Text

Forwards Excerpts from Draft ASP Rept for 1982-83.Analyses Performed Primarily for Historical Purposes to Obtain 2 Yrs of Previously Missing Data for NRC ASP Program.Response by Licensee Voluntary
	ML18065A673
Person / Time
Site:	Palisades
Issue date:	04/30/1996
From:	Gamberoni M; NRC (Affiliation Not Assigned)
To:	Smedley R; CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
References
	NUDOCS 9605020296
	Download: ML18065A673 (40)
	v • d • e

UNITED STATES **

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. ass 0001 Mr. Richard Smedley Manager, Licensing Palisades Plant 27780 Blue Star Memorial Highway Covert, MI 49043 April 30, 1996

SUBJECT:

DRAFT 1982-83 PRECURSOR REPORT

Dear Mr. Smedley:

Enclosed for your information *are excerpts from the draft Accident Sequence*

Precursor (ASP) Report for 1982-83. This report documents the ASP-Program analyses of operational events which occurred. during the period 1982-83.

We are providing the appropriate sections of this draft report to each licensee with a plant that had an.event in 1982 or 1983 that has been identified as a

precursor.

At least one of these precursors occurred at the Palisades Plant.

Also enclosed for your information are copies of Section 2.0 and Appendix A

. from the 1982-83 ASP Report.

Section 2.0 discusses the ASP Program event selection criteria and the precursor quantification process; Appendix A describes the models used in the analyses.

We emphasize that you are under no licensing obligation to review and comment on the enclosures.

The analyses documented in the draft ASP Report for 1982-83 were performed primarily for historical purposes to obtain the 2 years of previously missing precursor data for the NRC's ASP Program.

We re*lize that any review of the precursor analyses of 1982-83 events by affected.licensees would necessarily be limited in scope due to (1) the extent of the licensee's corporate memory apout specific details of an event which occurred 13-14 years ago, (2) the desire.to avoid competition for internal licensee staff resources with other, higher priority work, and (3) extensive changes in plant design, procedures, or operating practic&s imple~ented since the time period 1982-83, which may have resulted in significant reductions in the probability of (or, in some cases, even precluded) the occurrence of events such as those documented in this report.

the draft report contains detailed documentation fo*r*a11 *precursors with*

conditional core damage probabilities~ 1.0 x 10*5,

However, the relatively large number of precursors identified for the period 1982-83 necessitated that only sununaries be provided for precursors with conditional core damage probabilities between 1.0 x 10* and 1.0 x 10*5,

We will begin revising the report about May 31, 1996, to put it in final form for publication.

We will respond to any conunents on the precursor analyses which we receive from licensees. The responses will be placed in a separate section of the final report. Consumers Power Company is on distribution for 9605020296 960430.

PDR ADOCK 05000255 P.

PDR

...LL---*-.

April 30, 1996 the final report.

Please contact me at 415-3024 if you have any questions regarding this letter.

Any r~sponse to this letter on your part is entirely voluntary and does not constitute a licensing requirement.

Docket No. 50-255 Sincerely, Original Signed By:

Marsha Gamberoni, Project Manager Project Directorate 111-1 Division of Reactor Projects - Ill/IV Office of Nuclear Reactor Regulation

Enclosures:

-1.. lER No. 255/82-002

2.

LER Np. 255/82-024,-025,-044

3.

Selection Criteria and Quantification

4.

ASP MODELS cc w/encl:. See next page rD I STR IBUT ION_:.c...

! Docket Fil~-~~

P-Usrrc ---J- -

PD3-l R/F

-~Roe EAdensam(EGAl)

OGC AC Rs*

WKropp,Rlll PO '_Re-i 11 y

.I:

?-.-

J' v.:*

1;..l..*

. (,* -- ':.

~

~}. *'

~

-~

OFFICE LA:PD31 NAME DATE 0 .)QQ O*?>ii.

,} (

t.*

(

the final report.

Please contact me at 415-3024 if you have any questions regarding this letter.

Any response to this letter on your part is entirely voluntary and does not constitute a licensing requirement.

Docket No. 50-255

Enclosures:

1.

LER No. 255/82-002 Sincerely, 1~c_. jJc-,_J~u~

Marsha Gamberoni, Project Manager Project Directorate 111-1 Division of Reactor Projects - Ill/IV Office of Nuclear Reactor Regulation

2.

LER No. 255/82-024,-025,-044

3.

Selection tr.iteria and Quantification

4.

ASP MODELS cc w/encl: See next page

!i

~*

Mr. Richard *w.- Smedley Consumers Power Company' cc:

Mr. Thomas J. Palmisano Plant General Manager Palisades Plant 27780 Blue Star Memorial Highway Covert, Michigan 49043 Mr. Robert A. Fenech Vice President, Nuclear Operations Palisades Plant 27780 Blue Star Memorial Highway Covert, Michigan 49043 M. I. Miller, Esquire Sidley & Austin 54th Floor One First National Plaza Chicago, Illinois 60603 Mr. Thomas A. McNish Vice President & Secretary Consumers Power Company 212 West ~ichigan Avenue Jackson, Michigan* 49201 Judd L. Bacon, Esquire Consumers Power Company.

212 West Michigan Avenue Jackson, Michigan 49201 Regional Administrator, Region III

U.S. Nuclear Regulatory Coinmission 801 Warrenville Road Lisle, Illinois 60532-4351 Jerry Sarno

_. Townshi.p Superyisor.

Covert "Township 36197 M-140 Highway Covert, Michigan 49043 Office of the Governor Room 1 - Capitol Building Lansing, Michigan 48913 U.S. Nuclear Regulatory Commission Resident Inspector's Office

.Pa 1 i sades Pl ant 27782 Blue Star Memorial Highway Covert, Michigan 49043 Palisades Plant Nuclear Facilities and Environmental Monitoring Section Office Division of Radi~logical Health Department of Public Health 3423 N. Logan Street P. 0. Box 30195 Lansing, Michigan 48909 Gerald Charnoff, Esquire Shaw, Pittman, Potts and Trowbridge 2300 N Street, N. W.

Washington DC 20037 Mfchigan Department of Attorney General Special Litigation Division 630 Law Building P.O. Box 30212 Lansing, Michigan 48909 Sqicanber I 99S

LER No. 255/82-002 Transient with AFW Auto-Initiation Inoperable

B.6-1 B.6 LER No. 255/82-002 Event

Description:

Transient with AFW auto-initiation inoperable Date of Event:

January 6, 1~82 Plant:

Palisades B.6.1 Summary During monthly testing of the Auxiliary Feedwater (AFW) system on January 6, 1982, the AFW flow control valves failed to supply adequate flow. One valve had excessive opening time and the flow from the other valve oscillated. The valves were manually positioned to provide adequate flow. A plant trip occurred on January 3rd (ref: Gray Book). The estimated conditional core damage probability for this event is 5.0 x 10-s.

B.6.2 Ev.ent Description On January 6, 1982, during monthly testing of the AFW system, the flow control valves failed to function properly. One valve did not open until fifteen minutes after auto initiation..The second valve had flow

.oscillations varying from 120 gpm to 170 gpm. Normal flow should be 150 gpm. The malfunction of these valves rendered the AFW auto-initiation inoperable. The valve controls were placed in manual, and the valves were positioned to deliver the required flow. Investigation revealed that the flow controllers were out of adjustment. Adjustments were made and operability was restored.

B.6~3 Additional Event-Related Information Palisades AFW system is used to provide secondary side cooling given the loss of main feedwater. At the time of this event, the AFW system was a two train system consisting of one motor driven pump and one turbine driven pump. Both pumps take suction from the condensate storage *tank. Discharge from both pumps is combined into a single header and from there is distributed to each of the steam generators. In 1983, a third high pressure safety injection pump was converted to a second AFW motor driven pump. This second motor drivm pwnp also takes suction from the condensate storage tank but has its own headers to each steam generator. This analysis is based on the plant configuration at the time of the event mid thus_ only considers two AFW trains.

A plant trip occurred on January 3rd during startup due to a loss of condenser vacuum. It was assumed that during the trip, AFW was not demanded or was started manually and thus, the auto-initiation failure was not revealed at the time of the trip.

B.6.4 Modeling Assumptions This event was modeled as a transient with AFW inoperable. The malfunction of the AFW auto-initiation initially fails the AFW system when it is called for. By placing the valves in manual control, AFW can be LER No. 255/82-002

I B.6-2 recovered. This analysis assmnes that both trains of AFW were inoperable without some operator action due to the failure ofthe auto-initiation failure. To reflect the initial failure of AFW, both trains of AFW were set to failed, and AFW given A TWS (AFW/A TWS) was set to failed. The non-recovery probability for AFW was modified to reflect the manual control capabilities which could recover AFW. The non-recovery probability for AFW was set to 0.0 I to reflect the possible routine recovery capability from the control room. The non-recovery value 0.01 was taken from Table X in Section XXX of this report. The non-recovery probability for AFW/ATWS was left at 1.0 due to the lack of time available forrecovery given anATWS.

B.6.5 Analysis Results The estimated conditiopal core damage probability for this event is 5.0 x 1 o-s. The dominant sequence involved a postulated ATWS sequence with AFW failed and is highlighted on the event tree in Figure B.6.1 (to be provided in the final report).

LER No. 255/82-002

ATWS Manual Rods In

~*: ~i>:*.

~.....,

... *.:.)*:*

~. *.

...-.~**,..

Primary AFw Em-..rnency Pressure Boratlon

Um It id (AlWS)

(HPI+

Boron)

,.:;'..~.:*. :._;,~t<;'.., *'

PO RV IS RV Reseat (ATWS)

... \\***:,.

