ML20056C340
| ML20056C340 | |
| Person / Time | |
|---|---|
| Site: | 05200001 |
| Issue date: | 05/13/1993 |
| From: | Fox J GENERAL ELECTRIC CO. |
| To: | Poslusny C Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 9305190275 | |
| Download: ML20056C340 (16) | |
Text
__
.. =.
GE Nuclear Energy i
f twew twwe taur
??5 Cu mn km < Dn J::x D195125 May 13,1993 Docket No. STN 52-001 l
f I
Chet Poslusny, Senior Project Manager -
l Standardization Project Directorate i
Associate Directorate for Advanced Reactors and License Renewal Office of the Nuclear Reactor Regulation f
Subject:
Submittal Supporting Accelerated ABWR Review Schedule'- Response to l
Questions on Flooding PRA.
i i
Dear Chet:
~
l Enclosed are the responses to NRC questions on the Flooding PRA transmitted to GE by letters '
[
dated March 25,1993 and April 21,1993, r
If additionalinformation or clarification of these responses are required, please contact Art -
l
~
McSherry on (408)925-1917.
l Please forward a copy of this transmittal to Glenn Kelly.
l t
Sincer ly, j
ack Fox l
Advanced Reactor Programs i
cc: Norman Fletcher (DOE) i i_
Art McSherry (GE) l Jack Duncan (GE);
i 1
180047 i
l f
l 1:
nous
.\\ l 1
J~
i n
[
'9305190275 930513 p
PDR-ADOCK'05 1
.l A
05/D/93 RESPONSES TO NRC ABWR FLOODING QUESTIONS FROM 3/25/93 LETTER i
Question a) In Figures 19R.5-1 and -2 (Turbine Building Flooding (Iow and high UHS, respectively)), credit was taken for the truck entrance doors not holding back any water.
These figures also assumed that the door from the turbine building to the service building access tunnel is a watertight door and is closed. Lastly,it is assumed that the probability of the reactor being brought to a safe condition is IE-8 given the flooding to that point.
l (i) The staffis not cominced that the truck entrance is not capable ofretaining water. It is quite possible that it could hold water to a level of one foot or higher before there was a catastrophic failure of the door that would open it enough to let all the flood waters out.
]
GE should provide an evaluation that d&rmines at what flood height a flood from the turbine building to the senice buildhig is a concem. GE should look into what height a truck door actually can retain water or should assume that the door will retain some level 1
ofwater.
Response a(i) The turbine building flooding analysis has been changed to take into i
account the potential for the truck door to retain some level ofwater. The analysis j
assumes that there is a probability of.9 that the truck door will not catastrophically fail. If the truck door retains water to a level greater than 8 inches, the security door between the turbine building and senice building would be challenged. It is assumed that the probability of this door failing is 0.9. If this door were to fail, water could enter the senice building and flow down the stairwell to the entrances to the reactor and control buildings. Normally closed watertight doors below grade on the control and reactor buildings would prevent water from entering and damaging safety related equipment. The exception is the watertight door at the entrance to the control room which is normally l
open for easy access to the control room. So if flooding were to progress to this level (one level below grade), this door would have to be closed. Failure to close this door would not result in core damage as all automatic safety features would continue to l
function and the plant could be safely shutdown frora the remote shutdown panel if necessary.
t At grade level, there is a normally closed and alarmed fire door (non watertight) for access l
to the clean area of the reactor building. If the fire door failed, water could enter the reactor building through two air lock motor driven doors in the clean access area. Floor drains would then direct the water to the corridor of the first floor. No safety related
.i equipment would be damaged since watertight doors on the ECCS rooms would prevent j
flooding in the rooms. It is expected that if flooding continued to this level water could exit the senice building by the main entrance. The CDF for turbine building flooding is j
l approximately 1.0E-8 per year for a high ultimate heat sink (UHS) and 4.0E-9 per year for a low UHS. Attachments 1 and 2 are the revised turbine building flooding event trees.
l Question a(ii) GE should report to the staffwhat equipment in the control building l
would be failed by various levels of flooding from the senice building.
