ML17180B056

Plant Initiating Events Notebook Sections 1,2 & 3

ML17180B056
Person / Time
Site:	Dresden, Quad Cities
Issue date:	12/23/1994
From:	COMMONWEALTH EDISON CO.
To:
Shared Package
ML17180B055	List: ML17180B054 ML17180B056 ML20078S957
References
PROC-941223, NUDOCS 9412290321
Download: ML17180B056 (59)

Text

,, ',,

k: \\nla \\quad\\rairev4. wpf ENCLOSURE 1 QUAD CITIES STATION Initiating Events Notebook Sections 1, 2, & 3

-ii~22lg~~~ i~b~~1~7 p

Section

2.0 BACKGROUND

INITIATING EVENTS (IE) NOTEBOOK TABLE OF CONTENTS 2.1 Loss of Coolant Accidents 2.2 Anticipated Transients 2.3 Unanticipated Transients 2.4 Special Initiating Events 2.5 Consequential Events 3.0 CATEGORIZATION OF EVENTS 3.1 Loss of Coolant Accidents 3.2 Anticipated Transients 3.3 Unanticipated Transients 3.4 Special Initiating Events 4.0 CALCULATION OF FREQUENCIES 4.1 Loss of Coolant Accidents 4.2 Anticipated Transients 5.0

SUMMARY

OF RES UL TS 6.0 IPE INSIGHTS 7.0

!PE/ACCIDENT MANAGEMENT INSIGHTS

8.0 REFERENCES

1 3

3 3

5 5

5 9

9 13 25 28

41.

41 45 53 54 56 57 58 APPENDIX A QUAD CITIES INTERFACING SYSTEMS LOCA ASSESSMENT A-1 APPENDIX B APPENDIX C I-726316-1 E 0506931E QUAD CITIES UNIT 1 TRIP

SUMMARY

QUAD CITIES UNIT 2 TRIP

SUMMARY

B-1 C-1

1.0 INTRODUCTION

An initiating event is any occurrence which disrupts normal plant operations sufficiently to require a reactor trip by either automatic or manual action. An initiating event may occur due to a random* component failure or a human action, thus requiring plant systems to respond to maintain the unit in a safe, stable condition. An initiating event marks the starting point of an accident sequence analysis.

Initiating events have historically been addressed as either "internal" or "external" events.

"Internal" initiating events are those attributable to plant systems, such as loss of coolant accidents (LOCAs) and loss of major support systems (e.g., service water), as well as some pseudo-external events, such as loss of off-site power (LOOP 1). True "external" events, such as tornado strikes and external fires, are outside the scope of the Individual Plant Examination. Internal flooding, however, will be included in the Quad Cities Individual Plant Examination/Accident Manag~ment (IPE/AM) Program.

Internal flooding events will be examined and documented separately in an Internal Flooding Analysis notebook. Likewise, internal fires will be assessed separately in an Internal Fire Analysis as part of the External Events IPE.

"Internal" initiating events are typically divided into two major groups, transients and LOCAs.

Transients are events disrupting power operations such that a reactor trip ensues; however, the primary system integrity is not breached by the transient initiating event itself. Transients may be further divided into three smaller groups - anticipated transients, unanticipated transients, and special initiating events. LOCAs are primary system breaches which, if not isolated, result in an ongoing loss of primary coolant inventory.

A comprehensive examination of all potential initiating events is required to assure that all important potential accident sequences are identified.

First, a generic set of potential initiating events is identified by reviewing the available literature (such as NUREG/CR-2300, Numerous references have interchangeably used the acronyms "LOSP" and "LOOP" for "Loss of Offsite Power. For convenience, this analysis uses LOOP throughout (unless otherwise noted).

I* 726316-1 E 0506931E IE-1

NP-2230, and NUREG/CR-3862) for historical events resulting from plant operations. Prior PRAs (such as WASH-1400 and Shoreham) are reviewed to identify additional events analyzed for similar facilities. Quad Cities' design and historical records are then reviewed to identify any plant-specific initiating, events which should also be addressed. Special initiating events are identified during this process. Special initiating events are major failures of support systems and balance-of-plant systems, and the designs of both of these types of systems tend to vary greatly from plant to plant. Historically, these events have included

__ events such as loss of service water (SW) and loss of a DC power bus.

Once a comprehensive list is developed, then the events may be grouped based on similar plant responses. Specific events within a given group have basically the same impact on the systems utilized to maintain core cooling and containment heat removal, despite involving different causes and/or components.

This grouping simplifies the overall analysis by

, permitting analysis of groups of initiators rather than requiring analysis of each individual initiating event.

The frequency of each initiating event is then derived, with the group frequency being the summation of each individual initiating event frequency within that group.

Where plant-specific data is considered sufficient, the frequency estimations will be based on that data; otherwise, generic data will be used.

I-726316-1 E 0506931E IE-2

2.0 BACKGROUND

2.1 Loss of Coolant Accidents LOCAs are uncontrolled breaches of the primary system or interconnected systems, resulting in a loss of primary coolant. As a result of this coolant loss, makeup systems must be utilized to replenish Reactor Coolant system (RCS) inventory. Likewise, reactor core heat

. _ removal systems must function to maintain the reactor core temperatures within acceptable bounds. Typically analyzed LOCAs for BWRs include breaks of high-energy piping inside or outside containment, breaks in low pressure piping/components that interface with the primary system, isolation condenser (IC) tube ruptures, reactor pressure vessel (RPV) failure, and stuck open relief valves (SORVs). Very small leaks are not considered in the LOCA analysis since the response to these events would be similar to that of a transient.

2.2 Anticipated Transients

~

Anticipated Transients include those events which disrupt normal power operation sufficiently to cause a reactor trip and require core heat removal, but do not directly result in a violation of the primary coolant system pressure boundary (with successful relief valve operation excepted). Typically these events involve hardware failures or abnormalities in balance-of-plant systems, resulting in a reactor trip signal being generated. Turbine trip with or without turbine bypass valve failure is an example of an anticipated transient event.

By definition, anticipated transients are those transient events which are expected to occur during plant operation and, thus, the plant systems have been designed to accommodate these events. NUREG/CR-3862, Development of Transient Initiating Event Frequencies For Use In Probabilistic Risk Assessments (Reference 1 ), provides a thorough review of historical transient initiating events through the end of December 1982.

Table 1 lists the transients identified in NUREG/CR-3862. Note that included in this listing are some events which are defined herein as unanticipated transients.

1*726316-IE 0506931E IE-3

TABLE 1 NUREG/CR-3862 BWR INITIATORS 1.

Electric Load Rejection

2.

Electric Load Rejection with Turbine Bypass Valve Failure

3.

Turbine Trip

4.

Turbine Trip with Turbine Bypass Valve Failure

5.

Main Steam Isolation Valve (MSIV) Closure

6.

Inadvertent Closure of One MSIV

7.

Partial MSIV Closure

8.

Loss of Normal Condenser Vacuum

9.

Pressure Regulator Fails Open 1 O.

Pressure Regulator Fails Closed

11.

Inadvertent Opening of a Safety/Relief Valve (Stuck)

12.

Turbine Bypass Fails Open

13.

Turbine Bypass/Control Valves Cause Increased Pressure (Closed)

14.

Recirculation Control Failure {Increasing Flow)

15.

Recirculation Control Failure (Decreasing Flow)

16.

Trip of One Recirculation Pump

17.

Trip of All Recirculation Pumps

18.

Abnormal Startup of Idle Recjrculation Pump

19.

Recirculation Pump Seizure

20.

Feedwater (Increasing Flow at Power)

21.

Loss of Feedwater Heater

22.

Loss of All Feedwater Flow

23.

Trip of One Feedwater Pump (or Condensate Pump)

24.

Feedwater (Low Flow at Power)

25.

Low Feedwater Flow During Startup or Shutdown

26.

High Feedwater Flow During Startup or Shutdown

27.

Rod Withdrawal at Power

28.

High Flux Due to Rod Withdrawal at Startup

29.

Inadvertent Insertion of Rod or Rods

30.

Detected Fault in the Reactor Protection System 31.

Loss of Offsite Power

32.

Loss of Auxiliary Power (Loss of Auxiliary Transformer)

33.

lnaavertent Startup of HPCl/HPCS

34.

Scram Due to Plant Occurrences

35.

Spurious Trip Via Instrumentation, RPS Fault

36.

Manual Scram (No Out-of-Tolerance Condition)

37.

Cause Unknown I-726316-1 E 050693IE IE-4

2.3 Unanticipated Transients L_

Unanticipated Transients are those events classified as design-basis accidents (DBAs) in the Quad Cities Station Updated Final Safety Analysis Report (UFSAR) (Reference 29). Table 2 provides a listing of unanticipated initiators identified from a review of the Quad Cities UFSAR, Chapter 14, as well as those identified in prior PRAs.

By definition they are considered unanticipated transients.

2.4 Special Initiating Events Unique plant configurations may result in plant-specific, or special, initiating events. To be classified as a special initiating event, an event must result in, or require, a reactor trip and adversely impact the ability of one or more plant systems to mitigate a transient event. For example, loss of a DC power bus is a special initiator commonly identified during initial plant-specific screening.

To identity any potential special initiating events, frontline and key support systems must be reviewed.

Where appropriate, these potential initiators are combined with existing initiators; the remaining events are treated separately.

2.5 Consequential Events Consequential events are significant plant events which arise subsequent to an.d due to other more benign plant occurrences. A consequential event of note in BWRs is the potential occurrence of reactor power instabilities in certain reactor power/recirculation flow regimes.

These instabilities have been observed during startup conditions in which recirculation flow was very low and, more important to the IPE analysis, subsequent to the trip of both recirculation pumps while at power. This unstable condition manifests itself as oscillations in reactor power. These oscillations have a characteristic period of two to three seconds and may attain peak values greater than 100% reactor power (Reference 12).

If, during reactor power operations, the recirculation pumps should both trip off, the procedures direct the operator to immediately reduce reactor power to exit the power/

I-726316-1 E 0506931E IE-5

1.

Control Rod Drop

2.

Refueling Accidents TABLE 2 UNANTICIPATED INITIATORS

3.

Main Steam Line Break Outside the Drywell

4.

Loss-of-Coolant Accident

5.

Loss of Control Room

6.

Station Blackout (SBO)

I-726316-1 E 0506931E IE-6

---

~

I I

I recirculation flow regime in which oscillations are likely. The reactor operators are further instructed to scram the reactor if the characteristic reactor power oscillations occur (Reference 13). Quad Cities has an alarm to warn the operators that the plant has entered the instability region (Reference 14). The Reactor Protection system at Quad Cities is designed with a "recirculation flow biased" scram. This means that the Average Power Range Monitors (APRMs) provide a scram signal at a setpoint that depends upon recirculation flowrate. The APRM scram set point is determined by the following equation

_ _ (Reference 15):

APRM Hi-Hi =

0.58 W0 + 62%

where W0

=

percent of full recirculation flow currently existing.