. ~.. *.

~\\) ~. ~. l RCS COOL-DOWN AHR HPR ENO SEQ

STATE *No

Trclllenlmpne

..Clh c:tllllqed..

. primary Nll.C nlwl.

. >>E;;,HE*L:

. CD

.504 OK 505*

CD 506 CD 507 CD

. 508 CD 509

/

I

/

1-e

B.6-4 CONDmONAL CORE DAMAGE PROBABILITY CALCULATIONS Event ldentif ier: ZBS.1.82-002 Event

Description:

Tinansient with AFW auto-initiation inoperable Event Date:

.lllllnlllary 6, 1982 Plant:

liel11sades INITIATING EVENT NON-RECOVERABLE 11111!1laJUIG EVEllT PROBABILITIES TRANS SEQUENCE CONDITIOllAll.. PROBABILITY SUMS

End State/lnitis.t.or CD TRANS Total SEQUENCE CONDITIO!fAf.. IP.ROBABILITIES (PROBABILITY ORDER)

Sequence 508 trans rt -priim.;,press.limited AFW/ATWS 121 trans -rt ARI *fw feed.bleed

- non-recovery credD~ for edited case SEQUENCE CONDITIOllAL iRRaBABILITIES (SEQUENCE ORDER)

SeqJenee 121 trans -rt ARI sn:fw feed.bleed 508 trans 'rt -pri111..press. limited AFW/ATWS

- non-recovery crediit for edited case SEQUENCE MOOEL:

BRANCH MODEL:

PROBABILITY FILE:

No Recovery Limit c:.:\\aspcode\\models\\pwrg8283.~

c::'}.aspcode \\models \\pal i sade. 82 c.:\\.aspcode\\models\\pwr8283.pro BRANCH FREQUENCIESJFllQBABILITIES Branch trans loop loca

sgtr rt rt( loop)

AFW System 1.2E-03 1.6E*05 2.4E*06 1.6E-06 2.SE-04 O.OE+OO 1.3E-03 > 1.0E+OO 1.0E+OO Probability 5.0E-05 5.0E-05 Non*Recov 1.0E+OO 5.3E*01 5.4E-01 1.0E+OO 1.0E-01 1.0E+OO End State CD CD End State CD CD 4.5E-01 > 1.0E-02 Prob 2.BE-05

2. 1E-05 Prob

2. 1E-05 2.BE-05 Opr Fail 1.0E-01 3.4E-03 N Rec**

3.4E-03 1.OE-01 LER No. 255/82-002

./

Branch Model:

1.0F.2+ser Train *1 Cond Prob:

Train 2 Cond Prob:

Serial Can:.,onent Prob:

AFW/ATWS Branch Model:

1.0F.1 Train 1 Cond Prob:

afw/ep mfw porv.chal l porv.chal l/afw porv.chal l/loop porv.chal l/sbo porv.reseat porv.reseat/ep srv.reseat(atws) hpi feed.bleed emrg.boration recov.sec.cool

recov.sec.cool/offsite.pwr rcs.cooldown rhr csr hpr ep seal. loca offsite.pwr.rec/*ep.and.-afw offsite.pwr.rec/-ep.and.afw offsite.pwr.rec/seal.lo~a offsite.pwr.rec/*seal.loca sg.iso.and.rcs.cooldown rcs.cool.below.rhr prim.press.limited

branch model file

- forced Heather Schriner 09-25-1995 13:58:51 2.0E-02 > Failed 5.0E-02 > Failed 2.8E-04 B.6-5 7.0E-02 > 1.0E+OO 7.0E-02 > Failed 5.0E-02 2.0E-01 4.0E-02 1.OE+OO 1.0E-01 1.OE+OO 2.0E-02 2.0E-02 1.OE-01 1.0E-03

2. 1E*02 O.OE+OO 2.0E-01 3.4E-01 3.0E-03

3. 1E-02 1.OE-03 1.5E-04 2.9E*03 4.6E-02 2.2E-01

6. 7E-02 5.7E-01 1.6E*01 1.0E*02 3.0E-03 8.8E*03 1.OE+OO 3.4E*01 3.4E*01 1.0E+OO 1.OE+OO 1.0E+OO 1.0E+OO 1.1E*02 1.0E+OO 1.0E+OO 8.9E*01 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 7.0E*02 1.0E+OO 1.0E+OO 8.9E*01 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 1.0E*01 1.0E+OO 1.0E+OO 1.0E*02 1.0E*02 1.OE*03 1.OE*03 1.0E*03

3.0E*03 LER No. 255/82-002 LER No. 255/82-024, -025, -044 OBA Sequencer Failed and Possible Failure of SW Given Concurrent LOOP and LOCA

B.7-1 B. 7 LER No. 255/82-024, 255/82-025, 255/82-044 Event

Description:

OBA sequencer failed and possible failure of SW given concurrent LOOP and LOCA Date of Event:

August 19, 1982 Plant:

Palisades.

B.7.1 Summary On August 19, 1982, a design error was discovered which indicated that a Loss of Coolant Accident (LOCA) with a concum:nt Loss of Off-site Power (LOOP) and the foss of one Emergency Di~l Generator (EOG),

running Service Water (SW) pwnps could potentially trip due to runout. On August 27, 1982, another design error was discovmxi Which indicated that following a LOOP and normal !'".'quencer operation, the OBA sequencer would not operatC if a safety injection signal was received more than 55 seconds after the LOOP. On November.

30, 1982, anOthef design error was discovered which indicated that MCC l and MCC2 feeder breakers could potentially overload folloWing a LOCA if the station batteries were discharged or the hydrogen recombiners ~ere

placed on line. The increa5e in core damage probability over the duration of this event is 3.0x10-4.

~* 7.2 Event Descrip~on During a review of the Systematic Evaluation Program (SEP) topics on:.August 19, 1982, it was determined that following a LOCA with a concurrent LOOP and loss of either EOG~ the* running service water pumps may trip

as a result of nmout occurring from the CCW heat exchanger outlet valves failing fully opeii due to the loss of instrument air which occurs during a LOOP. The problem was eliminated by the installation of hard stops on the. CCW heat exchanger service water outlet valves and by. throttling the service ~ater pump 7-B discharge valve. During an A/E review of sequencer logic circuits for AFW modifications on August 27; *1982, it was.

determined that following a LOOP and normal shutdown sequencer operation, the OBA sequencer would not

~

if a safety injection signal is received more than 55 seconds after the LOOP. Emergency procedures were

put* in place to require the operator to start the safeguards loads ifa LOOP occurs and a safety injection signal

is received. Design modifications were to be made. and installed to elimin.ate the problem. On November 30, 1982, while perfcmring an A/E review of.EOG loading, it was determined that Ute feedei: bre.aJ{ers _and cables to MCC 1 and MCC2 might be overloaded following a LOCA if the station batteries are discharged or the hydrogen---:-*.* - * ~--*

recombiners are placed on line. The problem was eliminated by administrative requirements to shed loads and maintain batteries in a charged condition. The electrical circuits wer:e to be modified to ~liminate the overload condition during the next extended shutdown.

B. 7.3 Additional Event-Related Information LER No. 255/82-024, -025, -044

B.7-2 The Palisades service water system is a two train system with three parallel pumps which provide cooling water to the condensate pump, the EOG coolers, and both Emergency Safeguards Systems (ESS) room coolers. Two service water pumps are normally required to furnish the normal cooling water demand, the third pump is nonnalJy on standby. In the event of a OBA, depending upon the accident events, either one or two service water pmnps are required to provide cooling. A loss of service water would lead to the failure of the EDGs, the failure of the coodensate pmnps, and the loss of room cooling for the HPI pumps, the RHR pumps, the CS pumps, and one AFW pump. According to the Palisades Individual Plant Examination, the loss of room cooling was assumed to result in pump failures prior to the end of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time. The EDGs provide emergency

power to AFW, HPI, RHR. SW and CS systems given the loss of normal power. EOG 1-1 provides power to one service water pump and EOG 1-2 provides power to two service water pumps in the event of a LOOP. The OBA sequencer starts and loads HPI and RHR given a safety injection signal. The MCCs provide power to the motor operated injection valves for HPI and RHR., provide power to the ESS room cooler fans, and provide power to the EOG ventilation systems and fuel oil transfer systems. The Palisades Individual Plant Examination states that the failure of the EOG ventilation system and fuel oil transfer systems would eventually fail the EDGs prior to the end of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time.

B. 7.4 Modeling Assumptions Although the LER states that the CCW heat exchanger outlet valves would fail open possibly resulting in SW rurtout given a LOCA concurrent with a LOOP and the loss of one EOG, this anlaysis assumes that a LOOP with a loss of one EOG is sufficient to cause the CCW heat exchanger outlet valves to fail open and result in SW runout. The reasoning behind this assumption is as follows. In the event of a LOCA with SI, the CCW heat exchanger outlet valves open after RWST is pumped down. Most of the service water system demand following

~ LOCA with SI would be from the opening of the CCW heat exchanger outlet valves. In the event of a LOOP, instrument air will be lost after approximately 2.6 minutes. It is possible to manually align an air compressor to an EOG-supplied bus, but it cannot be assumed, that~

would accomplish this action within 2. 6 minutes

. after an event involving a LOOP accompanied by a loss of one EOG occurred. Once instrument air is lost, the CCW heat exchanger outlet valves would fail open. Thus, the service water system demands following a LOOP and one EOG inoperable would be similar to that of a LOCA with SI.

