended medium LOCA blowdown at intermediate RCS pressure.

Failure of this event block implies that reactor vessel integrity is compromised, and, subsequently, the reactor pressure vessel does not remain intact. The effects from this failure are also bounded in the ESD by mapping the failure path to an excessive LOCA condition that exceeds the makeup capacity of all injection systems. The failure sequence is mapped directly to early core damage at low RCS pressure. The resulting plant damage state is designated as a "wet" condition, because at least the HHSI system delivers RWST water into the containment sump.

The following discussion refers to Page 2 of the ESD when all HHSI fails.

Earlier versions of the medium LOCA ESD, included descriptions of additional operator actions to cooldown and depressurize the RCS to pressures less than the LHSI shutoff head; i.e., Events 20 through 26. These events included the status of the AFW system, the steam generator power operated relief valves, the actions to restore MFW including the status of the startup feedwater pump and condensate system, reopening of the MSIVs, the availability of the steam dumps and circulating water system, and, as a backup, the operator action to depressurize the RCS using the pressurizer PORVs and reactor vessel head vents.

These events were always excluded from the medium LOCA event trees and of course the large LOCA event trees. Consistent with these earlier models, the current model assumes that the medium LOCA break size is large enough to depressurize the RCS to allow LHSI injection without these additional events. However, the assumption that at least one HHSI pump must also inject into an intact loop, is also retained.

Page 64 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 A.4 Medium or Large LOCA Event Trees This section describes the LOCA event tree, which is derived from the medium or large LOCA ESD discussed in the previous section. The medium or large LOCA event model is also broken up into two stages when the ESD is converted into an event tree. The early response event tree (i.e., MLOCA) evaluates all the expected medium or large LOCA transient response sequences and accident sequences that lead to core damage within approximately 30 minutes to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the occurrence of the event; i.e., during the RCS injection phase, and the containment protection functions before switchover to sump recirculation. The late response event tree (i.e., LTMLOCA) evaluates the progression of sequences during and after recirculation switchover, and the availability of core debris cooling after core damage has occurred. While many of the event blocks in the medium or large LOCA ESD are mapped into the MLOCA event tree, there are several event blocks in the medium LOCA ESD that are not included in the medium or large LOCA event tree as top events. Table A.4-1 provides the grouping of medium or large LOCA ESD event blocks into event tree top events. The rationale for excluding event blocks from the MLOCA event tree follows. These comments apply to both medium LOCAs and large LOCAs.

Table B.3-1 in Appendix B presents all the split fraction values used in quantification of the medium and large LOCA event model. The changes in split fractions made to incorporate outputs from CASA GRANDE to evaluate GSI-191 phenomena are highlighted in red text of that table and the basis for these changes are described with the top events presented below. For top events with no discussion of their corresponding split fractions, no changes were made for this evaluation; i.e., the split fractions are the same as in the reference PRA, Version 7.1, for STP.

The reactor trip event (MLOCA Event Block 1) is not included in the MLOCA event tree, because the requirement for injection insures sufficient boron is present in the RCS to guarantee reactor shutdown.

The ESFAS system, the SSPS logic cabinets, and the bus load sequencer cabinets (MLOCA Event Blocks 2 and 16) are modeled in the electric power tree; EPONSITE. These events model the generation of the necessary control signals to engineered safety feature (ESF) equipment and isolation of important containment penetrations. These signals start the HHSI and the LHSI pumps, and align the associated safety injection valves. These signals also affect startup and alignment of equipment in several of the plant support systems, such as ECW, component cooling water, essential chilled water, electrical equipment and heating, ventilation and air conditioning (HVAC). Therefore, the availability of these signals must be determined as an input to the mechanical support systems event tree model. The electric power event tree split fraction rules transmit the status of these signal availabilities to the mechanical support, MLOCA, and the LTMLOCA response event tree. The electric power event tree also includes a top event for operator actions to manually start equipment very early in the sequence if the automatic signals fail (medium or large LOCA ESD Event Block 3). These recovery actions are evaluated on a sequence-specific basis to account for effects from operator stress, event timing, procedures, etc. They are included in the electric power portion of the event tree model to ensure that the effects from both successful and failed recovery actions are correctly propagated through the remaining event trees.

Page 67 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSII91-V02 Revision 1 Three sets of pumps are modeled in the MLOCA early tree; the HHSI pump trains (ESD Event Block 9), the LHSI pump trains (ESD Block 10) and the containment spray pump trains (ESD Event Block 17).

The medium LOCA early response tree also considers the containment isolation function, which occurs early in the sequences. Operation of the reactor containment fan coolers (RCFCs, ESD Event Block 15) is also considered in the MLOCA event tree, as their operation can affect containment sump temperatures.

Medium or large LOCA ESD Event Block 6 considers the successful reclosure (or remaining closed) of the steam dump valves in the context of a severe overcooling transient but is not modeled in the MLOCA event tree. The operation of the steam dump valves to assist in secondary heat removal (ESD Event Block 25) is not modeled in the MLOCA event tree.

Secondary heat removal could be important in a medium LOCA scenario, if primary pressure remains above LHSI shutoff pressure and there is insufficient HHSI for primary makeup. The objective, given these conditions, is to rapidly depressurize the primary system to LHSI cut-in conditions. The MLOCA event tree does not take credit for rapid depressurization under these circumstances. For large LOCAs, the RCS depressurizes rapidly anyway and again these functions are not of concern. Thus, it is not necessary to model the following medium LOCA ESD event blocks related to rapid depressurization:

Decreasing the Steam Generator PORV Setpoints (Medium LOCA ESD Event Block 20)

The Availability of the AFWST and the Motor-Driven AFW Trains (Medium LOCA ESD Event Block 21)

Reopening the MFW Isolation Valves (Medium LOCA ESD Event Block 22)

Using the Motor-Driven Startup Feedwater Pump and the Condensate System (Medium LOCA ESD Event Block 23)

Reopening the MSIVs (Medium LOCA ESD Block Event 24)

The Opening of the Steam Dumps (Medium LOCA ESD Event Block 25)

RCS Depressurization Using the Pressurizer PORVs and the Reactor Pressure Vessel Head Vents (Medium LOCA ESD Event Block 26)

This conservative approach substantially reduces the size of the MLOCA event tree without introducing significant conservatisms into the model.

The remainder of the medium and large LOCA ESD event blocks, which are excluded from the medium LOCA event tree, are included in the late response event tree. These event blocks include:

Page 68 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Low Pressure Recirculation Switchover (Medium or Large LOCA ESD Event Block 11)

The Availability of the Recirculation Sump Valves (Medium or Large LOCA ESD Event Block 12)

The Availability of the RHR Heat Exchangers (Medium or Large LOCA ESD Event Block 14)

The Availability of the RCFCs (Medium or Large LOCA ESD Event Block 15)

RWST Suction Isolation (Medium or Large LOCA ESD Event Block 13)

A.4.1 MLOCA Early Event Tree The remainder of this section discusses the top events of both the early and late frontline system response trees. Figure A.4-1 shows the MLOCA early response event tree, which has been generalized to make it applicable for both medium LOCAs and large LOCAs.

Top Event TT. This top event includes medium or large LOCA ESD Event Block 5. Top Event TT determines whether full-rated steam flow is stopped after the reactor is shutdown. This is normally accomplished by tripping the main turbine (Medium LOCA ESD Event Block 5). Turbine trip is achieved by closing the turbine throttle or governor valves. In the event of main turbine trip failure (i.e., turbine throttle or governor valves remain open), automatic signals will be generated to close the MSIVs (Event Block 4).

Success of Top Event TT occurs if the main turbine is tripped. The success branch indicates that there is no severe overcooling of the primary via the steam generators.

Subsequent top events model operation of the HHSI and LHSI delivering flow to the vessel. Top Event TT fails if at least one pair of turbine throttle valves and governor valves remains open. The plant response to the failure of Top Event TT and Top Event SGI is conservatively bounded by treating the resulting cooldown as if full-rated steam flow continues after the reactor is shut down. Failure of the turbine to trip is not of interest for large LOCAs because the RCS cools down rapidly anyway.

Top Event SGI. This top event includes medium or large LOCA ESD Event Block 4. If the main turbine throttle valves and governor valves remain open, failure of Top Event TT, automatic signals will be generated to close the MSIVs. Success of Top Event MSIV occurs if at least three of four MSIVs close automatically following turbine trip failure.

Failure may also occur if in response to a turbine trip failure, an MSIV fails to close and there is a coincident failure to isolate the feedwater regulating valves on the same loop.

The success branch indicates that there is no severe steam generator overcooling.

Failure of Top Event SGI occurs if at least two MSIVs fail to close. To avoid the need to model multiple top events and to perform separate cooldown analyses for a variety of steam flow conditions, plant response to the failure branch from Top Event SGI is conservatively bounded by treating the resulting cooldown as if full-rated steam flow continues to the turbine after the reactor is shut down. The failure branch thus subsequently evaluates the effect of pressurized thermal shock to the reactor vessel.

Page 69 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Top Event Vl. The MLOCA early response event tree applies a conservative bounding model for the effects from potential reactor vessel PTS challenges represented by the medium or large LOCA ESD Event Block 19. Top Event VI evaluates the likelihood that the reactor vessel remains intact during a severe overcooling transient caused by failure of Top Event TT and Top Event SGI. Vessel integrity is evaluated assuming both HHSI and LHSI pumps will be available for injection. The model also contains the following two principal sources of conservatism.

The assigned temperature and pressure conditions for which Top Event VI is evaluated.

The subsequent effects following failure of Top Event VI.

The rate and amount of RCS overcooling are bounded by assigning failure of top events TT and SGI to a condition with full-rated steam flow remaining after the reactor is tripped. Automatic safeguards actuation signals from high pressure rate and low pressurizer pressure (success of Medium LOCA ESD Event Block 2) will cause full injection flow from the HHSI pumps (success of Medium LOCA ESD Event Block 9).

Failure of the operators to quickly stop all HHSI flow will partially restore RCS pressure.

No detailed analyses have been performed to compare the rate of volumetric shrinkage during the cooldown with the rate of RCS repressurization. However, the estimate is that the lack of credit in the model for this operator action to terminate HHSI introduces only slight conservatism. Full HHSI flow will begin to refill the RCS when the steam generators boil dry and the cooldown subsides. Emergency procedures and operator training programs strongly advise against rapid intervention to reverse automatic system response until a comprehensive plant status review is completed. Based on these observations, the results from detailed analyses of RCS thermal and hydraulic response and a time-integrated model for operator interaction are expected to provide only slight changes from the bounding repressurization model used for Top Event VI. The model also does not account for possible extensions to the repressurization time that could result from partial or total HHSI system failure.

The effects from failure of Top Event VI during medium LOCAs are conservatively bounded by assigning the failure branch of Top Event VI to an excessive LOCA condition beyond the combined makeup capacity from the HHSI and LHSI systems.

This condition is equivalent to catastrophic failure of the reactor vessel. For large LOCAs, the RCS is already open and depressurized so that top event is assumed successful regardless of the status of top events TT and SGI. The failure branch of Top Event VI continues to question the common equipment that affects RWST injection flow to the ECCS trains. All of those branches are then directly mapped to the long-term response tree.

The success of Top Event VI implies that the integrity of the reactor vessel is intact. The tasks at hand are to cooldown and depressurize the RCS in order to achieve long-term cooling. Since this requires LHSI and HHSI, the success branch of Top Event VI also models top events representing the common equipment that affects RWST injection flow to the ECCS trains.

Page 70 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I Top Event S138A. This top event models the common cold leg injection check valve to RCS loop A, S10038A. HHSI, LHSI, and the RCS Loop A accumulator share this common check valve. Failure of this top event disables Train A injection to the RCS.

However, failure of this top event does not necessarily fail pump operation. Therefore, for the GSI-191 project, failure of this top event was assumed to have no impact on the two pumps and the accumulator to Train A themselves. Rather, the requirement for this common check valve is considered later in a macro that describes successful HHSI and LHSI RCS injection and in a macro describing avoidance of core damage.

Top Event S138B. This top event models the common cold leg injection check valve to RCS Loop B, S10038B. This top event is similar to Top Event S138A Top Event S138C. This top event models the common cold leg injection check valve to RCS Loop C, S10038C. This top event is similar to Top Event S138A Top Event Al. This top event models the three accumulators in the emergency core cooling systems. The accumulators each discharge into one of the RCS cold legs in Loop A, B, or C. For medium LOCAs, success of this top event requires at least one of three accumulators to successfully inject. It's possible that the break may be in one of the three Loops A, B, C, or to Loop D to which no accumulators are connected. The specific RCS loop in which the break is said to occur is assigned an equal probability for all loops and is tracked by top event BRKS. Top Event BRKS is placed in the common SEISET event tree. Failure of this top event indicates no accumulator successfully injects into the RCS. For large LOCAs, the success criterion is that two accumulators must successfully inject. Failure of Top Event Al is assumed to lead to core damage and is defined in Macro "SUCC" in the MLOCA Plant Damage State Tree, PDSML.

Top Event CP. Top Event CP models the automatic isolation of all normally open "large" containment penetrations (> 3-inch diameter) before or at the time of vessel failure. The containment penetrations of particular concern are the large containment supplementary purge lines. Success of this top event requires that at least one containment isolation valve in each purge line be automatically closed. Success implies that there is no immediate venting of fission products, and that the RCFCs are capable of removing heat and radioactivity from the containment atmosphere through the condensation process, while also preserving water inventory in the containment. Thus, the success branch of Top Event CP questions the availability of RCFCs under Top Event CF. The success branch for Top Event CP does ask small containment line isolation in addition to questions relating to fission product removal.

Failure of Top Event CP occurs if at least one of the containment purge lines remains unisolated. This immediate venting of the fission products renders the RCFCs ineffective for filtering the releases. The only effective method for fission product removal occurs if the containment sprays operate at the time of vessel failure. Thus, the failure branch from Top Event CP does not question the status of the RCFCs, but focuses on the containment sprays modeled by Top Event CS. Since containment integrity is lost, small containment line isolation is no longer significant, and is therefore not asked. With at least one of the containment purge lines unisolated, the containment remains atmospheric limiting some of the margin for NPSH.

Page 71 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Top Event Cl. This top event models the automatic isolation of the containment penetrations that connect the containment atmosphere to the outside atmosphere, are open before or at the time of reactor vessel failure, and have a flow area less than an equivalent 3-inch diameter hole. The top event includes long-term response core melt ESD Event Block 28. Top Event Cl is questioned except in those sequences in which the supplementary purge lines are unisolated (failure of Top Event CP). The penetrations considered in the analysis of this top event include:,

Containment Radiation Monitor Sampling Lines Pressurizer Relief Tank (PRT) Vent Line PRT Post-Accident Sampling Reactor Coolant Drain Tank (RCDT) Vent Line RCDT to Liquid Waste Penetration Space (LWPS) Holdup Tank Flow Path Containment Normal Sump Drain Line Seal Return and Letdown Line Top Event CF. Top Event CF includes the MLOCA ESD Block 15 and models the availability of at least two RCFCs with cooling water flow supplied by the CCW system.

Success of Top Event CF indicates that long-term containment heat removal and fission product removal are being provided. If LHSI pump flow is later established from the containment sump in the recirculation mode to the RCS is also available, regardless of whether the RHR heat exchangers is cooled, then core decay heat removal is also available.

Top Event PA. This top event models all common equipment that affects RWST injection flow from ECCS Train A; i.e., HHSI Pump A, LHSI Pump A, and Containment Spray Pumps A. This is the Train A portion of MLOCA ESD Event Block 8. Success of Top Event PA indicates that the RWST is available, that Train A Motor-Operated Suction Valve XSI-0001A is open, that Check Valve XSI-0002A opens on demand, and that room cooling is available. The success branch of Top Event PA continues in the early response tree to question the availability of flow from the Train A LHSI pump and HHSI pump. Failure of Top Event PA implies that the Train A ECCS pumps are not available to inject RWST water into the RCS or containment. If the pumps receive automatic signals to start during the early phase of event response, the failure branch from Top Event PA is assigned to an end state that also disables all three ECCS Train A pumps (i.e., HHSI, LHSI, and containment spray on Train A) for later containment sump recirculation flow.

Top Event PB. This top event is similar to Top Event PA. It models the common equipment that affects RWST injection from ECCS train B.

Page 72 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Top Event PZ. This top event is similar to Top Event PA. It models the common equipment that affects RWST injection from ECCS Train C.

The RWST is shared by all three ECCS pump trains. The event tree logic structure has been simplified by not including a separate top event for model failures of this common borated water supply. Failure of the RWST disables Top Events PA, PB, and PZ. This single contribution is propagated through the conditional split fraction models. Thus, RWST failure leads directly to event sequences with all three Top Events PA, PB, and PZ failed.

Top Event HA. Top Event HA models the availability of HHSI Train A to deliver water from the common ECCS suction header to the RCS. It includes the Train A portion of Medium LOCA ESD Block 9. Success of Top Event HA requires the train A HHSI pump to start and to continue operation for at least 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , delivering injection flow to the RCS. Success of this top event requires success of Top Event PA. Success of the HHSI function during a medium or large break LOCA requires at least one pump train to inject into an intact RCS loop. The location of the broken loop is set in the seismic event tree, SEISET, in Top Event BRKS. However, for the GSI-191 project, success of Top Event HA is instead considered even if the break is located in Loop A. For the GSI-191 model, we are interested in whether the HHSI pumps operate and eventually take suction from the containment sump regardless if their injection flow is injected to the RCS. Rather, the requirement for RCS injection, that loop A not be the break location, is considered later in a macro that describes successful RCS injection and in a macro describing avoidance of core damage. Total pump flow taking suction from the containment sumps is an important parameter in determining the potential for sump strainer blockage and strainer failures, air ingress, and whether excessive debris collects in the fuel.

