ML20072H951
| ML20072H951 | |
| Person / Time | |
|---|---|
| Site: | Byron  |
| Issue date: | 12/31/1988 |
| From: | Ament G, Cassidy B, Sloane B WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP. |
| To: | |
| Shared Package | |
| ML20072H829 | List: |
| References | |
| WCAP-11992, NUDOCS 9408260170 | |
| Download: ML20072H951 (118) | |
Text
,.- _ _ _ _ _ . _
'h' ; ]d [., ' ' '; i ' - .i.* , 'v', ,; _ , ", . , " , . , ,{ ,; }. ;, ; . ,.p*, , . .:s, ; . '. },* l;;
...g s....c.,
. ' . ,';' .., , p_ , . .-. . ,' ,-. ' .,**s..
. . ' ' . , ,'Il*$.._',
f., l_ t
- k . ' } '.. . ;". -'.,',',' .,,.;,..'.'.-
. . . .- , *.'.,':'*.,,,....as < ,. ,':' * , . ' * , .r.,,,.g'.i ';:6. , 4 , ., .
. .. .- . , .. ^ . * ,-
. . ; .. , ,,q _ . ; ' *; ,, ; ;, . ',-- 7. : ) 'l :, "' ,u.j N' _T ; ;; ;; .' :7,.'l .': y;.h L;L. 9 , . ". *. .
.e-e'
, :., ., , :. m, e,,; ; . : , ;- ^**.L.-.-' ; ;, . . , ,.;; .. .:.. . . . i, ; v, % .
- f. . ' *;, ;:
. . ,. e 's . . .: "
., *.. ', - : ., .., . . . . . . . ~ . , . . . .s. :.F c : -
, . . ~
., l .
. *i . . . 9' ...;':.','.',,[',? : '
i ;d ' ./ - ((,',7 ' . .
'. s-,;['..'.,}.:.*..', .'.:1 . . ./j . **
. ".'.: - . . . '. 8 \ ' ,3 .I , , ' ..'
....'T1.,'..'.~...>;.'.',* ',. -
.>.e
,Y.
1, ,
W. . g. , .. ' ,' , .: r'. . : ' , . ' , ' . ;,; !* : .* ; . ...,.,.[',,'* ~ . " -' .'. .~
~ v 1.- - . n ,: .,. ,: - . w , . . - - , .: s .
~
, ..; _;,.,. ;.,*...A... - .....,> * *. -N. : ., p .~,.'.<':.,:.
- . ...r -
,..e.. .. .,..:,.- ' . . .
s-.s
- . ,n .?~, . -
. - : :-' '. ' a
- .,.' w g .A. .-Q :. ,:
n:y_.4'. m~S- , . .
- - . .. .. .' .. ' '::.: - 1. : ..'.;.',,
. .. .:-. -' . . , ,7 -'?:,.".-,"..'.,*..,:. g,. , . , . - < '.o....
..- v,
.n. . .: '~ .
,'.t .- .. ~v:1. n
.-q...-' .Gc.,.,,..',.',,,;.,-;'.*
1 s Lb.,'..,.
.i,
~..,. .!, , .!.I . ' . u4:* . 7 ....; .*^
-. a
.- s. 8 ..
f, %:'.L',,.
s ?.
.,,.c-:.....
,3. -
~,.i.;,.. ,,.
.:. a- n v..,. ,
.~: .1 : . . . ..v-.. = , .. , -;,..',
,.- ...,.,en , ' , . ,. ~ , , .:.
-.e L..c:,g , . . :....
. y; ; ,a. - , i. - : . . %, : _- ;- ,. ~. e
,,,; ,.,...,.4 , 7, .. . , . . , *.,, [. , l l .;- ,' . ._,'.,,.,,,'..,':-
t' i
- e _:_._ ...;.:....,.:.,;,,...,..,..,g.
g;e -
Q ^ ' f: . s .,: . . .,. l.V z'. '..',3.e.~.
.}...,:,,
p.,; .