From this equation it can be seen that when the recirculation flow rate approaches zero, the APRM scram setpoint approaches 62% of full power. This reduced scram setpoint following a dual recirculation pump trip is a very favorable attribute of the Quad Cities RPS tor protecting the plant from this power oscillation phenomenon.

Another attribute of the Quad Cities RPS design that helps to protect the plant from these oscillations is that high single Local Power Range Monitor (LPRM) signals can cause the APRM to generate a trip signal. Although the important point is that single LPRM signals have tripped the associated APRM, it must be noted that the high signals in these cases were due to detector degradation. This design characteristic is discussed in the RPS system notebook (Reference 16).

The implications of the reactor power oscillations are being investigated at the time of the production of this document. At present, the hazard involved is not completely understood.

However, procedures direct the operators to take actions to reduce power if the reactor enters the instability region. Additionally, an alarm has been installed to warn the operators of entering this region. Independently, the operators are instructed to scram the reactor if the characteristic oscillations are observed and the RPS is expected to sense the oscillations I-726316-1 E 0506931E IE-7

and provide an automatic scram. Trip of both recirculation pumps and the onset of power oscillations will, therefore, lead to either a manual scram or an automatic scram and is already included in the transient grouping described in this document.

Further consideration of this phenomenon is warranted, however, in consideration of those events in which the RPS system fails to shutdown the reactor.

In these situations, the recirculation pumps are tripped to reduce reactor power, thus possibly placing the plant in

. _ the instability region. This phenomenon is being analyzed further by the industry. At the publication of this document, this phenomenon is felt by the industry to not constitute a new or significantly increased risk to the health and safety of the public (Reference 49).

I-726316-1 E 0506931E IE-8

3.0 CATEGORIZATION OF EVENTS 3.1 Loss of Coolant Accidents

[Note that break sizes will be verified during the MAAP analyses.]

The LOCA analysis requires the break to be located within the primary system and

. _ sufficiently large to result in an automatic or manual reactor trip and a safeguards actuation.

Because the design of the BWR reactor vessel internals creates a standpipe effect in the jet pump configuration, BWRs are not very sensitive to the break elevation for loss of coolant events. The jet pump inlets are located at the two-thirds core height level. Leakage from any piping connected to the vessel outside this standpipe-protected region will not prevent core reflooding to the top of the jet pumps. The piping outside this region includes all the major piping systems interfacing with the reactor vessel. Due to this design characteristic, BWRs are, in general, more sensitive to LOCA size than to LOCA location.

Theoretically, any connection to the reactor vessel or reactor coolant system can fail, resulting in a loss of coolant event.

However, from both probabilistic and realistic standpoints, only a few of these connections pose sufficient risk as to justify further investigation. Breaks in piping connected to the upper vessel area result in the release of steam only. Safety systems may readily make up the lost inventory, keeping the active core submerged. Thus, steam breaks alone do not warrant detailed analysis. However, those connections whose failure would also disable a system utilized to maintain inventory, such as feedwater, are evaluated to determine whether the combined occurrence of the LOCA and the loss of the safety system will pose a significant risk of core damage. This analysis thus adequately bounds all credible breaks in the upper vessel area.

Breaks in the lower vessel area (below the core plate) could theoretically drain the reactor vessel such that core uncovery could occur. The control rod housings and the standby liquid control connections provide hypothetical LOCA pathways. However, due to the rigorous analysis and the intense scrutiny attending the construction of these connections, the I-726316-1 E 0506931E IE-9

4 t

likelihood of their failure is very low. While rod ejection events, described as a control rod being ejected through the housing such that a vessel breach occurs, have been hypothesized, they are generally considered incredible events. In addition, should such an event occur, the control rod drive housing supports suspended below the reactor vessel are designed to retain the ejected rod within the failed housing. The resulting pathway is then only the circumferential space between the rod and the housing, thus greatly reducing the flow rate from the vessel. Given the safety systems available for make-up, the reduced flow

_ _ resulting from the retained rod, and the extremely low likelihood of the ejection event itself, lower vessel failures are not considered to be probabilistically significant events. They are therefore removed from further consideration in this initiating events analysis.

Breaks in piping connected to the middle-to-lower vessel areas threaten loss of liquid inventory. Breaks in the recirculation piping have been analyzed in numerous studies to assess the core damage potential resulting from this liquid loss. While some inventory will be lost out the break, safety sy§tems are expected to keep water levels at or above the two-thirds active core height, thus maintaining the core in a safely cooled state. Some leakage via the jet pump slip-joint connections is expected, but safety systems provide sufficient make-up capability to maintain adequate water levels. Thus, the postulated recirculation piping LOCA is considered to envelope all breaks in this area.

LOCA initiating events are separated into categories based on break flow rates, typically described in terms of an equivalent break size, and the safety systems needed to mitigate the break. Thus developing the categories involves matching the break sizes to the safety system capabilities.

First the overall range of break sizes is established for the primary system, followed by partitioning the sizes into appropriate categories. The upper bound is a catastrophic reactor pressure vessel failure. Due to its massive size, as compared to other postulated breaks, this event is addressed as a single category, the catastrophic LOCA.

I-726316-1 E 0506931E IE*10

The remaining break sizes range from a recirculation piping break (approximately 28 inches in diameter) downward to a break which causes a high drywell pressure condition (i.e., 2.5 psig per Ref. 15) within several seconds, but because of the limited inventory loss, fundamentally resembles a transient initiator.

Based on safety systems mitigation capabilities, this category requires three subdivisions, the large-break, medium-break and small-break LOCAs.

The large-break LOCA involves a 0.19 ff or larger break such that the primary system depressurizes rapidly. An automatic scram occurs and low pressure injection systems are automatically actuated to restore RPV level and inventory. High pressure injection systems are inadequate for a break of this size. Since the Feedwater system does not inject into the lower plenum, its water immediately exits the vessel via the break. The High Pressure Coolant Injection (HPCI) and Reactor Core Isolation Coolant (RCIC) systems are unavailable because of insufficient steam pressure to operate the turbine. Due to the large break size, Automatic Depressurization sy§tem (ADS) actuation is not required.

The medium-break LOCA includes breaks ranging from 0.008 ff to 0.19 ft2. Successful medium-break LOCA response requires implementation of a means of RPV depressurization in conjunction with low pressure injection. The HPCI system is not sufficient by itself because it eventually becomes inoperable due to low vessel pressure and is unable to maintain vessel inventory. Similarly, the feedwater makeup capability is not adequate by itself to maintain vessel inventory and, without low pressure injection, core damage eventually results.

The small-break LOCA consists of breaks smaller than 0.008 ff. Two additional makeup and cooling sources are available for successful small-break LOCA response. First, feedwater with normal makeup is adequate to maintain RPV inventory and cooling over the entire mission time. Additionally, HPCI is also sufficient to provide RPV inventory and pressure control for the entire mission time.

RCIC may be used during the early stages of the accident, but will be inadequate to provide inventory and pressure control throughout the entire mission time. Early in the accident sequence, RCIC, combined with the safe shutdown I-726316-1 E 0930931E IE-11

makeup pump (SSMP), can provide adequate makeup to the reactor vessel. However, the vessel must be depressurized at approximately 7-8 hours into the accident, resulting in the loss of RCIC and a late core melt scenario.

Two separate categories addressing recirculation pump seal leaks and interfacing systems LOCAs are also postulated. Normal seal wear during plant operation often leads to seal leakage, sometimes at rates requiring prompt shutdown (such events have occurred at Quad Cities). Instrumentation provides considerable detection capability for these leaks, which typically are less than 5 gpm, although they may range upwards to a maximum of 50 to 100 gpm. Typically these leaks can be easily detected and isolated. Because of the low flowrates expected, the plant response is virtually identical to that for transient events.

Interfacing system LOCAs, typically referred to as V sequences, result from a high pressure-

. to-low pressure system breach. These breaches can result in significant leaks of primary coolant via the low pressure system, either as major low pressure system leakage or as low pressure piping rupture. This event is further complicated by the corresponding failure of the low pressure system which may be demanded due to the breach. Likewise, containment bypass through the breach is possible. The Peach Bottom analysis (Reference 4) reports that precursors to V sequences have occurred during high pressure-to-low pressure isolation valve testing.

High energy line breaks outside containment, such as breaks in main steam, feedwater, RCIC, and HPCI lines, are addressed as a separate category. These LOCAs pose the dual problem of primary system breach and system failure, but may be isolated by valve closure.

Should the breach occur inside containment, then the event would be essentially the same as a LOCA and is treated accordingly.

1-726316-IE 1219941E IE-12

J 3.2 Anticipated Transients In addition to the transients specified in NUREG/CR-3862 (see Table 1 above), prior PRAs outside the CECo IPE/AM Program were reviewed to identify any additional potential initiators which should be addressed for Quad Cities. The following studies were reviewed:

Reactor Safety Study (WASH-1400, Reference 11)

Peach Bottom (NUREG/CR-4550, Reference 4)

Shoreham 1 PAA (Reference 8)

Millstone 1 IREP (NUREG/CR-3085, Reference 6)

Big Rock Point PAA (Reference 9)

Pilgrim IPE (Reference 10)

Limerick PAA (Reference 7)

Grand Gulf (NUREG/CR-4550, Reference 5)

Table 3 provides a comparison of initiating events addressed in other BWR PRAs. Most of these events are addressed by the NUREG/CR-3862 categories.

Based on this review, some events not present in the EPRI listing were identified. These additional events are listed in Table 4. Note that this review also identifies potential plant-specific failure modes which may lead to plant-specific initiating events. These events are considered below, under the "Special Initiator" section. The remainder are addressed as part of the anticipated transient initiating events analysis.