Top Event HB. This top event is similar to Top Event HA. It models startup and operation of HHSI Train B.

Top Event HC. This top event is similar to Top Event HA. It models startup and operation of HHSI Train C.

Top Event LA. LHSl pump train A delivers flow to the RCS. For the GSI-191 model, we are also interested in whether the LHSI pumps operate and eventually take suction form the containment sump regardless if their injection flow is injected to the RCS. Total pump flow taking suction from the containment sumps is an important parameter in determining the potential for sump strainer blockage and strainer failures, air ingress, and whether excessive debris collects in the fuel. The status of the LHSI pump trains is initially assumed not affected by the location of the break since the LHSI pumps may still eventually take suction from the containment sumps even if the injection loop for that train is the same as the break location and flow never enters the RCS. Rather, the requirement for RCS injection, that Loop A not be the break location, is considered later in a macro that describes successful RCS injection and in a macro describing avoidance of core damage.

Top Event LB. Same as LA with respect to Train B Page 73 of 256

South Texas Project Risk-Informed GSI-l191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Top Event LC. Same as LA with respect to Train C Top Event CS. This top event has been modified from the CSR and WI top events originally used to represent containment spray in the medium LOCA late tree in Revision 7.1. Those top events represented the operation of containment during the recirculation mode (i.e., CSR) or for water injection into the containment after core damage (i.e., WI), if the RWST had not been injected earlier. For Revision 7.1, containment spray during the injection phase was not modeled since containment spray is not required to realistically limit containment pressure to acceptable levels, even for the largest of the large LOCAs.

For the GSI-191 project, the availability of containment spray pumps during sump recirculation can affect the potential for strainer clogging issues. Therefore, both the spray injection and spray recirculation functions are of interest. Top Event CS tracks the availability of the containment spray pumps to start and operate in response to the containment pressure increase during RCS blowdown, and for the pumps to operate for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The status of all three spray pump trains are tracked by the eight state top event; i.e., CS. The associated containment spray pump trains are later assumed failed if the common RWST suction valves for that train (i.e., PA, PB, or PZ) are failed. However, the status of the spray trains is not affected by the location of the break, nor by the failure of the common SI injection check valves since the spray pumps do not inject to the RCS. A total of 66 split fractions are developed for Top Event CS. Two of these split fractions are used as defaults; i.e., for guaranteed success (i.e., 0 failure probability) or failed (1.0 failure probability) boundary conditions. The remaining 64 correspond to the evaluation of the eight states of this top event for eight different boundary conditions. The eight different boundary conditions correspond to the conditions when supporting systems (e.g., AC power) are successful or failed for each of the three pump trains; i.e., eight conditions in all. The actual fault tree for containment spray is not logically different than that developed for Version 7.1 in that the failure modes considered are the same. The fault tree logic has only been restructured to allow for the evaluation of all 66 split fractions.

Top Event OSI. This new top event represents a manual operator action to secure one train of containment spray, if all three are running, to conserve RWST water; i.e., per Procedure OPOP05-EO-EO10, LOSS OF REACTOR OR SECONDARY COOLANT. This event was not modeled in Revision 7.1. It is added because reducing the flow through the containment strainers reduces the potential for strainer clogging issues. This top event is only branched at in MLOCA event tree after the one Top Event CS state in which all three trains of containment spray are successfully running since that is the only condition in which the action is directed.

For the current GSI-1 91 project, this action is always assumed failed within the PRA model; i.e., split fraction OSIZ=1.0 is always used. However, within CASA GRANDE, this action is always assumed successful when determining the failure probabilities introduced by the GSI-191 phenomena. This top event is included in the PRA model only as a means for performing sensitivity analyses of the pump state combination frequencies on the operator action failure probability.

Page 74 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Detailed quantification of the success or failure for each top event is accomplished by defining one or more split fractions that depend on the specific event sequence conditions when the top event is questioned. These split fractions account for important dependencies that affect system success criteria, equipment response, or operator actions. The models for each split fraction are presented in more detail in the system analysis notebooks.

Table A.4-1 Grouping of Medium LOCA ESD Event Blocks into Event Tree ESD Event Top Event Definition Notes*

Event Tree Top Blocks Event 1

RT At least 55 out 56 control rods inserted to shut down the reactor 1

in response to an automatic reactor trip signal - not modeled in MLOCA event tree.

2 IA Automatic safety injection and isolation signal available from 1

ESFAS train A. Included in electric power model of support systems which precede the frontline Medium LOCA trees 2

lB Automatic safety injection and isolation signal available from 1

ESFAS train B. Included in electric power model of support systems which precede the frontline Medium LOCA trees 2

IC Automatic safety injection and isolation signal available from 1

ESFAS train C. Included in electric power model of support systems which precede the frontline Medium LOCA trees 3

OR Operators manually start and align equipment that does not 3

receive automatic actuation signals of support systems which precede the frontline Medium LOCA trees 4

SGI At least 3 of 4 MSIVs close automatically to isolate steam flow 2

from the steam generators and either the MSIV closes or the feed water regulating valves close in each loop Page 75 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table A.4-1 Grouping of Medium LOCA ESD Event Blocks into Event Tree (Continued)

ESD Event Top Event Definition Notes*

Event Tree Top Blocks Event 5

TT Turbine throttle or governor valves close automatically to stop 2

steam flow through main turbine.

6 Steam Dumps Closed - Not modeled in event trees.

4, 8 7

Reactor Pressure Vessel (RPV) Pressure Above LHSI 7, 8 Shutoff 8

PA RWST suction path available for HHSI, LHSI, and containment 2

spray train A.

8 PB RWST suction path available for HHSI, LHSI, and containment 2

spray train B.

8 PZ RWST suction path available for HHSI, LHSI, and containment 2

spray train C.

9 HA HHSI pump train A delivers flow to the RCS.

2 9

HB HHSI pump train B delivers flow to the RCS.

2 9

HC HHSI pump train C delivers flow to the RCS.

2 10 LA LHSI pump train A delivers flow to the RCS.

2 10 LB LHSI pump train B delivers flow to the RCS, 2

10 LC LHSI pump train C delivers flow to the RCS.

2 11, 12, 13 RA Containment sump suction path available and RWST isolated for 6

HHSI, LHSI, and containment spray train A.

11, 12, 13 RB Containment sump suction path available and RWST isolated for 6

HHSI, LHSI, and containment spray train B.

11, 12,13 RC Containment sump suction path available and RWST isolated for 6

HHSI, LHSI, and containment spray train C.

14 RX Coolant flow path open and CCW valves aligned for RHR heat 6

exchanger in at least one operating LHSI train.

15 CF At least two RCFC fan units running with cooling water flow path 2

aligned to CCW system.

16 SS Solid state protection system processes automatic reactor trip 1

signals and safeguards actuation signals of support systems which precede the frontline Medium LOCA trees Page 76 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table A.4-1 Grouping of Medium LOCA ESD Event Blocks into Event Tree (Continued)

ESD Event Top Event Definition Notes*

Event Tree Top Blocks Event 17 CS At least one containment spray train delivers flow to the spray 2, 9 ring headers, automatically.

18 HA HHSI pump train A delivers flow to the RCS. 1 of 3 trains needed 2

for success 18 HB HHSI pump train B delivers flow to the RCS. 1 of 3 trains needed 2

for success 18 HC HHSI pump train C delivers flow to the RCS. 1 of 3 trains 2

needed for success 19 VI Reactor vessel remains intact during severe overcooling PTS 2

challenge. HHSI pump train C delivers flow to the RCS.

20-26 Not modeled in event trees 8

27 CP Automatic isolation of 1 of 2 valves in each supplementary purge 2

line if open at the time of the accident.

28 Cl Automatic isolation of 1 of 2 valves in all other (less than 3 inch 2

diameter) containment penetrations that connect the containment atmosphere to the outside atmosphere and are open before at the time of reactor vessel failure.

29

S138A, Cold leg injection check valve XSI0038A, opens on demand 2

29 S138B Cold leg injection check valve XSI0038B opens on demand 2

29 S138C Cold leg injection check valve XSI0038C., opens on demand 2

30 Al Sufficient accumulators (2 of 3 for Large and 1 of 3 for Medium) 2 provide injection through motor operated valves XS10039 and check valves XS10046 via an intact RCS loop.

31 OS1--

Operators secure 3rd running containment spray prior to sump 2

recirculation switchover 32 OFFS Operators secure all containment spray pumps operating during 6

sump recirculation 33 SUMP Absence of sump plugging issues during recirculation; i.e., loss of 6

NPSH, pump cavitation caused air ingress, or strainer collapse 34 HLEG Transfer of at least one LHSI pump train from cold leg to an intact 6

loop for hot leg injection at 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after a Medium or Large LOCA.

Page 77 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table A.4-1 Grouping of Medium LOCA ESD Event Blocks into Event Tree (Continued)

ESD Event Top Event Definition Notes*

Event Tree Top Blocks Event 35 FBLK Absence of in-vessel flow blockage during sump recirculation 6

36 BORON Absence of boron precipitation following a Medium or Large 6

LOCA cold leg break.

Notes:

1.To facilitate tracking support system dependencies, this top event is modeled in the electric power event tree.

2.This top event is modeled in the MLOCA event tree.

3.To facilitate tracking support system dependencies, this recovery action is modeled in the electric power event tree. Recovery actions are evaluated on a sequence-specific basis to account for the timing of failures, stress, control room alarms, procedures, etc., that affect operator response.

4.No credit is taken for secondary systems decay heat removal capability.

5.The Medium LOCA event tree does not model the rapid depressurization of the RCS to LHSI cut-in conditions on loss of HHSI, and it is assumed to lead to core damage.

6.This top event is modeled in the long-term response event tree. (LTMLOCA).

7.Since the Medium LOCA initiating event category covers a range of RCS breaks (flow rates from piping ruptures from 2 inches to 6 inches in diameter), this event block is used as "flag" to note the differences in plant response for this range of break sizes. Although this event block is not modeled explicitly in the event trees, the Medium LOCA event tree structure and success criteria for HHSI and LHSI apply a simplified bounding model and reflects the case where the Medium LOCA requires one HHSI pump and one LHSI pump injecting into an intact RCS loop.

8. This event is not modeled in any event tree

9. All three containment spray system trains represented by one multi-state top event, CS.

Page 78 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 A.4.2 Late Medium LOCA Event Tree The MLOCA event tree branches to the late response tree, LTMLOCA shown in Figure A.4-2.

The LTMLOCA event tree questions coolant injection into the RCS and to the containment spray headers. Top Event N2 at the beginning of the late Medium LOCA event tree segregates sequences requiring emergency containment recirculation cooling from those sequences resulting in or tending towards core damage as a result of the sequence path through the early Medium LOCA event tree. LTMLOCA also evaluates the status of emergency containment sump recirculation function (Top Events RA, RB, and RC), sump clogging issues (i.e., Top Events OFFS, HLEG, FBLK, and BORON) and RHR cooling (Top Event RX).

The MLOCA and LTMLOCA event trees were used for the Medium LOCA initiating event only in Revision 7.1. For the GSI-191 project, the revised set of early and late event trees for Medium LOCA have been generalized to also make them applicable to large LOCAs. The Revision 7.1 large LOCA event tree is not used.

Top events in the LTMLOCA event tree are described below.

Top Event N2. Identifies the sequence paths through the MLOCA tree resulting in early core damage. Early core damage may result from a PTS condition I6ading to vessel failure, from inadequate accumulator injection, from failure of HHSI, or from failure of LHSI. For large LOCAs, only inadequate accumulator injection or failure of LHSI core damage mechanisms apply. The status of containment spray injection is established in the early MLOCA event tree but is not used in the evaluating the status of Top Event N2.

" Top Event RA. Containment sump suction path for Train A available and RWST isolated for HHSI, LHSI, and containment spray Train A. Failure of Top Event RA prevents sump recirculation involving the HHSI, LHSI, or containment spray pump on Train A.

" Top Event RB. Same as RA with respect to Train B

" Top Event RC. Same as RA with respect to Train C Top Event OFFS. This new top event for the GSI-191 project represents a manual operator action to secure all trains of containment spray; per Procedure OPOP05-EO-EO10, LOSS OF REACTOR OR SECONDARY COOLANT, Step 16 and Step 16c when containment pressure falls below 6.5 psig and the TSC concurs. The same procedure notes that it may be necessary to run containment spray for up to 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after sump recirculation switchover in order to reduce containment Iodine levels sufficiently before TSC concurrence would be obtained. This event is added because reducing the flow through the containment strainers reduces the potential for strainer clogging issues.. It is included in the model as a means for performing sensitivity analyses of the pump state combination frequencies on the operator action failure probability. Note that by procedure, only those trains of containment spray operating during the injection phase are to be aligned for sump recirculation prior to this action.

Page 80 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 For the current GSI-191 project, this action is always assumed failed within the PRA model; i.e., split fraction OFFSZ=1.0 is always used. However, within CASA GRANDE, this action is always assumed successful when determining the failure probabilities introduced by the GSI-191 phenomena.

Top Event SUMP. This new top event for the GSI-191 project represents the GSI-191 sump clogging issues specifically related to the sump strainers; i.e., sump plugging resulting in insufficient flow, loss of NPSH, pump cavitation caused by air ingress, or strainer collapse by excessive loading. The remaining GSI-191 issues are represented by later top events.

At STP, there are three separate sump strainers; one for each of the three pump trains A, B, and C. The sump failure probabilities are provided by CASA GRANDE as a function of the specific sequence paths through the MLOCA and LTMLOCA event trees.

For the GSI-191 project model of 2012, these failure probabilities are evaluated as a function of the number of HHSI, HLSI and containment spray pumps operating for sump recirculation. CASA GRANDE looks at the sump failure probabilities for each of the three trains separately and reports the highest of the three for each sequence condition.

The RISKMAN PRA model then conservatively assumes that if one sump strainer fails they all do. If Top Event SUMP fails, this implies that all three trains of sump recirculation fail and that core damage results.

Since the most likely condition is that all three pump trains are available on each strainer for sump recirculation, this assumption is not believed overly conservative.

The failure probabilities for this top event are provided directly from the CASA GRANDE output in Volume 3. The uncertainty in these failure probabilities are reported as discrete probability distributions with 5 points each. A data variable is developed for each pump state failure probability distribution. Then these data variables are assigned directly as the split fraction values for each pump state analyzed. The mean values from the CASA GRANDE output distributions are used for the mean values of the SUMP split fractions. The full data variable 5 bin distributions are instead used when uncertainty analysis is performed. Effectively these split fractions can be thought of as single basic event fault tree where the basic event probability is the same as the split fraction value.

There are 10 split fractions assigned to this top event; i.e., five each for medium LOCA and for large LOCA. It is coincidental that the number of split fractions analyzed is the same number as the number of discrete points in the data variable uncertainty distributions for sump failure probability noted above. Since there are three ECCS pump systems of interest and each can be in a state of zero, one, two, or three pumps running, there are theoretically a total of 64 pump state combinations. Actually there are fewer combinations because only those sequences in which sufficient pumps are available to prevent core damage are of interest for Top Event SUMP. The CASA GRANDE results have been evaluated for just five of these possible pump state combinations for both medium LOCAs and large LOCAs. An additional 11 pump state combinations are assigned to the least conservative pump state combination split fractions from among the five states that are evaluated by CASA GRANDE for each LOCA size. For these 11 combinations a new split fraction is not developed but rather the relevant sequences are assigned to use one of the five that are developed for each LOCA size. The Page 81 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 remaining 48 pump state combinations are relatively low in occurrence frequency and are therefore conservatively assumed to always fail Top Event SUMP; i.e., we conservatively assume sump plugging occurs for these unanalyzed pump state combinations.

Top Event HILEG. This top event is not included in the LTMLOCA event tree of Revision 7.1. It has been added here for the GSI-1 91 project and applied to both medium LOCAs and large LOCAs. The fault tree for Top Event HLEG models the operator action and equipment necessary to align at least one low head safety injection train to the associated RCS hot leg in accordance with Procedure OPOP05EOES14 -

TRANSFER TO HOT LEG RECIRCULATION. This procedure directs that both HHSI and LHSI trains be aligned for hot leg recirculation. At least one low head recirculation train is to remain injecting to the associated cold leg; all other LHSI trains are aligned to their associated hot leg. Hot leg recirculation is required approximately 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after a design basis large LOCA, in order to prevent boron precipitation in the reactor vessel which could impede or block the effectiveness of long term recirculation, thus leading to core degradation. Success of the hot leg recirculation function requires an operator action to align at least one recirculation flow path to discharge to the reactor coolant system hot leg. Failure of this function may lead to core damage if boron precipitation is excessive.

