ML17038A307

Final ASP Analysis- Catawba 1 (LER 413-2016-001)

ML17038A307
Person / Time
Site:	Catawba
Issue date:	04/13/2017
From:	Mark Thaggard NRC/RES/DRA
To:
C. Hunter 415-1394
Shared Package
ML17038A305	List: ML17038A307
References
IR 2016002, LER 413-2016-001
Download: ML17038A307 (10)

Text

Final Precursor Analysis Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Mis-Positioned Breaker with Concurrent Emergency Diesel Catawba Nuclear Generator Unavailability Results in Potential Loss of Recirculation Station, Unit 1 Capability LERs: 413-2016-001 Event Date: 3/28/2016 CDP = 1x10-6 IRs: 05000413/2016002 Plant Type: Pressurized-Water Reactor (PWR); Westinghouse Four-Loop with a Wet, Ice Condenser Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% Reactor Power)

Analyst: Reviewer: Contributors: BC Review Date:

Christopher Hunter Ian Gifford N/A 1/18/2017 EXECUTIVE

SUMMARY

On March 28, 2016, while performing an emergency core cooling system (ECCS) interlock test, operators determined that breaker 1EMXD-F02A for the residual heat removal (RHR) pump B hot-leg suction valve 1ND-36B was open. Breaker 1EMXD-F02A is required to be closed in Modes 1-3 of plant operation to provide an interlock with the RHR supply valve to safety injection (SI) pump B (1NI-136B), which operators must manually open for high-pressure, cold leg-recirculation. An investigation determined that the last operation of 1EMXD-F02A was during the previous refueling outage (December 2015). During this exposure period, emergency diesel generator (EDG) A was declared inoperable for approximately 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br />. An alternate interlock for 1NI-136B is provided by the other RHR pump B hot-leg suction valve 1ND-37A; however, this redundant signal could be lost during a postulated loss of offsite power (LOOP) and unavailability of EDG A. Therefore, if high-pressure, cold-leg recirculation were needed to mitigate a postulated a loss-of-coolant accident (LOCA) or provide sustained feed and cooling during a concurrent LOOP with EDG A unavailability, ECCS train B would be unavailable.

According to the risk analysis modeling assumptions used in this Accident Sequence Precursor (ASP) analysis, the most likely core damage scenario is a loss of 4.16kV bus A with subsequent failure of auxiliary feedwater (AFW), successful initiation of feed and bleed cooling, and failure of high-pressure recirculation (for sustained operation). In addition to the unavailability of the ECCS recirculation train B, this scenarios risk significance is largely attributed to Catawbas AFW system design of a single motor-driven (train B) and single turbine-driven pump (train A).

A Green finding (i.e., very low safety significance) was identified due to the licensee failure to adequately implement procedures for operation of the RHR system. This licensee performance deficiency led to breaker 1EMXD-F02A being left open during plant startup, resulting in ECCS train B inoperability for greater than the allowed outage time per plant technical specifications.

Risk assessments performed as part of the Significance Determination Process (SDP) are limited to the analysis of individual performance deficiencies. An independent ASP analysis is required because EDG A was unavailable concurrently with breaker 1EMXD-F02A being open.

1

LER 413-2016-001 EVENT DETAILS Event Description. On March 28, 2016, while performing an interlock test on ECCS cold-leg recirculation train 1B, operators determined that that breaker 1EMXD-F02A for the RHR pump B hot-leg suction valve 1ND-36B was open. Breaker 1EMXD-F02A is required to be closed in Modes 1-3 of plant operation to provide an interlock with the RHR supply valve to SI pump B (1NI-136B), which operators must manually open for high-pressure, cold-leg recirculation (i.e.,

piggyback mode of recirculation). Therefore, ECCS train 1B was declared inoperable. An investigation determined that the last operation of 1EMXD-F02A was during the previous refueling outage on December 13, 2015.

During this exposure period, EDG 1A was declared inoperable on five separate occasions for a total of approximately 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br />. With breaker 1EMXD-F02A opened and EDG 1A unavailable to perform its safety function, cold-leg recirculation could be rendered unavailable during a postulated LOOP with concurrent LOCA.