The combination of the transient initiating events defined in NUREG/CR-3862 and those anticipated transient events identified by the prior PRA review form the initial transient initiating events listing, as enumerated in Table 5. To facilitate _the accident sequence analyses, many of these events, similar in nature, may be combined into more generic 1-726316-IE 0506931E IE-13

TABLE 3 TRANSIENT INITIATING EVENT CATEGORIES ADDRESSED IN OTHER BWR PRA's INITIATING EVENT Electric Load Rejection Electric Load Rejection with Turbine Bypass Valve Failure Turbine Trip Turbine Trip with Turbine Bypass Valve Failure Main Steam Isolation Valve (MSIV) Closure Inadvertent Closure of One MSIV Partial MSIV Closure Loss of Normal Condenser Vacuum Pressure Regulator Fails Open Pressure Regulator Fails Closed IORV Turbine Bypass Fails Open Turbine Bypass or Control Valves Cause Increased Pressure (Closed)

Recirculation Control Failure (Increasing Flow)

Recirculation Control Failure (Decreasing Flow)

Trip of One Recirculation Pump Trip of All Recirculation Pumps Abnormal Startup of Idle Recirculation Pump Recirculation Pump Seizure Feedwater (Increasing Flow at Power)

Loss of Feedwater Heater Loss of All Feedwater Flow 1-726316-IE 0506931E WASH-1400 x

x x

x x

x x

x x

x x

x PEACH BIG ROCK BOTTOM LIMERICK POINT MILLSTONE PILGRIM SHOREHAM x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

e x

x e

x x

e x

x e

x x

x e

x x

e x

x x

x x

x x

e x

x x

x x

x x

IE-14 GRAND GULF x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x

TABLE 3 (Continued)

TRANSIENT INITIATING EVENT CATEGORIES ADDRESSED IN OTHER BWR PRA's INITIATING EVENT Trip of One Feedwater Pump (or Condensate Pump)

Feedwater (Low Flow at Power)

Low Feedwater Flow During Startup or Shutdown High Feedwater Flow During Startup or Shutdown Rod Withdrawal at Power High Flux Due to Rod Withdrawal at Startup Inadvertent Insertion of Rod or Rods Detected Fault in the Reactor Protection System Loss of Offsite Power Loss of Auxiliary Power (Loss of Auxiliary Transformer)

Inadvertent Startup of HPCl/HPCS Scram Due to Plant Occurrences Spurious Trip Via Instrumentation, RPS Fault Manual Scram (No Out-of-Tolerance Condition)

Cause Unknown (Scram Occurs)

Loss of Circulating Water System Loss of Plant Air Compressors (Instrument Air)

Loss of Nitrogen Loss of Turbine Building Closed Cooling Water System Loss of Reactor Building Cooling Water System Loss of Service Water Loss of DC Power (or Bus) 1-726316-IE 0506931E WASH-PEACH 1400 BOTTOM LIMERICK x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

e x

x e

e e

e e

x IE-15 BIG ROCK POINT MILLSTONE PILGRIM SHOREHAM x

x x

x x

x e

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x x

x e

x x

x e

e x

x GRAND GULF x

x e

e x

e x

x x

x x

x x

x x

TABLE 3 (Continued)

TRANSIENT INITIATING EVENT CATEGORIES ADDRESSED IN OTHER BWR PRA's INITIATING EVENT Loss of Emergency Service Water Loss of High Pressure Service Water Loss of Fire Protection System Loss of Individual AC Buses Loss of Individual AC Panel Degradation of Onsite AC Power Bus Loss of Drywell Coolers Reactor Water Level Reference Line Break Excess Water Release Into Reactor Building Elevation 8 Loss of HVAC Spurious Opening - Reactor Depressurization System Valve Spurious Closing - Both Recirculation Line Valves Inadvertent Core Spray Injection During Startup Rod Withdrawal At Startup Fuel Loading Error During Refueling Rod Drop Accident Note:

e - Considered but Eliminated 1-726316-IE 050693IE WASH-1400 PEACH BIG ROCK BOTTOM LIMERICK POINT MILLSTONE PILGRIM SHOREHAM e

e e

e x

e e

x e

e x

x x

x x

x e

x x

e e

e e

IE-16 GRAND GULF j

TABLE 4 ADDITIONAL INITIATING EVENTS IDENTIFIED FROM PRA REVIEW INITIATING EVENT Loss of Circulating Water System Loss of Plant Air Compressors (Instrument Air)

Loss of Nitrogen Loss of Turbine Building Closed Cooling Water System Loss of Reactor Building Closed Cooling Water System Loss of Service Water Loss of DC Power (or Bus)

Loss of Emergency Service Water Loss of High Pressure Service Water Loss of Fire Protection System Loss of Individual AC Buses Loss of Individual AC Panel Degradation of Onsite AC Power Bus Loss of Drywall Coolers Reactor Water Level Reference Line Break Excess Water Release Into Reactor Building Elevation 8 Loss of HVAC Spurious Opening - Reactor Depressurization System Valve Spurious Closing - Both Recirculation Line Valves Inadvertent Core Spray Injection During Startup Rod Withdrawal At Startup

-Fuel Loading Error During Refueling 1-726316-IE 050693IE IE-17 REFERENCE STUDY Millstone Peach Bottom, Big Rock Point, Millstone, Pilgrim Peach Bottom, Pilgrim Peach Bottom, Millstone Peach Bottom Peach Bottom, Big Rock Point, Millstone, Pilgrim, Shoreham

.Peach Bottom, Big Rock Point, Millstone, Pilgrim, Shoreham Peach Bottom, Millstone Peach Bottom Millstone Peach Bottom, Millstone, Shoreham, Big Rock Point Big Rock Point Big Rock Point, Pilgrim Pilgrim, Shoreham Pilgrim, Shoreham Shoreham Peach Bottom Big Rock Point Big Rock Point Big Rock Point Big Rock Point Big Rock Point

I *

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23.

24.

25.

26.

27.

28.

29.

30.

31.

32.

33.

34.

35.

36.

37.

38.

39.

40.

41.

42.

TABLE 5 PRELIMINARY LISTING OF ANTICIPATED TRANSIENT INITIATING EVENTS Electric Load Rejection Electric Load Rejection with Turbine Bypass Valve Failure Turbine Trip Turbine Trip with Turbine Bypass Valve Failure Main Steam Isolation Valve (MSIV) Closure Inadvertent Closure of One MSIV Partial MSIV Closure Loss of Normal Condenser Vacuum Pressure Regulator Fails Open Pressure Regulator Fails Closed Inadvertent Opening of a Safety/Relief Valve (Stuck)

Turbine Bypass Fails Open Turbine Bypass/Control Valves Cause Increased Pressure (Closed)

Recirculation Control Failure (Increasing Flow)

Recirculation Control Failure (Decreasing Flow)

Trip of One Recirculation Pump Trip of All Recirculation Pumps Abnormal Startup of Idle Recirculation Pump Recirculation Pump Seizure Feedwater (Increasing Flow at ~ower)

Loss of Feedwater Heater Loss of All Feedwater Flow Trip of One Feedwater Pump (or Condensate Pump)

Feedwater (Low Flow at Power)

Low Feedwater Flow During Startup or Shutdown High Feedwater Flow During Startup or Shutdown Rod Withdrawal at Power High Flux Due to Rod Withdrawal at Startup Inadvertent Insertion of Rod or Rods Detected Fault in the Reactor Protection System Loss of Offsite Power Loss of Auxiliary Power (Loss of Auxiliary Transformer)

Inadvertent Startup of HPCl/HPCS Scram Due to Plant Occurrences Spurious Trip Via Instrumentation, RPS Fault Manual Scram (No Out-of-Tolerance Condition)

Cause Unknown Spurious Opening - Reactor Depressurization System Valve Spurious Closing - Both Recirculation Line Valves Inadvertent Core Spray Injection During Startup Rod Withdrawal At Startup Fuel Loading Error During Refueling 1-726316-1 E 0506931E IE-18

categories. Thus, those events resulting in essentially the same plant and system response are merged into a single category, with the category becoming a single initiating event. To define the categories, key parameters describing unique plant responses are identified. Each potential initiating event is then tested against these parameters. Those events having the same response are then assigned to the same initiating event category.

The first parameter is the reactor feedwater (FW) availability. This parameter addresses the

__ continued availability of FW as a supply of coolant to the reactor. Any event which prevents the continued operation of FW to supply coolant to the reactor (e.g., FW pump trip) is considered to render FW unavailable.

The second parameter is the main condenser (MC) availability. This parameter addresses the continued availability of the MC as a core heat removal mechanism. Any event which prevents steam from being delivered to the MC (e.g., MSIV closure or turbine bypass vaive failure) or prevents the MC frqm being able to condense steam (e.g., loss of condenser vacuum or circulating water) is considered to render the MC unavailable for core heat removal.

From Table 5, all events are categorized as to whether FW and MC remain available. Table 6 briefly addresses each potential initiator and the basis for assigning them to their respective categories. The following discussion addresses those events requiring more specialized attention.

Inadvertent Opening (and Stuck Open) Relief Valve (IORV)

Due to the unique nature of this event, and the subsequent plant response, Event 11 has historically been separately categorized. An IORV does not pressurize the drywall, and therefore an automatic reactor scram does not occur on high drywell pressure as it would for the "typical" LOCA.

Additionally, _ IORVs typically happen with a substantially greater frequency than a small or medium-sized LOCA. The event is, therefore, separated into its own category.

I-726316-1 E 0506931E IE-19

TABLE 6 POTENTIAL QUAD CITIES TRANSIENT INITIATORS

1.

Electric Load Rejection - This event results in a turbine trip. The MC and FW would remain available and it is categorized as a general transient with the MC and FW available.

2.

Electric Load Rejection with Turbine Bypass Valve Failure - This event results in a turbine trip with the bypass valves unable to direct steam to the main condenser.

• FW would not be affected and it is categorized as a general transient with MC unavailable and FW available.

3.

Turbine Trip - Having essentially the same effect as Event 1, this event is categorized as a general transient with the MC and FW available.

4.

Turbine Trip with Turbine Bypass Valve Failure - With conditions essentially the same as Event 2, this event is categorized as a general transient with MC unavailable and FW available.

5.

Main Steam Isolation Valve (MSIV) Closure - This event is categorized as a general transient with the MC unavailable and FW available.

6.

Inadvertent Closl,jre of One MSIV - The closure of one MSIV will cause high steam flow in the other steamlines, which may cause isolation of all MSIV's due to high steam flow. This event is categorized as a general transient with MC unavailable and FW available.

7.

Partial MSIV Closure - Partial closure of one MSIV would not be sufficient to cause high steam flow isolation. Therefore, this event is categorized as a general transient with MC and FW available.

8.

Loss of Normal Condenser Vacuum - This event is categorized as a general transient with the MC unavailable and FW available.

9.

Pressure Regulator Fails Open - This event causes a decreasing coolant inventory as the mass flow of water entering the vessel decreases. If the operators do not intervene, a low level reactor trip/turbine trip will occur at +8 inches. Once the reactor is tripped, the level would not be expected to decrease to -59 inches and cause MSIV closure. As of December 1982, none of these events have occurred at Dresden or Quad Cities. This event is categorized as a general transient with the MC and FW available.

10. Pressure Regulator Fails Closed - This event causes increasing pressure and thus decreasing steam flow from the vessel. If the operators do not intervene, either a high vessel pressure reactor trip will occur at 1060 psig or a high vessel level turbine trip at +55 inches. Since the feedwater pumps are also tripped at +55 inches, this event is categorized as a general transient with the MC available and FW unavailable.

11. Inadvertent Opening of a Safety/Relief Valve (Stuck) - Due to its unique nature, this event is a separate initiator category. MC and FW would both be available.