This event was modeled in two cases. The first case deals with the failure of the DBA seql1ence; givt'"n ci LQOP, but with both EDGs operable. Owing a postulated LOOP, HPI is needed given the PORVs fail to close. Since, the SI signal would likely be issued more than 55 secoNk following the LOOP, the OBA sequencer was assumed to be failed. Thus, HPI was set to failed with a non-recovery factor of 0.1 to reflect the routine practice of the operators to start and load this system and the stress wbich may be present due to events occurring in c0njunction

. with the LOOP. The unavailabilify ofHPI due to the design flaw was assumed to be *a year. Although the actual * -

design error existed longer, the ASP program in the past has not modeled these,types of flaws for more than a year.

The second case deals with the possibility of a LOOP occurring with the OBA sequencer failed and one EOG inoperable, which could fail the service water system. Since EOG 1-2 supplies two service water pumps, the loss of EOG 1-2 concum:nt with a LOOP would result in the start and failure of EOG 1-1 due to service water runout.

Since service water demands could be met by two service water pumps, it is unlikely that service water runout would occur given the loss of EOG 1-1. To model this case, both trains of EDGs were initially set to failed. If service water was provided to the EOG prior to runout, EOG tempertures would slowly increase as SW flow LER No. 255/82-024, -025, -044

B.7-3 decreased. If operators noted the temperature increase and determined the cause, there could potentially be an opportunity to n:cover the EOG through service water recovery. Thus, the EP non-recovery probability was set to 0.55. HPI was assumed to be inoperable (set to failed) due to the failure of the OBA sequencer and also assumed non-recoverable (probability of non-recovery was set to 1.0) since the loss of both EDGs would complicate the ability of the operator to manually start and load the system. To account for the loss of EOG 1-1 which would still leave two service water pumps operable and not likely result in service water runout, the conditional core damage probability results with both trains ofEDGs set to failed was multiplied by_ the failure probability ofEDG 1-2, assumed to be 0.05.

For operational events involving unavailabilities, such as this event, the ASP program estimates the core damage probability for the event by calculating the probability of core damage during the unavailability period conditioned on the failures observed during the event, and subtracting a base case probability for. the same period, assuming plant equipment performs nominally. In the two cases, the ASP code was used to calculate the probability of ocwe* damage given the conditions.observed during these events and a postulated LOOP. The non-recovery probability for the LOOP was modified to reflect the probability of a LOOP occurring within the one year duration of die event. The overall conditional core damage probability estimate for this event was taken to be a combination of both cases minus the base case. The overall estimated conditional core damage probability was determined as follows:

p(cd) = p(casel, conditiom~l core damage proba,bility assuming both EDGs are successful)* p(both EDGs are successful, 1. 0-0: 1) + p( case 2, conditional ccre *damage probability assuming both EDGs failed)* p(EDG 1-2 failed, 0.05) - p(base case).

The possible failures of the MCCs were not explicitly modeled in this analysis.

B. 7.5 Analysis Results The core damagep:obability for case.I is 1.1x10~. The dominant sequence involves a postulated LOOP with a successful reactor shutdown, successful emergency power, failme of AFW,.successful recovery of off site power,.*

and failure offeed and bleed and is shown in Figure B. 7.1 (to be provided in the final report). The core daniage probability for case :! is G 6 x ~ 0 3. The dominant sequence involves a postulated LOOP, successful reactor shutdown, failure of emergency power, successful AFW, no seal LOCA and failure to recover off site power prior to battery depletion given no seal LOCA. This sequence is also shown in Figure B. 7.1 (to be provided in

. the final report). The overall increase in core damage probability over the duration of the event is 3. 0 x 10-4.

LER No. 255/82-024, -025, -044

OFFSITE I I FEED I RECOV I RCS I

I PORV I PORV I RCP SEAL I POWER HP!

SEC SIDE COOL* I AHR I CSR I HPA LOOP I RT(LOOP) I EP AFW '

CHAU.

RESEAT

lOCA, RECOV

' BLEED COOLING DOWN I

ENO SEO.

(LONG)

STATE NO OK 201 OK 202

~--1 OK 203 I

E :

I*

CD 207 OK 208 co 209 co 210 OK 211 OK 212 OK 213 r

-1 I

co 214 I

CO 215 co 218 OK 217 OK 218 i

I co 21e co 220 co 221 OK 222 OK 223

_____ _;,,..~---""11 r

r I

co m

1 co 227 co

,m e

OK 229 co 2:10 co 2:11 l

OK 2:12

.I OK 233 I

co m

1 co 2:17 co 2:18 OK 2:19 co 240 co 241 co 242

~:l-8.1. \\

l

B.7-5 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 255/82-024, -025, -044 Event

Description:

OBA sequencer failed given LOOP and LOCA, August 19, 1982 both EDGs operable (case 1)

Event Date:

Plant:

Palisades INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES LOOP SEQUENCE CONDITIONAL PROBABILIT~ SlltS Er1d State/Initiator CD LOOP Total SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)

Sequence 5-3E-02 Probability

1. 1E-06

1. 1E-06 End State 216 LOOP -rt( loop) -EP afw -offsi te.pwr. rec/-ep.and.afw 'teed.bleed CD 207 LOOP -rt(loop) -EP -afw porv.chall/loop porv.reseat -offsite.p CD wr.rec/*ep.and.-afw HPI 221 LOOP -rt(loop> -EP. afw offsite.pwr.rec/-ep.and.afw feed.bleed CD non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)

. Sequence End State 207 LOOP -rt(loop) -EP -afw porv.chall/l.POP porv.reseat -offsite.p CD wr.rec/-ep.and.-afw HPI 216 LOOP -rt(loop) -EP afw -offsite.pwr.rec/-ep.and.afw feed.bleed CD 221 LOOP -rt(loop) -EP afw. offsite.pwr.rec/-ep.and.afw feed.bleed CD

- non-recovery credit for edited case

-SEQUENCE MOOEL:

BRANCH MOOEL:

PROBABILITY FILE:

llo Recovery Limit c: \\aspcode\\inode l s\\pwrg8283. c:q>

c:\\aspcode\\mOdels\\palisade.82 c:\\aspcode\\models\\pwr8283.pro BRANCH FREQUENCiES/PROBABILITIES Branch trans lOOP Branch Model:

INITOR Initiator Freq:

System 1.2E-03 1.6E-05 > 1.6E-05 1.6E-05 llon-Recov 1.0E+OO 5.3E-01 > 5.3E-02 Prob

8.SE-07

9. 1E-08 6.3E-08 Prob 9.1E-08 8.SE-07 6.3E-08 Opr Fall N Rec**

2.4E-02 5.SE-05 2.4e-02 N Rec**

5.8E-05.

2.4E-02 2.4E-02 LER No. 255/82-024, -025, -044

loca sgtr rt rt( loop) af w afw/atws afw/ep mfw porv.chall porv.chall/afw porv.chal l/loop porv.chall/sbo porv. reseat porv.reseat/ep srv.reseat(atws)

HPI Branch Model:

1.0F.2 Train 1 Cond Prob:

Train 2 Cond Prob:

feed.bleed emrg.boration recov.sec.cool recov.sec.cool/offsite.pwr rcs.cooldown rhr csr hpr EP.

Branch Model:

1.0F.2 Train 1 Cond Prob:

Train 2 Cond Prob:

seal.loca offsite.pi1T.rec/*ep.and.*afw offsite.pwr.rec/*ep.and.afw.

offsite.pi1T.rec/seal.loca offsite.pi1T.rec/*seal.loca sg.iso.and.rcs.cooldown rcs.cool.bel0111.rhr prim.press.limited

branch model file

- forced Heather Schriner 02-19-1996 08:31:55 2.4E*06 1.6E*06 2.8E*04 O.OE+OO 1.3E*03 7.0E-02 5.0E-02 2.0E-01 4.0E*02 1.0E+OO 1.OE*01 1.0E+OO 2.0E*02 2.0E-02 1.OE-01 B.7-6 1.0E-03 > 1.0E+OO 1.OE-02 > Failed 1.OE-01 > Failed

2. 1E*02 O.OE+OO 2.0E-01 3.4E*01 3.0E-03 3.1E*02 1.0E*03 1.5E*04 2.9E*03 > O.OE+OO **

5.0E*02 5.7E*02 4.6E*02 2.2E*01 6.7E*02 5.7E*01 1.6E*01 1.0E-02 3.0E-03 8.8E*03 5.4E*01 1.OE+OO 1.0E*01 1.0E+OO 4.5E*01 1.0E+OO 3.4E*01 3.4E*01 1.0E+OO 1.0E+OO 1.0E+OO 1.OE+OO i.1E*02 1.0E+OO 1.0E+OO 8.9E*01 > 1.0E*01 1.0E+OO 1.OE+OO 1.0E+OO 1.0t:+OO 1.OE+OO 7.0E*02 1.OE+OO 1.0E+OO 8.9E*01 1.OE+OO 1.0E+OO 1.0E+OO 1.OE+OO 1.0E+OO 1.0E-01 1.0E+OO 1.0E+OO

'l.OE-02 f..OE*02 1'.0E*03

'l.OE*03 1:..0E-03 3.0E-03 LER No. 255182-024, -025, -044

B.7-7 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 255/82*024, -025, -044 Event

Description:

OBA sequencer failed given LOOP, both EDGs inoperable, case 2 Event Date:

August 19, 1982 Plant:

Palisades INITIATING EVEllT tlON*RECOVERASU INITIATlllG EVENT PROBABILITIES LOOP 5.3E*OZ SEQUENCE CODHIOllAL PROBABILITY SUMS End State/Initiator Probability CD Looi>

Total 6.6E-'o3 6.6E-03 S~QlJENCE COllDITIOllAL PROBABILITIES (PROBABILITY ORDER)