Additional information is provided in Licensee Event Report (LER) 413/2016-001 (Ref.1) and Inspection Report (IR) 05000413/2016002 (Ref. 2).

Cause. The test procedure for pressure boundary valve testing did not contain specific guidance for establishing a suction source for RHR pump 1B; therefore, coordination was required with the standby readiness alignment procedure. The lack of specific procedural guidance allowed breaker 1EMXD-F02A to remain open. In addition, there was ineffective coordination by licensee personnel while performing both procedures. Note that there is no control room indication for the position of breaker 1EMXD-F02A.

Simplified RHR System Drawing. A simplified drawing of the Catawba, Unit 1 RHR systems drawing is shown in Figure B-1 in Appendix B.

MODELING ASSUMPTIONS Analysis Type. The Catawba Standardized Plant Analysis Risk (SPAR) Model Version 8.20 dated May 20, 2014, was used for this event analysis. A condition assessment was performed for the mis-positioned breaker (1EMXD-F02A) and the concurrent unavailability of EDG A due to maintenance.

SDP Results/Basis for ASP Analysis. The ASP Program uses SDP results for degraded conditions when available (and applicable). A Green finding (i.e., very low safety significance) was identified (see IR 05000413/2016002 for additional information). This finding was due to the licensee failure to adequately implement procedures for operation of the RHR system as required by Section 3 of Regulatory Guide 1.33 (Ref. 3). Specifically the licensee failed to align the RHR system for standby readiness prior to plant startup. This resulted in breaker 1EMXD-F02A being left open during plant startup and ECCS train 1B being inoperable for greater than the allowed outage time per plant technical specifications. However, a redundant signal from the RHR pump B hot-leg suction valve 1ND-37A was available to provide the required permissive signal to open 1ND-136B; therefore, the SDP evaluation determined that there was no loss of safety function of ECCS train B. The LER was closed in IR 05000413/2016002.

2

LER 413-2016-001 A search for additional Catawba (Unit 1) LERs was performed to determine if additional unavailabilities existed during the exposure period of the mis-positioned breaker. There have been no additional LERs submitted by Catawba Nuclear Station.

An independent ASP analysis is required because EDG A was unavailable concurrently with breaker 1EMXD-F02A being open. Risk assessments performed as part of the SDP are limited to the analysis of individual performance deficiencies and, therefore, the analysis of the inspection finding associated with the mis-positioned breaker did not factor the concurrent unavailability of EDG A.

SPAR Model Modifications. The following modifications were required for this condition assessment:

• The applicable EDG recovery basic events EPS-XHE-XL-NR01H (operator fails to recover emergency diesel in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />), EPS-XHE-XL-NR02H (operator fails to recover emergency diesel in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />), and EPS-XHE-XL-NR04H (operator fails to recover emergency diesel in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) were set to TRUE in the base SPAR model. These basic events are set to TRUE for applicable ASP condition assessments and their use is limited to cases where event information supports credit for EDG recovery.

• The current SPAR model for Catawba Nuclear Station does not include fault tree logic for the interlocks between the RHR hot-leg suction valves (1ND-1B, 1ND-2A, 1ND-36B, and 1ND-37A) and the RHR supply valves to the SI pumps (1ND-28A and 1NI-136B).1 To model the breaker dependency of these interlocks, the HPR-RHRA (RHR train A flow path) and HPR-RHRB (RHR train B flow path) fault trees were modified. In the HPR-RHRA fault tree, a new AND gate HPR-RHRA-2 (ND-28A fails to open due to hot leg suction valve interlocks) was inserted under existing OR gate HPR-RHRA-1 (ND28A fails to open). Two new OR gates HPR-INTERLOCK-ND1B (interlock from ND-1B fails) and HPR-INTERLOCK-ND2A (interlock from ND-2A fails) were inserted under gate HPR-RHRA-2. To represent the potential unavailability of the interlock signals from valves 1ND-1B and 1ND-2A to 1ND-28A due to mis-positioned valve breakers, new basic events HPR-CRB-ND1B (breaker for ND-1B is open) and HPR-CRB-ND2A (breaker for ND-2A is open) were inserted under gates HPR-INTERLOCK-ND1B and HPR-INTERLOCK-ND2A, respectively. These basic events were set to a screening value of 1x10-2.2 In addition to the mis-positioned breakers causing the unavailability of the interlock signals, a loss of the associated safety-related AC electrical power would render the interlock signal unavailable.

