ML19277F774

Forwards K Shiu 840106 Memo Re Single Failures in Facility Pra.Memo Satisfies Contractual Obligations for Task 1 of Project 4 in FIN A-3393.Related Info Encl

ML19277F774
Person / Time
Site:	Limerick
Issue date:	01/23/1984
From:	Papazoglou I BROOKHAVEN NATIONAL LABORATORY
To:	Chelliah E Office of Nuclear Reactor Regulation
References
CON-FIN-A-3393 NUDOCS 8401300328
Download: ML19277F774 (8)

Text

_

h BROOKHAVEN NATIONAL LABORATORY

{ ASSOCIATED UNIVERSITIES, INC.

Upton. Long Island. New York 11973 (516) 282s FTS 666, 2435 Ja nuary 23, 1984 Mr. " . 'ah Re.. utlity and Risk Assessment Branch Division of Safety Technology Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D.C. 20555

Dear Erul:

Enclosed, please find a memo from K. Shiu to myself on the subject of single failures in the Limerick-PRA.

This memo satisfies the contractual obligations of BNL for Task I of Project 4 in FIN A-3393.

If you have any questions please do not hesitate to contact me or Dr.

Best regards,

_ _, )

m _

1. A. Papazoglou, Group Leader Risk Evaluation Group p

Enc.

cc: R. Bari R. Hall g1P f@'

b9#

8401300328 840123 CF ADOCK 05000352 bb $

h ij,

BROOKHAVEN NATIONAL LACORATORY MEMORANDUM DATE: I" 6, 1@

To: 1. A. Papazoglou FROM: K. Shiu

SUBJECT:

Single failures in the Limerick-PRA.

This memo summarizes the results obtained in an ef fort to identify single failures of various frontline systems and of combinations of these systems. A total of six cases were examined. They are: a) Low Pressure Coolant Injection (LPCI), b) Low Pressure Core Spray (LPCS), c) High Pressure Coolant Injection and Automatic Depressurization System (HPCI and ADS), d) ADS and Reactor Core Isolation Cooling (RCIC), e) ADS and LPCI, and f) ADS cnd LPCS.

The study was based on the Limerick system f ault trees, as revised by BNL, and ninimal cutsets were generated. In addition to single f ailures, doubles were also investigated qualitatively to determine if they can potentially become single failures.

With the exception of the two low pressure systems, the LPCI and LPCS, failure of all four DC divisions is the only " single" failure that has beer.

identified for the six cases. As for the two low pressure r ems, in 4

addition to the DC common mode, the other single f ailures a: loss of water source, ciscalibration of sensors, and system in maintanance. (See Attachment A for a more detailed discussion.)

KS/dm

Attachment A This attachment provides a more detailed discussion in two areas. The first area entails the procedure by which single and double f ailures are evalua t ed . This is presented in Section A.I. The second area concerns the results obtained from the analysis which is given in Section A.2. This study examines a total of five frontline systems and evaluates f ailures of the following six cases:

a) Low Pressure Coolant injection (LPCI),

b) Low Pressure Core Spray (LPCS),

c) High Pressure Coolant Injection and Automatic Depressurization System (HPCl and ADS),

d) ADS and Reactor Core Isolation Cooling (RCIC),

e) ADS and LPC1, and f) ADS and LPCS.

A.1 Method For this study, the evaluation .'f single f ailures of frontline systems is based on the system fault trees which are developed in the LGS-PRA as modified by E;L. A detailed discussion of the specific modifications is given in the BNL review report of LGS-PRA, NUREG-CR/3028. Single or double failures which res ult in system f ailures are obtained by evaluating the minimal cutsets of the particular frontline system. In the LGS-PRA system f ault trees, support systems are only modeled as developed events. Therefore, in order to identify any single failure from support sy7tems that will contribute to the system f ailure, the electric power fault tree and service water fault tree are reviewed . It is found that the common mode f ailure of all DC divisions, the service water loops, and the various AC buses would di,able these support systems.

In addition to the single failures, f ailures of two components that lead to system failure are also evaluated. A screening approach is then applied to these failures and they are selected to be included in the results based on the following criteria:

1) Both failures are human error related and one of them has a high probability of occurrence,

2) A single hardware failure coupled with a high probability of human er-ror, and

3) Potential casmon mode f ailures.

It is important to note that udnimal cutsets are generated without regard to the cutset failure probabilities. In other words , no truncation due to the probability of occurrence of these cutsets is assumed.

A.2 Results a) LPCI The single and double f ailures of the LPCI system are summarized in Table A.I. Two single failures which could disable the LPCI system are identified.

They are the loss of suppression pool (LSP), and the common mode failure of all four DC divisions. The loss of suppression pool failure can be further resolved into either a loss of suppression pool water due to pipe rupture or unavailability of suppression pool due to high water temperature. The common cause f ailure of all four DC division is a rare event; nonetheless, its oc-currence will ensure the f ailure of the LPCI system.