For the GSI-191 project in 2012, the probability of excessive boron precipitation considered later in top event BORON is assumed dependent on whether the break is in the cold leg, on the extent of core flow blockage prior to hot leg switchover, and by whether a LHSI train is realigned for hot leg recirculation; i.e., no dependence on the number of HHSI trains aligned is assumed. It's possible that aligning the flow from just a single HHSI pump for hot leg recirculation would also be successful, but this is not credited.

There are three trains of LHSI which may be aligned for hot leg recirculation but by procedure, one must remain aligned for cold leg recirculation. The procedures are not explicit as to the trains to align so we assume that either Train A, Train B, or both Trains A and B are aligned for hot leg recirculation depending on the number of LHSI pump trains operating during sump recirculation. Separate split fractions are evaluated for cases when only Train A is available for swapover to hot leg, when only B is available or when both A and B are available, the latter case because all three LHSI pump trains are operating in the sump recirculation mode. Sequence conditions in which at least two LHSI pump trains are not operating are instead assigned to a guaranteed failure probability for Top Event HLEG when quantifying the event tree; i.e., Split Fraction HLEGZ=1.0 is used.

Recall that if only two trains of LHSI are operating, that the train realigned to the hot leg may inadvertently be directed to the loop where the break is located. This event combination is counted as a failure of the LHSI pump train which would be aligned to the broken RCS loop for hot leg recirculation. Since the second train of LHSI must be maintained on cold leg injection such a situation is also assumed to fail hot leg recirculation represented by top event HLEG due to diversion of flow out the broken loop.

Page 82 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Top Event FBLK. This new top event for the GSI-191 project represents the GSI-191 sump clogging issue associated with excessive plugging within the reactor vessel of the coolant flow path to the core fuel tubes. The probability of failure is provided as an input from CASA GRANDE. The failure probability is a function of the number of pumps trains operating from the sump during recirculation. Failure of this event is assumed to lead to core damage.

The failure probabilities for this top event are provided directly from the CASA GRANDE output in Volume 3. The uncertainty in these failure probabilities are reported as discrete probability distributions with 5 points each. A data variable is developed for each pump state failure probability distribution. Then these data variables are assigned directly as the split fraction values for each pump state analyzed. The mean values from the CASA GRANDE output distributions are used for the mean values of the FBLK split fractions. The full data variable 5 bin distributions are instead used when uncertainty analysis is performed. Effectively these split fractions can be thought of as single basic event fault tree where the basic event probability is the same as the split fraction value.

There are 10 split fractions assigned to this top event; i.e., five each for medium LOCA and for large LOCA. It is coincidental that the number of split fractions analyzed is the same number as the number of discrete points in the data variable uncertainty distributions for sump failure probability noted above. Since there are three ECCS pump systems of interest and each can be in a state of zero, one, two, or three pumps running, there are theoretically a total of 64 pump state combinations. Actually there are fewer combinations because only those sequences in which sufficient pumps are available to prevent core damage are of interest for Top Event FBLK. The CASA GRANDE results have been evaluated for just five of these possible states for both medium LOCAs and large LOCAs. An additional 11 pump state combinations are assigned to the least conservative split fractions from among the five pump state results that are evaluated by CASA GRANDE for each LOCA size. For these 11 combinations a new split fraction is not developed but rather they are assigned to use one of the five that are developed for each LOCA size. The remaining 48 pump state combinations are relatively low in occurrence frequency and are therefore conservatively assumed to always fail Top Event FBLK; i.e., we conservatively assume flow blockage within the reactor core or entrance to the core occurs for these unanalyzed pump state combinations.

The above describes how the PRA model was changed to accept the CASA GRANDE results before they were made available. The CASA GRANDE results later showed that there was zero probability of flow blockage failure for any of the conditions analyzed.

Nevertheless, for all the other 48 pump state combinations a failure probability of 1.0 was assumed. However, this conservative assumption has no effect on the GSI-191 results because all those same sequences are already assigned to failure of sump plugging via top event SUMP.

Top Event BORON. This new top event for the GSI-1 91 project represents the recently added GS-1 91 issue associated with boron precipitation sufficient to prevent extended core cooling. The failure probability is a function of the number of pumps trains operating from the sump during recirculation and on the success or failure of hot leg switchover. Failure of this event is assumed to lead to core damage.

Page 83 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 CASA GRANDE provides the probabilities of boron precipitation prior to the alignment for hot leg recirculation at 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . The split of break locations in the hot leg versus the cold leg is considered in CASA GRANDE for each break size. If the break is in the hot leg, the potential for boron precipitation is judged to be zero. If the break is in the cold leg, CASA GRANDE provides the probability of boron precipitation in the first 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months as a function of the ECCS pump state combinations operating; i.e., prior to hot leg recirculation switchover. If boron precipitation in the first 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months does not occur, then Top Event BORON further considers whether the alignment for hot leg recirculation is successful; i.e., whether Top Event HLEG is successful. If HLEG is successful, then no boron precipitation after 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months is assumed. If HLEG fails, then the fraction of breaks which are in the cold leg are considered when evaluating the probability of excessive boron precipitation. Only if the break is in the cold leg and HLEG fails is boron precipitation after 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months assumed. Since failure of hot leg switchover is assumed to guarantee boron precipitation failure for cold leg breaks in the long term, there is no need to distinguish failures earlier than the required time of switchover from later times.

Top Event HLEG is therefore asked first and the split fractions for Top Event BORON account for this observation.

The excessive boron precipitation failure probabilities for this top event are provided from the CASA GRANDE output in Volume 3 for the period of time prior to hot leg recirculation switchover. The uncertainty in these failure probabilities are reported as discrete probability distributions with 5 points each. A data variable is developed for each pump state failure probability distribution. Then these data variables are considered in the development of the split fraction values for each pump state analyzed.

The CASA GRANDE failure probabilities are used directly for split fraction conditions in which the switchover to hot leg recirculation is successful; i.e. when HLEG=S there is no contribution to boron precipitation failure after switchover. For split fraction conditions involving failure of switchover to hot leg recirculation, the early probability of excessive boron precipitation is added to the fraction of breaks which occur in the cold legs to account for excessive boron precipitation after the time of required hot leg switchover.

The overlap of the two failure probabilities is subtracted out to avoid double counting the overlap in the total split fraction probability. Effectively these split fractions can be thought of as one or two basic event fault trees. In practice, the split fraction equation creation method of RISKMAN was again used to avoid the need to create such fault trees which while simple are also numerous.

The mean values from the CASA GRANDE output distributions are used for the point estimate mean values of the SUMP split fractions. The full data variable 5 bin distributions are instead used when uncertainty analysis is performed.

There are 26 split fractions assigned to this top event which consider both boron precipitation in the first 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and afterwards if hot leg recirculation is not successful; i.e., 13 each for medium LOCA and for large LOCA. The 13 split fractions for each apply to the five different pump state cases, with and without HLEG success, plus three additional, default split fractions that are independent of the specific pump state. Since there are three ECCS pump systems of interest and each can be in a state of zero, one, two, or three pumps running, there are theoretically a total of 64 pump state combinations. Actually there are fewer combinations because only those sequences in Page 84 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RJ-GSI 191 -V02 Revision 1 which sufficient pumps are available to prevent core damage are of interest for Top Event BORON. The CASA GRANDE results have been evaluated for just five of these possible states for both medium LOCAs and large LOCAs. An additional 11 pump state combinations are assigned to the least conservative pump state combination split fractions from among the five pump state results that are evaluated by CASA GRANDE for each LOCA size. For these 11 combinations a new split fraction is not developed but rather the relevant sequences are assigned to use one of the five that are developed for each LOCA size. The remaining 48 pump state combinations are each individually relatively low in occurrence frequency and are therefore conservatively assumed to always fail Top Event BORON; i.e., we conservatively assume that excessive boron precipitation results for these unanalyzed pump state combinations.

Top Event RX. Top Event RX models the availability of the RHR heat exchangers to remove core decay heat. It includes the medium LOCA ESD Event Block 14. The top event is questioned whenever at least one LHSI pump train is available to provide low pressure recirculation flow through the RHR heat exchangers. Success implies that the associated component cooling water (CCW) supply and return valves are open for the RHR heat exchangers, and that core decay heat is being removed through the CCW system. The success for Top Event RX is that the RHR heat exchanger be available for decay heat removal for at least one of the associated and available LHSI pump trains operating in the recirculation mode. In scenarios in which only one LHSI pump train is available (only Top Event LA, LB, or LC is successful), success of Top Event RX requires the RHR heat exchanger associated with that LHSI pump train to be available.

The success path indicates that long-term core decay and containment heat removal is established in at least one functioning safety injection train. Failure of Top Event RX indicates that no core decay heat removal is available through the RHR heat exchanger.

An alternate heat removal mechanism via the RCFCs may be established, but still at least one LHSI pump train must be operating in the sump recirculation mode..

Page 85 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis IE N2 RA RB RC OFFS SUM P HLEG FBLK BORON RX I

I

.__ý

-I- - - - - - - - - - -

X9.

X9 Xli X12 X13 X13 X13 X13 X13 X13 RI-GS1191-V02 Revision 1 B#

S#

1 1-2 2-3 3-4 4

5-6 5

7-12 6

13-7 14-26 8

27-52 9

53-78 10 79-104 11 105-130 12 131-156 13 157-182 14 183-15 184-185 16 186-187 17 188-189 18 190-191 19 192-193 20 194-195 21 196-197 22 198-I X9 X9 X9 X9 X9 X9 X9 Figure A.4-2 Generalized LTMLOCA Late Event Tree Page 86 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 A.4.3 Plant Damage Statesfor Medium LOCA Events The final linked event tree in the Level 1 linked set for medium and large LOCAs is the same as that developed in Revision 7.1 for Medium LOCAs; i.e., PDSML. This is a single top event tree that is used simply to supply the plant damage state binning logic for each path through the Level 1 models; i.e., the single Top Event BI is set to guaranteed success.

The binning logic for PDSML is developed in terms of macros defining the conditions for physical parameters that are used in both the PDSML binn-ing rules and in the CET Level 2 split fraction assignment and release category binning logic. This macro logic is shown in Table A.4.3-1. The key macro, SUCC, defines the conditions in which a sequence avoids core damage.

The contributors to core damage are distinguished by the failure mechanisms. Four different bins are defined; i.e., MELT, MELTSUMP, MELTFBLK, and MELTBORON. Bin MELT represents the conditions that lead to core damage that are not related to any of the GSI-191 issues. The other three bins correspond to the GSI-191 failure mechanisms; i.e., sump strainer failures, fuel flow blockage, and boron precipitation. IF there are sequences in which multiple GSI-1 91 failure mechanisms are present, the failures are grouped in the order in which the bins appear in the rules; i.e., MELT, MELTSUMP, MELTFBLK, and then MELTBORON. The Level 1 sequence group PDS is then defined as the sum of these four bins.

Table A.4.3-2 shows the Plant Damage State Assignment Rules for Medium/Large LOCAs in terms of the macros presented in Table A.4.3-1.

Page 87 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GS1191 -V02 Revision 1 Table A.4.3-1 PDSML Macro Logic for Plant Damage State Assignment RCS at high pressure at UTAF. Guaranteed false because pressure is assumed to be < 600 psi in a Medium LOCA RCSPHI BI=S*BI=F (BDVV)

RCS at system pressure. Guaranteed false because RCSPSY BI=S*BI=F pressure assumed to be < 600 psi in a MLOCA (BDW)

Steam Generator cooling. Assumed to be false because SGCOOL BI=S*BI=F MLOCA empties steam generators (BDW)

RCS at low pressure at UTAF. Pressure assumed to be >

200 psi unless vessel fails (BDVV) FOR MLOCAS, YET RCSPLO VI=F*IMLOCA +ILLOCA ALWAYS TRUE FOR LLOCAS RCS at Medium pressure at UTAF. Default for MLOCA.

Pressure not low added to rule to remove conflict (BDW),

RCSPMD

-RCSPLO NEVER TRUE FOR LLOCA Dummy rule because pump seal cooling not important in SEALCOOL

-(Bl=S*BI=F)

MLOCA. Renamed from LK12F (BDVV)

Stuck open PZR PORV not important in MLOCA so guaranteed false. LK13F renamed to PORVFL. LK15F PORVFL BI=S*BI=F deleted (BD")

((LA=S*RA=S*S138A=S*-SLBRKA Recirculation cooling using LHSI and RHR HX (BDW); 113

+LB=S*RB=S*SI38B=S*-SLBRKB FOR SUCCESS, ADDED CL INJECTION VALVE AND

+LC=S*RC=S*SI38A=S*-

BREAK LOCATION DEPENDENCIES; AND LOGIC FOR RECOOL SLBRKC)*RX=S)*SUMP=S*FBLK=S*BORON=S GS1191 FAILURE MODES Containment spray injection success (BDW), CHANGED CSI SPRYAS+SPRYBS+SPRYCS TO NEW SPRAY SUCCESS MACROS Containment spray recirculation success (BDW),

CHANGED TO NEW LATE SPRAY RECIRCULATION CSR LATESPRYA+LATESPRYB+LATESPRYC MACROS FOR GSI-191 Page 88 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table A.4.3-1 PDSML Macro Logic for Plant Damage State Assignment (Continued)

Small containment isolation failure (BDW); LARGE ISOLATION FAILURES ARE MODELED IN CET VIA SF ISOFAILS CI=F LIB WHICH ENTERS INTO MACRO:= ELARGE Containment bypass not applicable for MLOCA sequences CNTINTB BI=S*BI=F (BDW)

Sl success using any pump (BDW); CHANGED TO INCLUDE LOGIC FOR CL INJECTION VALVES, RWST SI38A=S*PA=S*-SLBRKA*(HA=S+LA=S)

SUCTION LINES, AND FOR BREAK LOCATION AS

+SI38B=S*PA=S*-SLBRKB*(HB=S+LB=S)

+

WELL AS HPI AND LHSI PUMPS, SPRAY INJECTION SIANY SI38C=S*PA=S*-SLBRKC*(HC=S+LC=S)

REPRESENTED SEPARATELY BY CSI MACRO No core damage FOR MLOCA; Success of AI=S*-VI=F*(SUCCHHSI+ILLOCA)*SUCCLHSlR

ACCUMULATORS, PTS,HPI, & LHSI VIA N2, AND THEN N2=S * (RX=S + RX=F*CP=S*CF=S)*-SUMP=F*-

LHSI RECIRCULATION WITH COOLING BY RX OR VIA SUCC FBLK=F*-HLEG=F FC ;AND NO GS1191 FAILURE MECHANISMS

((HA=S*S138A=S*PA=S*-SLBRKA*-HHSIA*-

SlCOMA)+(HB=S*SI38B=S*PB=S*-SLBRKB*-

HHSIB*-SICOMB)+(HC=S*SI38C=S*PZ=S*-

SUCCESSFUL HHSI 1/3 INJECTION TO UNBROKEN SUCCHHSI SLBRKC*-HHSlC*-SlCOMC))

LOOP, NOT NEEDED FOR RECIRCULATION

( (LA=S*S138A=S*PA=S*-SLBRKA*-LHSIA*-

SICOMA*RA=S)+(LB=S*S138B=S*PB=S*-

SLBRKB*-LHSIB*-

SICOMB*RB=S)+(LC=S*SI38C=S*PZ=S*-

SUCCESFUL LHSI 1/3 TO UNBROKEN LOOP, ALSO SUCCLHSIR SLBRKC*-LHSlC*-SlCOMC*RC=S) )

NEEDED FOR RECIRCULATION Page 89 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table A.4.3-2 Plant Damage State Assignment Rules for Medium and Large LOCAs

(-SUCC*-SUMP=F*-FBLK=F*-

MELT (HLEG=S*BORON=F))

MELT SEQUENCES WITHOUT G191 EFFECTS MELTSUMP SUMP=F*-SUCC ADDED MELT SEQUENCES DUE TO SUMP STRAINER ISSUES MELTFBLK FBLK=F*-SUCC ADDED MELT SEQUENCES DUE TO FUEL FLOW BLOCKAGE ADDED MELT SEQUENCES DUE TO BORON PRECIPITATION MELTBORON BORON=F*HLEG=S*-SUCC BUT WITH HLEG=S SUCCESS 1

SUCCESS SEQUENCES (NOT CORE DAMAGE)

Event Tree: PDSML.ETI IE BI 09:45:45 June 19 1

2 1-2-

Page 90 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I A.4.4 Level 2 Containment Event Treefor Medium and Large LOCA events The Level 2 containment event tree developed for Revision 7.1 of the STP PRA (Reference 2) is used as is for the GSI-191 project. This includes the definition of release categories and the grouping of release categories into four release category groups; i.e., RELI, RELII, RELIII, and RELIV. One difference is in the logic defining the macros used in the CET. These macros are those defined in Table A.4.3-1. Because the containment spray top events CSR and WI were removed and the new Top Event CS added, the macro logic was changed to reflect these differences; i.e., macros for containment spray injection (CSI), containment spray recirculation (CSR) and for any means of injecting RWST water into the containment (SIANY) were changed.

Also, the macro for recirculation cooling (RECOOL) was changed to explicitly add the dependencies for cold leg injection check valves and break location to the recirculation cooling macro. For convenience, the four release category groups are defined in Table A.4.4-1.