Sequence

.230 LOOP -rt(loop) EP *afw/ep porv.chall/sbo *porv.reseat/ep *seal

.loca offsite.pwr.rec/*seal.loca 228 LOOP -rt(loop) EP *afw/ep porv.chall/sbo *porv.reseat/ep seal

loca offsite.pwr. rec/seal. loca

. 231 LOOP -rt( loop)

EP *afw/ep porv.chal l/sbo porv.reseat/ep

- 227 LOOP -rt:(loop)

EP *afw/ep porv.chall/sbo *porv.reseat/ep seal

.loca -o1ffsite,pwr.rec/seal.loca HPI 241 LOOP -rt(loop) EP l!fw/ep

non* recawe.ry credit for edited case

SEQlJENCE CCllDJTI~ PROBABILITIES CSEQlJENCE ORDER) 227 228

230 231 241 Sequence LOOP -rt(loop) EP ~afw/ep porv.chall/sbo *porv.reseat/ep seal

.loca -offsite.pwr.rec/seal.loca HPI LOOP -r:t(loop)

EP *afw/ep porv.chall/sbo *porv.reseat/ep-seal

-~fOcli offsite.plr.ree/seal.loca-.-

LOOP -irt(loop) EP *afw/ep porv.chall/sbo ~porv.reseat/ep *seal

.loca offsite.pwr.rec/*s~al.loca -

LOOP -rt(loop) EP *afw/ep porv.chal l/sbo -porv. reseat/ep LOOP -rt( loop)

EP afw/ep non*reccwer-y credit for edited case SEQUENCE Mme.:

BRANCH MODEL:

PROBABILITY F!lE:

No Recovery :Limit c:\\aspcode\\lllOdels\\pwrg8283.aiiP c:\\aspcode\\lllOdels\\palisade.82 c:\\aspcode\\m0dels\\pwr8283.pro

-End State CD CD CD CD i:o End State CD CD CD CD CD Prob.

4.3E*03 7.4E*04 5.7E-04 5.6E-04 5.0E-04 Prob 5.6E-04 7.4E*04 4.3E*03 5.7E-04 5.0E-04 N Rec**

2.9£-02 2.9£~02 2.9£-02 2.9E-02.

9.9E-Q3 -

N. Rec**

2.9£:02 2.9E-02 2.9E-02 2.9E-02 9.9E*03 LER No. 255/82-024, -025, -044 i

. BRANCH FREQUENCIES/PROBABILITIES Branch trans LOOP loca sgtr rt Branch Model:

INITOR Initiator Freq:

rt( loop) afw afw/atws afw/ep mfw porv.chal l porv.chal l/afw porv.chal l/loop porv.chall/sbo porv.reseat porv.reseat/ep srv.reseat(atws) tlPI.

Branch Model:

1.0F.2 Train 1 Cond Prob:

Train 2 Cond Prob:

feed.bleed emrg.boratfon recov.sec.cool recov.sec.cool/offsite.pwr rcs.cooldown rhr csr hpr EP Branch Model:

1.0F. 2-Trai n 1 Cond Prob:

Train 2 Cond Prob:

seal. loca offsite.pwr.rec/*ep.and.-afw offsite.pwr.rec/-ep.and.afw offsite.pwr.rec/seal.loca

offs i te. pwr. rec/* seal

l oca sg.iso.and.rcs.cooldowi-t rcs.cool.below.rhr prim.press.limited branch model file forced

+leather SChriner 03-22-1996 08:50:03 B.7-8 System 1.2E*03 1.6E-05 > 1.6E*OS 1.6E-05 2.4E*06 1.6E-06 2.8E-04 O.OE+OO 1.3E*03 7.0E-02 S.OE-02 2.0E-01 4.0E-02 1.0E+OO 1.\\)E-01 1.0E+OO 2.0E-02 2.0E-02 1.OE-01 1.0E-03 > 1.0E+OO

. 1.0E-02 > Failed 1.OE-01 > Failed

2. 1E*02 O.OE+OO 2.0E-01 3.4E*01 3.0E-03

3. 1E*02

. 1.0E*03 1.SE-04 2.9£-03 > 1.0E+OO 5.0E-02 > Failed 5.7E-02 > Failed 4.6E*02 2.2E*01 6.7E-02 5.7E-01 1.6E*01 1.0E-02 3.0E-03 8.~:03 Non*Recov 1.OE+OO 5.3E*01 > 5.3E*02 5.4E*01 1.0E+OO 1.0E-01 1.0E+OO 4.SE-01 1.0E+OO 3.4E*01 3.4E*01 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 1.1E*02 1.0E+OO 1.0E+OO 8.9E*01 >

1.OE+OO 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 7.0E-02 1.0E+OO 1.0E+OO 1.0E+OO 8.9E*01 > 5.SE-01 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 1.0E+OO 1.0E-01 1.OE+OO 1.0E+OO Opr Fail 1.0E-02 1.0E*02 1.0E-03 1.0E-03 1.0E-03 3.0E-03 LER No. 255/82-024, -025, -044

B.7-9 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 255/82-024, -025, -044 Event

Description:

DBA sequencer failed given LOOP, base case Event Date:

August 19, 1982 Plant:

Palisades INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES LOOP 5.3E*02 SEQUENCE CONDITIONAL PROBABILITY SlJIS End State/Initiator Probability CD LOOP

.9E-05 Total 2.9E*05 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)

Sequence 230 LOOP -rt<loop> ep -afw/ep porv.chall/sbo -porv.reseat/ep -seal

.loca offsite.pwr.rec/-seal.loca 228 LOOP -rt(loop) ep -afw/ep porv.chall/sbo -porv.reseat/ep seal

loca offsi te.pwr. reciseal. loca*

231 LOOP -rt(loop) ep -afw/ep porv.ch'all/sbo porv.reseat/ep 241 LOOP -rt(loop) ep afw/ep 216 LOOP -rt(loop) -ep afw -offsite.pwr.rec/-ep.and.afw feed.bleed non-recovery credit for edited case SEQUENCE.CONDITIONAL PROBABILITIES (SEQUENCE ORDER)

Sequence 216 LOOP -rt(loop) -ep afw -offsite.pwr.rec/-ep.and.afw feed.bleed 228 LOOP -rt(loop) ep -afw/ep porv.chall/sbo -porv.reseat/ep seal

.loea offsite.pwr.rec/seal.loca 230 LOOP -rt(loep> ep -afw/ep porv.chall/sbo *porv.reseat/ep -seal

.loca offsite.pwr.rec/-seal.loca 231 LOOP *rt(loop) ep -afw/ep porv.chall/sbo porv.reseat/ep 241 LOOP -rt( loop>

ep afw/ep non-recovery credit for edited case SEQUENCE MCl>EL:

BRANCH MCl>EL:

PROBABILITY FILE:

No Recovery Limit c:\\aspcode\\m0dels\\pwrg8283.~

c:\\aspcode\\lllOdels\\palisade.82 c:\\aspcode\\m0dels\\pwr8283.pro BRANCH FREQUENCIES/PROBABILITIES End State CD CD CD*

CD CD End State CD CD

-~-

CD CD Prob 2.0E-05 3.4E-06 2.6E-06 2.3E-Ot>

8.7E~07 Prob 8.7E-07 3.4E~06

. 2.0E-05 2.6E-06 2.3E-06 N Rec**

4.7E-02 4.7E-02 4.7E-02.

1.6E-02 2.4E-02 N tee**

2.4E-02 4.7E-02 4.7E-02 4.7E-02 1.6E-02 LER No. 255/82-024, -025, -044

Branch trans.

LOOP loca sgtr rt Branch Model:

INITOR Initiator Freq:

rtClooj:>)

afw afw/atws afw/ep mfw porv.chal l porv.chal l/afw porv.chal l/loop porv.chall/sbo porv.reseat porv.reseat/ep srv.reseat(atws>

hpi feed.bleed emrg.boration recov.sec.cool recov.sec.cool/offsite.pwr rcs.cooldown rhr csr hpr ep seal. loca offsite.pwr.rec/*ep.anc:l.*afw offsite.pwr.rec/-ep.anc:l.afw offsite.pwr.rec/seal.loca offsite.pwr.rec/-seal.loca sg.iso.anc:l.rcs.cooldown rcs.cool.below.rhr prim.press.limited

branch model file

- forced Heather Schriner 02-19-1996 09:55:23 B.7-10 System 1.2E*03 1.6E-05 > 1.6E-05 1.6E*05*

2.4E-06 1.6E-06 2.BE-04 O.OE+OO 1.3E*03 7.0E-02 5.0E-02 2.0E-01 4.0E-02 1.0E+OO 1.0E-01 1.0E+OO 2.0E-02 2.0E-02 1.0E-01 1.OE-03 2.1E-02 O.OE+OO 2.0E-01

).4E-01 3.0E-03 3.1E-02 1.0E-03 1.5E-04 2.9E-03 4.6E-02 2.2E*01 6.7E-02

. 5.7E-01 1.6E-01.

1.0E-02 3.0E-03 8.BE-03

Non-Recov 1.OE+OO 5.3E-01 > 5.3E-02 5.4E*01 1.OE+OO 1.0E-01 1.OE+OO 4.5E-01 1.0E+OO 3.4E-01 3.4E-01 1.OE+OO*

1.0E+OO 1.OE+OO 1.0E+OO

1. 1E-02.