1 i
t 05/13/93 Response a(ii) If the watenight doors on the entrances to the control building from the senice building were to fail, the following equipment could be exposed to flooding: first and second floors-RCW (Division C first and the other two divisions if the RCW watertight doors were to also fail), third floor - divisional batteries and certain MCCs, j
fourth floor (one level below grade)- the control room.
Question a(iii) GE should reconsider its IE-8 conditional core damage frequency in top event " Reactor Brought to a Safe Cond" given the equipment failed in "ii" above. GE will be certifying in its final SSAR that the IE-8 conditional core damage frequency is appropriate and correct.
Response a(iii) The conditional probability of core damage for a manual shutdown with i
no equipment damage is IE-8 per year based on the results of the turbine trip event tree l
from the full power PRA. The turbine trip CDF was conservatively used as a controlled manual shutdown would not result in a turbine trip transient from high power. As stated in the flooding report, higher conditional probabilities are associated with manual shutdowns ifless than three divisions of safety equipment are available.
Question a(iv) The top events in Figure 19R.5-1 does not appear to consider the potential for a siphoning effect. To what extent is siphoning possible for a plant with a low ultimate heat sink? Ifit is possible, either modify the event tree orjustify why it does not need to be considered.
I l
Response a(iv) Siphoning could occur to a certain level in the turbine building depending l
on the level of the UHS but as long as the level is below grade, the maximum flood level due to siphoning will remain below grade. The main concern for turbine building flooding, beyond a turbine trip transient, is flooding of the senice building if the water level reaches grade in the turbine building. Since this cannot occur by siphoning for a low UHS, siphoning is not considered for this configuration.
Question b Figure 19R.5-3 is the event tree for Control Building Flooding. (i) In this figure there are three places where the event tree considers the possibility oflevel sensors detecting the flood. The assumed failure probability of all sensors is E-9. This value appearsto be very unreasonable and does not appear to consider common cause failure.
Please discuss the values chosen an J discuss how common cause failure (including such things as improper maintenance) was factored into the estimate.
l Response b(i) The design of the level sensors in the control building at.15 and.8 meters I
are required by the ABWR design to be diverse to eliminate the potential for common cause failures of the two sets of sensors. Each of the level sensor designs uses a two out j
of four logic. For the lower level sensors the unavailability was calculated to be 1.7E-4 per demand. The upper level sensors failure rate was increased by an order ofmagnitude for cases where the lower sensors failed (i.e.,1.7E-3 per demand). This is a conservative assumption because the designs are diverse. For the case where the upper and lower 2
i l,
L l
05n3/93 j
l I
l sensors in one division fail, the unavailability of the sensors in the second division was i
assumed to be.1 to account for CCF, If the lower sensors in the affected division j
successfully actuated but the upper level sensors failed, the probability of the lower and j
upper level sensors in the other two divisions all failing is assumed to be.01 (i.e.,.1 for j
each sensor type). Failure of all sensors or failure of the operator to isolate the flooding l'
source if automatic features fail is assumed to result in core damage due to flooding of the battery rooms. The CDF for control building flooding is 4.1E-9 per year. Attachment 3 is the revised control building flooding event tree.
l Question b(ii) Please provide a list of the equipment that would be flooded in the l
Control Building based on where the flood waters travel to and the height of the flood.
j i
Response b(ii) See the response to question a(ii) above.
j l
Question (c) In Figure 19R.4-2 (Reactor Service Water System), it appears that there are j
two valves in the service water system supply line to the control building, but there is only l
one isolation valve after the service water has cooled its associated equipment in the i
control building. (i) Is there a corresponding isolation valve to MO F014 (' the supply m
l line)in the line down stream ofMO F0057 l
l i
t i
Response c(i) No. The return line to the UHS contains an air break (i.e., the line ends j
l before entering the water of the UHS).such that siphomng cannot occur.