Table A.4.4-1 Definition of Release Category Groups Release Category Group description GROUP Total CDF PDS Early large containment failure: before or at vessel breach (CP=F), early H2 burn RELI Early small containment failure: before or at vessel breach, early H2 burn RELII Late: overpressure, burn, or large late failure RELIII No release, intact containment RELIV Page 91 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 A.5 References

1. STPEGS Level 2 PSA and Individual Plant Examination, August 1992.

2. "Medium Loss of Coolant Accident (LOCA) Event Tree (MLOCA,LTMLOCA,PDSML),"

Revision 7, prepared by Mary Anne Billings and Chase Gilmore for South Texas Project Electric Generating Station, Probabilistic Risk Assessment, June 18, 2012.

Page 92 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GS1191-V02 Revision I Appendix B. RISKMAN Modeling Changes for Medium and Large LOCA Event Trees B.1 Introduction For the GSI-1 91 project, the STPREV7.1 RISKMAN model was changed to reflect the GSI-1 91 sequence model changes and to incorporate the associated phenomena. The changes to the frontline event tree structures and top events are presented in Appendix A, i.e., for event trees MLOCA and LTMLOCA. This appendix presents the split fraction rules, macros, and binning logic for the event trees that have changed for this project. Further, the master frequency file used for the GSI-191 quantification, both for the revised base case and for the quantification with GSI-191 phenomena included is also provided; i.e., the same master frequency file is used for both quantifications, but the ones representing GSI-191 phenomena are not used in the base case quantification.

B.2 Event Tree Rule Changes As described in Appendix A, a single set of linked event trees is used to quantify both the medium LOCA and large LOCA initiating events. The event tree names linked are the same as for the medium LOCA initiating event in model STPREV7.1. This linked set is as follows:

SEISET PMET OFFGRID EPONSITE MECHSUP MLOCA LTMLOCA PDSML CET (for Level 2 release categories only)

The only event trees in this linked set that required split fraction rule changes are for MLOCA (Table B.2-1) and LTMLOCA (Table B.2-2). The event trees that required macro logic changes are: PMET (Table B.2-3), EPONSITE (Table B.2-4), MLOCA (Table B.2-5), and PDSML (Table B.2-6). Only event tree PDSML required bin assignment rule changes (Table B.2-7) because it is at the end of the linked event trees for the Level 1 quantification. No changes were made to the Level 2 binning rules. The full set of event tree rules is presented in each table with the changed rules shown in red. The bin assignment rules shown in Table B.2-7 were reordered depending on the analysis outcomes being evaluated. Recall that the first binning rule satisfied when evaluating top to bottom is assigned to a given sequence.

Page 93 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree Split Rule Comment Fraction TTZ (IA=F+SPR=F)*(IB=F+SPS=F)

TTC IB=F+SPS=F TTB IA=F+SPR=F TTA 1

SGIY ILLOCA ELIMINATED SG ISOLATION FAILURES FOR LLOCA SINCE RCS ALREADY DEPRESSURIZES VERY FAST SGIZ SGIF Modified to reflect changes in REV61 Feedwater Isolation Modeling SGIC IB=F*OR=F+DB=F+SGISB Modified to reflect changes in REV61 Feedwater Isolation Modeling SGIB IA=F*OR=F+DA=F+SGISA Modified to reflect changes in REV61 Feedwater Isolation Modeling SGIA OR=S+IA=S*IB=S+DA=S*DB=

Modified to reflect changes in REV61 S

Feedwater Isolation Modeling VIA 1

SI38AZ SLBRKA*-SLBRKA REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT SI38AA 1

Si38BZ SLBRKB*-SLBRKB REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT SI38BC SLBRKA*-SLBRKA REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT SI38BB S138A=F POTENTIAL CCF THOUGH NOT MODELED SI38BA 1

SI38CZ SLBRKC*-SLBRKC REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT Page 94 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction SI38CH SLBRKB*-SLBRKB*S138A=F REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT SI38CG SLBRKB*-SLBRKB REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT SI38CF SLBRKA*-SLBRKA*SI38B=F REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT S138CE SLBRKA*-SLBRKA REMOVED DEPENDENCE ON SLBRKA,B,C, AND ADDED IT TO ACCUMULATOR RULES SEPARATELY FOR BOTH MLOCA AND LLOCA; FLOW DIVERSION HAS DIFFERENT IMPACT SI38CD S138A=F*SI38B=F POTENTIAL CCF THOUGH NOT MODELED SI38CC S138A=F POTENTIAL CCF THOUGH NOT MODELED SI38CB S138B=F POTENTIAL CCF THOUGH NOT MODELED S138CA 1

AIMLZ

((S138A=F+ACCA+SLBRKA)*(S RV51 RMTS macro added.; ADDED 138B=F+ACCB+SLBRKB)*(SI3 DEPENDENCE ON SLBRK LOCATION; AND 8C=F+ACCC+SLBRKC)+VI=F)

ADDED RESTRICTION TO MLOCA OR LLOCA

IMLOCA IES AIMLA

((S138B=F+ACCB+SLBRKB)*(S RV51 RMTS macro added.; ADDED 138C=F+ACCC+SLBRKC))*IML DEPENDENCE ON SLBRK LOCATION; AND OCA ADDED RESTRICTION TO MLOCA OR LLOCA IES AIMLB

((S138A=F+ACCA+SLBRKA)*(S RV51 RMTS macro added.; ADDED 138C=F+ACCC+SLBRKC))*IML DEPENDENCE ON SLBRK LOCATION; AND OCA ADDED RESTRICTION TO MLOCA OR LLOCA IES AIMLC

((S138A=F+ACCA+SLBRKA)*(S RV51 RMTS macro added.; ADDED 138B=F+ACCB+SLBRKB))*IML DEPENDENCE ON SLBRK LOCATION; AND OCA ADDED RESTRICTION TO MLOCA OR LLOCA IES AIMLBC (S138A=F+ACCA+SLBRKA)*IM RV51 RMTS macro added.; ADDED LOCA DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES Page 95 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction AIMLAC (S138B=F+ACCB+SLBRKB)*IM RV51 RMTS macro added.; ADDED LOCA DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES AIMLAB (S138C=F+ACCC+SLBRKC)*IM RV51 RMTS macro added.; ADDED LOCA DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES AIML IMLOCA RV51 RMTS macro added.; ADDED DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES AILLZ

((S138A=F+ACCA+SLBRKA)*(S RV51 RMTS macro added.; ADDED 138B=F+ACCB+SI38C=F+ACC DEPENDENCE ON SLBRK LOCATION; AND C+SLBRKB+SLBRKC)+(S138B ADDED RESTRICTION TO MLOCA OR LLOCA

=F+ACCB+SLBRKB)*(S138C=F IES

+ACCC+SLBRKC))*ILLOCA AILLBC (S138A=F+ACCA+SLBRKA)*IL RV51 RMTS macro added.; ADDED LOCA DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES AILLAC (S138B=F+ACCB+SLBRKB)*IL RV51 RMTS macro added.; ADDED LOCA DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES AILLAB (S138C=F+ACCC+SLBRKC)*IL RV51 RMTS macro added.; ADDED LOCA DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES AILL ILLOCA RV51 RMTS macro added.; ADDED DEPENDENCE ON SLBRK LOCATION; AND ADDED RESTRICTION TO MLOCA OR LLOCA IES CPG PGOPEN*CNTPGA*CNTPGB NO CHANGES REQUIRED FOR GSI-191 CPF PGOPEN*CNTPGB CPH PGOPEN*CNTPGA CPE PGOPEN CPC CNTPGA*CNTPGB CPB CNTPGB CPD CNTPGA CPA 1

CIZ CNTIB*(CNTIA+CNTIC)

NO CHANGES REQUIRED FOR GSI-191 CIC CNTIB CIE CNTIA*CNTIC CIB CNTIA Page 96 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction CID CNTIC CIA 1

CFZ FNCLRA*FNCLRB*FNCLRC NO CHANGES REQUIRED FOR GSI-191 CFU ACRUN*FNCLRB*FNCLRC CFT BCRUN*FNCLRB*FNCLRC CFS ABRUN*FNCLRB*FNCLRC CFR ACRUN*FNCLRA*FNCLRC CFQ BCRUN*FNCLRA*FNCLRC CFP ABRUN*FNCLRA*FNCLRC CFO ACRUN*FNCLRA*FNCLRB CFN BCRUN*FNCLRA*FNCLRB CFM ABRUN*FNCLRA*FNCLRB CFL ACRUN*FNCLRC CFK BCRUN*FNCLRC CFJ ABRUN*FNCLRC CFI ACRUN*FNCLRB CFH BCRUN*FNCLRB CFG ABRUN*FNCLRB CFF ACRUN*FNCLRA CFE BCRUN*FNCLRA CFD ABRUN*FNCLRA CFC ACRUN CFB BCRUN CFA ABRUN PAZ ECCSA NOTE: ECCSAB,C DOES NOT INCLUDE DEPENDENCE ON SLBRKA NOR S138A (BC),

LATER MUST INCLUDE IN N2 RULES AND SUCCESS MACRO FOR INJECTION PAA I

PBZ ECCSB NOTE: ECCSA,B,C DOES NOT INCLUDE DEPENDENCE ON SLBRKA NOR S138A (B,C),

LATER MUST INCLUDE IN N2 RULES AND SUCCESS MACRO FOR INJECTION PBC ECCSA PBB PA=F PBA 1

PZZ ECCSC NOTE: ECCSA,B,C DOES NOT INCLUDE DEPENDENCE ON SLBRKA NOR S138A (B,C),

LATER MUST INCLUDE IN N2 RULES AND SUCCESS MACRO FOR INJECTION Page 97 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction PZI ECCSA*ECCSB PZH ECCSB*PA=F PZG ECCSB PZF ECCSA*PB=F PZE ECCSA PZD PA=F*PB=F PZC PA=F PZB PB=F PZA 1

HAZ HHSIA+SI38A=F*-SLBRKA REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HAA 1

REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HBZ HHSIB+ SI38B=F*-SLBRKB REMOVED DEPENDENCE ON VI, ADDED SI38A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HBC HHSIA+SI38A=F*-SLBRKA REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HBB HA=F REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO Page 98 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction HBA 1

REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCZ HHSIC+SI38C=F*-SLBRKC REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCI (HHSIA+SI38A=F*-

REMOVED DEPENDENCE ON VI, ADDED SLBRKA)*(HHSIB+SI38B=F*-

S138A,B,C DEPENDENCE SINCE PUMPS SLBRKA)

FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCH (HHSIB+SI38B=F*-

REMOVED DEPENDENCE ON VI, ADDED SLBRKB)*HA=F S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCG HHSIB+SI38B=F*-SLBRKB REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCF (HHSIA+SI38A=F*-

REMOVED DEPENDENCE ON VI, ADDED SLBRKA)*HB=F S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCE HHSIA+SI38A=F*-SLBRKA REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO Page 99 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction HCD HA=F*HB=F REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCC HA=F REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCB HB=F REMOVED DEPENDENCE ON VI, ADDED SI38A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO HCA 1

REMOVED DEPENDENCE ON VI, ADDED S138A,B,C DEPENDENCE SINCE PUMPS FAIL ONLY IF NOT THE BROKEN LOOP WHEN CL VALVE FTO, LATER ASSUME CL INJECTION PATH IS NEEDED FOR SUCCESSFUL RCS INJECTION IN N2 RULE AND SUCC MACRO LAZ LHSIA+SI38A=F*-SLBRKA LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LAA 1

LBZ LHSIB+SI38B=F*-SLBRKB LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LBC LHSIA+SI38A=F*-SLBRKA LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN Page 100 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction LBB LA=F LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LBA 1

LCZ LHSIC+SI38C=F*-SLBRKC LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCI (LHSIA+SI38A=F*-

LHSIA,B,C INCLUDES RWST SUCTION ON SLBRKA)*(LHSIB+SI38B=F*-

PA AND BREAK LOCATION VIA SLBRKA, SLBRKB)

BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCH (LHSIB+S138B=F*-

LHSIA,B,C INCLUDES RWST SUCTION ON SLBRKB)*LA=F PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCG LHSIB+S138B=F*-SLBRKB LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCF (LHSIA+SI38A=F*-

LHSIA,B,C INCLUDES RWST SUCTION ON SLBRKA)*LB=F PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCE LHSIA+SI38A=F*-SLBRKA LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN Page 101 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI1191 -V02 Revision I Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction LCD LA=F*LB=F LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCC LA=F LHSIAB,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCB LB=F LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN LCA 1

LHSIA,B,C INCLUDES RWST SUCTION ON PA AND BREAK LOCATION VIA SLBRKA, BUT ONLY FOR LLOCAS, NOT MLOCAS, DELETED BREAK LOCATION DEPENDENCE FOR LLOCAS EXCEPT AS SAVING PUMP WHEN CL VALVE FAILS TO OPEN CS1AA CS = CSABC * (-

CS = CSABC and Success: CSS SUPPORT A CSCSPRYAF * -

and Success: CSS SUPPORT B and CSCSPRYBF*-

Success: CSS SUPPORT C CS CSPRYCF)

CSIAB CS = CSABC * (CSCSPRYAF CS = CSABC and Failed: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS1AC CS = CSABC * (-

CS = CSABC and Success: CSS SUPPORT A CSCSPRYAF

and Failed: CSS SUPPORT B and Success:

CSCSPRYBF*-

CSS SUPPORT C CS CSPRYCF)

CSIAD CS = CSABC * (CSCSPRYAF CS = CSABC and Failed: CSS SUPPORT A

CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CSIAE CS = CSABC * (-

CS = CSABC and Success: CSS SUPPORT A CSCSPRYAF * -

and Success: CSS SUPPORT B and Failed:

CSCSPRYBF*

CSS SUPPORT C CS CSPRYCF)

CSIAF CS = CSABC * (CSCSPRYAF CS = CSABC and Failed: CSS SUPPORT A

-CSCSPRYBF

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C Page 102 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction CSIAG CS = CSABC * (-

CS = CSABC and Success: CSS SUPPORT A CSCSPRYAF

and Failed: CSS SUPPORT B and Failed:

CSCSPRYBF*

CSS SUPPORT C CS CSPRYCF)

CSIAH CS = CSABC * (CS_CSPRYAF CS = CSABC and Failed: CSS SUPPORT A

CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CSCSPRYCF)

CSS SUPPORT C CS2AA CS = CSAB * (-CSCSPRYAF CS = CSAB and Success: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS2AB CS = CSAB * (CSCSPRYAF

CS = CSAB and Failed: CSS SUPPORT A and

-CSCSPRYBF * -

Success: CSS SUPPORT B and Success:

_CSCSPRYCF)

CSS SUPPORT C CS2AC CS = CSAB * (-CS_CSPRYAF CS = CSAB and Success: CSS SUPPORT A

CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS2AD CS = CSAB * (CS CSPRYAF

CS = CSAB and Failed: CSS SUPPORT A and CSCSPRYBF * -

Failed: CSS SUPPORT B and Success: CSS CS CSPRYCF)

SUPPORT C CS2AE CS = CSAB * (-CS_CSPRYAF CS = CSAB and Success: CSS SUPPORT A

-CSCSPRYBF*

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS2AF CS = CSAB * (CSCSPRYAF

CS = CSAB and Failed: CSS SUPPORT A and

-CSCSPRYBF

Success: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS2AG CS = CSAB * (-CS_CSPRYAF CS = CSAB and Success: CSS SUPPORT A

CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS2AH CS = CSAB * (CSCSPRYAF

CS = CSAB and Failed: CSS SUPPORT A and CSCSPRYBF

Failed: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS3AA CS = CSAC * (-CS_CSPRYAF CS = CSAC and Success: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS3AB CS = CSAC * (CSCSPRYAF

CS = CSAC and Failed: CSS SUPPORT A and

-CSCSPRYBF * -

Success: CSS SUPPORT B and Success:

_CS CSPRYCF)

CSS SUPPORT C CS3AC CS = CSAC * (-CS_CSPRYAF CS = CSAC and Success: CSS SUPPORT A

CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS3AD CS = CSAC * (CSCSPRYAF

CS = CSAC and Failed: CSS SUPPORT A and CSCSPRYBF * -

Failed: CSS SUPPORT B and Success: CSS CS CSPRYCF)

SUPPORT C CS3AE CS = CSAC * (-CSCSPRYAF CS = CSAC and Success: CSS SUPPORT A

-CS CSPRYBF

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS3AF CS = CSAC * (CSCSPRYAF

CS = CSAC and Failed: CSS SUPPORT A and

-CSCSPRYBF

Success: CSS SUPPORT B and Failed: CSS ICS CSPRYCF)

SUPPORT C Page 103 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191-V02 Revision I Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction CS3AG CS = CSAC * (-CS_CSPRYAF CS = CSAC and Success: CSS SUPPORT A

CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS3AH CS = CSAC * (CSCSPRYAF

CS = CSAC and Failed: CSS SUPPORT A and CS CSPRYBF

Failed: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS4AA CS = CSBC * (-CSCSPRYAF CS = CSBC and Success: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS4AB CS = CSBC * (CSCSPRYAF

CS = CSBC and Failed: CSS SUPPORT A and

-CSCSPRYBF * -

Success: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS4AC CS = CSBC * (-CSCSPRYAF CS = CSBC and Success: CSS SUPPORT A

CSCSPRYBF* -

and Failed: CSS SUPPORT B and Success:

CSCSPRYCF)