-~.OE+OO 1.0E:t 8.9E*Ot' 1'.0E+OO

t.OE+OO

1.OE+OO*

1:.0E+OO 1}~00*

.-r,.oe:~o2'

.t.OE+OO 1.0E+OO

.a.9E-01 1:.0E+OO 1'.0E+OO 1'.0E+OO 1*.0E+OO r:.oe*oo 1.OE-0-1 i*.oe+oo 1'.0E+OO Opr Fail 1.0E-02 1.0E-02.

1.0E-03 1.0E-03 1.0~*03 3.0E-03 LER No. 255/82-024, -025, -044

Selection Criteria and Quantification

J..

2-1 2.0 Selection Criteria and Quantification 2.1 Accident Sequence Precursor Selection Criteria The Accident Sequence Precursor (ASP) Program identifies and documents potentially important operational events that have involved portions of core damage sequences and quantifies the core damage probability associated with those sequences.

Identification of precursors requires the review of operational events for instances in which plant functions that provide protection against core damage have been challenged or compromised. Based on previous experience with reactor plant operational e*vents, it is known that most operational events can be directly or indirectly associated with four initiators: trip [which includes loss of main feedwater (LOFW) within its sequences],

loss-of-offsite power (LOOP), small-break loss-of-coolant accident (LOCA), and steam generator tube ruptures (SGTR) (PWRs only). These four initiators are primarily associated with loss of core cooling. ASP Program staff members examine licensee event reports (LERs) and other event documentation to determine the impact that operational events have on potential core damage sequences.

2.1.1 Precursors This section describes. the steps used to identify events for quantification. Figure 2.1 illustrates this process.

A computerized search of the SCSS data base at the Nuclear Operations Analysis Center (NOAC) of the.Oak Ridge National Laboratory was conducted to identify LERs that met minimum selection criteria for precursors.

This computerized search identified LERs potentially involving failures in plant systems that provide protective functions for the plant and those potentially involving core damage-related initiating events. Based on a review of the 1984-198 7 precursor evaluations and all 1990 LERs, this computerized search successfully *.

identifies almost all *precursors and the resulting subset is approximately one-third to one-half of the total LERs. It should be noted, however, that the computerized search scheme has not been tested on the LER database for the years prior to 1984. Since the LER reporting requirements for 1982-83 were different than for 19~ and later,* the possibility exists that some 1982-83 precursor events were not included in the selected subset. Events described in NUREG -090020 and in issues of Nudear Safety that potentially impacted core damage sequences were also selected for review.

Those events selected for review by the computerized search of the SCSS data base underwent at least two independent reviews by different staff members. The independent reviews of each LER were performed to determine if the reported event should be examined in greater detail. This initial review was a bounding review, meant to capture events that in any way appeared to deserve detailed review and to eliminate events

that were clearly unimportant. This process involved eliminating events that satisfied predefined criteria for rejection and accepting all others as either potentially significant and requiring analysis, or potentially significant but impractical to analyze. All events identified as impractical to analyze at any point in the study are documented in Appendix E. Events were also eliminated from further review if they had little impact on core damage sequences or provided little new information on the risk impacts of plant operation-for example, short-term single failures in redundant systems, uncomplicated reactor trips, and LOFW events.

Selection Criteria and Quantification

e LERs requiring review Does !be event only involve:

. component failure (no loss of ralundancy)

- Ion or redundancy (single sy<t=)

. seismic qualification/design enor

.*environmental qualificationldesi1n error

. Yes

. pR-critical event

. sbVctural degradation

. desicn error discovered by re-malysis

. bounded by trip or LOFW

. no appreciable safety system impact

. shuulown-related event

. post-core dama~e impacts only No Can e'*ent be reasonably analyud by PRA-ba*ed models~

Yes Perform detailed revie"** analysis. and quantification Does operational event involve:

. a core damage initiator

. a IOW Ion or a system

. a loss or redundancy "ill.two or more synems

. a reactor lrip with a degraded milipting system Is conditional probability 2 I ct6 Ye5 Document as a precmsor 2-2 Reject Identify as P?tentially significant but impractical to analyze Define impact of cvcn1 in terms of 11.iii:uor

observed and trains of sy<tems unavailable.

Modify branch probabilities to reflect event.

Calculat.e conditional probability associated with event using modificd*event trees.

No Reject No Reject based on 101>* 11robabiliiy Figure 2.1 ASP Analysis Process Selection Criteria and Quantification lan'1 dr3win&s.

system descriptions.

FSA Rs. etc.

2-3 LERs.were eliminated from further consideration as precursors if they involved, at most, only one of the following:

a component failure with no Joss* of redundancy, a short-term Joss of redundancy in only one system, a seismic design or qualification error, an environmental design or qualification error, a structural degradation, an event that occurred prior to initial criticality, a design error discove.red by reanalysis, an event bounded by a reactor trip or LOFW, an event with no appreciable impact on safety systems, or an event involving only post core-damage impacts.

Events identified for further consideration typically included the following:

unexpected core damage initiators (LOOP, SGTR, and small-break LOCA);

all events in which a reactor trip was demanded and a safety-related component failed; aU support system failures, including failt1res in cooling ~ater systems, instrument air, instrumentation and control, and electric power systems; any event in which two or more failures occurred; any event or operating condition that was not predicted or that proceeded differently from the plant design basis; and

. any event that, based on the reviewers' experience, could have resulted in or significantly affected a chain of events leading to potential severe core damage.

Events determined to be potentially significant as a result of this initial review were then subjected to a thorough, detailed analysis. This extensive analysis was intended to identify those events considered to be precursors to potential severe core damage accidents, either because of an initiating event, or because of failures that could have affected the course of postulated off~normal events or accidents. These detailed reviews were not limited to the LERs; they also used final safety analysis reports (FSARs) and their amendments, individual plant e~aminations (IPEs), and other inform:i.tion related to the event of interest.

The detailed review of each event considered the immediate impact of an initiating event or the potential impact of the equipment failures or operator errors on readiness of systems in the plant for mitigation of off-normal and accident conditions. In the review of each selected event, three general scenarios (involving both the actual event and postulated additional failures) were considered.

1.

If the event or failure was immediately detectable and occurred while the plant was at power, then the event was evaluated according to the likelihood that it and the ensuing plant response

could lead to severe core damage.

2.

If the event or failure had no immediate effect on plant operation (i.e., if no initiating event occurred), then the review considered whether the plant would require the failed items for mitigation of potential severe core damage sequences should a postulated initiating event*

occur during the failure period.

Selection Criteria and Quantification

2-4

3.

If the event or failure occurred. while the plant was not at power, then the event was first assessed to detennine whether it impacted at-power or hot shutdown operation. If the event could only occur at cold shutdown or refueling shutdown, or the conditions clearly did not impact at-power operation, then its impact on continued decay heat removal during shutdown was assessed; otherwise it was analyzed as if the plant were at power. (Although no cold shutdown events were analyzed in the present study, some potentially significant shutdown-related events are described in Appendix D).

For each actual occurrence or postulated initiating event associated with an operational event reported in an LER or multiple LERs, the sequence of operation of various mitigating systems required to prevent core damage was considered. Events were selec~ and documented as precursors to potential severe core damage accidents (accident sequence precursors) if the conditional probability of subsequent core damage was at least J.0 X Jo~ (see section 2.2). Events of low significance are thus excluded, allowing attention to be focused on the more important events. This approach is consistent with the approach used to define J 988-1993 precursors, but differs from that of earlier ASP reports, which addressed all events meeting the precursor selection criteria regardless of conditional: core damage probability.

As noted. above, 115 operational events with conditional probabilities of subsequent severe core damage <!

J.0 X J o*6 were identified as accident sequence precursors.

2.1.2 Potentially Significant Shutdown-Related E\\'ents No cold shutdown events were analyzed in this study because the lack of information concerning plant status at the time of the event (e.g., systems unavailable, decay heat loads, RCS heat-up rates, etc.) prevented development of models for such events. However, cold shutdown events such as a prolonged loss of RHR cooling during conditions of hlgh decay heat can be risk significant. Sixteen shutdown-related events which may have potential risk significance are described in Appendix D.

2.1.3 Potentially Significant Events Considered Impractical to Ana.lyze In ~on:ie cases, events are impractical to analyze due to lack of information or inability to reasonably model withln a probabilistic risk assessment (PRA) fram~work, considering the level of detail typically available in PRA models and the resources available to the ASP Progrim.

Forty-three events (some involving more than a single LER) identified as potentially significant were considered impractical to analyze. It is thought that such events are capable of impacting core damage sequences. However. the events usually involve component degradations in whlch the extent of the degradation could not be detennined or the impact of the* degradation on plant response could notbe ascertained.

For many events classified as impractical to analyze, an assumption that the affected component or function was unavailable over a 1-year period (as would be done using a bounding analysis) would result in the conclusion that a very significant conditum existed. This conclusion would not be supported by the specifics of the event as reported in the LER(s) or by the limited engineering evaluation performed in the ASP Program.

Descriptions of events considered impractical to analyze are provided in Appendix E.

Selection Criteria and Quantification

2-5 2.1.4 Containment-Related Events In addition to accident sequence precursors, events involving loss of containment functions, such as

containment cooling, containment spray. containment isolation (direct paths to the environment only), or hydrogen control, identified in the reviews of 1982-83 LERs are documented in Appendix F. It should be

noted that the SCSS search algorithm does not specifically search for containment related events. These events, if identified for other reasons during the search, are then examined and documented.

2.1.5 '~Interesting" Events Other events that provided insight-into unusual failure modes with the potential to compromise continued core cooling but that were determined not to be precursors were also identified. These are.documented as "interesting" events in Appendix G.