To model this electrical dependency, existing fault tree transfers ACP-1ETA (division 1A AC power bus 1ETA fails) and ACP-1ETB (division 1B AC power bus 1ETB fails) were inserted under HPR-INTERLOCK-ND2A and HPR-INTERLOCK-ND1B, respectively. The modified HPR-RHRA fault tree is shown in Figure C-1. Similar changes were made to the HPR-RHRB fault tree (see Figure C-2).

Exposure Periods. The breaker was opened during the nightshift on December 13, 2015. The plant transitioned to Mode 3 on December 15th at 1:52 p.m. The breaker was discovered to be open on March 28, 2016, and was subsequently closed at 12:01 p.m. During this period, 1 Valves 1ND-1B and 1ND-2A provide the interlock signal to valve 1ND-28A, while valves 1ND-36B and 1ND-37A provide the interlock signal to valve 1NI-136B. Only one operable interlock signal (per valve) is needed to allow the manual operation of 1ND-28A and 1NI-136B.

2 NUREG-1792, Good Practices for Implementing Human Reliability Analysis, provides that 1x10-2 is an appropriate screening (i.e., typically conservative) value for most pre-initiator HFEs.

3

LER 413-2016-001 EDG 1A was concurrently unavailable for approximately 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br />. Therefore, the following two exposure periods were identified for this condition assessment:

• Exposure Period #1: Breaker 1EMXD-F02A is open concurrently with EDG 1A unavailable due to maintenance for approximately 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br />.

• Exposure Period #2: While in Modes 1-3, breaker 1EMXD-F02A was open from December 15, 2015, at 1:52 p.m., until it is closed at 12:01 p.m. on March 28, 2016, which is approximately 2443 hours0.0283 days <br />0.679 hours <br />0.00404 weeks <br />9.295615e-4 months <br /> (after subtracting the 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br /> from Exposure Period #1).

Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event:

Exposure Period #1 (51 Hours)

• Basic event HPR-CRB-ND36B was set to TRUE due to breaker 1EMXD-F02A being open.

- During a postulated loss of the redundant interlock signal from the other RHR hot-leg suction valve 1ND-37A due to the unavailability of train A safety-related AC power, operators would be unable to manually open 1NI-136B from the main control room.

During scenarios where ECCS injection is required, operators will enter ES-1.3, Transfer to Cold Leg Recirculation, when the refueling water storage tank (FWST) level reaches its low level set point (20 percent). Step 6.i of ES-1.3 directs operators to manually open 1NI-136B (and 1ND-28A) when FWST level decreases to 5 percent.

This procedure does not contain guidance on the applicable interlock or direct verification of breaker positions of the RHR hot-leg suction valves (1ND-1B, 1ND-2A, 1ND-36B, and 1ND-37A). In addition, there are no readily available cues/indications of the breaker positions for the RHR hot leg suction valves.3, 4

• Basic event EPS-DGN-TM-1A (diesel generator 1A unavailable due to test and maintenance) was set to TRUE.5,6

- Maintenance activities on critical equipment would have been restricted while EDG A was inoperable. Therefore, basic events EPS-DGN-TM-1B (diesel generator 1B unavailable due to test and maintenance), AFW-TDP-TM-TDP (AFW TDP unavailable due to test and maintenance), and AFW-MDP-TM-1B (AFW motor-driven 1B unavailable due to test and maintenance) were set to FALSE.

Exposure Period #2 (2443 Hours)

• Basic event HPR-CRB-ND36B was set to TRUE due to breaker 1EMXD-F02A being open.

3 The ASME/ANS PRA Standard requires applicable procedures to credit operator recovery actions.

4 Time available for operators to troubleshoot the failure of 1NI-136B to open would be limited given that only 5 percent of FWST inventory would be available when operators attempt to manually open 1NI-136B.