Also identified in Table A.1 are f:wo double failures. The first one con-tains two operatoc failures: (1) f ailure to manually realign valves, and (2) miscalibration of pressure channels. This minimal cutset is deemed worthy of consideration because the probability of failure to manually realign valves is assumed to be quite close to unity (0.9) . Furthermore, due to the uncertainty nature inherent in the estimates of all human error probabilities, mis-calibration of pressure channels by operators may have the effect equivalent to a single failure which is necessary to failure the system.

The second double failure includes failure of both Loop A and Loop B of the service water system. In the Limerick design, there are two service water sys tems : the normal service water system and the emergency service water sys-tem. In order to fail Loop A, both the normal and the emergency Loop A serv-ice water systems would have to b di sabled . Granted that the likelihood of such an occurrence is relatively low, this cutset does 13.lustrate the f act that if there exists a common mode failure of these two service water loops, the LPCI system will be rendered inoperable.

b) LPCS In the evaluation of the LPCS system, four single f ailures are identified and they are presented in Table A.2. The one single human error which will cause the failure of the system is a common cause miscalibration of the react 6r pressure sensors (LHU512DXI). According to what is given in the Limerick LPCS system fault tree, the failure of room cooling to Loop A will als o re s u'. t in the failure of the system (KRMCLCSA) . However, based on the information given in the FSAR Chapter 6.3, each of the core spray pumps and its associated components are contained within each individual compartment; it is therefore likely that there is an error in the designator of the room cooling event. If one assumes the individual room cooling capability for each pump, then the minimum cutset KRMCLCSA will be eliminated.

The third single failure is the common cause failure of all four divisions of DC power. Finally, test and maintenance of both loops of the core spray system also contribute to the unavailability of the system.

As for the double failures, there are quite a number of them and only those which satisfy the criteria listed in Section A.1 are included in Table A.2. The first pair of f ailures includes the loss of the suppression pool along with a human failure to replenish the CST water in time (LHU5229XI).

The human error probability used in the Limerick fault tree is 0.1. The second set of double failures include also the loss of the suppression pool and in addition an cperator f ailure to open manually in a timely manner valven to the CST (LHU902DXI) . This operator failure probability is also estimated to be 0.1. The third set of failures is representative of a combination of

' loss of the 440 buses. Failure of either C and B or A and D will disable the LPCS system.. Similarly, the loss of the 4 kV buses results in an analogous situation. This is represented by the fourth minimal cutset. The double failures of two electric buses are included in this discussion because they are deemed to be credible events. Lastly, the failure of both Loop A and Loop B of the service water system will also lead to system f ailure.

c) HPCI and ADS The minimal cutsets for the HPCI and the ADS systems are evaluated. The HPCI system cutsets contain many single element failures whereas the ADS

system cutsets, including the automatic initiation functions, contain only four single failures. The single element cutset of these two systems together yield only the common mode f ailure of the four DC divisions. Due to the number of single f ailures of the HPCI system, there are many double f ailures for the two combined systems. These events are examined and they do not satisfy the criteria established in Section A.1 to warrant their inclusion in the results.

d) ADS and RCIC As for the HPCI system, therc are many single failures for the RCIC system. However, only one single failure is calculated for the combination of the RCIC and the ADS. This is the common mode failure of all four DC divisions, e) ADS and LPCI Single failure evaluation yields only one cutset, and it is the common mode four DC division failure. As for higher order cutsets, principally the double failures, human error of various nature appears in most of the cutsets; however, they do net satisfy the criteria stated in Section A.I.

f) ADS and LPCS The result is similar to (e) above.

Table A.1 Failures Which Disable LPCI Sincles

1) EDC125 Common mode failure of all 4 divisions of DC power.

2) LSP Loss of suppression pool.

Doubles

1) DHU102DXI Failure of operator to manually realign valves.

DHU919DXI Miscalibration of pressure channels.

2) WSWA Loss of service water Loop A.

WSWB Loss of service water Loop B.

Table A.2 Failures Which Disable LPCS Sincles

1) LHU512DXI Miscalibration of pressure sensors.

2) KRKCLCSA Loss of room cooling Loop A.

3) EDC125 Common mode f ailure of all DC divisions.

4) LTM12 Both core spray loops are in maintenance.

Doubles

1) LSP Loss of suppression pool.

LHU522DXI Failure to replenish CST in tLme.

2) LSP Loss of suppression pool.

LHU902DXI Failure to open manual valves to CST in time.

3) EAC440C(A) Loss of the 440 bus C or A.

EAC440B(D) Loss of the 440 bus D or D.

4) EACC( A) Loss of 4kV bus C or A.

EACB(D) Loss of 4kV bus B or D.

3) WSWA Loss of service water Loop A.

WSWB Loss of service water Loop B.

.