Question c(ii) How was the volume ofwater in the service water line downstream ofMO
{
l F005 treated in the internal flooding analysis? Is this volume included in the calculation of f
l the 2000 meters maximum?
I l
Response c(ii) The 2000 meters does take into account drain back ofwater from the l
RSW return line for breaks in the RCW room. Drain back from both the RSW discharge
{
line and RSW return line should not occur due to the RCW heat exchanger isolation valves which receive a close signal due to high water level in the RCW room. If both of these valves fail to close, drain down ofboth RSW lines could occur. The water from J
both lines will not flood more than one division (i.e., the RCW room can contain drain back of 4000 meters of RSW piping plus the water that was pumped into the room prior to automatic flood isolation).
l Question c(iii) If the RSW pumps trip but the isolation valves fail to close on a break in J
the control building, can a siphon effect continue to pull water into the control building, especially if the ultimate heat sink is at a similar height or even higher than the control building?
Response c(iii) Yes. Anti siphon valves are included in the design to prevent this occurrence.
3
)
a
l..
05/13/93 i
Question c(iv) If a siphon effect can occur, what would be the correct value to the top f
event " Automatic Flooding Isolation" in Figure 19R.5-3?
i Response c(iv) The 8E-7 value for automatic flooding isolation includes potential failure ofboth the pumps to trip and the anti siphon valves to actuate.
Question (d) In Table 19R.5-3 (Control Building Flooding), does "Div. 2 Power or Senice Water Unavailable" mean that both ac and de power that supply Division 2 i
equipment are available or does it mean that ac power is lost? Ifde power is not considered lost, why not? When the table states "Div. 2 and 3 Power or Senice Water Unavailable", does it mean that ac and de electrical power to both Divisions 2 and 3, or j
the senice water to both Divisions 2 and 3 are unavailable?
Response (d) The values in the table are the conditional probabilities ofcore damage from the full power PRA for loss of one, two or three divisions of RCW due to a flood l
given failure of flood mitigating features and operator errors. The fault trees were l
modi 6ed to account for loss of more than one division by assuming a loss of AC power.
Loss ofDC is only assumed to occur if flooding continues beyond the RCW rooms due to'
{
failure of all sensors or failure of the operator to isolate the flood given a high level alarm.
Question (e) Figure 19R.4-1 is unreadable. Please provide a readable copy.
l Response (e) Attachment 4 is a readable copy of Figure 19R.4-1.
l l
Question (f) Let us assume that the CWS including its water source is at an elevation that is higher than the passage from the Turbine Building to the Service Building. This is l
l the case at a number of power plants today. Let us also assume that the door between the Turbine Building and the Senice Building is not a watertight door (This information was I
orally communicated to me recently by GE). Now a break in the CWS pipe in the Turbine Building (4E-2 per year) would flood the building. Even iflevel switches detected the flood and tripped the CWS pumps, unless the three MOVs isolated, the water would continue to pour into the Turbine Building. Ifwe also assume that the truck entrance door can retain some height ofwater at its base without severely buckling, the fire door leading from the Senice Building to the Control Building would allow water to enter into the Senice Building and on into the Control Building. This is about a SE-4 per year event. If as in Figure 19R.5-3, the conditional probability of a large flood in the Control l
Building preventing the reactor from being brought to a safe shutdown is IE-1, then the overall frequency of an internal find leading to core damage is on the order of SE-5 per l
year. Please discuss this poss c sent and whyit should not be considered a potential l
vulnerability, if the CWS is smheiently high.
j l
Respor.se (f) As discussed in the response to question "a" above, normally closed watertight doors at entrances to the control and reactor buildings below grade (except for the entrance to the control room) would prevent damage to safety related equipment. If flooding were to continue to fill up the senice building to the level of the control room t
l 4
4
+, -
9 m
w y
y---
- - +
-<q.y+g,,
y -~ q
05/13/93 (one level below grade), sufficient time and many personnel would be available to cl the watertight door before the control room would be flooded. Even if the control ro were flooded, automatic safety features would not be affected so that core dama not occur. The CDF for turbine building flooding is 1.0E-8 per year for a high UHS and 4.0E-9 per year for a low UHS per year when all the preventive and mitigate features accounted for.