12. Turbine Bypass Fails Open - This event results in decreasing vessel level. If the operators do not intervene, a low level reactor trip/turbine trip will occur at +8 inches. This event is categorized as a general transient with the MC unavailable and FW available.

13. Turbine Bypass or Control Valves Cause Increased Pressure (Closed) - This event causes increasing pressure and thus decreasing steam flow from the vessel. If the operators do not intervene, either a high vessel pressure reactor trip (at 1060 psig) or a high vessel level turbine trip (at

+55 inch~s) will occur. Since the feedwater pumps also trip at +55 inches, this event is categorized as a general transient with the MC and FW unavailable.

14. Recirculation Control Failure (Increasing Flow) - If this transient were severe enough, it would escalate reactor power until a high reactor power trip occurs. This event is categorized as a general transient with the MC and FW available.

1-726316-IE 1219941E IE-20

TABLE 6 (Continued)

POTENTIAL QUAD CITIES TRANSIENT INITIATORS

15. Recirculation Control Failure (Decreasing Flow) - The integrated plant response to this event is difficult to evaluate, but would most likely result in a reactor trip due to a mismatch in reactor power and FW/Steam flow. Since the event decreases reactivity in the core slowly, it would not seem to be a potentially "severe" transient. Through December of 1982, none of this category of event have occurred at Dresden or Quad Cities. The event is categorized as a general transient with the MC and FW available.

16. Trip of One Recirculation Pump - This event would cause a prompt power level drop and corresponding MS pressure drop. The turbine electro-hydraulic control would close to prevent MS pressure dropping to the low pressure MSIV closure at 850 psig. Level would increase, but is sufficiently slow to allow FW level control to respond and prevent a high level FW trip at +55 inches. This event is categorized as a general transient with MC and FW available.

17. Trip of All Recirculation Pumps - This event would cause a prompt power level drop and would lead to MSIV initiation on low reactor pressure at 850 psig. Level will increase faster than the FW control can respond, and a FW trip at +55 inches is also expected. This event is categorized as a general transient with MC and FW unavailable.

18. Abnormal Startup of Idle Recirculation Pump - This transient occurs when an idle recirculation pump is started at an improper power and flow condition. The increased flow could cause a flux spike, or, if the loop has been idle so as to allow coolant in the pump loop to cool, core inlet subcooling. Since this analysis addresses only events at full power, this initiator is not applicable. (Technical Specifications do not permit full power operation with only one recirculation pump running.) [Note - As of December 1982, only 4 such events have occurred in 227 BWR years of operation.]

19. Recirculation Pump Seizure - This event is essentially the same as Event 16, only faster. However, the event response would not be expected to be different. Through December of 1982, this event has only occurred once in 227 BWR years of operation (and never at either Dresden or Quad Cities). The event is categorized as a general transient with MC and FW available.

20. Feedwater (Increasing Flow at Power) ~ Increasing flow would drive the RPV water level upward. If the event were to progress far enough, the feedwater pumps:and turbine would trip when vessel level reached +55 inches. It is considered as a general transient with the MC available and FW unavailable.

21. Loss of Feedwater Heater - Loss of feedwater heating may ultimately lead to delivered feedwater temperatures such that core scram parameters are exceeded, resulting in a reactor scram. Through December of 1982, none of this category of event have occurred at Dresden or Quad Cities.

The event is categorized as a general transient with MC and FW available.

22. Loss of All Feedwater Flow - This event involves a complete loss of feedwater delivery to the core, RPV level decreases quickly, and reactor trip occurs. Loss of all feedwater flow is assumed to result in automatic MSIV closure due to low vessel level. Through December of 1982, no events of this type have occurred at Dresden or Quad Cities. The event is categorized as a general transient with MC and FW unavailable.

23. Trip of One Feedwater Pump (or Condensate Pump) - This event assumes other FW and condensate pumps continue to operate. Hence, it is categorized as a general transient with MC and FW available.

1-726316-IE 1219941E IE-21

TABLE 6 (Continued)

POTENTIAL QUAD CITIES TRANSIENT INITIATORS

24. Feedwater (low Flow at Power) - If the operators do not intervene in this scenario, a low level reactor trip/turbine trip will occur at +8 inches.

After reactor trip, the level would not be expected to decrease to -59 inches. This event is categorized as a general transient with MC and FW available.

25. Low Feedwater Flow During Startup or Shutdown - Since initiators for the Quad Cities IPE work are assumed to occur while the plant is at full power, this initiator is not applicable to this analysis.

26. High Feedwater Flow During Startup or Shutdown - Since initiators for the Quad Cities IPE work are assumed to occur while the plant is at full power, this initiator is not applicable to this analysis.

27. Rod Withdrawal at Power - If sufficient reactivity is inserted, then a high power reactor trip signal will be generated. Through December of 1982, no events of this type have occurred at Dresden or Quad Cities, and the event has only occurred 3 times in 227 BWR years of operation. The event is categorized as a general transient with MC and FW available.

28. High Flux Due to Rod Withdrawal at Startup - Since initiators for the Quad Cities IPE work are assumed to occur while the plant is at full power, this initiator is not applicable to this analysis.

29. Inadvertent Insertion of Rod or Rods - Since the event decreases reactivity in the core, it would not seem to be a potentially "severe" transient.

Assuming the event does result in conditions requiring a reactor scram, it* is categorized as a general transient with MC and FW available.

30. Detected Fault in_ the Reactor Protection System - This transient occurs when a scram is initiated due to an indicated fault in the reactor protection system. An example is the high level indication in the scram discharge volume. Since the reason for the reactor trip does not affect MC and FW in this category of initiator, this event is categorized as a general transient with MC and FW available.

31. Loss of Offsite Power - This event has diverse implications for plant operations. Due to its unique nature, it is included as a separate initiator category. Both MC and FW would be unavailable during this event.

32. Loss of Auxiliary Power (Loss of Auxiliary Transformer) - This transient occurs when the loss of incoming power to a plant results from onsite failures such as the loss of an auxiliary transformer. This initiator is addressed under the loss of offsite power initiator category. Both MC and FW may be lost in this event and are both considered unavailable during this event.

33. Inadvertent Startup of HPCl/HPCS - Quad Cities does not have a HPCS system. If the HPCI system was inadvertently actuated, a high vessel level trip of the feedwater pumps and turbine are likely to occur, or a high power reactor trip might occur first due to insertion of the relatively cold water. This event is categorized as a general transient with MC available and FW unavailable. (As of December 1982, only 2 of these events have occurred in 227 BWR years of operation.)

34. Scram Due to Plant Occurrences - Events such as fire, turbine vibration, etc., require manual or automatic shutdown even though they may not result in an out-of-tolerance condition in the primary system. This category of events primarily addresses balance of plant type problems and may affect the MC. Therefore, this event is categorized as a general transient with the MC unavailable and FW available.

1-726316-IE 1219941E IE-22

TABLE 6 (Continued)

POTENTIAL QUAD CITIES TRANSIENT INITIATORS

35. Spurious Trip Via Instrumentation, RPS Fault - This transient ensues when instrumentation or logic circuits, due to human error or hardware failure, erroneously force a reactor scram. Since no mitigating components or equipment (e.g., pumps, heat exchangers and MOVs) are impaired from operation (although manual operation may be necessary), this event is categorized as a general transient with MC and FW available.

36. Manual Scram (No Out-of-Tolerance Condition) - This category of events includes normal controlled shutdown. The event is categorized as a general transient with MC and FW available.

37. Cause Unknown - This transient occurs when a scram occurs, but the cause was not determinable. This event is considered to be bounded by a general transient with the MC and FW unavailable.

38. Spurious Opening - Reactor Depressurization System Valve - Analyzed for Big Rock Point, this event is, due to the Quad Cities ADS design, the same as the IORV event.

39. Spurious Closing - Both Recirculation Line Valves - This event closely resembles the Trip of All Recirculation Pumps event, except that recirculation flow may terminate more quickly. This event is considered bounded by a general transient with MC and FW unavailable.

40. Inadvertent Core Spray Injection During Startup - Since initiators for the Quad Cities IPE work are assumed to occur while the plant is at full power, this initiator is not applicable to this analysis.

41. Rod Withdrawal At Startup - Since initiators for the Quad Cities IPE work are assumed to occur while the plant is at full power, this initiator is not applicable to this analysis.

42. Fuel Loading Error During Refueling - Since initiators for the Quad Cities IPE work are assumed to occur while the plant is at full power, this initiator is not applicable to this analysis.

1-726316-IE 1219941E IE-23

Loss of Offsite Power (LOOP)

The Loss of Offsite Power (LOOP) event dramatically affects plant operations since it not only results in a unit trip, but it also affects mitigation response by placing demands on the onsite power system. Likewise, loss of auxiliary power (or loss of the auxiliary transformer) occurs when the loss of incoming power to a plant results from onsite failures such as the loss of an auxiliary transformer, resulting in much the same conditions as the loss of offsite

. _ power. These events require special attention and are thus separately categorized.

Offsite power may be lost due to any of three groups of events: plant-centered faults, grid-related losses, and weather-related losses. Since Quad Cities is a multi-unit facility, the LOOP event may affect only one unit or it may affect both, depending on which of these three groups of events controls. A dual unit initiator (DUI) must be separately defined and assessed for both units due to the greater potential impact on plant operations.

Plant-centered events are those whose occurrence is related to the design and operational characteristics of the plant itself. Examples include hardware failures, design deficiencies, human errors in switching and maintenance, localized weather-induced faults (such as ice and lightning), and combinations of these occurrences. Separate plant-centered frequencies must be calculated for each unit, as well as a combined frequency for the facility based on plant design.

Grid-related events address those occurrences where the reliability of the grid or external influences on the grid have an adverse effect on the availability of offsite power. Grid-related events are attributable to all units at a given plant site.

Weather-related events are primarily those resulting from storms and similar atmospheric events. Typically of longer duration than either plant-centered or grid-related events, these events are the underlying cause of the loss of offsite power. Depending on the event itself, weather may or may not impact power restoration. If weather does not affect the restoration time, the event is included in the pl.ant-centered group; if it does, then it is included in the I-726316-1 E 0506931E IE-24

weather-related group. Weather-related events are attributable to all units at a given site.

A sub-group, extremely severe weather events, is also attributable to all units at a given site.

Anticipated Transient Without Scram (A TWS)

An ATWS event is the failure of the Reactor Protection system (RPS) to properly insert control rods to reduce reactor power, given a transient event which should initiate the RPS.

. _ Should an ATWS occur, alternative measures must be taken to assure reactor shutdown.

The ATWS event is a conditional event requiring separate analysis.

Table 7 provides the preliminary Quad Cities transient initiating event groupings.

3.3 Unanticipated Transients The unanticipated transients ar:e identified in Table 2. The IPE treatment of these events is discussed below:

Control Rod Drop:

This event is the same event as NUREG/CR-3862 Event 27, Rod Withdrawal at Power. As Table 6 explains, this event is considered to be bounded by a general transient with the MC unavailable. Therefore, it is grouped with the anticipated transients.