CSS SUPPORT C CS4AD CS = CSBC * (CSCSPRYAF

CS = CSBC and Failed: CSS SUPPORT A and CSCSPRYBF * -

Failed: CSS SUPPORT B and Success: CSS CS CSPRYCF)

SUPPORT C CS4AE CS = CSBC * (-CSCSPRYAF CS = CSBC and Success: CSS SUPPORT A

-CSCSPRYBF

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS4AF CS = CSBC * (CSCSPRYAF

CS = CSBC and Failed: CSS SUPPORT A and

-CS_CSPRYBF

Success: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS4AG CS = CSBC * (-CS_CSPRYAF CS = CSBC and Success: CSS SUPPORT A

CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS4AH CS = CSBC * (CSCSPRYAF

CS = CSBC and Failed: CSS SUPPORT A and CSCSPRYBF

Failed: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS5AA CS = CSA * (-CSCSPRYAF

CS = CSA and Success: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS5AB CS = CSA * (CSCSPRYAF * -

CS = CSA and Failed: CSS SUPPORT A and CSCSPRYBF * -

Success: CSS SUPPORT B and Success:

CSCSPRYCF)

CSS SUPPORT C CS5AC CS = CSA * (-CSCSPRYAF

CS = CSA and Success: CSS SUPPORT A CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS5AD CS = CSA * (CSCSPRYAF

CS = CSA and Failed: CSS SUPPORT A and CSCSPRYBF * -

Failed: CSS SUPPORT B and Success: CSS CS CSPRYCF)

SUPPORT C CS5AE CS = CSA * (-CSCSPRYAF

CS = CSA and Success: CSS SUPPORT A

-CSCSPRYBF

and Success: CSS SUPPORT B and Failed:

ICS CSPRYCF)

CSS SUPPORT C CS5AF CS = CSA * (CSCSPRYAF * -

CS = CSA and Failed: CSS SUPPORT A and CSCSPRYBF

Success: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C Page 104 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction CS5AG CS = CSA * (-CSCSPRYAF

CS = CSA and Success: CSS SUPPORT A CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS5AH CS = CSA * (CSCSPRYAF

CS = CSA and Failed: CSS SUPPORT A and CSCSPRYBF

Failed: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS6AA CS = CSB * (-CSCSPRYAF

CS = CSB and Success: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS6AB CS = CSB * (CSCSPRYAF * -

CS = CSB and Failed: CSS SUPPORT A and CSCSPRYBF * -

Success: CSS SUPPORT B and Success:

CSCSPRYCF)

CSS SUPPORT C CS6AC CS = CSB * (-CSCSPRYAF

CS = CSB and Success: CSS SUPPORT A CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS6AD CS = CSB * (CSCSPRYAF

CS = CSB and Failed: CSS SUPPORT A and CSCSPRYBF * -

Failed: CSS SUPPORT B and Success: CSS CS CSPRYCF)

SUPPORT C CS6AE CS = CSB * (-CSCSPRYAF

CS = CSB and Success: CSS SUPPORT A

-CSCSPRYBF

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS6AF CS = CSB * (CSCSPRYAF * -

CS = CSB and Failed: CSS SUPPORT A and CSCSPRYBF

Success: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS6AG CS = CSB * (-CSCSPRYAF

CS = CSB and Success: CSS SUPPORT A CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS6AH CS = CSB * (CSCSPRYAF

CS = CSB and Failed: CSS SUPPORT A and CSCSPRYBF

Failed: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS7AA CS = CSC * (-CSCSPRYAF

CS = CSC and Success: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS7AB CS = CSC * (CSCSPRYAF * -

CS = CSC and Failed: CSS SUPPORT A and CSCSPRYBF * -

Success: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS7AC CS = CSC * (-CSCSPRYAF

CS = CSC and Success: CSS SUPPORT A CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS7AD CS = CSC * (CSCSPRYAF

CS = CSC and Failed: CSS SUPPORT A and CSCSPRYBF * -

Failed: CSS SUPPORT B and Success: CSS CS CSPRYCF)

SUPPORT C CS7AE CS = CSC * (-CSCSPRYAF

CS = CSC and Success: CSS SUPPORT A

-CSCSPRYBF

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS7AF CS = CSC * (CSCSPRYAF * -

CS = CSC and Failed: CSS SUPPORT A and CSCSPRYBF

Success: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C Page 105 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-1 Split Fraction Rule Changes for MLOCA Event Tree (Continued)

Split Rule Comment Fraction CS7AG CS = CSC * (-CS CSPRYAF

CS = CSC and Success: CSS SUPPORT A CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS7AH CS = CSC * (CSCSPRYAF

CS = CSC and Failed: CSS SUPPORT A and CSCSPRYBF

Failed: CSS SUPPORT B and Failed: CSS CS CSPRYCF)

SUPPORT C CS8AA CS = CSNO * (-CSCSPRYAF CS = CSNO and Success: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS8AB CS = CSNO * (CSCSPRYAF

CS = CSNO and Failed: CSS SUPPORT A

-CSCSPRYBF * -

and Success: CSS SUPPORT B and CS CSPRYCF)

Success: CSS SUPPORT C CS8AC CS = CSNO * (-CSCSPRYAF CS = CSNO and Success: CSS SUPPORT A

CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS8AD CS = CSNO * (CSCSPRYAF

CS = CSNO and Failed: CSS SUPPORT A CSCSPRYBF * -

and Failed: CSS SUPPORT B and Success:

CS CSPRYCF)

CSS SUPPORT C CS8AE CS = CSNO * (-CSCSPRYAF CS = CSNO and Success: CSS SUPPORT A

-CSCSPRYBF

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS8AF CS = CSNO * (CSCSPRYAF

CS = CSNO and Failed: CSS SUPPORT A

-CSCSPRYBF

and Success: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS8AG CS = CSNO * (-CSCSPRYAF CS = CSNO and Success: CSS SUPPORT A

CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C CS8AH CS = CSNO * (CSCSPRYAF

CS = CSNO and Failed: CSS SUPPORT A CSCSPRYBF

and Failed: CSS SUPPORT B and Failed:

CS CSPRYCF)

CSS SUPPORT C OSIZ CS=CSABC OPERATOR ACTION ONLY CREDITED FOR STATE WITH ALL THREE SPRAY TRAINS INJECTING, STATE CSABC OSIY 1

ADDED FOR COMPLETENESS BUT OPERATOR ACTION IS NOT ASKED FOR STATES OTHER THAN WITH ALL 3 TRAINS OF SPRAY INJECTING Page 106 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA Split Rule Comment Fraction N2Z (S138A=F+PA=F+HA=F+SLBR "Modified for Hot Leg and Accumulator KA+HHSIA)*(SI38B=F+PB=F+

changes"; FOR GSI191,ADDED LOGIC FOR HB=F+SLBRKB+HHSIB)*(SI38 BREAK TRAIN LOCATION SINCE NOW C=F+PZ=F+

EXCLUDED FROM MACROS S138A,B,C; HC=F+SLBRKC+HHSIC)*IMLO ALSO ADDED LOGIC FOR LHSI SINCE CA+VI=F+AI=F+(SI38A=F+PA=

MOVED UP TO EARLY TREE,LHSI AND F+LA=F+SLBRKA+LHSIA)*(SI3 HHSI CONSIDERED SEPARATELY 8B=F+PB=F+LB=F+SLBRKB+L HSIB)*(S138C=F+PZ=F+LC=F+

SLBRKC+LHSIC)

N2Y 1

AND ADDED DEPENDENCE ON HHSI ONLY FOR MLOCA SINCE THIS TREE NOW SHARED WITH LLOCA; ALSO ADDED ACCUMULATOR DEPENDENCE SINCE MISSING FROM REV 6 AND REV 7.1 (THOUGH INCLUDED IN MACRO SUCCESS)

RAZ SWA+ECCSA SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RAA 1

SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RBZ SWB+ECCSB SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RBC SWA+ECCSA SWA,B,C MACROS ALSO INCLUDES PAB,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RBB RA=F SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS Page 107 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA (Continued)

Split Rule Comment Fraction RBA 1

SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCZ SWC+ECCSC SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCJ (SWA+ECCSA)*(SWB+ECCSB SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCH (SWB+ECCSB)*RA=F SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCG SWB+ECCSB SWA,B,C MACROS ALSO INCLUDES PAB,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCF (SWA+ECCSA)*RB=F SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCE SWA+ECCSA SWA,B,C MACROS ALSO INCLUDES PA,BC=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCD RA=F*RB=F SWA,B,C MACROS ALSO INCLUDES PA,BC=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS Page 108 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA (Continued)

Split Rule Comment Fraction RCC RA=F SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCB RB=F SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS RCA 1

SWA,B,C MACROS ALSO INCLUDES PA,B,C=F; THAT'S OK BUT; DROPPING S138A,B,C=F DEPENDENCE WHICH IS NOT REQUIRED FOR CONTAINMENT SPRAY, ECCSA,B,C CONSIDERS SICOMA,B,C AND SUPPORTS OFFSZ 1

DUMMY AWAITING REAL VALUES FROM CASA GRANDE SUMPY INIT=MLBASE+INIT=ML2BAS+

NO SUMP FAILURES IF EXCLUDE GSI-191 INIT=LLBASE+INIT=LL2BAS PHENOMENA SUML1 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 SUMP PLUGGING

STRNRID1 SUML9 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 SUMP PLUGGING

STRNRID9 SUML22 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 SUMP PLUGGING

STRNRID22 SUML26 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 SUMP PLUGGING

STRNRID26 SUML43 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 SUMP PLUGGING

STRNRID43 SULL1 (INIT=LLOCA+INIT=LLOCA2)*

MLOCA WITH GSI-191 SUMP PLUGGING STRNRID1 SULL9 (INIT=LLOCA+INIT=LLOCA2)*

MLOCA WITH GSI-191 SUMP PLUGGING STRNRID9 SULL22 (INIT=LLOCA+INIT=LLOCA2)*

MLOCA WITH GSI-191 SUMP PLUGGING STRNRID22 SULL26 (INIT=LLOCA+INIT=LLOCA2)*

MLOCA WITH GSI-191 SUMP PLUGGING STRNRID26 SULL43 (INIT=LLOCA+INIT=LLOCA2)*

MLOCA WITH GSI-191 SUMP PLUGGING STRNRID43 SUMPZ 1

DEFAULT FOR REMAINING 64-16=48 PUMP COMBINATION CASE IDS HLEGY IMLOCA *-IMLOCA NOW ASKING HLEG SWITCHOVER FOR BOTH LLOCA AND MLOCA; STPREV7.1 ASSUMPTION DID NOT REQUIRE FOR MLOCA Page 109 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA (Continued)

Split Rule Comment Fraction HLEGZ HLEGA*HLEGB*HLEGC REWRITTEN FROM LLOCA RULES TO REFLECT HL SWITCHOVER GUIDANCE, IF NO TRAINS AVAILABLE THEN FAIL HLEGZ HLEGA*HLEGB FAIL IF ONLY 1 TRAIN AVAILABLE SINCE 2

+HLEGA*HLEGC REQUIRED BY PROCEDURE

+HLEGB*HLEGC HLEGAB

(-HLEGA*-HLEGB*-HLEGC*-

3 TRAINS AVAILABLE AND SWITCH 2 BY SLBRKA*-SLBRKB)

PROCEDURE, NEITHER IS BROKEN LOOP, A&B PREFRRED TO SWITCH HLEGA

(-HLEGA*HLEGB*-HLEGC*-

A AND ONE OTHER TRAIN AVAILABLE AND SLBRKA)+ (-HLEGA*-

TRAIN A NOT BROKEN OR ALL 3 HLEGB*HLEGC*-SLBRKA) +(-

AVAILABLE BUT B TRAIN BROKEN HLEGA*-HLEGB*-HLEGC*-

SLBRKA*SLBRKB)

HLEGB (HLEGA*-HLEGB*-HLEGC*-

B AND C TRAINS AVAILABLE AND B NOT SLBRKB) + (-HLEGA*-

BROKEN, B PREFERRED IF A HLEGB*-HLEGC*SLBRKA*-

UNAVAILABLE OR ALL 3 AVAILABLE BUT SLBRKB)

BUT A BROKEN HLEGZ 1

ALL OTHER CASES NOT SUCCESS, MUST HAVE TWO AVAILABLE AND ASSUME BROKEN LOOP NOT KNOWN FWY INIT=MLBASE+INIT=ML2BAS+

NO CORE FLOW BLOCKAGE FAILURES IF INIT=LLBASE+INIT=LL2BAS EXCLUDE GSI-191 PHENOMENA; I.E. BAS OR BASE IES FML1 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 CORE FLOW

VESSELID1 BLOCKAGE FML9 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 CORE FLOW

VESSELID9 BLOCKAGE FML22 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 CORE FLOW

VESSELID22 BLOCKAGE FML26 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 CORE FLOW

VESSELID26 BLOCKAGE FML43 (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 CORE FLOW

VESSELID43 BLOCKAGE FLL1 (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 CORE FLOW VESSELID1 BLOCKAGE FLL9 (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 CORE FLOW VESSELID9 BLOCKAGE FLL22 (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 CORE FLOW VESSELID22 BLOCKAGE FLL26 (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 CORE FLOW VESSELID26 BLOCKAGE FLL43 (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 CORE FLOW VESSELID43 BLOCKAGE FWZ 1

DEFAULT FOR REMAINING 64-16=48 PUMP COMBINATION CASE IDS BORON (INIT=MLBASE+INIT=ML2BAS IF GSI-191 PHENOMENA EXCLUDED, AND Y

+INIT=LLBASE+INIT=LL2BAS)

HLEG=S THEN NO CHANCE OF BORON

_*HLEG=S PRECIPITATION.

Page 110 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA (Continued)

Split Rule Comment Fraction BORML (INIT=MLBASE+INIT=ML2BAS)

IF GSI-191 PHENOMENA EXCLUDED, AND

HLEG=F HLEG=F THEN CHANCE OF BORON PRECIPITATION DETERMINED BY COLD LEG FRACTION FOR MLOCAS.

BORLL (INIT=LLBASE+INIT=LL2BAS)*

IF GSI-191 PHENOMENA EXCLUDED, AND HLEG=F HLEG=F THEN CHANCE OF BORON PRECIPITATION DETERMINED BY COLD LEG FRACTION FOR LLOCAS.

BORML (INIT=MLOCA+INIT=MLOCA2)

IF GSI-191 PHENOMENA INCLUDED, AND

HLEG=F HLEG=F THEN CHANCE OF BORON PRECIPITATION LIMITED BY COLD LEG FRACTION FOR MLOCAS.

BORLL (INIT=LLOCA+INIT=LLOCA2)*

IF GSI-191 PHENOMENA INCLUDED, AND HLEG=F HLEG=F THEN CHANCE OF BORON PRECIPITATION LIMITED BY COLD LEG FRACTION FOR LLOCAS.

BML1 F (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID1*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR MLOCAS.

BML9F (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID9*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR MLOCAS.

BML22F (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID22*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR MLOCAS.

BML26F (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID26*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR MLOCAS.

BML43F (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID43*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR MLOCAS.

BLL1 F (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-1 91 PHENOMENA VESSELID1*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR LLOCAS.

Page 111 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA (Continued)

Split Rule Comment Fraction BLL9F (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID9*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR LLOCAS.

BLL22F (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-1 91 PHENOMENA VESSELID22*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR LLOCAS.

BLL26F (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID26*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR LLOCAS.

BLL43F (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID43*HLEG=F INCLUDED, AND HLEG=F,THEN CHANCE OF BORON PRECIPITATION ALSO INCLUDES COLD LEG FRACTION FOR LLOCAS.