Question (g) Figure 19R.5-4 (Reactor Building Flooding in ECCS Room) ha event "(No) Water in the Corridor" This water in the conidor is only considered if the sump level switches have failed to detect a flood. This does not seem to be appro It would appear that water could get into the conidor regardless of whether th level switches alarmed or not. (i) Consider modifying the event tree to include consideration of water being in the corridor after an ECCS pipe break, since it makes difference whether or not the sump level switches alarm. (ii) The event tree does no consider the chance ofa common cause failure failing all three ECCS doors. Inste doors are treated as independent, having a combined chance of 1 in a billi or leaking. Please modify the event tree to more realistically quantify the chances o flood in an ECCS pump room flooding the other pump rooms.
Response (g) The top event " water in the corridor" is used to model failure of the watertight door to retain flood waters in the ECCS room. Likewise, " water in the n ECCS room" implies failure of a watenight door on one of the other ECCS room top event titles will be changed to reflect these failures. The event tree has be to model common cause failure of all three watertight doors. The CCF is 2 5E-5 a calculated using the Multiple Greek method with a Beta of.05 and a gamma of.5 CDF for flooding in the ECCS room is calculated to be 3.lE-9 per year. Attach the revised reactor building ECCS room flooding event tree.
Question (h) In Figure 2 in your March 3,1993 fax to the staffon the ABWR Probabilistic Flooding Analysis, you took credit for a IE-4 recovery factor. (i) P explain this factor. (ii) Does it come from the Class II CET? (iii) Exactly what is assumed to be recovered and in what time frame? Does it include recovery offeed pumps, condensate pumps, or fire water? (iv) What is meant by " Failure to Restore Normal Heat Removal"? (v) Why is the loss of service water frequency c year? (vi) The value of 6.38E-4 does not appear in any of the event trees. How is t loss ofsenice water event tree used?
Response (h) The loss of all senice water conditional probability is not used in the analysis. It is conservatively assumed that for loss of all three divisions that makeup source is AC Independent Water Addition. The conditional probability 4 will be removed from the SSAR. Therefore, Figure 2 of the March 3,1993 fax is applicable.
l l
5
l 05/13/93 RESPONSES TO NRC ABWR FLOODING QUESTIONS FROM 4/21/93 LETTER Question 1) The GE bounding analysis identified the potential flood sources and selected the ones expected to have the greatest impact on the operability of systems required to safely shutdown the plant. No sources were identified that could affect more than one i
division of equipment without the failure of at least some flood protection features, either isolation barriers or mitigation features. In the review of the flood sources the staff found that at least one flood source, the reactor cooling water surge tanks, was prevented from arTecting more than one division through the use of raised sills on the entrance to the room containing the tanks. This is the only feature that prevents this flood source from potentially affecting two divisions ofECCS equipment. Because of the significance of a flood that would affect multiple system divisions, GE should assure that proper installation of the sills is incorporated into the ITAAC for flood protection. This assurance should be provided by an ITAAC.
Response 1) Due to the requirement that advanced light water reactor designs be compatible with use of robots for post accident inspections, all sills have been eliminated.
Flooding between two divisions due to leaks in the RCW surge tanks is not a concern because of the installed floor drains and the relatively small size of the surge tanks. The RCW surge tanks for divisions A and C are located in adjacent rooms that are separated by a fire wall and fire rated door. Any leakage from the surge tank in either room should be directed by the floor drain system to the sumps on floor BlF. Even in the unlikely event that the floor drains in both divisions become clogged, the 16 cubic meters ofwater in the tank when spread over the available area of approximately 395 square meters would only flood to a level ofless than two inches. Since all equipment is installed at least 8 inches off the floor, no flooding damage would occur.
Elimination ofother sills in the plant is not a risk concern as floor drains will direct flood waters to the appropriate floor for removal by sump pumps or the room can contain the flood water..