2.2 Precursor Quantification Quantification of accident sequence precuJSOr significance involves determination of a conditional probability of subsequent severe core damage, given the failures*observed during an operational event. This is estimated by mapping failures observed during the event onto the ASP models, which depict potential paths to severe core damage, and calculating a conditional probability of core damage through the use of event trees and system models modified to reflect the event_ The effect of a precursor on event tree branches is assesseq by reviewing the operational event specifics against system design information. Quantification results in a revised probability of core damage failure, given the operational event. The conditional probability estimated for each precursor is useful in ranking because it provides an estimate of the measure of protection against core damage that remains once the observed failures have occurred. Details of the event mooeling process and calculational results can be found in Appendix A of this report.

The frequencies and failure probabilities used in the calculations are derived in part from data obtained across the light-water reactor (L WR) population for the 1982-86 time period, even th,ough they are appli~d to*

sequences that are plant-specific in nature.. Because ofthis, the conditional probabilities determined for each

.precursor cannot be rigorously_ associated with the probability of severe core damage resulting from the actu~

event at the specific reactor plant at which it occurred. Appendi_x A documents the accident sequence models*

used in the 1982-83 precursor analyses. and provides examples of the *probability values used in the calculations.

The evaluation of precursors in this report consider:ecf equipment and recovery procedures believed to have been available at the various plants in the l 982-83 time frame. This includes features addressed in the current (1994) ASP models that were not considered in the analysis of 19.84-91 events, and only partially in the analysis of 1992-93 events. These features include the poten.tial use of the residual heat removal system for long-term decay heat removal following a small-break LOCA in PWRs, the potential use of the reactor core isolation cooling system to supply makeup following a small~break LOCA in BWRs; and core damage sequences assc;x:iated with failure to trip the reactor (this condition was previously designated "A TWS," and not developed). In addition, the potential Jong-term recovery of the power conversion system for BWR decay heat removal ha5 been addressed in the models.

Selection Criteria and Quantification

2-6 Because of these differences in the models, and the need to assume in the analysis of 1982-83 events that equipment reported as failed near the time of a reactor trip could have impacted post-trip response (equipment response following a reactor trip was required to be reported beginning in 1984 ), the evaluations for these years may not be directly comparable to the results for other years.

Another difference between earlier and the most recent (1994) precursor analyses involves the documentation of the significance of precursors involving unavailable equipment without initiating events. These events are termed unavailabilities in this report, but are also referred to as condition assessments. The 1994 analyses.

distinguish a precursor conditional core damage probability (CCDP), which addresses the risk impact of the*

failed equipment as well as all other nominally functioning equipment during the unavailability period, and.

an importance measure defined as the difference between the CCDP and the nominal core damage probability (CDP) over the same time period. This importance measure, which estimates the increase in core damage probability because of the failures,' was referred to as the CCDP in pre-1994 reports, and was used to rank unavailabilities.

For most unavailabilities that meet the ASP selection criteria, observed failures significantly impact the core damage model. In these cases, there is little difference between the CCDP and the importance measure. For some events, however, nominal plant response dominates the risk.' In these cases, the CCDP can be*

considerably higher than the importance measure. For ! 994 unavailabilities, the CCDP, CDP, and importance are all provided to better characterize the significance of an event. This is facilitated by the computer c~

used to evaluate 1994 events (the GEM module in SAPHIRE), which reports these three values.

The analyses of 1982-83 events, however, were perfor.ned using the event evaluation code (EVENTEVL) used in the assessment of 1984-93 precursors. Because this code only reports the importance measure for unavailabilities, that value was used as a measure of event significance in this report. In the documentation of each unavailability, the importance measure value is referred to a5 the increase in core damage probability, over the period of the uriavailability, which is what it represents. An example of the difference between a conditional probability calculation and an importance calculation is provided in Appendix A.

2.3 Review of Precursor Documentation With completion of the iniual analyses of the precursors lP}d reviews by team members, this draft report containing the analyses is being transmitted to an NRC contractor, Oak Ridge National Laboratories (ORNL),

for an independent review. The review is intended to (1) provide an independent quality check of the analyses..

(2) ensure consistency with the ASP analysis guidelines and with other ASP analyses for the same event type.

and (3} verify the adequacy of the modeling approach and appropriateness of the assumptions used in thr analyses. In addition, the draft report is being sent to the pertinent nuclear plant licensees for review and to the NRC staff for review. Comments received from the licensees within 30 days will be considered during resolution of comments received from ORNL and NRC staff.

2.4 Precursor Documentation Format The 1982-83 precursors are documented in Appendices B and C. The at-power events with conditional core damage probabilities (CCDPs) ~ 1.0 x 10*5 are contained in Appendix B and those with CCDPs between 1.0 x 1 o-s and 1.0 x 10-6 are summarized in Appendix C. For the events in Appendix B, a description of the evem Selection Criteria and Quantification

I*.

2-7 is provided with additional infonnation relevant to the assessment of the event, the ASP modeling assumptions and approach used in the analysis, and analysis results. The conditional core damage probability calculations are documented and the documentation includes probability summaries for end states, the conditional

'probabilities for the more important sequences and the branch probabilities used. A figure indicating the dominant core damage sequence postulated for each event will be included in the final report. Copies of the

. LERs are not provided with this draft report.

2.5 Potential Sources of Error As with any analytic procedure, the availabilicy of information and modeling assumptions can bias results. In this section, several of these potential sources of error are addressed.

I.

Evaluation of only a subset of 1982-83 LERs. For 1969-1981and1984-1987, all LERs reported during the year were evaluated for precursms. For i. 988-1994 and for the present ASP study of 1982-83 events, only a subset of the LERs were evaluated after a computerized search of the SCSS data base. While this subset is th~ght to include most serious operational events, it is possible that some events that would normally be selected as precursors were missed because they were not included in the subset that resulted from the screening process.

Reports to Congress on Abnormal Occurre.nceszn (NUREG-0900 series) and operating experience articles in Nuclear Safety were ~

reviewed'. for events that may have been missed by the SCSS computerized screening.

2.

Inherent biases in the selection process. Although the criteria for identification of an operational event as a precursor are fairly well-defined,. the selection of an LER for initial review can be somewhat judgmental. Events selected* in the study were more serious than most, so the majority of the LERs selected for detailed review would probably have been selected by other reviewers with experience in L WR systems and their operation. However, some differences would be expected to exist; thus, the selected set of precursors should not be considered unique.

3.

Lack of appropriate event information. The accuracy and completeness of the LERs and other event-related documentation_in refle.cbng pertinent operational information for the 1982-83 events are questionable in some cases. Requirements associated with LER reporting at the time, plus the approach to event reporting practiced. at particular plants, could have.

resulted in variation in the extent of events reported* and. report details among plants. In addition, only details of the sequence (or partial sequences for failures discovered during testing) that actually occurred are usually provided~ details concerning potential alternate sequences of interest in this study must often be inferred~ Finally, the lack of a requirement at the time to link plant trip information to reportable events required that certain assumptions be made in the analysis of certain kinds of 19'2-83 events. Specifically, through use of the "Grey Books" (Licensed Operating Reactors Status /&port, NUREG-0200)19 it was possible to detennine that system unavailabilities reported in LERs could have overlapped with plant trips if it was assumed that the component could have been out-of-service for 'h the test/surveillance period associated with that component However, with the link between trips and events not being described in the LERs, it was often impossible to determine whether or not the component was actually unavailable during the trip or whether it was demanded Selection Criteria and Quantification

2-8 during the trip. Nevertheless, in order to avoid missing any important precursors for the time period, any reported component unavailability which overlapped a plant trip within Yi of the component's test/surveillance period, and which was believed not to have been demanded during (he trip, was assumed to be unavailable concurrent with the trip. (If the component had been demanded and failed, the failure would have been reported; if it had been demanded and worked successfully, then the failure would have occurred after the trip). Since such assumptions may be conservative, these events are distinguished from the other precursors listed in Tables 3.1 - 3.6. As noted above, these events are termed "windowed" events to indicate that they were analyzed because the.potential time ~indow for their unavailability was assumed to.have overlapped a plant trip.

4.

Accuracy of the ASP models and probability data. The event trees used in the analysis are plant-class specific and reflect differences between plants in the eight plant classes that have been defined. The system models are structured to reflect the plant-specific systems, at least to the train level. While major differences between plants are represented in this way, the plant models utilized in the analysis may not adequately reflect all important differences.

Modeling improvements that address these problems are being pursued in the ASP Program.*

Because of the sparseness of system failure events, data from many plants must be combined to estimate the failure probability of a multitrain system or the frequency of low-and moderate-frequency events (such as LOOPs and small~break LOCAs). Because of this, the *.

modeled response for each event will tend toward an average response for the plant class. If systems at the plant at which the event oci:urred are better or worse than average (difficult to ascertajn without extensive operating experience), the actual conditional probability for an event could be higher or lower than that calculated in the analysis..

Known plant-specific equipment and procedures that can provide additional protection against core damage beyond the plan.t-class features included in the ASP event tree models.

were addressed in the 1982-83 precursor analysis for some plants. This iiiformation was not uniformly available; much of it was based on FSAR and IPE documentatfon available at the time this report was prepared. As a result, consideration of additional features may not be consistent in prec.ul'Sor analyses of events at different plants. However, analyses of multiple events that occurred at an individual plant or at similar units at the same site h~v,e been consistently analyzed.

5.

Difficulty in 'determining the potential for recovery of failed equipment. Assignment of recovery credit for an event can have a significant impact on the assessment of the event. The approach used to assign recovery.credit is described in detail in Appendix A. The actual likelihood of failing to recover from an event at a particular plant during 1982-83

is difficult to assess and may vary substantially from the values currently used in the ASP analyses. This difficulty is demonstrated in the genuine differences in opinion among analysts, operations.

and maintenance personnel, and others, concerning the likelihood of recovering from specific failures (typically observed during testing) within a time period that would prevent core damage following an actual initiating event.