Refueling Accidents: These events are outside the scope of this analysis and are omitted from further consideration.

Main Steam Line Break Outside the Drvwell: These events are addressed by the LOCA analysis described in Sections 2.1 and 3.1. Therefore, separate evaluation of these events as unanticipated transients is not required.

Loss-of-Coolant Accidents (LOCAs}: These events are treated explicitly by this analysis in Sections 2.1 and 3. 1. Separate evaluation of these events as unanticipated transients is not required.

Loss of Control Room: This event may result from a fire in or near the control room. This event will be addressed as part of the external events analysis (see Section 1.0); further analysis as an initiating event is not required.

I-726316-1 E 0506931E IE-25

TABLE 7 INITIATING EVENT GROUPINGS T1 - GENERAL TRANSIENT WITH FW AND MC AVAILABLE Electric Load Rejection (NUREG/CR-3862 Initiator 1)

Turbine Trip (NUREG/CR-3862 Initiator 3)

Partial MSIV Closure (NUREG/CR-3862 Initiator 7)

Pressure Regulator Fails Open (NUREG/CR-3862 Initiator 9)

Recirculation Control Failure (Increasing Flow) (NUREG/CR-3862 Initiator 14)

Recirculation Control Failure (Decreasing Row) (NUREG/CR-3862 Initiator 15)

Trip of One Recirculation Pump (NUREG/CR-3862 Initiator 16)

Recirculation Pump Seizure (NUREG/CR-3862 Initiator 19)

Loss of Feedwater Heater (NUREG/CR-3862 Initiator 21)

Trip of One Feedwater Pump (or Condensate Pump) (NUREG/CR-3862 Initiator 23)

Feedwater (Low Flow at Power) (NUREG/CR-3862 Initiator 24)

Rod Withdrawal at Power (NUREG/CR-3862 Initiator 27)

Inadvertent Insertion of Rod or Rods (NUREG/CR-3862 Initiator 29)

Detected Fault in the Reactor Protection System (NUREG/CR-3862 Initiator 30)

Spurious Trip Via Instrumentation, RPS Fault (NUREG/CR-3862 Initiator 35)

Manual Scram (No Out-of-Toler.ance Condition) (NUREG/CR-3862 Initiator 36)

T2 - GENERAL TRANSIENT WITH FW AVAILABLE AND MC UNAVAILABLE Electric Load Rejection with Turbine Bypass Valve Failure (NUREG/CA-3862 Initiator 2)

Turbine Trip with Turbine Bypass Valve Failure (NUREG/CR-3862 Initiator 4)

Main Steam Isolation Valve (MSIV) Closure (NUREG/CR-3862 Initiator 5)

Inadvertent Closure of One MSIV (NUREG/CA-3862 Initiator 6)

Loss of Normal Condenser Vacuum (NUAEG/CA-3862 Initiator 8)

Turbine Bypass Fails Open (NUREG/CR-3862 Initiator 12)

Scram Due to Plant Occurrences (NUREG/CR-3862 Initiator 34)

T3 - GENERAL TRANSIENT WITH FW UNAVAILABLE AND MC AVAILABLE Pressure Regulator Fails Closed (NUREG/CA-3862 Initiator 10)

Feeawater (Increasing Flow at Power) (NUREG/CA-3862 Initiator 20)

Inadvertent Startup of HPCl/HPCS (NUREGJCA-3862 Initiator 33)

T4 - GENERAL TRANSIENT WITH FW AND MC UNAVAILABLE Turbine Bypass or Control Valves Cause Increased Pressure (Closed) (NUREG/CR-3862 Initiator 13)

Trip of All Recirculation Pumps (NUREG/CR-3862 Initiator 17)

Loss of All Feedwater Flow (NUREG/CR-3862 Initiator 22)

Cause Unknown (Scram Occurs) (NUREG/CR-3862 Initiator 37)

I-726316-1 E 0506931E IE-26

I._

TABLE 7 (Continued)

INITIATING EVENT GROUPINGS T5 - LOSS OF OFFSITE POWER (NU REG/CR-3862 Initiator 31)

Loss of Auxiliary Power (Loss of Auxiliary Transformer) (NUREG/CR-3862 Initiator 32)

Transient w/Loss of 4160VAC Safety Bus (NUREG/CR-2300)

T6 - INADVERTENT OPENING OF A SAFETY/RELIEF VALVE (STUCK)

{NUREG/CR-3862 Initiator 11)

Stuck Open Relief Valve T7 - ATWS Control Rod Drop Accident {Stuck) (GE Lesson Plan - Abnormal Events Analysis)

Incomplete Rod Insertion (GE Lesson Plan - Abnormal Events Analysis)

MSIV Closure w/o Scram {GE Lesson Plan - Abnormal Events Analysis)

Stuck Open Relief Valve w/o Scram (GE Lesson Plan - Abnormal Events Analysis)

Loss of Feedwater w/o Scram (GE Lesson Plan - Abnormal Events Analysis)

I-726316-1 E 0506931E IE-27

Station Blackout: These events are the result of multiple AC power source failures and are identified by the support state analysis.

The likelihood of entering this condition is determined by the quantification of the support state model and, therefore, is not treated further in this notebook.

3.4 Special Initiating Events The review of prior PRAs outside the CECo program (conducted in Section 3.2 to identify

__ potential transient events) also yielded a list of suspect special initiating events. Table 4 provides a listing of the events identified in the prior PAA review process, including the suspect special initiating events. This list of possible special initiators serves as the starting point for the plant-specific systems review.

Service Water (SW) System The Quad Cities SW system i.s completely shared by Units 1 and 2.

It consists of five pumps, with four normally operating and one standby swing pump, which supply flow to a common unisolable header. This header then supplies three strainers, one per unit and a swing strainer, followed by another common unisolable header. This header then supplies SW cooling loads for both units. The major loads are as follows:

Steam Tunnel Coolers, Emergency Air Coolers.

Control Room A/C, Traveling Screen Wash, Fire Protection System, Turbine Building Closed Cooling Water Heat Exchangers, Reactor Building Closed Cooling Water Heat Exchangers, HPCI Room Coolers, I-726316-1 E 0506931E IE-28

Instrument Air Coolers, MSIV Room Coolers, Generator Stator Water Coolers, Generator Hydrogen Coolers, MG Set Oil Coolers, and Turbine Oil Coolers.

The return flow from these loads is routed to one of two discharge headers (per unit), both of which then discharge to the Circulating Water system discharge header. The Service Water system may also be required to supply Standby Coolant Supply to the main condenser hotwell. System walkdown team members reviewed the gates at the outfall structure to determine whether gate closure would result in a plant trip. This review revealed that water would be diverted over a spill~ay and back into the river and that the unit would not be tripped. Electric power to the pumps and valves is generally aligned according to the Unit being supplied. Two pumps are powered from Unit 1, two are powered from Unit 2, and the swing pump is powered from either unit. (See SW system notebook, Reference 30.) The UFSAR specifies that, given a loss of all off-site electrical power (LOOP) simultaneously with a LOCA at one unit, one SW pump is sufficient to satisfy the needs of both units (with both having been scrammed by the LOOP event).

Note that cooling to the Residual Heat Removal (RHR) heat exchangers is provided by a separate system, the RHR service water (RHRSW) System.

A review of several hundred reactor years of BWR experience reveals that, to date, a loss of all Service Water has never occurred. [Telephone conversation between T. Dart, Tenera, and M. Eldridge, Stoller Power Corp. (Nuclear Power Experience, Reference 31 )].

In addition, all ECCS systems, including ADS, HPCI, RHR, CS, and RCIC, remain available following a loss of Service Water. Thus, given both the low consequences and the low probability of the loss of Service Water event, the event is not separately evaluated as an initiating event. The plant response to a loss of Service Water resembles the response to I-726316-1 E 0506931E IE-29

a general transient with the main condenser unavailable. The frequency for the General Transient with the Main Condenser Unavailable initiating event is expected to be relatively high compared to the Loss of Service Water event frequency. Since the Loss of Service Water event will not significantly affect this frequency, the event is dropped from further consideration.

Turbine Building Closed Cooling Water (TBCCW) System The TBCCW system is a closed loop system which transfers heat from turbine building and crib house loads to the SW system. These loads include the following:

EHC Fluid Coolers, Bus Duct Coolers, Alternator Exciter Coolers,

~

Service Air Compressors and Aftercoolers, Sparging Air Compressor Aftercoolers, Turbine Building Sample Panel, Control Rod Drive (CRD) pumps, Circulating Water pumps, Reactor Feed pumps, and Condensate and Condensate Booster pumps.

Loss of cooling to these latter components will ultimately result in a reactor trip. Likewise, most of the components may be used to mitigate a reactor trip. Therefore, Loss of TBCCW is a valid special initiating event. However, since the TBCCW system relies on the SW system for cooling, loss of SW will, for TBCCW loads, result in the same plant conditions.

Note also that due to the dual pump and heat exchanger arrangement, failure of the TBCCW system would be dominated by loss of the support systems, which are addressed elsewhere I-726316-1 E 0506931E IE-30 I

in this analysis. Since loss of TBCCW will result in a loss of the Feedwater system, the unit response will be very similar to the General Transient with the Main Condenser (MC) and Feedwater (FW) Unavailable event. However, due to the relatively high frequency of the MC and FW Unavailable event (and the expected low frequency for the Loss-of TBCCW event),

the Loss of TBCCW event will not significantly affect the MC and FW Unavailable frequency.

Thus, the Loss of TBCCW event may be dropped from further consideration. (See TBCCW system notebook, Reference 32.)

Reactor Building Closed Cooling Water (RBCCW) System The RBCCW is a closed loop system which transfers heat from reactor building and drywell loads to the SW system. These loads include the following:

Recirculation pumps, Drywell coolers, Drywall Pumpback compressors and aftercoolers, Drywell Pneumatic compressors and attercoolers, Non-Regenerative heat exchangers, Fuel Pool heat exchangers, Drywell Equipment Drain Sump heat exchanger, Reactor Building Equipment Drain Tank heat exchanger, and Other miscellaneous loads.

Loss of RBCCW will result in a reduction in power because the operators are required to trip the Recirculation pumps. After shedding loads from the RBCCW system, the procedures direct the operators to trip the recirculation pumps if the temperature is still outside the acceptable range. They are then directed to proceed with a controlled shutdown. This transient is less severe than a General Transient with the Main Condenser Unavailable event.

1-726316-1 E 0506931E IE-31

Plant records reveal that Quad Cities has experienced no significant RBCCW system problems which adversely affected plant operations. As with the TBCCW system, loss of SW is expected to dominate the RBCCW system failures.