.- .: - y_
1,b $ .
- e. ,, r.
- t. -_'...;j,+ * : . [ ;'. [. , ';.[f. ;y. g* .
...z..
l
, , ., .g., . . .y.s. , _., . ..., ,.,- . - , , ...c.,
.es. : . c, ; t. ..n.,. ;i - .,- . .,..,; 3
- ., - .t.
,.. ;; . - - : .~ . '.
- t. . o,;- ,,2 -
. g : ,., ~ , s ? ,..:.,
3 ,,;. . . , . " , , . ... c . ;, f, , . .. , . p.. , 3 ,. . .: q4 . ,,' ,f
, 3 ,. ;, .,,. .. .c.....'_ , . .: . .- . . j ys, . , .; . .-
%... ..,7..,.,. :
s . .,
7, . . . . .:..- . , , , . ,, ,
., ;; '
- 4;, ., ? , e , ... .~ ..,., _ ,
y.
' .: .. :e ' .. ..; i.. .,-. . . i. , ,,,'.:d,.,' . ..
' f ,e ' ;
u.... '. . -! .c:'. . *...'.t.^ ,.' ' ,' , '. ', '?!'S.;. ,p ' ;-
.' ,,' '.. , .r; ..?...l.'.
.:...,; ,,y ;.. , .. . . . , . . s .,. . , . , . ' . . . . .".,'
. r .. O o'
, . : p,' , y. . . ( j ,
.;.....f.'..-,..,...s.,:',.'.s.:
,..'s' -* , - ' : ' : * ;, ;, _ % .x ! -' - '
,; > p r -
- . ., i ::, ; . . 'b r
- j .. .' ; ,_.y. ,,, ' ,' . *'; * . y *.
- . . . ~ .'. .,. .: a 7 7 2,c_ : ;, .3 :;.." . :*. 7 _ ,.c
- . .- g ..
. ; ._ _' .$:z.:, .L ;.. , ,. y ,, ; ,;}. ::. ,f,
];,; ','_ v., f., .. " ' 4 ,, f. " .
". , -3
- c. -. ' . , .' ,?.,. - . * : { 't . . . ~: - . . .. :
,(,.
- f. r,,
.?,~",. ; - i , . -,*, :. _ ~ .. , ;' \
~ :;; ; . ;;:..' , 4,; .' y."t-s q': . . L,
- v *. ;Q . ' . .... '. b. _ _T~ .. ,;;;,m' '- ' . ... :.w
?
', ,a ..' . r f;; r ' . ' . -
- -) .?..'. .s ;c.* .:. .....'...n3_..' ,:i . ., '.,,,::' . . , .: n . , s ,
....$..:.'_'>.+'_-:, ; .:!!. ..; . ' ,
,..y ,
- .. , .c,,,...
, v; : ;ge , ,~. .
~
9 ; . . , . -,. , g. -
, . ..<.,,. . . . .>. ..n_..
.o.. .; . .9.,;
- .._,.~ .w . c_ e.
.,. g, u.-
o
.e.. 7 . o . r . .p .. :..~
r,4, . . ,
.- - . . . . . .. 1,:4, .
, .. . :. : .., ;- e , , '.a., , 7.y lq$,, .r .. :.;'[. .l'. ' : ,: . ll l .)>. ,
! b, ; .;V y @ . } .Y ..;~. L ;' ;,/.
w ... l.< w. .*.lL. . . c; .' *-<'*
. - ;. , - ; ;.; 1,~,v.s;. ;';. .
.. f . . , . . - :.. . .( -
, x, _.. ;,
.;p...'...
{ q- } Y.,,,:t.._, .,.:..n '.g ,.._?.
.i
..y ;3 . _.
'., , ,,._. .;. ?,; . . .....;..,, ) n , :9. . .' .,_ g,:('. ;,. ~ ,.:..f...',..{.p',.'*(',':
o .
' :l; ~ . _ ' , . j : -^y ., ?: : . ; l ;
f':g;,T ,?.:. : :- : .af e. ,,l': ; .: x..? n . .. :*y l . ; . .;.:
- .