6.

Assumption of a 1-month test interval. The core damage probability for precursors involving Selection Criteria and Quantification

2-9 unavailabilities is calculated on the basis of the exposure time associated with the event. For failures discovered during testing, the time period is related to the test interval. A test interval of I month was assumed unless another interval was specified in the LER. See reference I for a more comprehensive discussion of test interval assumptions.

Selection Criteria and Quantification

---~--

-~~~--- ---

ASP Models -

I 4-'

A-1 Appendix A:

ASP MODELS ASPMODELS

i-A-2 A.O ASP Models This appendix describes the methods and models used to estimate the significance of 1982-83 precursors.. The modeling approach is similar to that used to evaluate 1984-91 operational events. Simplified train-based models are used, in conjunction with a simplified recovery model, to estimate system failure probabilities specific to an

operational event. These probabilities are then used in event tree models that describe core damage sequences relevant to the event. The event trees have been expanded beyond those used in the analysis of 1984-91 events to addn:ss features of the ASP models used to assess 1994 operational events (Ref. I) known to have existed in the 1982-83 time period.

A.I Precursor Significance Estimation The ASP program pe.rforms retrospective analyses of operating experience. These analyses require that certain methodological assumptions be made in order to estimate the risk significance of an event If one assumes, following an operational event in which core cooling was successful, that components observed failed were "failed" with probability.1.0, and components that functioned successfully were "successful" with probability 1.0, then one can conclude that the risk of core damage was z.ero, and that the only potential sequence was the combination of eveqts that occmred. In order to avoid such trivial results, the statµs of certain components must be considered latent.

In the ASP program, this latency. is associated with components that operated successfully-these components are considered to have been capable of failing dming the operational.event Quantification ofprecursor significance involves the determination of a conditional probability of slibsequent core damage given the failures and other undesirable conditions (such as an initiating event or an unexpected relief valve cballenge) observed during an operational event. The effect of a pri:cursor on systems addressed in the core damage models is assessed by reviewing the operational event specifics against plant design and optnting infoonatioo, and tramlating the results of the review into a revised model for the plant that reflects the observed failures.. The precursors's significance is estimated by calcUiating a conditional probability of core damage given the observed failures. The conditional probability calculated in this way is useful in ranking because it provides an estimate of the measure of protection against CQre damage remaining once the observed failures have occurred.

A. l. l.Types of Events Analyzed Two different types of events are addressed in precurs<r quantitative analysis. In the first, an initiating eve.nt sur.h as a loss of offsite power (LOOP) or small-break loss of coolant accident (LOCA) occurs as a part of the precursor. The probability of core damage for this type of event is calculated based on the required plant R.SpCJme to the particular initiating event and other failures that may have occurred at the same time. This type of eve.nt includes the windowed" events subsetted for the 1982-83 ASP program and discussed in Section 2.2 of the main report.

The second type of eve.nt involves a failure condition that existed over a pCriod of time during which an initiating event could have, but did not occur. The probability of core damage is calculated based on the required plant R.SpCJme to a set of postulated initiating events, considering the failures that were observed. Unlike an initiating

. evmt assessmmt, where a particular initiating event is asannecf to occur with probability l.O, each initiating event is assumed to occur with a probability based on the initiating event frequency and the failure <hntion.

ASP MODELS

--+---.

A-3

{)

A.1.2 Modification of System Failure Probabilities to Reflect Observed Failures The ASP models used to evaluate 1982-83 operational events describe sequences to core damage in terms of combinations* of mitigating systems success and failure following an initiating event. Each system model represents those canbinations of train or component failures that will result in system failure. Failures observed during an operational event must be represented in terms of changes to one or more of the potential failures included in the system models.

If a failed component is included in one of the trains in the system model, the failure is reflected by setting the pro~ability for the impacted train to 1.0: Redundant train failure.probabilities are conditional, which allows potential common cause failures to be addressed. If the observed failure could have occurred in other similar cxxnpoomts at the same time, then the system failure probability is b::reased to represent this. If the failure could not simultaneously occur in other c0mponents (for. example, if a component was removed from service for preventive mamtenana:), then the sys~:m failure probability is also revised, but only to reflect the "removal" of the unavailable component from the model.

If a failed component is not specifically included as an event in a model, then the failure is addressed by setting elements impacted by the failure to failed. For example, support systems are not co~pletely developed in the 1982-83 ASP models. A breaker failure that results in the Joss of power to a group cf components would be represented by.setting the elements associated with each component in the group to failed.

Occasionally, a precursor occurs that cannot be modelled by modifying probabilities in existing system models.

In such a case, the model is revised as necessary to address th~ event, typically by adding events to the system model or by addressing an unusual initiating event through the use of an additional event tree.

A.1.3 Recovery from Observed Failures The models used to eValuated 1982-83 events address the potential for recovery of an entire system if the system fails. This is the same approach that was used in the analysis of most precursors through 1991.1 In this approach,_the potential for recovery is addressed by a5signing a recovery "action to each system failure and initiating event.

Four classes were used to describe the different types of short-tenn recovery that could be involved:

1 Later precursor analyses utilize Tune-Reliability Correlations to estimate the probability of failing to recover a failed system when recovery is dominated by operator action.

v.,

ASP MODELS

.; p.

A-4 Recovery Liblihood of Non-Recovery Characteristic Cius Recove,Y RI 1.00 The failure did not appear to be i"ccovcrable in the required period, either from the control room or at the failed equipment.

R2 o.ss The failure appeared recoverable in the required period at the failed equipment, and the equipment was accessible; recovery from the control room did not appear possible.

R3

. 0.10 The failure appeared recoverable in the required period from the control room, but recovery was not routine or involved substanti"1 operator burden.

R4 0.01 The failure appeared rccovaable iri the required period from the control room and was considered routine and p~uraUY based.

The ~gmnent of an event to a recovery class is based on. engineering judgment, which considers the specifics.

of each operational event and the likelihood of not reeovering from ~e*obsmedfailure in a moderate to high-.

stress situation following an initiating event.

Substantial time is usually available to recover a* failed residual heat removal (RHR) or BWR power conversion

system (PCS). For tb:e:se systems~ the nonrecovery probabillties listed above are overly conservative. Data in

Refs. 2 arid 3 was med to e5timate the following nonreeovery probabilities for these systems:

BWR RHR system.

BwRPCS PWR RHR system.

System

. p{nonrecoverv) 0.016 (0.054 if failures involve service water)*

0.52 (0.017 for MSIV closure) 0.057 It must be noted that the actu8I likelihood of failing to recover from an event at a particular plant is difficult to assess and may vmy substantially from the yalues listed. this difficulty is demonstrated in the genuine differences in opinioo among analysts, operations Ind maintenance-personnel, etc.* ~g the likelihood.of recovering specific failures {typically observed during testing) within a time pC:riod that would pre\\tem COI'C.

damage folloWing an actual initiating event.

I A.1-4 Conditional Probability Associated with Each Precursor As described cartier in this appendix, the calculation process for each* precur5or involves a determination of initiatas that mustbe modeled, plus any mOdifications to* system probabilities necessitated by failures.observed

~ese nonrecovery probabilities are cons~nt with values specified in M.B. Sattison et al.* *Methods Improvements Incorporated into the SAPHIRE ASP Models," Proceedings of the U.S. Nuclear Regulatory Commission 'J'wenty-Second Water Reactor Safety Information Meeting, NUREG/CP-0140. Vol. 1. April 1995.

ASPMOl)ELS

~j

~* -

-;--~---~.. ~---

A-5 in an operational event. Once the probabilities that reflect the caid.itions of the precursor are established, the sequences leading to core damage are calculated to estimate the cmditional probability for the precursor. This calculational process 1s summariz.ed in Table A. I.

Several simplified examples that illustrate the basics of precursor c:akulational process follow. It is not the intent of the examples to describe a detailed precursor analysis, but instead to provide a basic understanding of the process.

The hypothetical core damage model for these examples, shown in Fig. A. I, consists of initiator I and four

systems that provide protection against core damage: system A, B, C, and D. In Fig. A.I, the up branch represents success and the down branch failure for each of the sysaans. Three sequences result in core damage if completed: sequence 3 [I /A ("f' represents system success) B CJ. sequence 6 (I A/BCD) and sequence 7 (I A B). In a conventional PRA approach, the frequency of core damage would be calculated using the frequency of the initiating event I, l(I), and the failure probabilities for A, B, C, and D [p(A), p{B), p(C), and p(D)].

Assuming l(I) = O. I yr1 and p(All) = 0.003, p(BllA) = O.OI, p(Cll) = 0.05, and p(D~C) = 0.1,3 the frequency of core damage is determined by calculating the frequency of each of the three core damage sequences and adding the frequencies:

0.1 yr*1 x (I - 0.003) x 0.05 x 0.1(sequence3) +

O.I yr*1 x 0.003 x (I - O.OI) x 0.05 x OJ (sequence 6) +

O. I yr*1 x 0.003 x O.OI (sCqucnce 7)

= 4.99 x I0--4yr1 (sequence 3) + l.49 x 10~ yr*1 (sequence6) + 3.00 x 10~ yr1 (sequence 7)

In a nomirial PRA, sequence 3 would be the dominant core damage sequence.

The ASP program calculates a conditional probability of core damage, given an initiating event or component

--

failures. This probability is different than the frequency calculated al>ove and c8nnot be directly compared with.

it.