BML1S (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID1*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BML9S (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID9*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BML22S (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID22*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BML26S (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID26*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BML43S (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA

VESSELID43*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BLLI S (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID1*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BLL9S (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID9*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER Page 112 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA (Continued)

Split Rule Comment Fraction BLL22S (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID22*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BLL26S (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID26*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWlTCHOVER BLL43S (INIT=LLOCA+INIT=LLOCA2)*

LLOCA WITH GSI-191 PHENOMENA VESSELID43*HLEG=S INCLUDED, AND HLEG=S,ONLY EARLY CHANCE OF BORON PRECIPITATION INCLUDED, BEFORE HLEG SWITCHOVER BMLGF (INIT=MLOCA+INIT=MLOCA2)

MLOCA WITH GSI-191 PHENOMENA INCLUDED, PUMP COMBINATION STATE DEFAULT FOR EARLY CHANCE OF BORON PRECIPITATION = CL FRACTION FOR MLOCAS, INDEPENDENT OF HLEG SWITCHOVER BLLGF (INIT=LLOCA+INIT=LLOCA2)

LLOCA WITH GSI-191 PHENOMENA INCLUDED, PUMP COMBINATION STATE DEFAULT FOR EARLY CHANCE OF BORON PRECIPITATION = CL FRACTION FOR LLOCAS, INDEPENDENT OF HLEG SWITCHOVER RXZ (PA=F+HXA+LA=F+RA=F ADDED IN CL INJECTION VALVES S138A,B,C

+S138A=F FOR LHSI, PA,B,C=F; AND POTENTIAL FOR

+SLBRKA+LHSIA)*(PB=F+HX SLBRKA,B,C SINCE INTERESTED IN B+LB=F+RB=F+S138B=F AVOIDING CORE DAMAGE HERE, ALSO

+SLBRKB+LHSIB)*(PZ=F+HX ADDED SUMP=F FROM GS1191 BUT LEFT C+LC=F+RC=F+S138C=F OUT FUEL BLOCKAGE OR BORON

+SLBRKC+LHSIC) + SUMP=F PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C RX1A (PA=F+HXA+LA=F+RA=F+S13 ADDED IN CL INJECTION VALVES S138A,B,C 8A=F+SLBRKA+LHSIA)*(PB=F FOR LHSI, PA,B,C=F; AND POTENTIAL FOR

+HXB+LB=F+RB=F+S138B=F+

SLBRKA,B,C SINCE INTERESTED IN SLBRKB+LHSIB)

AVOIDING CORE DAMAGE HERE, ALSO ADDED SUMP=F FROM GSI191 BUT LEFT OUT FUEL BLOCKAGE OR BORON PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C RX1B (PA=F+HXA+LA=F+RA=F+S13 ADDED IN CL INJECTION VALVES S138A,B,C 8A=F+SLBRKA+LHSIA)*(PZ=F FOR LHSI, PA,B,C=F; AND POTENTIAL FOR

+HXC+LC=F+RC=F+S138C=F+

SLBRKA,B,C SINCE INTERESTED IN SLBRKC+LHSIC)

AVOIDING CORE DAMAGE HERE, ALSO ADDED SUMP=F FROM GS1191 BUT LEFT OUT FUEL BLOCKAGE OR BORON PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C Page 113 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-2 Split Fraction Rule Changes for Event Tree LTMLOCA (Continued)

Split Rule Comment Fraction RX1A (PB=F+HXB+LB=F+RB=F+S13 ADDED IN CL INJECTION VALVES S138A,B,C 8B=F+SLBRKB+LHSIB)*(PZ=F FOR LHSI, PA,B,C=F; AND POTENTIAL FOR

+HXC+LC=F+RC=F+S138C=F+

SLBRKA,B,C SINCE INTERESTED IN SLBRKC+LHSIC)

AVOIDING CORE DAMAGE HERE, ALSO ADDED SUMP=-F FROM GS1191 BUT LEFT OUT FUEL BLOCKAGE OR BORON PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C RX2BC PA=F+HXA+LA=F+RA=F+S138 ADDED IN CL INJECTION VALVES S138A,B,C A=F+SLBRKA+LHSIA FOR LHSI, PA,B,C=F; AND POTENTIAL FOR SLBRKA,B,C SINCE INTERESTED IN AVOIDING CORE DAMAGE HERE, ALSO ADDED SUMP=F FROM GS1191 BUT LEFT OUT FUEL BLOCKAGE OR BORON PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C RX2AC PB=F+HXB+LB=F+RB=F+S138 ADDED IN CL INJECTION VALVES S138A,B,C B=F+SLBRKB+LHSIB FOR LHSI, PA,B,C=F; AND POTENTIAL FOR SLBRKA,B,C SINCE INTERESTED IN AVOIDING CORE DAMAGE HERE, ALSO ADDED SUMP--F FROM GS1191 BUT LEFT OUT FUEL BLOCKAGE OR BORON PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C RX2AB PZ=F+HXC+LC=F+RC=F+S138 ADDED IN CL INJECTION VALVES S138A,B,C C=F+SLBRKC+LHSIC FOR LHSI, PA,B,C=F; AND POTENTIAL FOR SLBRKA,B,C SINCE INTERESTED IN AVOIDING CORE DAMAGE HERE, ALSO ADDED SUMP=F FROM GS1191 BUT LEFT OUT FUEL BLOCKAGE OR BORON PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C RX3 1

ADDED IN CL INJECTION VALVES S138A,B,C FOR LHSI, PA,B,C=F; AND POTENTIAL FOR SLBRKA,B,C SINCE INTERESTED IN AVOIDING CORE DAMAGE HERE, ALSO ADDED SUMP=-F FROM GS1191 BUT LEFT OUT FUEL BLOCKAGE OR BORON PRECIPITATION, ADDED PMET GENST MACROS: LHSIA,B,C see comment DELETED ALL WI AND CSR SFS SINCE NO LONGER NEEDED, SPRAY IS NOW ALWAYS ASKED IN THE EARLY MLOCA TREE, AND RECIRC IS DETERMINED BY MACROS AFTER RECIRCULATION QUESTIONS ASKED Page 114 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I Table B.2-3 Changes to Macro Rules for Event Tree PMET Event Tree Macro Rule Comment PMET ABRUN Macro ABRUN sets initial plant support configuration. In (TYPE=F+TYPE=S)+GENST=CFCORR+GE this configuration trains A&B of EW, EABHVAC, NST=MSNPM1+GENST=GENS3+GENST=

CRHVAC, and ECH running, Train A COW and Train B GENS6+GENST=GENS9+GENST=GENS12 CVCS are running PMET BCRUN Macro BCRUN sets initial plant support configuration. In (TYPE=F+TYPE=S)+GENST=MSNPM2+GE this configuration trains B&C of EW, EABHVAC, NST=GENS1+GENST=GENS4+GENST=GE CRHVAC, and ECH running, Train B CCW and Train B NS7+GENST=GENS1 0+GENST=GENS1 3 CVCS are running PMET ACRUN Macro ACRUN sets initial plant support configuration. In (TYPE=F+TYPE=S)+GENST=MSNPM3+GE this configuration trains A&C of EW, EABHVAC, NST=GENS2+GENST=GENS5+GENST=GE CRHVAC, and ECH running, Train C CCW and Train A NS8+GENST=GENS1 1 CVCS are running PMET PGOPEN

-(TYPE=F + TYPE=S)

Allows a quantification to be performed assuming the Supplemental Purge Line is open 100% of the time, and is used for quantifying individual maintenance states PMET BUSF

-(TYPE=F + TYPE=S)

RV51 RMTS macro, 13.8kV Standby Bus F supply to ElA PMET BUSG

-(TYPE=F + TYPE=S)

RV51 RMTS macro, 13.8kV Standby Bus G supply to E1B PMET BUSH

-(TYPE=F + TYPE=S)

RV51 RMTS macro, 13.8kV Standby Bus H supply to ElC PMET EDAM

-(TYPE=F + TYPE=S)

RV51 RMTS macro, 4.16kV Bus EIA PMET E1BM

-(TYPE=F + TYPE=S)

RV51 RMTS macro, 4.16kV Bus E1B PMET E1CM

-(TYPE=F + TYPE=S)

RV51 RMTS macro, 4.16kV Bus ElC PMET MLOEW1 INIT=LOECW1 + INIT=LEW1 L2 +

Tracks the status of support system initiators, one train INIT=LOECW4 + INIT=LEW4L2 +

of ECW INIT=LOECW7 + INIT=LEW7L2 PMET MLOEW2 INIT=LOECW2 + INIT=LEW2L2 +

Tracks the status of support system initiators, two trains INIT=LOECW5 + INIT=LEW5L2 +

of ECW INIT=LOECW8 + INIT=LEW8L2 Page 115 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET MLOEW3 INIT=LOECW3 + INIT=LEW3L2 +

Tracks the status of support system initiators, three INIT=LOECW6 + INIT=LEW6L2 +

trains of ECW INIT=LOECW9 + INIT=LEW9L2 PMET MLOCW1 INIT=LOCCW1 + INIT=LCC1 L2 +

Tracks the status of support system initiators, one train INIT=LOCCW4 + INIT=LCC4L2 +

of CCW INIT=LOCCW7 + INIT=LCC7L2 PMET MLOCW2 INIT=LOCCW2 + INIT=LCC2L2 +

Tracks the status of support system initiators, two trains INIT=LOCCW5 + INIT=LCC5L2 +

of CCW INIT=LOCCW8 + INIT=LCC8L2 PMET MLOCW3 INIT=LOCCW3 + INIT=LCC3L2 +

Tracks the status of support system initiators, three INIT=LOCCW6 + INIT=LCC6L2 +

trains of CCW INIT=LOCCW9 + INIT=LCC9L2 PMET MLOCR1 INIT=LOCR1 + INIT=LCR1L2 + INIT=LOCR4 Tracks the status of support system initiators, one train

+ INIT=LCR4L2 + INIT=LOCR7 +

of CR HVAC INIT=LCR7L2 PMET MLOCR2 INIT=LOCR2 + INIT=LCR2L2 + INIT=LOCR5 Tracks the status of support system initiators, two trains

+ INIT=LCR5L2 + INIT=LOCR8 +

of CR HVAC INIT=LCR8L2 PMET MLOCR3 INIT=LOCR3 + INIT=LCR3L2 + INIT=LOCR6 Tracks the status of support system initiators, three

+ INIT=LCR6L2 + INIT=LOCR9 +

trains of CR HVAC INIT=LCR9L2 PMET MLOEB1 INIT=LOEAB1 + INIT=LEB1L2 +

Tracks the status of support system initiators, one train INIT=LOEAB4 + INIT=LEB4L2 +

of EAB HVAC INIT=LOEAB7 + INIT=LEB7L2 PMET MLOEB2 INIT=LOEAB2 + INIT=LEB2L2 +

Tracks the status of support system initiators, two trains INIT=LOEAB5 + INIT=LEB5L2 +

of EAB HVAC INIT=LOEAB8 + INIT=LEB8L2 PMET MLOEB3 INIT=LOEAB3 + INIT=LEB3L2 +

Tracks the status of support system initiators, three INIT=LOEAB6 + INIT=LEB6L2 +

trains of EAB HVAC INIT=LOEAB9 + INIT=LEB9L2 PMET SSPSR

-(TYPE=F+TYPE=S)

Logic Train R maintenance PMET SSPSS

-(TYPE=F+TYPE=S)

Logic Train S maintenance Page 116 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET ESFA

-(TYPE=F+TYPE=S)

ESF Actuation Train A maintenance PMET ESFB

-(TYPE=F+TYPE=S)

ESF Actuation Train B maintenance PMET ESFC

-(TYPE=F+TYPE=S)

ESF Actuation Train C maintenance PMET SEQA

-(TYPE=F+TYPE=S)

Load Sequencer Train A maintenance PMET SEQB

-(TYPE=F+TYPE=S)

Load Sequencer Train B maintenance PMET SEQC

-(TYPE=F+TYPE=S)

Load Sequencer Train C maintenance PMET CFCA

-(TYPE=F+TYPE=S) + GENST=GENS1 RV6-modified GENST assignment. Used for planned maintenance of RCFC Train A PMET CFCA1

-(TYPE=F+TYPE=S) + GENST=GENS1 RV6-modified GENST assignment. This macro is not yet assigned. It models the planned maintenance of RCFC Fan Unit 11A PMET CFCA2

-(TYPE=F+TYPE=S) + GENST=GENS1 RV6-modified GENST assignment. This macro is not yet assigned. It models the planned maintenance of RCFC Fan Unit 12A PMET CFCB

-(TYPE=F+TYPE=S) + GENST=GENS2 RV6-modified GENST assignment. Used for planned maintenance of RCFC Train B PMET CFCB1

-(TYPE=F+TYPE=S) + GENST=GENS2 RV6-modified GENST assignment. This macro is not yet assigned. It models the planned maintenance of RCFC Fan Unit 11B PMET CFCB2

-(TYPE=F+TYPE=S) + GENST=GENS2 RV6-modified GENST assignment. This macro is not yet assigned. It models the planned maintenance of RCFC Fan Unit 12B PMET CFCC

-(TYPE=F+TYPE=S) + GENST=GENS3 RV6-modified GENST assignment. Used for planned maintenance of RCFC Train C PMET CFCC1

-(TYPE=F+TYPE=S) + GENST=GENS3 RV6-modified GENST assignment. This macro is not yet assigned. It models the planned maintenance of RCFC Fan Unit 11C PMET CFCC2

-(TYPE=F+TYPE=S) + GENST=GENS3 RV6-modified GENST assignment. This macro is not yet assigned. It models the planned maintenanceof RCFC Fan Unit 12C Page 117 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision I Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET HEA

-(TYPE=F+TYPE=S) + GENST=GENS4 Applies to maintenance on EAB HVAC Train A PMET HEB

-(TYPE=F+TYPE=S) + GENST=GENS5 Applies to maintenance on EAB HVAC train B PMET HEC

-(TYPE=F+TYPE=S) + GENST=GENS6 Applies to maintenance on EAB HVAC train C PMET EWA

-(TYPE=F+TYPE=S) + GENST=GENS1 +

Applies to maintenance on ECW train A. Added CCA, CCA

CHA300

DGA CHA300 and DGA to eliminate feedback during planned maintenance PMET EWB

-(TYPE=F+TYPE=S) + GENST=GENS2 +

Applies to maintenance on ECW train B Added CCB, CCB

CHB300

DGB CHB300 and DGB to eliminate feedback during planned maintenance PMET EWC

-(TYPE=F+TYPE=S) + GENST=GENS3 +

Applies to maintenance on ECW train C Added CCC, CCC

CHC300

DGC CHC300 and DGC to eliminate feedback during planned maintenance PMET CCA

-(TYPE=F+TYPE=S) + GENST=GENS1 RV6-modified GENST assignment. Applies to maintenance on CCW train A PMET CCB

-(TYPE=F+TYPE=S) + GENST=GENS2 RV6-modified GENST assignment. Applies to maintenance on CCW train B PMET CCC

-(TYPE=F+TYPE=S) + GENST=GENS3 RV6-modified GENST assignment. Applies to maintenance on CCW train C PMET CHA300

-(TYPE=F+TYPE=S) + GENST=GENS1 +

RV6-modified GENST assignment. Applies to GENST=GENS4 maintenance on ECH Train A or 300 ton chiller PMET CHB300

-(TYPE=F+TYPE=S) + GENST=GENS2 +

RV6-modified GENST assignment. Applies to GENST=GENS5 maintenance on ECH Train B or 300 ton chiller PMET CHC300

-(TYPE=F+TYPE=S) + GENST=GENS3 +

RV6-modified GENST assignment. Applies to GENST=GENS6 maintenance on ECH Train C or 300 ton chiller PMET DGA

-(TYPE=F+TYPE=S) + GENST=GENS1 RV6-modified GENST assignment. Applies to maintenance on emergency diesel generator train A PMET DGB

-(TYPE=F+TYPE=S) + GENST=GENS2 RV6-modified GENST assignment. Applies to maintenance on emergency diesel generator train B Page 118 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET DGC

-(TYPE=F+TYPE=S) + GENST=GENS3 RV6-modified GENST assignment. Applies to maintenance on emergency diesel generator train C PMET TSCDG

-(TYPE=F+TYPE=S)

Applies to maintenance on TSC diesel generator PMET BOPDG

-(TYPE=F+TYPE=S)

Applies to maintenance on BOP diesel generator PMET IA1 1

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument air compressor 11(21)

PMET IA12

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument air compressor 12(22)

PMET IA13

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument air compressor 13(23)

PMET IA14

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument air compressor 14(24), diesel backed PMET PDP

-(TYPE=F+TYPE=S)

Applies to maintenance on PD Pump PMET SICOMA

-(TYPE=F+TYPE=S) + GENST=GENS7 Applies to maintenance on Sl Common Train A PMET SICOMB

-(TYPE=F+TYPE=S) + GENST=GENS8 Applies to maintenance on Sl Common Train B PMET SICOMC

-(TYPE=F+TYPE=S) + GENST=GENS9 Applies to maintenance on Sl Common Train C PMET HHA

-(TYPE=F+TYPE=S) + GENST=GENS7 Applies to maintenance on HHSI train A PMET HHB

-(TYPE=F+TYPE=S) + GENST=GENS8 Applies to maintenance on HHSI train B PMET HHC

-(TYPE=F+TYPE=S) + GENST=GENS9 Applies to maintenance on HHSI train C PMET LHA

-(TYPE=F+TYPE=S) + GENST=GENS7 RV6-modified GENST assignment. Applies to maintenance on LHSI train A PMET LHB

-(TYPE=F+TYPE=S) + GENST=GENS8 RV6-modified GENST assignment. Applies to maintenance on LHSI train B PMET LHC

-(TYPE=F+TYPE=S) + GENST=GENS9 RV6-modified GENST assignment. Applies to maintenance on LHSI train C PMET ACCA

-(TYPE=F+TYPE=S)

RV51 RMTS macro, SI Accumulator A PMET ACCB

-(TYPE=F+TYPE=S)

RV51 RMTS macro, SI Accumulator B Page 119 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GS1191 -V02 Revision 1 Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET ACCC

-(TYPE=F+TYPE=S)

RV51 RMTS macro, SI Accumulator C PMET CSA

-(TYPE=F+TYPE=S) + GENST=GENS7 Applies to maintenance on CS train A PMET CSB

-(TYPE=F+TYPE=S) + GENST=GENS8 Applies to maintenance on CS train B PMET CSC

-(TYPE=F+TYPE=S) + GENST=GENS9 Applies to maintenance on CS train C PMET CVA

-(TYPE=F+TYPE=S) + GENST=GENS3 RV6-modified GENST assignment. Applies to maintenance on charging pump A (C elect. power)

PMET CVB

-(TYPE=F+TYPE=S) + GENST=GENS1 RV6-modified GENST assignment. Applies to maintenance on charging pump B (A elect power)