Question 2) The analysis did not address flooding in areas of the design that are the 1
responsibility of the COL applicant, specifically the ultimate heat sink pump house. The COL Action Item 6 of Section 19.9.10 should be revised to include the requirement of a probabilistic assessment of the site specific design features.
Response 2) The COL Action Item list will be revised to include a site specific flooding PRA of the UHS pump house design.
Question 3) The review of the event trees and the quantification of the event trees did result in some identification ofissues, the resolution ofwhich would have some affect on the results of the analysis. In the turbine building flooding analysis, one of the events taken credit for is the release of flood waters through the turbine building truck entrance door. Because this door is not a watertight door, the analysis models the failure of the 6
x l
05/13/93 door to fail open with a probability of 0.05. However, nojustification for this value is provided and the assumption that the door would fail is contrary to normal PRA practices that do not use beneficial failures as possible mitigating measures. The staff requests that GE provide the staff with an assessment of the height ofwater that could be retained by the tmck door before it would be expected to fail and how this height relates to the flood l
i level necessary to allow for flooding in the control building. Alternatively, credit for the i
failure of the door should be removed from the event tree.
l Response 3) The event tree has been changed to show that the probability of the tmck l
door to retain water is 0.9. See the response to question a(i) of the NRC letter of 3/25/93.
l Question 4) This event tree also takes credit for the protection provided by the watertight door between the turbine building and the control building, failure of the door to stop the flood is assumed to result in the failure of all equipment in the control building.
While this is reasonable, it highlights the need to ensure that the watertight door is maintained and inspected properly. In a response to an RAI, GE states that credit was l
taken because in current operating plants the status of the door is typically visually l
checked during each shift. Since this assumption is part of the basis for crediting the watertight door, a COL Action Item is required to ensure that these inspections are incorporated into plant operating procedures.
Response 4) The door between the turbine building and the service building is a normally closed and alarmed fire door but it is not watertight. The turbine building flooding analysis has been changed to reflect this. The probability that the door will fail is 0.9. See the response to question a(i) of the NRC letter of 3/25/93.
Question 5) In the quantification of the control building event tree, there is an event titled
" automatic flooding isolation." This event is quantified as representing the failure to isolate the supply side of the service water system. This event consists of a combination of reactor senice water system valve, siphon breaker and pump trip failures. However, the conceptual design of the reactor senice water system shows only one motor operated valve between the control building and the system discharge. If this valve were to fail and the UHS is at a higher elevation than the basement of the control building, the location of the break, back flow into the building would be possible. This unisolated flood becomes the most dominant flood in all of the three buildings. The NRC is unclear whether additional protection is needed to reduce the likelihood of this unisolated flood.
Insufficient information was available to determine if this issue is of concern for the circulating water system and the turbine building senice water system. As part of this concern, the susceptioility of these systems to back flow through the discharge lines should be addressed.
Response 5) The ABWR flooding analysis assumes that flooding ofplant buildings cannot occur by gravity feed. Plant piping elevations are such that some lifting ofwater (i.e., through a pump) must occur for flooding. The analysis does address siphoning and anti siphon valves are included for systems where siphoning is a concern. For turbine 7
l 05/13/93 building flooding by the circulating water system, flood isolation by pump tripping is not l
credited. Control building flooding by the reactor service water system can be terminated l
by either isolation valve closure or pump tripping in conjunction with proper operation of i
l anti siphon valves.
i Question 6) In the reactor building flood in the ECCS room event tree there is an event titled " sump level switches detect flood." In the event tree no credit is taken for the operation of the sump pumps and the operator cannot isolate the flood. It is not clear why this event is included in the event tree. Additionally, in this event tree and in the reactor building flooding corridor, the possibility of flood svaters entering all three divisions of ECCS was not considered. Due to the relationship between the conditional core damage i
probabilities associated with the loss of one, two, and three divisions ofECCS, the sequence containing failure of all three watertight doors and the subsequent failure to i
safely shutdown the reactor with no ECCS available has a higher frequency of core damage than the sequences containing the failure of one or two ECCS divisions due to the flood.