- . v. f.
' ,:....)>.;
m:l' f; . '..
'I, ,s,, ' ' , *
. b' V . p; .
- e" ; ;l' . I _
..o j,_
._. . . .% ' \.s
...%.Q'..t,....,. <.6 r,,, . ' .,e
. . .: ;. . . . ... .; e .. ; . . . . , . . . ' . .
, ; . , ,; , ;. . . . :r% -::..,...-
,g,.t,e, s
N' :, .g .
. p... c . , . i .:. :.; .: .'..,,,j .l - e,
.p; . ..' s, l. , .
.f. ,;- - . . * ,
,s w%.5@, . . , . 5 v. . -? :.
A.,i .:' . .c *:s ' ,;:.. >
- .. 4,.
. '; y.e: p. 8 ..w y N c.
i Y ' ,)4k . . . . ..;? l'.: b ! *. , s' .
$b',N:Vh.'N: x.4.y',E: . ,
V ';p .. &:' -
u.'k .
- .....l;..;,_'..,,,....
- .
- t .;
. , 4:.+
- '. .+37 p.
- ,w* .- .:'., .ypi.!.e ,'.,!.; * . . . . ..
q:;
. .; M,pl. ; ; ,.. .*.2 4
. j.,, . ., ,,-.. . , .. . a 1 : ... ;y . ,
- i. ,u
.. 4 . . . . ,
lM:gl% $.g,e.., 3.
- :.i~. . . . . . , .
, .,: 4 . . . , . V.:,. %,
\ ; . M *coz. Xn.b : nO ' *:yn . l .
h.f,h. ,, .. f
~h lk . . ';'
- ,R , . . .
&.v.h'. cq..u.. ,j. ......qa.
. ;L, , g. -. . M l'
.-..,_%l'.
.. .q. , o.. ..._r .:..y;q .:
- < . . .1.-
'7
.4 A'Qh. ,;.;.;
'O4_yk_;f' , yW,.n. ' .... ;'f. : : .*. .a: - :...
d;~l~ l:i.u 5
,s ry'. ',.,' , ,;. ; t. im.o :.s ;,%
..,. ;Q Y',,f... ... . ' :.p
...* .,.x).%. ; f :. n' - f,9, ',*: ,
,.'; Q,,)$;.. tfC, 4~;..; * '2h 1., *: e, 9 :- . .-l ;.. .:
.e,
- .
- * {
i
. { . .
- p.f, . 'b h-[b ' '*
- . e .}.b ,g 'j,- , h.,;. -
' .! *F .
,: .;; ',,'L :
- U
., vy. . U, + ,U. h e P - '
~g e .
s .ls
-v :,,):,n
.; , .; Pg W, f. n-o,'
.. .!_,\.;. ~ y '..r.,,,,..'.
. 4 s 'fl 4. '{_?',,-},/.[:@%.,,;
.,g. . . .dy:;.Q. , , - ;,4 :h+ i ,g G. L.
p . .f, p ,ies: . . .[
. &. . or_ .; A. y'y. .- k. . .x..
s , s _s .f . . .n. : . . . r+p., : ,*::., e ..,::
.. t_ e
- _ c 74 4/
.Jfp _ ; . 7 ." %,
W,,, e. /p y; ,$ 6.q u f.h /: ..f, w ' /* ; ,;.. ", p. ., L,.gJ ,, q. ,. . . 's. e'. i. c'" ?. ' ; ,, 1 "ejY 2 7 g'g.,?. !' e;g.; .,* * .. '.
t*. , .* '@ -n 6..'s g s.. .. ':t q'
. , .";A.L N - J'.;M,9 .'fi!;T.: w 4.L.9.' .y. s.:. T. .Jd .1; ;&.c,
, .. + /'
' ..: ,,:.;;.-:*:3.,M. $l%..;\.%,
V!. #*p. ':,
- 4 '. : .".:. '. . ': J ,-'.'r.