PMET RHRA

-(TYPE=F+TYPE=S) + GENST=GENS1 RV6-modified GENST assignment. Applies to maintenance on RHR train A PMET RHRB

-(TYPE=F+TYPE=S) + GENST=GENS2 RV6-modified GENST assignment. Applies to maintenance on RHR train B PMET RHRC

-(TYPE=F+TYPE=S) + GENST=GENS3 RV6-modified GENST assignment. Applies to maintenance on RHR train C PMET PZPRVA

-(TYPE=F+TYPE=S)

Applies to maintenance on pressurizer PORV A PMET PZPRVB

-(TYPE=F+TYPE=S)

Applies to maintenance on pressurizer PORV B PMET MSISA

-(TYPE=F+TYPE=S)

RV51 RMTS macro, MS Isolation signal train A PMET MSISB

-(TYPE=F+TYPE=S)

RV51 RMTS macro, MS Isolation signal train B PMET SGISA

-(TYPE=F+TYPE=S)

REV61 macro, FW/MS Isolation signal train A PMET SGISB

-(TYPE=F+TYPE=S)

REV61 macro, FW/MS Isolation signal train B PMET SGPRVA

-(TYPE=F+TYPE=S) + GENST=GENS10 Applies to maintenance on SG A PORV PMET SGPRVB

-(TYPE=F+TYPE=S) + GENST=GENS1 1 Applies to maintenance on SG B PORV PMET SGPRVC

-(TYPE=F+TYPE=S) + GENST=GENS12 Applies to maintenance on SG C PORV PMET SGPRVD

-(TYPE=F+TYPE=S) + GENST=GENS13 Applies to maintenance on SG D PORV PMET AFWA

-(TYPE=F+TYPE=S) + GENST=GENS10 Applies to maintenance on AFW Train A PMET AFWB

-(TYPE=F+TYPE=S) + GENST=GENS1 1 Applies to maintenance on AFW Train B Page 120 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GS1191 -V02 Revision 1 Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET AFWC

-(TYPE=F+TYPE=S) + GENST=GENS12 Applies to maintenance on AFW Train C PMET AFWD

-(TYPE=F+TYPE=S) + GENST=GENS13 Applies to maintenance on AFW Train D PMET QDAM

-(TYPE=F+TYPE=S)

Applies to maintenance on QDPS Train A PMET QDBM

-(TYPE=F+TYPE=S)

Applies to maintenance on QDPS Train B PMET QDCM

-(TYPE=F+TYPE=S)

Applies to maintenance on QDPS Train C PMET QDDM

-(TYPE=F+TYPE=S)

Applies to maintenance on QDPS Train D PMET INSTIM

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument inverter Channel 1

PMET INST2M

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument inverter Channel 2

PMET INST3M

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument inverter Channel 3

PMET INST4M

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument inverter Channel 4

PMET INSTA

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument bus Channel 1 PMET INSTB

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument bus Channel 2 PMET INSTC

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument bus Channel 3 PMET INSTD

-(TYPE=F+TYPE=S)

Applies to maintenance on instrument bus Channel 4 PMET DCTA

-(TYPE=F+TYPE=S)

Planned maintenance on DC Battery ElAl 1 PMET DCTB

-(TYPE=F+TYPE=S)

Planned maintenance on DC Battery El B1 1 PMET DCTC

-(TYPE=F+TYPE=S)

Planned maintenance on DC Battery ElC1l PMET DCTD

-(TYPE=F+TYPE=S)

Planned maintenance on DC Battery ElD11 PMET SXAM

-(TYPE=F+TYPE=S)

Planned Maintenance on Station Auxiliary Transformer A

PMET SXBM

-(TYPE=F+TYPE=S)

Planned Maintenance on Station Auxiliary Transformer B

PMET ETRANS

-(TYPE=F+TYPE=S)

Applies to maintenance on emergency transformer PMET CRA

-(TYPE=F+TYPE=S)

Applies to maintenance on Control Room HVAC train A PMET CRB

-(TYPE=F+TYPE=S)

Applies to maintenance on Control Room HVAC train B Page 121 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI19I-V02 Revision I Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET CRC

-(TYPE=F+TYPE=S)

Applies to maintenance on Control Room HVAC train C PMET EW1TRN EWA*EWB + EWA*EWC + EWB*EWC This macro is used to imply 2 ECW trains out of service due to maintenance PMET EW2TRN EWA*-(EWB+EWC) + EWB*-(EWA+EWC) +

This macro is used to imply 1 ECW train out of service EWC*-(EWA+EWB) due to maintenance PMET EW3TRN

-(EWA+EWB+EWC)

This macro represents all ECW trains available PMET CC1TRN CCA*CCB + CCA*CCC + CCB*CCC +

This macro is used to imply 2 CCW trains out of service EWA*EWB + EWA*EWC + EWB*EWC due to maintenance PMET CC2TRN CCA*-(CCB+CCC) + CCB*-(CCA+CCC) +

This macro is used to imply 1 CCW train out of service CCC*-(CCA+CCB) + EWA*-(EWB+EWC) +

due to maintenance EWB*-(EWA+EWC) + EWC*-(EWA+EWB)

PMET CC3TRN

-(CCA+CCB+CCC+EWA+EWB+EWC)

This macro represents all CCW trains available PMET CR1TRN CRA*CRB + CRA*CRC + CRB*CRC This macro is used to imply 2 CR HVAC trains out of service due to maintenance PMET CR2TRN CRA*-(CRB+CRC) + CRB*-(CRA+CRC) +

This macro is used to imply 1 CR HVAC train out of CRC*-(CRA+CRB) service due to maintenance PMET CR3TRN

-(CRA+CRB+CRC)

This macro represents all CR HAVC trains available PMET HE1TRN HEA*HEB + HEA*HEC + HEB*HEC This macro is used to imply 2 EAB HVAC trains out of service due to maintenance PMET HE2TRN HEA*-(HEB+HEC) + HEB*-(HEA+HEC) +

This macro is used to imply 1 EAB HVAC train out of HEC*-(HEA+HEB) service due to maintenance PMET HE3TRN

-(HEA+HEB+HEC)

This macro represents all EAB HVAC trains available PMET AMSAC

-(TYPE=F+TYPE=S)

AMSAC not available PMET RTRIPR

-(TYPE=F+TYPE=S)

RV51 RMTS macro, Reactor Trip actuation signal train R

PMET RTRIPS

-(TYPE=F+TYPE=S)

RV51 RMTS macro, Reactor Trip actuation signal train S

Page 122 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSII9 I-V02 Revision 1 Table B.2-3 Changes to Macro Rules for Event Tree PMET (Continued)

Event Tree Macro Rule Comment PMET CIPHAA

-(TYPE=F+TYPE=S)

RV51 RMTS macro, Containment Isolation Phase A signal train A PMET CIPHAB

-(TYPE=F+TYPE=S)

RV51 RMTS macro, Containment Isolation Phase A signal train B PMET CIPHAC

-(TYPE=F+TYPE=S)

RV51 RMTS macro, Containment Isolation Phase A signal train C PMET BLOCKA

-(TYPE=F+TYPE=S)

Pressurizer PORV 655A Train A blocked, only applicable when TYPE=F (CRMP or MAS models)

PMET BLOCKB

-(TYPE=F+TYPE=S)

Pressurizer PORV 656A Train B blocked, only applicable when TYPE=F (CRMP or MAS models)

PMET BLKAOPEN

-(TYPE=F+TYPE=S)

Pressurizer PORV 655A block valve stuck open - added for CRMP PMET BLKBOPEN

-(TYPE=F+TYPE=S) ressurizer PORV 656A block valve stuck open - added for CRMP PMET SGMSSV

-(TYPE=F+TYPE=S)

RV51 RMTS macro, SG Safety Relieve Valve(s)

PMET DCBUSA

-(TYPE=F+TYPE=S)

RV6 RMTS macro, DC BUS ElAl1 PMET DCBUSB

-(TYPE=F+TYPE=S)

RV6 RMTS macro, DC BUS E1B11 PMET DCBUSC

-(TYPE=F+TYPE=S)

RV6 RMTS macro, DC BUS E1C11 PMET DCBUSD

-(TYPE=F+TYPE=S)

RV6 RMTS macro, DC BUS ElD11 PMET SMKPGALL

-(TYPE=F+TYPE=S)

RV6 macro, EAB HVAC Smoke Purge function - all trains (impact on DMZ split fraction)

Page 123 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE Event Tree Macro Rule Comment EPONSITE PZRLP ISLOCA+IILOCA+ISGTR+IRCRV+IRCPL Macro identifies initiators assumed to initiate SI only as a result of Low Pressurizer Pressure. For SSPS split fractions EPONSITE LOCA IMLOCA+ILLOCA+IELOCA+IRCR2 Other LOCA Initiators EPONSITE SINJ PZRLP+ISLBD+ISLBI+LOCA SI Initiating Events EPONSITE ACTRNA EA=F*-(GA=F)+BF=F*-(GA=S+OM=S)*-

Train A Essential AC Power fails if the bus is failed or EMXFA+IZ071X offsite power is not available and EDG A is not available and the emergency transformer is not available for Train A

EPONSITE ACTRNB EB=F*-(GB=F)+BG=F*-(GB=S+OM=S)*-

Defines failure for Train B Essential AC Power. Same EMXFB+IZ071X+IZ047X+IZ047B+IZ47BC conditions as for Train A applied to Train B EPONSITE ACTRNC EC=F*-(GC=F)+BH=F*-(GC=S+OM=S)*-

Defines failure for Train A Essential AC Power. Same EMXFC+IZ071X+IZ047X+IZ47BC conditions as for Train A applied to Train C EPONSITE INST1 EA=F*DA=F+SIV=F+INST1 M*(EA=F+OG=F Instrument Channel I Support. Power to QDPS Train A.

+BF=F+UA=F)+INSTA Added maintenance macros INSTIM and INSTA.

EPONSITE INST2 EA=F*DD=F+SIV=F+INST2M*(EA=F+OG=F Instrument Channel II Support. Power to QDPS Train D.

+BF=F+UA=F)+INSTB Added maintenance macros INST2M and INSTB.

EPONSITE INST3 EB=F*DB=F+SIV=F+INST3M*(EB=F+OG=F Instrument Channel III Support. Power to QDPS Train B.

+BG=F+SXA=F*SXB=F)+INSTC Added maintenance macros INST3M and INSTC.

EPONSITE INST4 EC=F*DC=F+SIV=F+INST4M*(EC=F+OG=F Instrument Channel IV Support. Power to QDPS Train

+BH=F+UA=F)+INSTD C. Added maintenance macros INST4M and INSTD.

Page 124 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic-Risk Analysis RI-GSI 19 1 -V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE DGAGF IFL26+IFLECW+ILOECW+SDG=F+DGA+E DGA failure due to support. Rev 5. RV6 RMTS macro WA+IHWIND+DCTA+DCBUSA+DA=F+IZ07 added lx EPONSITE DGBGF IFL26+IFLECW+ILOECW+SDG=F+DGB+E DGB failure due to support. IZ047X fails associated WB+IHWIND+DCTB+DCBUSB+DB=F+IZ04 4.16kV bus. Rev 5. RV6 RMTS macro added 7X+IZ071 X+IZ47BC+IZ047B EPONSITE DGCGF IFL26+IFLECW+ILOECW+SDG=F+DGC+E DGC failure due to support. IZ047X fails associated WC+IHWIND+DCTC+DCBUSC+DC=F+IZ04 4.16kV bus. Rev 5. RV6 RMTS macro added 7X+IZ071X+IZ47BC EPONSITE DGALL GA=F*GB=F*GC=F Failure of all three EDGs (any cause)

EPONSITE DG2 GA=F*(GB=F+GC=F)+GB=F*GC=F Failure of any two EDGs (any cause)

EPONSITE DG1 GA=F+GB=F+GC=F Failure of any EDG (any cause)

EPONSITE DGMAINT DGA+DCTA+DCBUSA+EWA+DGB+DCTB+

Maintenance on any EDG or ECW Train, RV6 added DCBUSB+EWB+DGC+DCTC+DCBUSC+E DC WC EPONSITE DGMNT2 (DGA+DCTA+DCBUSA+EWA)*(DGB+DCTB Maintenance on combinations of 2 EDG/ECW Trains,

+DCBUSB+EWB+DGC+DCTC+DCBUSC+E RV6 added DC WC)+(DGB+DCTB+DCBUSB+EWB)*(DGC+

DCTC+DCBUSC+EWC)

EPONSITE EMXFA BF=F*-EMXFC*GA=F*OX=S Emergency Transformer status for Train A. Bus F fails, EDG A isunavailable, and operator action to load the Emergency Transformer on Train A. Train C is assumed to have power. Macro is True if Transformer is available and aligned to Train A.

EPONSITE EMXFB BG=F*-(EMXFA+EMXFC)*GB=F*OX=S Emergency Transformer status for Train B. Bus G fails, EDG B is unavailable, and operator action to load the Emergency Transformer on Train B. Trains A and C are assumed to have power. Macro isTrue if Transformer is available and aligned to Train Page 125 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSl191-V02 Revision I Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE EMXFC BH=F*GC=F*OX=S Emergency Transformer status for Train C. Bus H fails, EDG C isunavailable, and operator action to load the Emergency Transformer on Train C. Train C is assumed to have the highest priority, then A then B.

Macro is True if Transformer is available EPONSITE ECWA ACTRNA+(BF=F+BCRUN)*(DA=F+IA=F*OR Defines failure for Train A ECW

=F)+EWA EPONSITE ECWB ACTRNB+(BG=F+ACRUN)*(DB=F+IB=F*OR Defines failure for Train B ECW

=F)+EWB EPONSITE ECWC ACTRNC+(BH=F+ABRUN)*(DC=F+IC=F*O Defines failure for Train C ECW R=F)+EWC EPONSITE FANFA ACTRNA+(BF=F+BCRUN)*(DA=F+IA=F*OR Defines failure for Train A EAB HVAC

=F)+RESA+HEA EPONSITE FANFB ACTRNB+(BG=F+ACRUN)*(DB=F+IB=F*OR Defines failure for Train B EAB HVAC

=F)+RESB+HEB EPONSITE FANFC ACTRNC+(BH=F+ABRUN)*(DC=F+IC=F*O Defines failure for Train C EAB HVAC R=F)+RESC+HEC EPONSITE CCWA ACTRNA+(BF=F+BCRUN+ACRUN)*(DA=F+

Defines failure for Train A CCW IA=F*OR=F)+WA=F+EBHVAC+CCA+ILOCC W+IZ1470 EPONSITE CCWB ACTRNB+(BG=F+ACRUN+ABRUN)*(DB=F Defines failure for Train B CCW

+IB=F*OR=F)+WB=F+EBHVAC+CCB+ILOC CW+IZ1470 EPONSITE CCWC ACTRNC+(BH=F+ABRUN+BCRUN)*(DC=F Defines failure for Train C CCW

+IC=F*OR=F)+WC=F+EBHVAC+CCC+ILOC CW+IZ1470 EPONSITE INEA ACTRNA+IA=F*OR=F+RESA Defines failure for Train A Non-essential CCW EPONSITE INEB ACTRNB+IB=F*OR=F+RESB Defines failure for Train B Non-essential CCW EPONSITE INEC ACTRNC+IC=F*OR=F+RESC+IZ1470 Defines failure for Train C Non-essential CCW EPONSITE MSIF IZ047X+(DA=F+IA=F*OR=F+MSISA)*(DB=F MSIV Isolation signal failure or failure of MSIV support.

+IB=F*OR=F+MSlSB)*-ILOIA RV51 added RMTS macro Page 126 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GS119 1-V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE SGIF IZ047X+(DA=F+IA=F*OR=F+MSISA)*(DB=F Added in REV61. Copied from REV6 Macro MSIF.

+IB=F*OR=F+MSISB)*-ILOIA FW/MSIV Isolation signal failure or failure of FW/MSIV support. RV51 added RMTS macro EPONSITE SGPVA AFAS+SGPRVA+QA=F+AC1=F Defines failure for Train A SG PORV. Modified to reflect failure of QDPS Train A EPONSITE SGPVB AFBS+SGPRVB+QB=F+AC3=F Defines failure for Train B SG PORV. Modified to reflect failure of QDPS Train B EPONSITE SGPVC AFCS+SGPRVC+QC=F+AC4=F Defines failure for Train C SG PORV. Modified to reflect failure of QDPS Train C EPONSITE SGPVD AFDS+ACTRNA+RESA+EBHVAC+SGPRV Defines failure for Train D SG PORV. Modified to reflect D+QD=F+AC2=F failure of QDPS Train D EPONSITE AFAS ACTRNA+DA=F+IA=F*AM=F*OR=F+RESA+

Defines failure for Train A AFW Pump.

EBHVAC+AFWA+IFR23+ILOCR*OR=F+SA F=F+IFR10+SLBRKA EPONSITE AFBS ACTRNB+DB=F+IB=F*AM=F*OR=F+RESB+

Defines failure for Train B AFW Pump.

EBHVAC+AFWB+IFR23+ILOCR*OR=F+SA F=F+IFR10+SLBRKB EPONSITE AFCS ACTRNC+DC=F+IC=F*AM=F*OR=F+RESC Defines failure for Train C AFW Pump.