Response 6) The event " sump level switches detect flood" is included for two reasons. -
First, depending on where the location of the flood is the operator could isolate it (e.g.,
line from CST, line from suppression pool downstream of the isolation valve, or in the fire water system). Secondly, the sump level switches will send a signal to the operator alerting him to a potential flood condition and the operator could elect to manually
{
shutdown the plant before flood damage occurs. Both of these actions could mitigate the potential flooding damage.
The flooding analysis has been changed to address common cause failure of all watertight doors. Attachment 6 is the revised reactor building corridor flooding event tree.
Question 7) The reactor building flood event trees consider the failures of the watertight doors protecting the ECCS rooms. Only random failures are considered, common cause failures are not. As part of the review, these two event trees were re quantified to address these three concerns. The sequences were modified to reflect the possibility of failure of all three watertight doors and the data of Table 19R5.2 was used to address common cause failure of the watertight doors. Only one sequence, when re quantiSed, had a core damage frequency greater than IE-8 per year. This sequence, with a frequency of approximately 1E-7 per year is a flood in the ECCS corridor followed by the common cause failure of all three watertight doors and the failure of the reactor to be safely shutdown with all three divisions of ECCS unavailable. To be consistent with the GE analysis, this re quantification used the 0.1 value for shutdown of the plant (which assumes j
that the power conversion system is unavailable) rather than the loss of division 1,2, and 3 power or service water systems. Although the re quantification significantly increases the frequency of core damage due to internal floods in the reactor building, there are reasons that this partimular internal flood becoming a potential vulnerability. This is because of the conservatism of the underlying analysis, the absolute value of the estimated core damage 8
M 4
05/13/93
)
frequency, and the significant uncertainty in the common cause failure value used for the three ECCS doors.
3 Response 7) The reactor building flooding analysis has been changed to address common cause failure of all ECCS watertight doors. The CCF used is 2.5E-5 per demand. This l
was obtained using the multiple Greek method with a Beta of.05 and a gamma of 0.5.
The highest core damage sequence is for flooding in the corridor with successful operation of the level switches but operator failure to isolate the flood and common cause failure of the watenight doors. This resulted in a CDF of 2.5E-10 per year. Therefore, this internal flood is not considered a vulnerability. Attachment 6 is the revised reactor building corridor flooding event tree.
1 1
i 9
O
+
4 N
0 4 O M D M D M O M M O D D M D M D R D D D 2
e O_
0 C O C O C O C O @O C
C C O C O C O C C C 1
9 BO 0
3 5
T F
f F
l 1
t.
g 1
c E
P g
1 1
t.
1 i
s g
4 e
R 1
1 1
E E R
E E
g 3
E E E E
y g
1 3
S t
u 5 8
u T
Q 0
3 g
4 4
g 4
4 J
7 4
y 2
E O
4 g
t g
1 6
8 1
f g
4 1
3 HU L
F t
B se T
C s
D n NN L
EWO F
u FYI R
twA0TI W
1 StD R
T N 8
OOUTHO 8
m R
R E
4 E
E s
E M
g e
D D
Q t.