Due to the dual pump and heat

• I exchanger arrangement, system failure is expected to be quite low; support system failures I (addressed elsewhere in this analysis) are expected to dominate. Given the low significance (from an initiating events perspective) of the system failure and the low likelihood of a Loss of RBCCW, the event may be dropped from further consideration. (See RBCCW procedures,

_ _ Reference 46.)

Drywell Coolers The Drywell Coolers provide normal heat removal for the drywell. The seven coolers are cooled by RBCCW, which is ultimately cooled by SW. Loss of SW is expected to dominate the Drywell Cooler failures. The Drywell Coolers remove only 1.2 MW of energy, which corresponds to the decay heat source after more than 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> have lapsed since reactor shutdown (see ANSl/ANS-5.1-1979 American Nuclear Society Decay Heat Power and Light Water Reactor - An American National Standard, Reference 43).

From an operational perspective, they are very important because, if they are lost, a unit shutdown will be required due to drywell heatup. Although drywell coolers affect timing of accident scenarios, they do not directly initiate events and are not considered a valid initiating event.

Emergency Service Water N/A for Quad Cities.

High Pressure Service Water N/A for Quad Cities.

1-726316-IE 0506931E IE-32

Fire Protection System Loss of the Fire Protection system is not considered an initiating event for Quad Cities.

However, the Internal Flooding Analysis will examine the potential for area flooding caused by Fire Protection System piping and components.

Circulating Water System Loss of the Circulating Water System is included in the data used for arriving at a Loss of Condenser Vacuum frequency (Reference 1 ).

DC Power (or Bus) 250VDC Review of the 250VDC loads revealed that, given a loss of 250VDC, no scram is expected to result.

Likewise, no immediate shutdown is required, although eventual shutdown is required if 250VDC is not recovered. (For example, if a battery fails, the operators must initiate shutdown within two hours and be in cold shutdown within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> unless the failed battery is made operable before such time expires.) Given the cross-unit alignments, the resulting alternate power arrangements, and the non-emergency response required should 250VDC be lost, this loss is not anaiyzed as an initiating event.

(See Electrical Power system notebook, Reference 34.)

125VDC Each unit's 125VDC battery bus system consists of the battery (operating in float), an alternate battery (to facilitate testing while at power), two battery chargers (with one in standby), and the distribution system (see Figure 1 ). Each unit's battery bus provides power to its own Turbine Building Main Bus, as well as the opposite unit's Turbine Building Reserve Bus. The system operates ungrounded; two faults to ground (one on each of the positive 1-726316-IE 0506931E IE-33

1-726316-IE 0506931E ll* I 12!J \\1iC BA llEliY 480 VAC

-~~~(:_

[

BAllERY l Ct1*RGER NlA

-**--***i--

NO

.. ________ J ~~~~-

480 VAC

-~~:r:J BA lTERY CttARGER 62

-~

C02 C04 I BOJ r-~~-l ----

tlC r r NC T B BUS IA I B RES E<US 18 T B RES BUS 28 801 1 r~::-r BOS--l ~04 ~-------

~'J~

'°, t 1!

1 B;il ~~

1

[81 IA\\

1A2 1

)~~, I) ~;g T 8 BUS 182 AOJ l AO\\

_ _J ______

R _!:'..BUS _!_ ____ r ___ _

1726316EA 050793 FIGURE 1:

UNITS 1 125 voe DISTRIBUTION AND 2 (SIMPUFIE'D)

IE-34 A03 r u-2 12s voe BAllERY C04 NC 480 VAC MCC 28-2 BAllERY CHARGER f2A NO r

C03 BATT BUS 2 _

T8 BUS 2A I B05 l 802 I B01 1

-N-C NC 1 NC l_~

~k-2A2 2A1 R B BUS 2 l AO\\

I REF: 4E-231B8, REV C

and negative buses) are required to discharge the battery via the fault. Note that should an operating battery charger fail, the dedicated standby charger must be aligned manually. The batteries are designed to provide emergency and safe shutdown power for four hours without charger operation. (See the Electrical Power system notebook, Reference 34.)

Loss of either the battery charger or the battery does not interrupt power to the 125VDC buses; loss of 125VDC requires the loss of both or failure of the Battery Bus, the Turbine Building Main Bus or the circuit breaker located between the two buses.

Should the operating charger fail, the battery will provide power to the bus for several hours, providing time for the operators to align the standby charger. If a 125VDC bus is lost, one recirculation pump at each unit and one-half of the ECCS systems become unavailable.

Plant procedures indicate that upon loss of a 125VDC bus, the unit may continue to operate; an automatic reactor scram does not result since the reactor feed pumps will continue operating (they automatically trip at some plants). Discussions with operations personnel

~

reveal that a manual unit scram is not indicated. Instead, unit power will be reduced (due to the lost recirculation pump), de power will be aligned to the alternate bus, and the unit will continue to operate. Obviously, if the operators fail to align to the alternate de source, changes in operating conditions will eventually lead to a reactor scram.

Given the procedures instructing the operators to align to the alternate source, the probability that they will fail to align to the alternate de power supply is quite low. The relatively low probability of loss of a single bus (estimated to be approximately 9E-04), combined with failure of the operators to align to the other source, results in an event of quite low probability. Given substantial plant resources would still be available to mitigate this event and its low probability, loss of 125VDC is not further analyzed as a potential initiating event for Quad Cities. Likewise, due to low probability, a dual unit loss of 125VDC event is not analyzed for Quad Cities.

1-726316-1 E 0506931E IE-35

Individual AC Buses and Panels Loss of a single AC bus or panel as an initiating event is much less likely than loss of offsite

• I power at one or both units. Additionally, LOOP is more limiting due to the more widespread plant impact. Loss of a single AC bus or panel is therefore subsumed by LOOP and by other transient events such as partial loss of feedwater.

. _ Degradation of On-site AC Power Bus See Loss of Off-site Power Analysis.

Plant Air Compressors (Instrument Air)

Instrument Air (IA) is used to maintain the outboard MSIVs in the open position. In addition, it is used for feedwater system and hotwell level control. Also, several vent valves rely on Instrument Air.

Loss of IA leads to MSIV closure and loss of the path to the Main Condenser. The event is therefore considered incorporated in the MSIV closure data, which contributes to the overall MC unavailable event.

Drywall Pneumatic System The Drywell Pneumatic system is used to maintain the inboard MSIVs in the open position.

If this system is lost or significantly impaired, the inboard MSIVs will go closed, isolating the path to the Main Condenser. Therefore, the event is considered incorporated in the MSIV closure data, contributing to the MC unavailable event.

Reactor Water Level Reference Line Break A leak in a reactor water reference line results in a relatively small LOCA event. Small LOCA events can lead to reactor scram and containment isolation. However, such a leak does not necessarily result in a plant transient. The impact on reactor operations depends on the I* 726316-1 E 0506931E IE-36

I l_

response of other systems. Provided feedwater maintains adequate level control, power operations may continue.

Loss of inventory in one reference leg will cause all level instrumentation dependent on that leg to read high, which may impact the plant/operator

• 1 response to the break. See BWR IPE Methodology, Section 4.4 (Reference 2). However, the Reactor Protection System is designed with sensors in two independent sensing lines, I precluding a single line break from initiating a reactor scram based on erroneous level I indication. (See RPS notebook, Reference 42). The probability of a reference line break is

+ addressed in the Small LOCA frequency. Thus, this event is not further evaluated as a separate initiating event.

Excess Water Release Into Reactor Building (Elevation 8)

Shoreham postulated event - N/A for Quad Cities. The Flooding Analysis assesses the potential for excessive water being released and the consequences of such a release.

High Pressure Coolant Injection (HPCI) System The turbine-driven HPCI system provides coolant to the core from either the contaminated condensate storage tank (the initial source) or the suppression pool (torus). The system is automatically actuated on low-low RPV water level and/or high drywall pressure. It then cycles, based on RPV level, to maintain level within preset limits. If the system is found or made inoperable, it must be returned to service within fourteen days. However, continued reactor operation during this period is permitted, provided that "the Automatic Pressure Relief Subsystem, the core spray subsystems, LPCI mode of the RHR system, and the RCIC system are operable." Thus, loss of the HPCI system does not mandate immediate unit shutdown; system failure is, therefore, not considered a special initiating event. Inadvertent startup of HPCI is, however, considered during this analysis (see Table 1, Initiator 33). (See HPCI system notebook, Reference 35).

1-726316-1 E 0506931E IE-37

Reactor Core Isolation Cooling (RCIC) System The turbine-driven RCIC system provides coolant to the core from either the contaminated condensate storage tank (the initial source) or the suppression pool (torus). The system is automatically actuated on low-low RPV water level; it may also be started manually. It then operates until it is automatically tripped on RPV level, pump low suction pressure, turbine high exhaust pressure, or an auto-isolation signal. If the system is found or made inoperable,

-- it must be returned to service within fourteen days. However, continued reactor operation during this period is permitted, provided that the HPCI system is operable. Thus, loss of the RCIC system does not mandate immediate unit shutdown; system failure is, therefore, not considered a special initiating event. (See RCIC system notebook, Reference 38).

Inadvertent startup of RCIC, given its small flow rates (as compared to HPCI), *is not considered a significant threat to continued power operations. Automatic level and flow controls on the Feedwater system should compensate for the added flow until operators shut down the RCIC system. Given the low flow, the automatic responses, and the minimal impact on power operations, inadvertent startup of RCIC is not considered a probabilistically significant initiating event.

Residual Heat Removal (RHR) System The RHR system is designed for three modes of operation, with each defined as a subsystem of the RHR System - 1) Low Pressure Coolant Injection (LPCI), 2) Containment Cooling, and 3) Reactor Shutdown and Head Cooling. The LPCI subsystem provides coolant to the core by pumping water from the suppression pool into the vessel via the recirculation piping. The Containment Cooling subsystem transfers heat from the torus to the AHR Service Water (RHRSW) system using the AHR heat exchangers. The cooled water may then be returned to the suppression pool or, alternatively, it may be used to control containment temperature and pressure by delivering it to the torus and/or drywall air spaces.

The Reactor Shutdown subsystem is used for routine shutdown and is not a safety requirement.

1-726316-IE 0506931E IE-38

The LPCI subsystem acts as a functionally redundant, but diverse alternative to CS. When the reactor is at power, the LPCI and Containment Cooling subsystems are normally in standby. If the entire LPCI subsystem becomes inoperable, it must be returned to service within seven days; otherwise, the reactor must be shut down. If one RHR pump becomes inoperable, it must be returned to service within thirty days; otherwise, the reactor must be shut down. Therefore, failure of the LPCI or Containment Cooling subsystems does not constitute a special initiating event. (See RHR system notebook, Reference 36.)