. .'; 7.
- , , ,;,. t; . r . 1 ', . .
- ,,9 e
.' ; - .'),
.:' ,. 7,, '. e $ . ,' , -
. '. , ,se
- 1
- g,.
-h.g +.m4q: y' . . . q* 'r'; .',e W .~^
l.g'.,* e'-_ { < ; :1'. ; .'o ;* ' ,e . *,e,', .-.-.- ..s.. . t t -
wr '. .m' , . . .~;,. 3 __ ,.; .: s ..-.' .'::. _ . ' . y.- .: - - - . .. . & , .
e ,,
. + % ' , . t .
e ;
' : . - y;* . _ : ; . .a _t. -.
p ';;
w+ c &. p -* .w ., . ..-
o r'", '% ::
m t ,w' 4). . ,= ,."w" w~ ' 4',*b '
... 3 .r ~kh'o;,?' I..*- .%m ,
- .,m(, . . @N.'h . \ #r ,. i r:...: . . . ~ ~, =: .
- f. ,
- :. v.r ". ( : w >.- c. : 9, - - -'
- -.'.d.'
'5). ' ' ' '
y p'gk ' - M h,.4
- e l' 's .'. ,fti
-k., - ,.'.g#)'h :
I.t ;- . , h ' . '. i 5 '.t . . - * " f
' - *J , ./ T ,Ji.,',',
7 ',*[**8' .- (* J ' k J,9 . e . [ J . b . ',., l - . ' -
- .M
,g . ' .f,i' . ll ' . ' '. \.
[+ . - . . , - f
- a J,' . i;i .
- ',i.,.*1 . . '" :
' '4 ' , 3 **a P .+ 4'yg..'! \-; fj./ ',*' A
- . .. * ,I' .,.'%
7.t'.,.:.,....,*[ s'*.
, . . . (, .' .{ .p*...,e ,,',./) ' .,;:
,.'.M.
. h, ..-). . , ,,'.';3 ..,e..+.-,
'r Q?\ f ' a. . . ' , - '. *["
..,. . .[',(. 8'. - ,. ,..t,, ,. .i.
p* *.e,.,.,...,,r*.,,'.'.=,i. .: ., . , ,
d ,
. g*.A, . .,
. .. g,e,i.,,.
.,4 s
..j
. .*.- .. , , ,- *g 4 ,4..*"'.',:.
,, ,, .i . , - , , . , ',, ,
yl., ..,;; . . , [ , , . ,
.a
' . ; , ;' x.. + .. .. : .:,,,
<'.J'. .. . r . * . . . . . . ' . . ; n. ...
. o. , y .:....p.
.t: .> -' . t. s ,, ' ,. ;.y - .' ,;
b.
a s' y
. 4. ,,* q .p . k ,*.. ;; ;,q l .:,-..~.,V:-
, .s
- %
- y. 1 . - .% : . .; p fa
.-<. . ~ . . ..
g A. .r . , .-, .u,,c.g. ,
- oa. . y. . . 3; . . . ' .',*,, ,.9
- . -g .
.' . : - , e .v.
, .., , * . .. .,:: ' 3 9. . : ;;; :: .
. . ., , y , * 'U. . : , ~iv...'..%'.. s. ,. . ... '. ?... ~ ' .J ..-.-n**M.. ..-.> .w w. 3, j;',4.,g; .-
h 7,.... .. , ..;.. .
- .y, p,,, J Q, - p, c, ..,.4,p,.'.4,.,, . . . " . , , ~
- "
..m .
, . ' . ,?;
.. ' . - . ..- . - . " . - . 'i a ,- . , Y. .,.w..."~..v%..!. ; .u..c ' f ';vc
,s..
.vQ, , . ' ;[., .. ;%, *;, . . .: y, , ". " . . .L
.s...k- = - . . .
e..A.;>,,'.*>'y..,.... . . - a *:. r. -
.e:. .-
'.:~,. . . .. .. ..".. 'f, x.. -
.....,.;.,:y
< _ q .; . -
n.' ,m. a'. . ?... . .: . , ,
, t
. 4c . ... . r ..s .... :-
. .-...'t.;. .; ,.