Q 0
a Q
1 1
t 1
1 g
s t
t K
N r
M M
t 8
A 1
1 M
1 1
9 o
t t
l t
1 i
i i1 1
,1
)
f ia IE aa ia iI E,,
,i 1
BtI IE 1
HU R
D W
ET$&FS 0
AR.O W)A 4
L NLC D
E (N E O
E RV Rf
.A O
HeWT n
fm L
f 3
S F
T KC r
r m
TR) o o
t (R
t t
n n
p A
I i
1 Il 11 D
RN l
4r OAfN T Sfs A TAX RCNx VERI f
f eA WTf o
o fF C M r
r
(
a o
n n
a 3
t L
rGC mM A
m t
FBS 9tY a
tA RS w
s iT r
u a
TE A
NL f
fR t
ta O
X MO T
I CO w
UD R
T a
OR g
TR T
RNO E
OEO v
T D
F 1
E AN
(
RC C
EU r
PR o
t n
t OT t
H sV C
O A
A T
G E
fS fO T
R L HC 2
T G
l K
A lA 1
2 S
)
P N s
E a
l P
P O EERP HW d
Tt e
YE r
L R a
LA I
n E
1 G
8 M
f D
Ht CO TO tuL uF s
T d
LC a
E E vT M
fE i D 1
M A
EE RNQ pen ID TR I WUL PTD 1
S D
SM Y
r W
o C
n A
I I
i e a S
3 S
C A
M D R D M D M O M O M D D 4 D R D M D R O o 2
LC O C O C O C O C O C O C C 0 C O C O C O C C 1
S SO P
1 5
1 t
4 1
5 14 1
e E
0 3
4 e
9 6
1 4
R 1
1 1
N R
M r,
2 E
E E
E E
T g
1 n
w g
w E
4 3
e Q
p S
E 3
t g
t 1
t 8
e S
4 e
g e
2 2
5 F
6 a
1 s
H U
H T
F fa fB H
D JX NN L
VEWO F
sqF)I N
sAzT R
StN W
R Tt P
O >iN O
s e
THO 8
8 8
e 8
e B
V a
c 0
0 0
c 0
Q T
SC C
E 1
1 1
1 N
T T
M A
1 N
1 K
T I
S Et a'
It
'I I'
It IE I'
f 1I S) a a
t a
1 s
t I
M U
R D
f $a4 H
f ARA 0 IG yNCl 8
H u J F [R n C W
(
a D
F sY O
Ri a
HdewS M
C e
O f
L T Kc r
F m
4TR) 1 tR O
A B
N b
M lI g
u tU B
D RNSr E
4 OAfN m
2 T
F e
STD C
A TA R
RCLO A
U YfOO r
t e
NlSt t
e i
T fEIF w
g D
n s
MD XES f
FNLO s
C I
L 0
VGC s
1 ReS x
t m.,
MDY fa e
stA T
r bis nn 2
TE A
NL f
tt n
Ko T'
1 s
T J
c C
U (R r
R nn T
a SE MC f'N sA (R
t R
i RNO C
T OEr 4
i T
O P
f 2
(
RC o
TU r
WR un (T
i Wt u
0N 7D i
(
a EO f
RO n
OL o
ir LF m
C E 3
t oT 0
i NA rL E
k aD
(
2 i
eS t
T g
T p
4 ePT J
s
/
i O F
MdU p
E V(S p
F R
RPE hem THA TE L n LA e G
S N EHD CO 1tO WL F
S T
G LC Q
f E
VT K
ELT F
I 1
M A
E E
RtNG fRNs Tmi Wit t PTi L
2 B
a SNS E
W m
C l
4
I l i' y
I E
g m.
m 4
S m
S A
@D mD
@C MD WD
- D o D
D D
D g D D D
D D
D L
M D WC M D D
D WC WC g C C C
C C
C C
C C
E C c
(
C C
C C
C O
C 8u m
q 8
3 t
t 3
7 e
4 o
1 2
1 1
3 9
s t
i i.
e m
E E
E E
E E
t 1
t e
1 4
9 1
9 e
e t
t R
f 0
t 1
S 1
1 E
E E
E t
E s
f n
4 s
3 4
E E.
E E
c, P
Q 0
t e
0 o
3 t
2 4
F a
e at E
E E
T.
3 1
S 9
t o
0 t
3 e
o 0
7 t
o 2
e a
m E
1 5
8 9
f 4
4 1
9 t
t g
4 1
3 i
6 1
1 S
Tes x
4v i
=
DWO NADN H
9
=
m rTf0 m
Guf D
fU S
RfN S
OEO AC n
a tFc o
S r
EO a
A x
m
,n u
R T I'
E
E
E I
E
E
E
I E'
I' I'
E' e
E' I'
r E
s E
.I m
S D
O L
C E
L u
n o
m e
O v
I m
O C
eh V
m, a
G o
4 4
a d
e s
0 G
t a
L n
u a
E E
D E
[
r r.
n D
M LA o.
n m
u D
C 4
a a
A t
a l
l1 ll 8
R R m
E&ft T
f SAE AWFET P
RA u
TTBR f
E f
E C
ftP P
sP RaUO a
m m
m ys lU w
a, EPC S A W
AO T
L C
RF A
OE P
m.