Residual Heat Removal Service Water (RHRSW) System The RHRSW System provides cooling to the RHR heat exchangers. This system is needed late in an accident sequence to provide heat removal for the suppression pool cooling and containment spray modes of AHR operation. While system failure will disable an accident mitigation system, prompt reactor scram is not required. The unit may continue to operate for up to thirty days with one Al:-IRSW pump disabled; the unit may operate seven days with the entire AHRSW system disabled. See the AHR\\RHRSW System Notebook. Thus, the loss of RHRSW event does not satisfy the criteria for an initiating event and is not further analyzed.

Core Spray (CS) System The CS system provides coolant to the core by pumping water from the suppression pool (or, alternately, the Contaminated Condensate Storage Tanks) into the vessel. This system acts as a functionally redundant, but diverse alternative to LPCI. When the reactor is at power, CS is normally in standby. If the system becomes inoperable, it must be returned to service within seven days; otherwise, the reactor must be shut down. During the period that one subsystem of CS is inoperable, "the other core spray subsystem and the LPCI mode of the AHR system and the diesel generators required for operation of such components if no external source of power were available shall be operable." Hence, failure of the CS system does not constitute a special initiating event. (See CS system notebook, Reference 37.)

I* 726316-1 E 0506931E IE-39

Heat. Ventilation. and Air Conditioning (HVAC) System The HVAC system provides area cooling to several safety systems, such as HPCI, RHR and CS. These components can all operate for varying periods of time without room cooling.

Since loss of HVAC does not cause a reactor scram, this event is not considered a special initiator.

1-726316-IE 1219941E IE-40

ENCLOSURE2 DRESDEN STATION Calculation Note - DR-CN-92-006 "Recovery of Power Probabilities for Dresden IPE."

_ k~~!~uad~r~irev+/-:V'.P~-- ___________ ~~

9412290328 941223 PDR ADOCK 05000237 P

PDR

I DR-CN-92-006 Page 1 of 16 CALCULATION NOTE COVER SHEET I

Section To Be Completed By Author(s):

Cale-Note Number: DR-CN-92-006 Revision Number:

0 Tiiie:

RECOVERY OF POWER PROBABILITIES FOR DRESDEN IPE Project: DRESDEN IPE Shop Order: N\\A

Purpose:

TO DOCUMENT THE SOURCE OFTHE PROBABILITIES USED FOR TWO NODES IN THE DRESDEN LOSS OF OFFSITE POWER AND STATION BLACKOUT PLANT RESPONSE TREES.

Results Summary:

THE DRESDEN STATION IS CONSIDERED TO BE IN THE GFOFFSITE POWER RECOVERY.CLUSTER GROUP #1. ACTUAL-PROBABILITIES OF NOT RECOVERING POWER AT SPECIFIC TIMES ARE SHOWN IN SECTION 4.

Author(s):

Completion Name: (Print or Type)

Signature Date ROBERT BUELL

_(8,.4.:;;/ ~

aLl~lze.

~

I I

Section to be completed by Verifier(s):

I Verlfler(s):

Name: (Print or Type)

"'1;Jnature Date 11!._2011_z DAVID J. BIZZAK

• ut1-4P-L

. f Section to be completed by Manager:

Approving Manager:

Approval Name: (Print or Type)

Signature Date

~.&~~

,b~

tPrffs

/

CALC-NOTE NUMBER: DR-CN-92-006 DR-CN-92-006 Page 2 of 16 REV._O_

CALCULATION NOTE METHODOLOGY CHECKLIST CHECKLIST TO BE COMPLETED BY AUTHOR(S):

(CHECK APPROPRIATE RESPONSE)

1.

2.

3.

4.

Is the Subject and/or the Purpose of the Design Analysis Clearly Stated?

Are the Required Inputs and Their Sources Provided?

Are the Assumptions Clearly Identified and Justified?

Are the Methods and Units Clearly Identified?

5.

Are the Results of Literature Searches, if Conducted, and Other Background Data provided?

6.

Are all the Pages Sequentially Numbered and Identified by the Calculation Note Number?

7.

Is the Project or Shop Order Clearly Identified?

8.

Has the Required Computer Calculation Information Been Provided?

9.

Were the Computer Codes Used Under Configuration Control?

10.

Are the Results and Conclusions Clearly Stated?

c§Mo

@)NON/A

@)No N/A

@)NON/A

@No YES NO <f!/iJ YES NO@

YES NO@)

~NO

11.

Were Approved Design Controlled Practices

~

Followed Without Exception?

~NO NOTE:

IF 'NO' TO ANY OF THE ABOVE, PAGE NUMBER CONTAINING JUSTIFICATION: __________

TABLE OF CONTENTS.

Section 1.0 Introduction 2.0 Determination of Offsite Power Cluster Subgroups 2.1 Grid Reliability/Recovery Group 2.2 Severe Weather/Recovery Group 2.3 Extremely Severe Weather Loss of Offsite Power Frequency Group 3.0 Determination of Offsite Power Cluster Group 4.0 Probability of Not Recovering Power at Time X (ROP1) 5.0 Conditional Probability of Not Recovering Power at Time X+i (ROP2) 6.0 References Appendix A Relevant Tables DR-CN-92-006 Page 3 of 16 Page 4

4 7

7 8

8 8

10 10 12

1.0 INTRODUCTION

DR-CN-92-006 Page 4 of 16 The purpose of this calculation note is to document the source of the probabilities used for two nodes in the Dresden Loss of Offsite Power and Station Blackout Plant Response Tree notebooks (References 1 and 2). The two nodes in question are:

ROP1 Recovery of Offsite Power in Time to Preclude Core Damage ROP2 -

Recovery of Offsite Power in Time to Preclude Containment Failure The methodology used to determine these probabilities is contained in this document and is based on the information found in NUREG-1032 "Evaluation of Station Blackout Accidents at Nuclear Power Plants" (Reference 3).

.* The steps to determine these probabilities include:

• Determine the "Offsite Power Cluster Group" that Dresden should be included in by implementing the selection criteria found in NUREG-1032.

• Determine the probability of recovering power in time to prevent core damage (ROP1) using the frequency distributions contained in NUREG-1032.

• Determine the conditional probability of power recovery for the time corresponding to ROP2, given failure of power recovery at the time corresponding to ROP1.

Each of these steps will be discussed in detail in the following sections.

2.0 DETERMINATION OF POWER CLUSTER SUBGROUPS The Offsite Power Cluster Grouping is an attempt to account for any relationship between switchyard design characteristics, local weather, power recovery procedures, and the duration of loss of offsite power events at a given plant. The methodology used to determine the

DR-CN-92-006 Page 5 of 16 appropriate Offsite Power Cluster Group is based on the selection criteria found in Tables A.2, A.3, A.6 and Tables A.8 through A.11 of NUREG-1032. The Offsite Power Cluster Group is determined by the unique combination of four subgroups. These subgroups, defined by grid design and local weather, are shown below:

1. Switchyard Configuration Group (11, 12, 13)

2. Grid Reliability/Recovery Group (G1, G2, G3, G4)

3. Severe-Weather-Induced Loss of Offsite Power Frequency/ Recovery Group (SR1, SR2, SR3, SR4, SAS, SR6, SR7, SRB, SR9, SR10)

4. Extremely Severe-Weather-Induced Loss of Offsite Power Frequency Group (SS1, SS2, SS3, SS4, SSS)

Two factors, grid and switchyard design, are pc:itentially significant with regard to frequency and duration of loss. of offsite power events.

The impact of these design factors is determined by declaring yes or no to the following statements. The unique blend of yes and no responses define the impact of these features and the subsequent Switchyard Configuration Group to which the plant belongs.

A. Independence of offsite power sources to the nuclear plant.

1. All offsite power sources are connected to the plant through one switchyard. NO

2. All offsite power sources are connected to the plant through two or more switchyards, and the switchyards are electrically connected. YES

3. All offsite power sources are connected to the plant through two or more switchyards or separate incoming transmission lines, but at least one of the AC sources is electrically independent of the others. NO

DR-CN-92-006 Page 6 of 16 B. Automatic and manual transfer schemes for the Class 1 E buses when the normal source Of AC power fails and when the backup sources of offsite power fail.

1. If the normal source of AC power fails, there are no automatic transfers and there is one or more manual* transfers to preferred or alternate off site power sources. NO

2. If the normal source of AC power fails, there is one automatic transfer but no manual transfers to preferred or alternate offsite power sources. NO

a. All of the Class 1 E buses in a unit are connected to the same preferred power source after the automatic transfer of power sources. YES

b. The Class 1 E buses in a unit are connected to separate offsite power sources after the automatic transfer of power sources. NO

3. After loss of the normal AC power source, there is one automatic transfer. If this source fails, there may be one or more manual transfers of power sources to preferred or alternate offsite power sources. YES

a. All of the Class 1 E buses in a unit are connected to one preferred power source after the first automatic transfer. YES

b. The Class 1 E buses in a unit are connected to separate offsite power sources after the first automatic transfer. NO

4. If the normal source of AC power fails, there is an automatic transfer to a preferred source of power. If this preferred source of power fails, there is an automatic transfer to another source of offsite power. NO

a. All of the Class 1 E buses in a unit are connected to the same preferred power source after the first automatic transfer. NO

b. The Class 1 E buses in a unit are connected to separate offsite power sources after the first automatic transfer of power source. NO The responses to the above statements are based on information contained in the Electric Power Systems Notebook (Reference 4) and show that Dresden falls into Switchyard Configuration Group 12. All group designations based on design factors are shown in Table 1 of Appendix A.

2.1 Grid Reliability/Recovery Group DR-CN-92-006 Page 7 of 16 The Grid Reliability/Recovery Group combines the inherent reliability of the local power grid and the ability of the plant to rapidly recover from the loss of power into a single factor.

From the Dresden Initiating Events Notebook (Reference 5), the frequency of grid related l_osses is 2.7E-3 per year. Dresden 'has never experienced a grid related loss of offsite power. NUREG-1032 implies use of a grid loss frequency of 1 E-2 per year if no loss of power events have occurred at the individual site. However, use of either frequency will place Dresden in Grid Group G1. Table 2 of Appendix A shows the relationship of grid loss frequency to Grid Group.

The next step in determining the Grid Reliability/Recovery Group is to identify the recovery group. The recovery group qualitatively identifies the plants ability to recover power within 1/2 hour following a grid blackout. The plant must have the capability and procedures to recover offsite (nonemergency) AC power to the site within 1/2 hour following a grid blackout to be considered in the R1 group. By default, all either plants not in the R1 group are contained in the R2 group. Dresden does not have specific procedures in place for recovering power in this time frame and therefore falls into the R2 recovery group. This combination of faders leads to a Grid Reliability/Recovery Group of GR5 as identified by Table 3 of Appendix A.

2.2 Severe Weather/Recovery Group The severe weather/recovery group combines the likelihood of loss of offsite power due to severe weather events with the ability of the plant to recover from the event in a rapid manner into a single fader. From the Dresden Initiating Events Notebook, the frequency of severe weather related loss of offsite power events at the Dresden station is B.4E-3 per year.