5 No credit for EDG recovery is provided in this analysis, which is potentially conservative. However, information on the recoverability of EDG A during the periods of inoperability reported in LER 413/2016-001 is unknown.

6 When setting EPS-DGN-TM-1A to TRUE, SAPHIRE will automatically set the fail- to-run and fail-to-start basic events for the effected EDG to 1.0. Given these changes, SAPHIRE will recalculate the common-cause failure (CCF) probabilities based on the math contained in Appendix E of NUREG/CR-5485. Since the common cause component group size for the Unit 1 EDGs is two, the CCF failure probabilities were left at their nominal values.

4

LER 413-2016-001 ANALYSIS RESULTS CDP. The point estimate increase in core damage probability (CDP) for this event is 1.1x10-6, which is the sum of both exposure periods. The ASP Program acceptance threshold is a CDP of 1x10-6 for degraded conditions. The CDP for this event exceeds this threshold; therefore, this event is a precursor. The dominant initiating events for this analysis are provided in the following table.

Event Tree CDP Percentage Description LOOP 5.38E-07 47.6% Loss of Offsite Power LOACA 4.33E-07 38.4% Loss of Essential AC Bus A SORV 1.27E-07 11.2% Stuck-Open Pressurizer Safety Relief Valve TRANS 1.17E-08 1.0% Transient MLOCA 8.69E-09 0.8% Medium Loss-of-Coolant Accident Dominant Sequence. The dominant accident sequence is loss of 4.16kV, safety-related AC bus A (LOACA) Sequence 19 (CDP = 3.3x10-7), which contributes approximately 29% of the total internal events CDP. The dominant sequences that contribute at least 1.0 percent to the total internal events CDP are provided in the following table. The dominant sequence is shown graphically in Figure A-1 in Appendix A.

Sequence CDP Percentage Description Loss of essential AC bus A initiating event; successful reactor trip; auxiliary feedwater (AFW) and main LOACA 19 3.32E-07 29.4% feedwater (MFW) fail; feed and bleed cooling succeeds; recovery of secondary side cooling fails; and high-pressure recirculation fails LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW succeeds; standby shutdown facility successfully provide reactor LOOP 19-02 1.34E-07 11.9%

coolant pump (RCP) seal cooling and steam generator inventory makeup; operators fail to restore offsite power within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Stuck-open pressurizer relief valve (LOCA) initiating event; successful reactor trip; high-pressure injection SORV 3 1.24E-07 11.0% succeeds; AFW succeeds; successful secondary side cooldown/depressurization; and high-pressure/

low-pressure recirculation fail LOOP initiating event; successful reactor trip; emergency LOOP 19-77 1.07E-07 9.5% power system failure results in SBO; AFW fails; operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Loss of essential AC bus A initiating event; successful reactor trip; AFW succeeds; pressurizer relief valve fail to close (LOCA); high-pressure injection succeeds; LOACA 5 9.79E-08 8.7%

successful secondary side cooldown/depressurization; shutdown cooling fails; and high-pressure recirculation fails 5

LER 413-2016-001 Sequence CDP Percentage Description LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW succeeds; standby shutdown facility fails to provide RCP seal LOOP 19-11-10 9.39E-08 8.3% cooling; RCP seal integrity is maintained; operators successfully shed DC loads to extend battery depletion time to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; operators fail to restore offsite power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> LOOP initiating event; successful reactor trip; emergency power system succeeds; AFW fails; feed and bleed LOOP 18 6.61E-08 5.9%

cooling fails; operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> LOOP initiating event; successful reactor trip; emergency power system succeeds; AFW fails; loss of RCP seal LOOP 02-05 3.21E-08 2.8% injection/cooling occurs; RCP stage 2 seals fail (LOCA);

operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; high-pressure injection fails LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW succeeds; standby shutdown facility fails to provide RCP seal LOOP 19-17 2.35E-08 2.1% cooling; RCP stage 2 seals fail (LOCA); operators successfully shed DC loads to extend battery depletion time to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; operators fail to restore offsite power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> LOOP initiating event; successful reactor trip; emergency power system succeeds; AFW fails; pressurizer relief LOOP 9 2.00E-08 1.8% valve fail to close (LOCA); high-pressure injection succeeds; operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; high-pressure recirculation fails LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW succeeds; standby shutdown facility successfully RCP seal cooling; LOOP 19-05-10 1.50E-08 1.3% but fails to provide steam generator inventory makeup; operators successfully shed DC loads to extend battery depletion time to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; operators fail to restore offsite power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> LOOP initiating event; successful reactor trip; emergency power system succeeds; AFW fails; feed and bleed LOOP 15 1.10E-08 1.0%

cooling succeeds; operators fail to recover offsite power within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; and high-pressure recirculation fails REFERENCES

1. Catawba Nuclear Station, "LER 413/16-001 - Mispositioned Breaker for Residual Heat Removal Loop Suction Results in Inoperable Train of Emergency Core Cooling System, dated June 23, 2016 (ML16179A207).

2. U.S. Nuclear Regulatory Commission, Catawba Nuclear Station - NRC Integrated Inspection Report 05000413/2016002, 05000414/2016002, dated July 19, 2016 (ML16202A116).

3. U.S. Nuclear Regulatory Commission, Quality Assurance Program Requirements (Operation), Regulatory Guide 1.33, Revision 3, dated June 2013 (ML13109A458).

6

LER 413-2016-001 Appendix A: Key Event Tree Loss of Essential ac Bus ETA REACTOR TRIP AUXILIARY FEEDWATER MAIN FEEDWATER PORV/SRVs ARE CLOSED LOSS OF SEAL COOLING HIGH PRESSURE INJECTION FEED AND BLEED SECONDARY SIDE COOLING SECONDARY SIDE RESIDUAL HEAT REMOVAL HIGH PRESURE RECIRC # End State AVAILABLE RECOVERED COOLDOWN (Phase - CD)

IE-LOACA RPS AFW MFW PORV LOSC LOSC-FTF HPI FAB SSCR SSC RHR HPR 1 OK 2 LOSC 3 OK 4 OK 5 CD 6 OK 7 CD 8 CD 9 OK 10 LOSC 11 OK 12 OK 13 CD PORV1 14 OK 15 CD 16 CD 17 OK 18 OK 19 CD 20 CD 21 ATWS Figure A-1. Catawba Loss of 4.16kV, Safety-Related AC Bus A A-1

LER 413-2016-001 Appendix B: System Drawing SI Pump A and RCS Hot Leg B Charging Pumps ND-28A FWST ND-1B Containment Spray Header A ND-2A ND-25A NS-43A FW-27A RCS Cold Legs C & D ND-67 ND-67 NI-173A RHR Train A ND-32A RHR Pump A Heat Exchanger ND-185A RCS Hot Containment Sump Legs B & C ND-183B FW-55B ND-65B ND-184B ND-59B RCS Cold Legs A & B ND-68 ND-68 NI-173B RHR Train B RHR Pump B Heat Exchanger ND-37A SI Pump B ND-36B NI-136B RCS Hot Leg C Containment Spray Header B NS-38B Figure B-1. Simplified RHR System Drawing for Catawba Unit 1 B-1