.: a. 2. . ; . e. , .s . .c..,r;af.".. n. . .... "!~ . 's. ';. -,. M. : . , .*
- t . - -
.:a
.,m. ....,'v..,..~.:.,;,,s,.......\...,.
. . , - ;i . r .
. +.,..,.q.s,j.
ny .., . .. .
c..,4 ; & .1 ; 3. p a .r, .'. ; .
.... ..'.p' .v a. . t " 3.. $.
,,....g- J, ...u. . .
- ' t,. : .,, . . " . . . .. ;. . . ,
. . . n:, . . >
c3,....n,,.,.,.s..
,s
' '. ) . , ; -le :
I - ,. #. *, - * .: . '
,. . Un .'
. ' . g,, . , m; .M: ::p... . .. .;,,,,,.,..s, ,a:',.. .g:.,.y: .p..f ..,,,,,g. .,.'.,/,.;'.3,..
,. . e ; e ; . - .r ..g., "
.- .-. ..; . :., - ..,..,y
^
.4 ; , ;,' . . :. M,s ,p. eg, 'a,.sn .,,..s ..* . ' . Y. . .
- v. -* . ,; . ' .. . , e ,a. , . g,-
+ '. , w ,:f.4 4.,.
.m.'* j
!, zy'.; . , :; y: 'w'<. ,
- . g f. . j , s.. . , ...; . . u . . /, ,
. . . . . . . .> .3 : ' v
. ;, a.
.,..n !. . . :,.. ': % ' s,
^
- r .. .':"- ~.:. , l.
, 4'y * . :,, .w Q.3A,W% p' 'e
- Q. " '. ; .. . : '. y . E ',: m
.-. l ? 2:1,% '. .is.C ."gh. .;;,;;'. xb <* r ':'.'N' . % ' .. : ,.' j Y r '.r k.:,,l..W f .%.b.z N y. * ,;r ;%:. ';3 r
.. ('.',
O '. !. +.'.,:.Y
' . :: :; ..y'^IL ' . . . % J ' Q, . . n , ' . .. . y ^ .- ;: :f;, '* '
1 :, '
.Q:l:?. ~.
..':'.s:.'g . t. + ,e 3 ; : .U..
. &&, *- n4 ' '3 d . q. rk. ,4',."?: x . ,.j.9c,....... ,y..R.i' ,
'J..o r . ,.4 [ S. . . . , ; ', . '. .'.* n + . -Q . , .'. ..V:
, n
- n ' . h : :: .
- ?
v , -
s, ., :. .- .h: . Au
' ' ~ , .
..:.. :- -.. ..:,, 1 ..- i,,f... w .< ..4 ., ,. . . .
3 *lj .*c 'c .;.,..:,,':". ,'...
.r -
q .p. gd ,w..g% q
, y 3- o . .:,c.., ': .m . *. ~ ..;.-..% . . , 3; . g .i, , , . ..
- .
/g.): , we. f.,- 3.,
- ":., O ;
,1, I y e. . : ,7, s A . *h. i ;, Gyjb&?,:' ?l.'".Y'h. '?e ".,C l # *h M ,? ,%g. c .:2.::.$ 'Y, = '%' -l. $;
e MjUr'f'Q[ .h.&g ,, n:,y.Pih d;0 * ' ' Nd '..! p,.:1 ': '4 ' ~-
yWf ,.I iyQ.'W 1: ?.$.. Q K l? j' !,lhlh k.h^N,;'f i5 M.'q ./:h% h':..,
f f:,y(. ' f,h,[ [#3 ....::rj f. )?. 7;.$?'
gle.l $ 7b' In':'[;h .".I ', '
.k . . hI 'l
! kf .k*L h;$9f
. . - ].?., '. % } ' % -Q i .% ',a.L
.- r, Y ^ . G : :
),?. .- .",,& : : : ,'5' ?C
,'. ;N . u' ;, '" .