-~....

This frequency in combination with the recovery group R2, identified earlier in section 2.1, defines a Severe Weather/Recovery Group of SR7. Tables 4 and 5 in Appendix A show the

DR-CN-92-006 Page B of 16 manner in which severe weather frequency and plant recovery ability are grouped to arrive at the SR7 group designation.

2.3 Extremely Severe Weather Loss of Offsite Power Frequency Group This group is determined strictly by the frequency of extremely severe weather, postulated in this case. This event consists of losses of offsite power caused by extreme weather such as hurricanes, very high winds (greater than 125 mph) and major damage to switchyards due to tornado strikes. Restoration of offsite power following these events is assumed to require at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The Dresden Initiating Events Notebook gives a frequency of 1 E-4 per year for this type of event. The group designators associated with each occurrence frequency range are shown in Table 6 of Appendix A. With an occurrence frequency of 1 E-4, Dresden is considered to be in group SS1.

3.0 DETERMINATION OF OFFSITE POWER CLUSTER GROUP The subgroups previously defined in section two permit determination of the offsite power cluster group. These subgroups 12, G1, SR7 and 551 can be inserted into the matrix shown in Table 7 of Appendix A to determine the proper cluster group. The results of this process show that Dresden should be included in Offsite Power Cluster Group 1.

4.0 PROBABILITY OF NOT RECOVERING POWER AT TIMEX (ROP1)

NUREG-1032 gives frequency distributions for durations of loss of offsite power events for each of the cluster groups (table A.11 of Reference 3). The probability of not recovering power at each hour was derived using the median values of the frequency distribution data contained in this table. The frequency at each time interval was divided by the frequency at time = O hours to normalize the values and thus render probabilities. Since the information contained in NUREG-1032 did not have values for every hour, values for each missing hour

DR-CN-92-006 Page 9 of 16 through 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> were obtained by using log extrapolations, which provide a good fit to the to the loss of offsite power frequency duration curves presented in Figure A.15 of NUAEG-1032. The values for each of the intermediate hours not given was estimated by the following equation:

1 Ql\\((LOG(x)+LOG(y))/2) where x = probability at each hour and y = probability at the next succeeding hour given This. equation gives a value for a. point midway between two known times x and y. The results of applying this equation can then be used again to determine a new intermediate value and the equation reapplied until all the unknown values are determined.

This information is summarized in the following table for Offsite Power Cluster Group 1 for events of up to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> duration.

DURATION Loss of offsite power frequency Probability of not (HR)

{Table A.11 of NUREG-1032) recovering power 0

1/2 1

2 3

4 5

6 7

8 9

10 11 12 13 14 15 16 Freq 0.0845 NIA N/A 0.0052 NIA 0.0025 N/A N/A N/A 0.0012 N/A N/A N/A N/A N/A N/A N/A 0.0005 Normalized 1.000E+OO NIA N/A 6.154E-02 N/A 2.959E-02 N/A N/A N/A 1.420E-02 N/A N/A N/A N/A N/A N/A N/A 5.917E-03 1.000E+OO 4.981 E-01 2.481 E-01 6.154E-02 4.267E-02 2.959E-02 2.463E-02 2.0SOE-02 1.706E-02 1.420E-02 1.273E-02 1.141 E-02 1.023E-02 9.167E-03 8.217E-03 7.365E-03 6.601 E-03 5.917E-03

DR-CN-92-006 Page 10 of 16 5.0 CONDITIONAL PROBABILITY OF NOT RECOVERING POWER AT TIME X+i (ROP2)

The Station Blackout Plant Response trees ask the power recovery question twice. The first, ROP1, is the non-recovery probability corresponding to the latest time that power can be recovered to prevent core damage. The second, ROP2, is the non-recovery probability corresponding is the latest time that power can be recovered to prevent containment failure.

However, ROP2 is a conditional probability influenced by the previous failure of ROP1.

ROP2 is therefore the probability that power is not restored at X+i hours, given that it was not restored at X hours (ROP1 ). Since ROP1 accounts for that portion of the non-recovery probability in the O to X hour period, ROP2 must only account for the fractional non-recovery probability that occurs in the intervening period between X and X+i hours. This relationship can be expressed mathematically by the following equation:

ROP2=

probability of non-recovery at time X (ROP1) probability of non-recovery at time X+i Because of the many combinations of times for which ROP2 must be calculated, only the methodology is presented here. The results of the individual calculations will be contained in their respective nodes in the Loss of Offsite Power and Station Blackout Event trees.

6.0 REFERENCES

1. Loss of Offsite Power Event Tree Notebook, Dresden Station Units 2 and 3, prepared by IPEP, (To be provided at a later date}.

2. Station Blackout Event Tree Notebook, Dresden Station Units 2 and 3, prepared by IPEP, (To be provided at a later date}.

DR-CN-92-006 Page 11 of 16

3. Baranowsky, P.W., et. al., "Evaluation of Station Blackout Events at Nuclear Power Plants", U.S. NRC Report NUREG-1032, June 1988.

4. Electric Power Systems Notebook, Dresden Station Units 2 and 3, prepared by IPEP, (To be provided ata later date).

5. Initiating Events Notebook,. Dresden Station Units 2 and 3, prepared by IPEP,.(to IJe providedata.later date).

I 4

~

APPENDIX A DA-CN-92-006 Page 12 of 16

J

~.

I

• TABLE 1 DR-CN-92-006 Page 13 of 16 DEFINITION OF SWITCHYARD CONFIGURATION GROUPS GROUP FACTOR 11 A1, A2, or A3 and 84 12 A1 or A2 and 82b or 83 13 A1 orA2andB1 orB2a TABLE 2 DEFINITION OF FREQUENCY OF GRID GROUPS GROUP FREQUENCY OF GRID LOSS PER SITE YEAR G1 less than 1.67E-2 G2 1.67E-2 to 5.0E-2 G3 5.0E-2 to 0.167 G4 equal to or greater than 0.167 TABLE 3 DEFINITION OF GR GROUPS FREQUENCY GROUP RECOVERY GROUP GRID RELIABILITY/RECOVERY GROUP (GR)

G1 R1 GR1 G2 R1 GR2 G3 R1 GR3 G4 R1 GR4 G1 R2 GR5 G2 R2 GR6 G3 R2 GR7

~

J

'I/

I

(,

• I TABLE 4 DR-CN-92-006 Page 14 of 16 DEFINITION OF FREQUENCY OF SEVERE-WEATHER GROUPS GROUP FREQUENCY PER SITE YEAR 51 less than 3.0E-3 S2 3.0E-3 to 1.0E-2 53 1.0E-2 to 3.0E-2 54 3.0E-2 to 0.1 SS 0.1 to 0.33 TABLE 5 DEFINITION OF SR GROUPS FREQUENCY GROUP RECOVERY SEVERE-WEATHER/RECOVERY GROUP GROUP 51 R1 SR1 S2 R1 SR2 S3 R1 SR3 S4 R1 SR4 SS R1 SAS 51 R2 SR6 52 R2 SR7 S3 R2 SRB 54 R2 SR9 55 R2 SR10

'

• l

.~.

TABLE 6 DR-CN-92-006 Page 15 of 16 DEFINITION OF EXTREMELY-SEVERE-WEATHER-INDUCED GROUPS GROUP FREQUENCY PER SITE YEAR SS1 less than 3.0E-4 SS2 3.04E-4 to 8.3E-4 SS3 8.3E-4 to 3.0E-3 SS4 3.0E-3 to 1.0E-2 SSS greater than or equal to 1.0E-2 TABLE 7 CLASSIFICATION OF OFFSITE POWER CLUSTER GROUPS CLUSTER I

GR SR SS GROUP 1

1,2 1,3,5 1,2,6,7 1,2 1,2 1,3,5 1,6 3

1,2 1,3,5 3

1,2 2

1,2 1,3,5 8

1,2,3 1,2 1,3,5 4

1-4 1,2 1,3,5 2,3,7 3,4 1,2 1,3,5 1,6 4

3 1,3,5 1,2,6,7 1-4 3

1,3,5 3,8 1,2 3

1,3,5 3

3,4 3

1,3,5 4

1-4 3

same as cluster 7

same as cluster same as cluster 2 and 1 2 and 1 2 and 1 4

1,2,3 1,3,5,7 10 1-5

TIME 0

1 2

3 4

5 6

7 8

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 I.

24 NU REG 1032 DISTRIBUTIONS PROBABILITY OF NOT RECOVERING POWER CLUSTER GROUPS 1

2 3

4 1.000E+OO 1.000E+OO 1.000E+OO 1.000E+OO 2.481 E-01 3.682E-01 4.105E-01 4.663E-01 6.154E-02 1.356E-01 1.685E~01 2.174E-01 4.267E-02

• 9.553E-02 1.198E-01 1.668E-01 2.959E-02 6.731 E-02 8.509E-02 1.279E-01 2.463E-02 5.852E-02 6.648E-02 1.184E-01 2.0SOE-02 5.0BBE-02 5.194E-02 1.097E-01 1.706E-02 4.424E-02 4.058E-02 1.01 SE-01 1.420E-02 3.846E-02 3.170E-02 9.403E-02 1.273E-02 3.B69E-02 2.725E-02 8.462E-02 1.141 E-02 3.312E-02 2.343E-02 7.615E-02 1.023E-02 3.074E-02 2.014E-02 8.265E-02 9.167E-03 2.852E-02 1.731E-02 6.167E-02 8.217E-03 2.647E-02 1.488E-02 5.550E-02 7.365E-03 2.456E-02 1.279E-02 4.994E-02 6.601E-03 2.280E-02 1.1 OOE-02 4.494E-02 5.917E-03 2.115E-02 9.455E-03 4.044E-02 5.304E-03 1.963E-02 8.128E-03 3.640E-02 4.754E-03 1.B22E-02 6.987E-03 3.275E-02 4.261E-03 1.691E-02 6.007E-03 2.948E-02 3.820E-03 1.569E-02 5.164E-03 2.652E-02 3.424E-03 1.456E-02 4.439E-03 2.387E-02 3.069E-03 1.351 E-02 3.816E-03 2.148E-02 2.751E-03 1.254E-02 3.2BOE-03 1.933E-02 2.465E-03 1.63E-02 2.B20E-03 1.740E-02 DR-CN-92-006 Page 16 of 16 5

1.000E+OO 6.622E-01 4.385E-01 3.567E-01 2.902E-01 2.393E-01 1.974E-01 1.628E-01 1.343E-01 1.142E-01 9.717E-02 7.030E-02 7.030E-02 5.979E-02 5.086E-02 4.326E-02 3.679E-02 3.130E-02 2.662E-02 2.264E-02 1.926E-02 1.638E-02 1.393E-02 1.185E-02 1.00SE-02