LER 413-2016-001 Appendix C: Modified Fault Trees RHR TRAIN A FLOWPATH HPR-RHRA FAILURE of PUMP COOLING BY CCW DIVISION 1A AC POWER BUS 1ETA ND28A Fails to Open Sump Recirculation MOV 184A Fails RHR RWST Isolation MOV 27A Fails FAILS HPR-RHRA-MDP1A-1 ACP-1ETA Ext HPR-RHRA-1 HPI-MOV-CC-NI184A 9.63E-04 RHR-MOV-OO-FW27A 9.63E-04 RHR MDP-1A CCF of Sump Recirculation MOVs Failure of RHR/HPI Discharge Check Valve ND10 RHR-MDPA Ext ND-28A FAILS TO OPEN DUE TO Interlocks on ND System Prevents CCF of RHR Supply to HPI ISOL HPI-MOV-CF-SMP 1.86E-05 HPI-CKV-CC-ND10 1.07E-05 RHR HTX-1A HOT LEG SUCTION INTERLOCKS Opening NI136B & ND28A Valves 136B and 28A MINIFLOW MOV ND25A Fails To Drains From Upper To Lower Open Containment Left Closed HPR-RHRA-2 HPR-INTERLOCK Ext HPI-MOV-CF-RHR 1.86E-05 RHR-HTXA Ext RHR Discharge (to SI) MOV 28A Fails RHR-MOV-CC-ND25A 9.63E-04 RHR-XHE-XM-DRAINS 1.25E-04 to Open Miniflow MOVs ND59B & ND25A Fail CCF of RHR/HPI Discharge Check To Open Valves ND10 and ND44 INTERLOCK FROM ND-2A FAILS INTERLOCK FROM ND-1B FAILS HPI-MOV-CC-ND28A 9.63E-04 RHR-MOV-CF-MINI 1.86E-05 HPI-CKV-CF-RHR 2.49E-07 CCF of RWST Isolation MOVs HPR-INTERLOCK-ND2A HPR-INTERLOCK-ND1B RHR-MOV-CF-RWST 7.78E-06 DIVISION 1A AC POWER BUS 1ETA BREAKER FOR ND-2A IS OPEN DIVISION 1B AC POWER BUS 1ETB BREAKER FOR ND-1B IS OPEN FAILS FAILS ACP-1ETA Ext HPR-CRB-ND2A 1.00E-02 ACP-1ETB Ext HPR-CRB-ND1B 1.00E-02 Figure C-1. Modified HPR-RHRA Fault Tree C-1

LER 413-2016-001 RHR TRAIN B FLOWPATH HPR-RHRB FAILURE of PUMP COOLING BY CCW DIVISION 1B AC POWER BUS 1ETB NI136B Fails to Open Sump Recirculation MOV 184B Fails CCF of RWST Isolation MOVs FAILS HPR-RHRB-MDP1B-1 ACP-1ETB Ext HPR-RHRB-1 HPI-MOV-CC-NI184B 9.63E-04 RHR-MOV-CF-RWST 7.78E-06 RHR MDP-1B CCF of Sump Recirculation MOVs Failure of RHR/HPI Discharge Check Valve ND44 RHR-MDPB Ext NI-136B FAILS TO OPEN DUE TO Interlocks on ND System Prevents CCF of RHR Supply to HPI ISOL HPI-MOV-CF-SMP 1.86E-05 HPI-CKV-CC-ND44 1.07E-05 RHR HTX-1B HOT LEG SUCTION VALVE Opening NI136B & ND28A Valves 136B and 28A RHR RWST Isolation MOV 55B Fails Drains From Upper To Lower INTERLOCKS Containment Left Closed HPR-RHRB-2 HPR-INTERLOCK Ext HPI-MOV-CF-RHR 1.86E-05 RHR-HTXB Ext RHR Discharge (to SI) MOV 136B to RHR-MOV-OO-FW55B 9.63E-04 RHR-XHE-XM-DRAINS 1.25E-04 SI System Fails to Open MINIFLOW MOV ND59B Fails To CCF of RHR/HPI Discharge Check Open Valves ND10 and ND44 INTERLOCK FROM ND-37A FAILS INTERLOCK FROM ND-36B FAILS HPI-MOV-CC-NI136B 9.63E-04 RHR-MOV-CC-ND59B 9.63E-04 HPI-CKV-CF-RHR 2.49E-07 Miniflow MOVs ND59B & ND25A Fail To Open HPR-INTERLOCK-ND37A HPR-INERLOCK-ND36B RHR-MOV-CF-MINI 1.86E-05 DIVISION 1A AC POWER BUS 1ETA BREAKER FOR ND-37A IS OPEN DIVISION 1B AC POWER BUS 1ETB BREAKER FOR ND-36B IS OPEN FAILS FAILS ACP-1ETA Ext HPR-CRB-ND37A 1.00E-02 ACP-1ETB Ext HPR-CRB-ND36B 1.00E-02 Figure C-2. Modified HPR-RHRB Fault Tree C-2