TT O
M m
AA RL t
r EU a
m t
W' B a
a (I
a i
N9W I8 1
Cr 0 4N S09n 3
RUtx FEu T
99Mu E
m teORt tWSFt D
m.
L W
TTf ET i
N L
Ce m
- /
EX VNTL t
EWE 5 4
u i
o i
v L
t eA mW3 L9CN N
f 4
E 4N Vf* J T
m EA;;C t
M L
E 8R".L 4S M
F N
E E 'P e tF M
m PR t
/
PNEd u
- /
T?
UEEI u
t r
SDF f
t T
t p
A Ol Te m
Sy Tz t
CX At T
L C
RF A
OE P
AA 1(
t TT n
m RL ED t
PS a
t OI e
T 8
A M m
T LCX 3 4f FE5N T
vT I
F EEWD D
m LD O
L C4O Rm9L L
d F
EW15WF a
9 r
O L
ft av t
MAEL m
H0G S84G 9
fH p
f TfD fiOIL pum PCU p
S q
WNI 9R 9
4ii' 21i-4jft!
1
- I ai
- i
i.
8
~
8 8
8 52 g
d d
8 E
t 111 1l<l N
h 8
x gs l
D lj 6
gip Y 2PE E*
w
_n-il 11 IfT F g
c
'==
6 i
i NW t
il _LJ_2::-4 1
Ic F i
L.
I r
_sp c
mi
- s
~
i gi 0
Q-a, e
1 c
>L 1
- I i a gq=
l e x-
_~
il yll'E k
c lc _f_
1
\\
h c
t
-L e
c e
~
"~
l l
j_l V
til 1
5 8
8 8
8 8
8 8
i S
i 7
5 l
d d
W H
i
l i
l l'
i l
f i
PIPE BREAK IN SUMP LEVEL OPERATOR ACTS WATER TIGHT REACTOR BROUGHT SEO. PROB.
CLASS ECCS ROOM SWITCHS DETECT TO STOP FLOODING DOORS PREVENT TO SAFE FLOODING FLOOD IN ALL SHUTDOWN i
ECCS ROOMS CONDITION ECCSPB FLDET OPACT WTDOOR SSD OK 1.30E-06 2.34E-09 CD OK 1.30E-06 2.60E-10 CD 1.00E-01 2.00E-03
'2.50E-05 1.00E-01 4.99E-10 CD OK 1.30E-06 2.60E-12 CD 1.00E-03 2.50E-05 1.00E41 5.00E-12 CD 2
i REACTOR BUILDING FLOODING IN ECCS ROOM.\\ABWRFLD_\\RBFECCS.TRE 5-05-93 i
/} 7'l ACHriful
[
.-w.------,...-.._-.,-v.__-----.
-_.._m,______,m-
.mm
PIPE BREAK IN LEVEL SWITCHS OPERATOR ACTS WATER TIGHT REACTOR BROUGHT SEO. PROB.
CLASS CORRIDOR DETECT FLOODING TO STOP FLOODING DOORS PREVENT TO SAFE FLOOD IN ALL SHUTDOWN ECCS ROOMS CONDITION CRDPB FLDET OPACT WTDOOR SSD L
OK OK 1.10E-12 CD 1.00E-01 OK 2.50E-05 1.00E-03 1.00E-01 2.50E-10 CD 1
OK 1
1.10E-14 CD 1.00E-03 OK 2.50E-05 l#
I 2.50E-12 CD
=
4
}
REACTOR BUILDING FLOODING IN CORRIDOR
.MBWRFLD\\RBFCORR.TRE 5-05-93 i
i Yl'f $N
-..