Example 1. Initiating Event Assessment. Assume that a precursor involving initiating event I-~* In response to I, systems A, B, and C start and operate correctly ml system D is not demanded. In a precursoi -.

initiating event assessment, the probability of I is set to 1.0. Al1hough systrms A, B, and C were successful, ncmina1 failure probabilities are assumed. Since system D was not demanded, a nominal failure probability is usumed for it as well. The conditional probability of core damage associated with precursor I is calculated by summing the conditional probabilities for the three sequences:

1.0 x (l -0.003) x 0.05 x 0.1(~3) +

1.0 x 0.003 x (I - 0.010) x 0.05 x 0.1(sequence6) +

1.0 x 0.003 x 0.01 (sequence 7) 3 The notation p(B I IA) means the probability dw B fails, given I occurred and A failed.

ASP MODELS

'.. )

~..

A-6

= 5.03 x 10"3.

If, instead, B had failed when demanded, its probability would have been set to 1.0. The conditional core damage probability for precursor IB would be calculated as 1.0 x (1-0.003) x 0.05 x 0.1(sequence3) + 1.0 x 0.003 x 1.0 (sequence 7) = 7.99 x 10*3*

Since B is failed sequence 6 cannot occur.

Example 2. Condition Assessment. Assume that during a monthly test system B is found to be failed, and that the failure could have occurred at any time during the month. The best estimate for the dura~on of the failure is one half of the test period, or 360 h. To estimate the probability of initiating event I during the 360 h period, the yearly 1iequmcy of I must be converted to an hourly rate. If I can only occur at power, and the plant is at power for 700/o of a year, then the frequency for I is estimated tO_ be 0.1 yr-1/(8760 h/yr x 0. 7) = 1.63 x 10-s h*1*

I( as in example I, Bis always demanded following I, the probability ofl in the 360 h period is the probability that at least one I occurs (since the failtire o_f B will then be discovered), or Using this val_ue for the probability of I, and setting p(B) = 1.0, the conditional probability of core damage for precursar*B is calculated by again summing the conditional probabilities for the core d8mage sequences in Fig.

A.I:

_5.85 x 10*3 x (1- 0.003) x 0.05 x_O.l (sequence 3) + 5.85 x 10*3 x 0.003 x 1.0 (seq~ce 7)

= 4.67 x I o*5.

As before, since Bis failed, sequence 6 cannot occur. The conditional prob~ility is the probability of core.

damage in the 360 h period, given the failure ofB. Note that the dominant core damage sequence is sequence 3, with a conditional probability of 2.92 x 10-s. This ~uence is unrelated to the failure of_B. The potential failure of systems C and D over the 360 h period still drive the core damage risk. _

To understand the significance of the failure of systan B, another calculation, an importance measure, is required.

The importance measure that is used is equivalent to risk achievement worth on an interval scale (sec Ref. 4).

In this calculation, the increase in core damage probability over the 360 h period due to the failure of B is estimated: p(cd I B) - p(cd). For this example the value is 4.67 x 10 2.94 x l<t5 = 1.73 x 105, where the second term on the left side of the equation is calculated using the preViously developed probability of I in the 360 h period and nominal failure probabilities for A, B, C, and D.

For most cooditioos identified as precursas in the ASP program, the importance and the conditional core damage -

probability are numerically close, and either can be used as a significance measme for the precursor. However, for some events-4ypica1Jy those in which the components that are failed are not the prinwy mitigating plant features-the OOllditional core damage probability can be significantly higher than the importance. In sUch cases, it is important to note that the potential failure of other components, ~ated to the precursor, are still dominating the plant risk.

ASP MODELS

\\;.

l~I.

A-7 The importanee measure for unavailabilities (condition assessmmts) like this example event were previously refemd to as a "conditiooal core damage probability" in annual pn:mrsor reports before 1994, instead of as the inaeasc in core 'damage probability over the duration of the unavailability. Because the computer ~e used to analyz 1982-83 events is the same as was used for 1984-93 evaluations, the results for 1982-83 conditions are also paented in the computer output in terms of "conditioiial probability," when in actuality the result is an importmce.

A.2 Overview of 1982-83 ASP Models Models used to rank 1982-83 precursors as to significance consist of system-based plant-class event trees and

. simplifmd plant-specific system models. These models describe mitiption sequences for the following initiating events: a nonspecific reactor trip [which includes lass offeedwata'{LOFW) within the model], LOOP, small-

break LOCA~ and steam generator tube rupture [SGTR, pressurimf.water reactors (PWRs) only].

Plant classes were defined based on the use of similar systems in providing protective functions in response to transiems, LOOPs, and small-break LOCAS. Systein designs and specific nomenclature may differ among plants included in a particular class; but functionally, they are similar in response.* Plants where certain mitigating systems do not exist, but which are largely analogous in their initiator response, are grouped into the appropriate

..

plant class. ASP plant categorization is described in the following s.e:ction.

The event trees consider two end states: success (OK), In which. con:alllding,exists, and core damage (CD), in which adequate core cooling is believed not to exist. In the ASP models, core damage is assumed to occur followillg are uncovery. It is acknowledged that clad *and fud damage will' occUr at later times, depending on the aiteria med to define "damage," and that time m8y be available to recowr core Cooling once core uncovery-occurs but befcn: the omet of are cfamage However, this potential rec:oveiy~*not. addressed in the models. Each event tree desc:rDbes cornbinatioos* of system failures that will prevent core mol.iilg,. and makeup if required., in both the short and long tam Primary systems designed to provide these fimdi0115 and alternate systems capable of also

. per:f~nning these functions are addressed.

The modds used to evaluate 1982-83 events consider both additional systems. that can provide core protection and initi#ing events not included in the plant-class models Used in lk* asses~ o( 1984-91 events, and only partially included in the messmcnt of 1992-93 evmts. Response to a fiilllrc to. trip the reactor is now addressed,

as is an SGTR in PWRs. In PWRs, the Jrtmrial use of the residual heat.removal system following a small-break LOCA (10 avoid sump recirculation) is addressed, as is. the potentid_recovezy of secondary-side cooling in the long tam following the initiatioo of feed and bleed. In boiling water n:IEfors*(BWRs), the potential use of react.Or ccre isolllion cooling (RCIC) and the control rod drive (CRD) systmlf0r makeup if a single relief valve stirks open is.tdresscd, as is the pOtcntial long-term recovery of the poWCli conversion system (PCS) for decay heat removal in BWRs. These models better reflect the capabilities of plant systems in preventing core,damage:

ASP MODELS

A-7 The importance measure for unavailabilities (condition assessments) like this example event were previously referred to as a "c:ooditiooal core damage probability".in annual precursor reports before 1994, instead of as the increase in cae damage probability over the duration of the unavailability. Because the computer code used to analy1.e 1982-83 events is the same as was used for 1984-93 evaluations, the results for 1982-83 conditions are also presented in the coinputer. output in tams of "conditional probability," when in actuality the result is an importance.

A.2 Overview of 1982-83 ASP Models Models used to rank 1982-83 precursors as to significance consist of system-based plant-cilss event trees and simplified plant~ ~

models. These models describe mitigation sequences for the following initiating *

.events: a nonspecific reactor trip [which includes loss offeedwater (LOFW) within the model], LOOP, small-break LOCA, and steam generator tube rupture [SGTR, pressuriz.ed water reactors (PWRs) only].

Plant classes were defmed based on the use of similar systems in providing protective functions in response to transients, LOOPs, and small-break LOCAs. System designs and specific nomenclature may differ among plants included in a particular class; but functionally, they are similar in response. Plants where certain mitigating systems do not exist, but which are largely analogous in their initiator response, are grouped into the appropriate plant class. ASP plant categorization is described in the following section.

The event trees consider two end states; su~ (OK), in which core cooling exists, and core damage (CD), in which adequate core cooling is believed not to exist. In the ASP models, core damage is assumed to OCClD' following cae uncoveiy. It is aclalawledged that clad and fuel damage will occur at later times, depending on the

aiteria used to define "damage," and that time may be available to recoYC'J' core cooling once core uncovery occurs but befc.-e the onset of cae damage However, 1his poamtial recCJYaY is Dot addresScd in the models. Each event tree descnbes combinatioos of~

failures that will prevent core cooling, and makeup if required. in both the short. and loog tam Primary systems designed to provide these functions and alternate systt.ms capable of also.

~orming these functions are addressed.

The models used to evaluate 1982-83 events considr.r both additional systems that can provide core protection and initiating events not included in the plant..class inodels used in the_ assessment of 1984-91 events, and only partially incluctccl in the asscssmmt of 1992-93 mms~ Respmse to a failure tO trip the reactor is now addressed,.

as is an SGTR in PWRs. In PWRs, thc p<<ential use of the residual beat removal system following a small-break

. LOCA (to avoid sump recirculation) is addressed, u is the potential recovery of sccondmy-side cooling in the kmg tam foQowing tbe*initilfion of feed and blaed. In boiling water reactors (BWRs), the potential use of react.or cae isolation cooling (RCIC) and the caotrol rod drive (CRD) system for makeup if a single relief valve sticks open is addressed, as is the potential long-tam recovery of the poMI' conversion system (PCS) fm decay heat ranoval in BWRs. These models better refla:t the capabilities of plant systt.ms in preventing core damage.

ASP MODELS

ML18065A673

Contents

Text

SUBJECT:

Dear Mr. Smedley:

Enclosures:

Enclosures:

Description:

Description:

Description:

Description:

Description:

Description:

Navigation menu

ML18065A673

Text

SUBJECT:

Dear Mr. Smedley:

Enclosures:

Enclosures:

Description:

Description:

Description:

Description:

Description:

Description:

Navigation menu

Search