+EBHVAC+AFWC+IFR23+ILOCR*OR=F+S AF=F+IFR10+SLBRKC EPONSITE AFDS DD=F+IA=F*AM=F*OR=F+AFWD+IFR23+IL Defines failure for Train D AFW Pump.

OCR*OR=F+SAF=F+SGI=F+SLBRKD+IZ07 1x EPONSITE AFWS AFA=F*AFB=F*AFC=F*AFD=F AFW System Failure EPONSITE PORVA DA=F+EBHVAC+PZPRVA Defines failure for Train A Pressurizer PORV EPONSITE PORVB DB=F+EBHVAC+PZPRVB+IZ047B+IZ47BC Defines failure for Train B Pressurizer PORV

+IZ047X EPONSITE LTDNCA IC=F*OR=F Page 127 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision I Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE ECCSA ACTRNA+DA=F+IA=F*OR=F+RESA+EBHV Failure of ECCS common train A AC+SICOMA+(ECA=F*-ECHA)*(ECB=F*-

ECHB)*(ECC=S+BCRUN*(ECC=F*-ECHC))

EPONSITE ECCSB ACTRNB+DB=F+IB=F*OR=F+RESB+EBHV Failure of ECCS common train B AC+SICOMB+(ECA=F*-ECHA)*(ECB=F*-

ECHB)*(ECC=F*-ECHC)*PA=S EPONSITE ECCSC ACTRNC+DC=F+IC=F*OR=F+RESC+EBHV Failure of ECCS common train C AC+SICOMC+((ECA=F*-ECHA)*((ECB=F*-

ECHB)+(ECC=F*-ECHC))+(ECB=F*-

ECHB)*(ECC=F*-

ECHC))*PA=S*PB=S+(ECA=F*-

ECHA)*(ECB=F*-ECHB)*(ECC=F*-

ECHC)*(PA=S+PB=S)

EPONSITE LHSIA ECCSA+PA=F+LHA+IZ071X+IZ1470 Failure of HHSI Train, REMOVED DEPENDENCE ON SLBRKA,B,C FOR LLOCA. (WAS NEVER THERE FOR MLOCAS)

EPONSITE LHSIB ECCSB+PB=F+LHB+IZ071X Failure of LHSI Train, REMOVED DEPENDENCE ON SLBRKA,B,C FOR LLOCA. (WAS NEVER THERE FOR MLOCAS)

EPONSITE LHSIC ECCSC+PZ-F+LHC+IZ071X Failure of LHSI Train, REMOVED DEPENDENCE ON SLBRKA,B,C FOR LLOCA. (WAS NEVER THERE FOR MLOCAS)

EPONSITE HHSIA ECCSA+PA=F+HHA+IZ1470 Failure of HHSI Train, REMOVED DEPENDENCE ON SLBRKA,B,C FOR MLOCA.

EPONSITE HHSIB ECCSB+PB=F+HHB Failure of HHSI Train, REMOVED DEPENDENCE ON SLBRKA,B,C FOR MLOCA.

EPONSITE HHSIC ECCSC+PZ=F+HHC Failure of HHSI Train, REMOVED DEPENDENCE ON SLBRKA,B,C FOR MLOCA.

Page 128 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE CSPRYA ECCSA+PA=F+CSA+IZ1470 Failure of CSS Train A, TO BE USED IN TOP EVENT CS BOUNDARY CONDITION LOGIC EPONSITE CSPRYB ECCSB+PB=F+CSB Failure of CSS Train B, TO BE USED IN TOP EVENT CS BOUNDARY CONDITION LOGIC EPONSITE CSPRYC ECCSC+PZ=F+CSC Failure of CSS Train C, TO BE USED IN TOP EVENT CS BOUNDARY CONDITION LOGIC EPONSITE LATESPRYA RA=S*SPRYAS*PA=S*-SICOMA*-OS1=S*-

TRAIN A SPRAY AVAILABLE FOR RECIRCULATION, OFFS=S ASSUME TRAIN A IS TURNED OFF EARLY WHEN PROCEDURES FOLLOWED EPONSITE LATESPRYB RB=S*SPRYBS*PB=S*-SICOMB*-OFFS=S TRAIN B SPRAY AVAILABLE FOR RECIRCULATION EPONSITE LATESPRYC RC=S*SPRYCS*PZ=S*-SICOMC*-OFFS=S TRAIN C SPRAY AVAILABLE FOR RECIRCULATION EPONSITE LATESPRYO

(-LATESPRYA*-LATESPRYB*-

0 TRAINS OF SPRAY RUNNING LATESPRYC)

EPONSITE LATESPRY1 (LATESPRYA*-LATESPRYB*-

I TRAY OF SPRAY RUNNING FOR RECIRCULATION LATESPRYC+ LATESPRYB*-

LATESPRYA*-LATESPRYC+

LATESPRYC*-LATESPRYB*-LATESPRYA)

EPONSITE LATESPRY2 (LATESPRYA*LATESPRYB*-

2 TRAINS WOF SPRAY RUNNING FOR LATESPRYC+ LATESPRYB*-

RECIRCULATION LATESPRYA*LATESPRYC+

LATESPRYC*-LATESPRYB*LATESPRYA)

EPONSITE LATESPRY3 LATESPRYA*LATESPRYB*LATESPRYC 3 TRAINS OF SPRAY RUNNING FOR RECIRCULATION EPONSITE NOSPRYA CS=CSBC+CS=CSB+CS=CSC+CS=CSNO MACROS FOR WHEN SPRAY TRAINS ARE NOT OPERATING FOR INJECTION IN TOP EVENT CS, A TRAIN ASSUMED SECURED BY OSI=S EPONSITE NOSPRYB CS=CSAC+CS=CSA+CS=CSC+CS=CSNO MACROS FOR WHEN SPRAY TRAINS ARE NOT OPERATING FOR INJECTION IN TOP EVENT CS Page 129 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE NOSPRYC CS=CSAB+CS=CSA+CS=CSB+CS=CSNO MACROS FOR WHEN SPRAY TRAINS ARE NOT OPERATING FOR INJECTION IN TOP EVENT CS EPONSITE SPRYAS CS=CSABC+CS=CSAB+CS=CSAC+CS=C MACROS FOR WHEN SPRAY TRAINS ARE SA OPERATING FOR INJECTION IN TOP EVENT CS EPONSITE SPRYBS CS=CSABC+CS=CSAB+CS=CSBC+CS=C MACROS FOR WHEN SPRAY TRAINS ARE SB OPERATING FOR INJECTION IN TOP EVENT CS EPONSITE SPRYCS CS=CSABC+CS=CSAC+CS=CSBC+CS=C MACROS FOR WHEN SPRAY TRAINS ARE SC OPERATING FOR INJECTION IN TOP EVENT CS EPONSITE LATEHSIAS RA=S*-HHSIA*PA=S*HA=S*-SICOMA ASSUME SUMP VALVES AND HHSI PUMPS REQUIRED BUT NOT CL INJECTION VALVES NOR INTACT LOOP EPONSITE LATEHSIBS RB=S*.HHSIB*PB=S*HB=S*-SICOMB ASSUME SUMP VALVES AND HHSI PUMPS REQUIRED BUT NOT CL INJECTION VALVES NOR INTACT LOOP EPONSITE LATEHSICS RC=S*-HHSIC*PZ=S*HC=S*-SICOMC ASSUME SUMP VALVES AND HHSI PUMPS REQUIRED BUT NOT CL INJECTION VALVES NOR INTACT LOOP EPONSITE LATEHHSIO

(-LATEHSIAS*-LATEHSIBS*-LATEHSICS) 0 TRAINS OF HHSI RUNNING IN RECIRCULATION EPONSITE LATEHHSI1 (LATEHSIAS*-LATEHSIBS*-LATEHSICS+

I TRAY OF HHSI RUNNING FOR RECIRCULATION LATEHSIBS*-LATEHSIAS*-LATEHSICS+

LATEHSICS*-LATEHSIBS*-LATEHSlAS)

EPONSITE LATEHHS12 (LATEHSIAS*LATEHSIBS*-LATEHSICS+

2 TRAINS OF HHSI RUNNING FOR RECIRCULATION LATEHSIBS*-LATEHSIAS*LATEHSICS+

LATEHSICS*-LATEHSIBS*LATEHSIAS)

EPONSITE LATEHHSI3 LATEHSIAS*LATEHSIBS*LATEHSICS 3 TRAINS OF HHSI RUNNING FOR RECIRCULATION Page 130 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 19 1-V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE LATELSIAS RA=S*-LHSIA*PA=S*LA=S*-SICOMA ASSUME SUMP VALVES AND HHSI PUMPS REQUIRED BUT NOT CL INJECTION VALVES NOR INTACT LOOP EPONSITE LATELSIBS RB=S*-LHSIB*PB=S*LB=S*-SICOMB ASSUME SUMP VALVES AND HHSI PUMPS REQUIRED BUT NOT CL INJECTION VALVES NOR INTACT LOOP EPONSITE LATELSICS RC=S*-LHSIC*PZ=S*LC=S*-SICOMC ASSUME SUMP VALVES AND HHSI PUMPS REQUIRED BUT NOT CL INJECTION VALVES NOR INTACT LOOP EPONSITE LATELHSIo

(-LATELSIAS*-LATELSIBS*-LATELSICS) 0 TRAINS OF HHSI RUNNING IN RECIRCULATION EPONSITE LATELHSII (LATELSIAS*-LATELSIBS*-LATELSICS+

1 TRAY OF LHSI RUNNING FOR RECIRCULATION LATELSIBS*-LATELSIAS*-LATELSICS+

LATELSICS*-LATELSIBS*-LATELSIAS)

EPONSITE LATELHSI2 (LATELSIAS*LATELSIBS*-LATELSlCS+

2 TRAINS OF LHSI RUNNING FOR RECIRCULATION LATELSIBS*-LATELSIAS*LATELSlCS+

LATELSICS*-LATELSIBS*LATELSIAS)

EPONSITE LATELHSI3 LATELSIAS*LATELSIBS*LATELSICS 3 TRAINS OF LHSI RUNNING FOR RECIRCULATION EPONSITE PUMPIDI LATEHHSl3*LATELHSI3*LATESPRY3 PUMP COMBINATION STATE:=H3L3S3SUCC EPONSITE PUMPID22 LATEHHSI2*LATELHSl2*LATESPRY2 PUMP COMBINATION STATE:-H2L2S2SUCC EPONSITE PUMPID5 LATEHHSl3*LATELHSl2*LATESPRY3 PUMP COMBINATION STATE:=H3L2S3SUCC EPONSITE PUMPID2 LATEHHSI3*LATELHSI3*LATESPRY2 PUMP COMBINATION STATE:-H3L3S2SUCC EPONSITE PUMPID17 LATEHHSl2*LATELHSI3*LATESPRY3 PUMP COMBINATION STATE:=H2L3S3SUCC EPONSITE PUMPID21 LATEHHSI2*LATELHSI2*LATESPRY3 PUMP COMBINATION STATE:-H2L2S3SUCC EPONSITE PUMPID23 LATEHHSl2*LATELHSl2*LATESPRY1 PUMP COMBINATION STATE:=H2L2S1SUCC EPONSITE PUMPID3 LATEHHSI3*LATELHSI3*LATESPRY1 PUMP COMBINATION STATE:=H3L3S1SUCC EPONSITE PUMPID26 LATEHHSI2*LATELHSII*LATESPRY2 PUMP COMBINATION STATE:=H2L1S2SUCC EPONSITE PUMPID6 LATEHHSl3*LATELHSl2*LATESPRY2 PUMP COMBINATION STATE:-H3L2S2SUCC Page 131 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GS1191 -V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE PUMPID43 LATEHHSII*LATELHSII*LATESPRY1 PUMP COMBINATION STATE:-HIL1SISUCC EPONSITE PUMPID38 LATEHHSII*LATELHSI2*LATESPRY2 PUMP COMBINATION STATE:=H1 L2S2SUCC EPONSITE PUMPID9 LATEHHSI3*LATELHSII*LATESPRY3 PUMP COMBINATION STATE:=H3L1S3SUCC EPONSITE PUMPID33 LATEHHSII*LATELHSI3*LATESPRY3 PUMP COMBINATION STATE:-H1L3S3SUCC EPONSITE PUMPID18 LATEHHSI2*LATELHSl3*LATESPRY2 PUMP COMBINATION STATE:=H2L3S2SUCC EPONSITE PUMPID4 LATEHHSl3*LATELHSI3*LATESPRYO PUMP COMBINATION STATE:-H3L3S0SUCC EPONSITE STRNRID1 PUMPIDI+PUMPID2+PUMPID4 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR STRAINER FAILURE EPONSITE STRNRID9 PUMPID9+PUMPID33 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR STRAINER FAILURE EPONSITE STRNRID22 PUMPID22+PUMPID5+PUMPID17+PUMPI PUMP COMBINATIONS MAPPED TO CASA GRANDE D21+PUMPID3+PUMPID6+PUMPID18 CASES FOR STRAINER FAILURE EPONSITE STRNRID26 PUMPID26+PUMPID23+PUMPID38 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR STRAINER FAILURE EPONSITE STRNRID43 PUMPID43 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR STRAINER FAILURE EPONSITE VESSELID1 PUMPIDI+PUMPID2 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR IN-VESSEL FAILURE EPONSITE VESSELID9 PUMPID9+PUMPID5+PUMPID17+PUMPID PUMP COMBINATIONS MAPPED TO CASA GRANDE 3+PUMPID6+PUMPID33+PUMPID18+PUM CASES FOR IN-VESSEL FAILURE PID4 EPONSITE VESSELID22 PUMPID22+PUMPID21 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR IN-VESSEL FAILURE EPONSITE VESSELID26 PUMPID26+PUMPID23+PUMPID38 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR IN-VESSEL FAILURE EPONSITE VESSELID43 PUMPID43 PUMP COMBINATIONS MAPPED TO CASA GRANDE CASES FOR IN-VESSEL FAILURE Page 132 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE CNTPGA IA=F*OR=F+CIPHAA Defines failure for Train A Containment Purge, RV51 added RMTS macro EPONSITE CNTPGB ACTRNB+IB=F*OR=F+RESB+EBHVAC+CI Defines failure for Train B Containment Purge, RV51 PHAB added RMTS macro EPONSITE CNTIA ACTRNA+IA=F*OR=F+RESA+EBHVAC+IZO Defines failure for Train A Containment Isolation, RV51 71X+IZ1470+CIPHAA added RMTS macro EPONSITE CNTIB ACTRNB+IB=F*OR=F+RESB+EBHVAC+CI Defines failure for Train B Containment Isolation, RV51 PHAB added RMTS macro EPONSITE CNTIC ACTRNC+IC=F*OR=F+RESC+EBHVAC+IZ Defines failure for Train C Containment Isolation, RV51 071X+CIPHAC added RMTS macro EPONSITE SWA ACTRNA+IA=F*OR=F+RESA+EBHVAC+PA Defines failure for Train A SI Recirculation

=F+IZ1470 EPONSITE SWB ACTRNB+IB=F*OR=F+RESB+EBHVAC+PB Defines failure for Train B SI Recirculation

=F EPONSITE SWC ACTRNC+IC=F*OR=F+RESC+EBHVAC+PZ Defines failure for Train C SI Recirculation EPONSITE LOOPGNR IELOOPG*OGR=F*OM=F Grid Related LOOP not recovered REV. 7 EPONSITE LOOPPNR IELOOPP*OGR=F*OM=F Plant Centered LOOP not recovered REV. 7 EPONSITE LOOPSNR IELOOPS*OGR=F*OM=F Switchyard Centered LOOP not recovered REV. 7 EPONSITE LOOPWNR IELOOPW*OGR=F*OM=F Weather Related LOOP not recovered REV. 7 EPONSITE HLEGA LA=F+RA=F+PA=F+S138A=F+LHSIA AVAILABILITY OF LHSI TRAIN A,B, OR C FOR HOT LEG, ASUME CL INJECTION PATH MUST HAVE WORKED; BREAK LOCATION UNKNOWN TO OPERATORS Page 133 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI191-V02 Revision 1 Table B.2-4 Changes to Macro Rules for Event Tree EPONSITE (Continued)

Event Tree Macro Rule Comment EPONSITE HLEGB LB=F+RB=F+PB=F+S138B=F+LHSIB AVAILABILITY OF LHSI TRAIN A,B, OR C FOR HOT LEG, ASUME CL INJECTION PATH MUST HAVE WORKED; BREAK LOCATION UNKNOWN TO OPERATORS EPONSITE HLEGC LC=F+RC=F+PZ=F+S138C=F+LHSIC AVAILABILITY OF LHSI TRAIN A,B, OR C FOR HOT LEG, ASUME CL INJECTION PATH MUST HAVE WORKED; BREAK LOCATION UNKNOWN TO OPERATORS Page 134 of 256

South Texas Project Risk-Informed GSI-191 Evaluation Volume 2: Probabilistic Risk Analysis RI-GSI 191 -V02 Revision 1 Table B.2-5 Changes to Macro Rules for Event Tree MLOCA Event Tree Macro Rule Comment MLOCA CSCSPRYAF CSPRYA CSS SUPPORT A MLOCA CSCSPRYBF CSPRYB CSS SUPPORT B MLOCA CSCSPRYCF CSPRYC CSS SUPPORT C Page 135 of 256

ML13175A235

Text

Navigation menu

Search