- hl, .?.' ':;'Q', x. V.
J .fW1 h; : d' ;'Q% f G vh i %y 7*:a
- 7. :
- Qid . ' . ll'.' Q,Q' 4 . C':t ' : ,.V? L;*
- '. , y [.,
- l :-
h ,';*.: ,i!. :.;z.l. _
.*G '.' M. :.:?.*'.'". *. *..
- ' :v - v::4l.'
.." '>b.-'% ADw
. m' o.*- :% i ,: ^ :v ?.
)
N;_ .' * .
,N. .. . . .i - $ '.
$. . e' f. , Y
< .k f? k$ $$ l '
.? Y':! '.' .
. l $.b? . *
.? , .$ .
-Y ,
..hh: i
- ** * ,i ,
r '
' * ~ . ' ';. .. .. *:r :m :y ,,:c,,:
$; ,\ .,s ,'V * . '
. . .,i . : 4 .h. .'.: ; .. . ' l.', - ~ '.
' +',c y..; - . .
% , a ' : .. :. .'P ,r... . , .n u e s'
" j e . . l" . ", . .: ' .- ., k . ;:. . * ,: . ; p.- .LLp. . .' . *-
7 ..:
. - e , ,
o
- .. ;. ' ,f.? * ~
. f, ; .'.:.' .,, ,:n..f, ' , '- ..uf.. .5. l..' I. .$ '
l >h' , . s.y u; ,.;; ' m ,$. L e.
- )~ .;.n;.,, A p . .,. s', ,. A' ..' ,. . g.,:... ,,y. :yfv J,.,p. .-- ' . . , , - .. . .- y; .. n,. .. ., q:- ,, . ..,. y,
- m. s z '; :
.g" .?.,.,..Ym.s - , , . .; .
- . y l ,, . . i. . . ,-. : <,, * .;). ;. .,-
. . , - . bf j, . '] ,, '
} 'h;' ,. , 1 -
,l . yh ; _ i i [. . _. Y. ' b'
.g . , . [ :l '. h .' ", . f' ', ,
4
.s- rMn r. :
'-Q,.'g. W.v.+' ,a, n f..y m.
. . . 9,. ; , ..
,.*.y*+:.;_......,,e.,,..L.
t
- ..,.,.,.~;,..,.'.#.,.
. . 4 :<' . . . .. . ..: , . . ... ..,a .. :, .
9,,,. o, 6 -
. . - *. =:..e.-. . . . ' ~ * . . . . ..,._-( .3. ,;- $. ,. g g, e ,g . s. ,
ie .
w". .. :..,...i.."..r4,:.s.a , p a., :r $ . - r ._ m.' .:: % r . .
e n&v;; .- . a s . '.: y
',;.,g ..*".' ( ':. , p .. q, y- - . 4. ,,;, ,:.+ .;S:., , r ;. .. ; '?. ; ,s , . -
s,:9 a, w .,e . _ ,
- I'
^
l?,. , .. ,t. $'.' , .i .il,*.; ,lI. . '- p... ,.;. .f, ,, v , ,,, ;<
. s. ., ..,.Y;.',..';,...
- :, ' * ^;
,,.O'..'. '..-..,e,',I . ' .' . *
- : ,; . <*s m.C , f '. ' d. '.
.m.....,...,..:
,w p, g... . ,
..r.,.i.
~:.
..:-,~.f.- ..< -, 3. g ,#. ts.
,,-. _ . . c ....r,.,a,..
. m .: c . . -
... ,s,- +. .? 1.,. ,
,9.,,..,,,p,v.,. . , . . ;, . . , ., ,,, p . . ';- . . ;. ; s, ,.,t.-('., 3.s.: %. a- m,.; :..- s... ..y .s . s-p ,,...,:. w
. s .. .:..y; * , *. .,g
.3 .A..;...c.,,
k,...',e........g i .. .I e. g l,
, .N >$ .+e l,e .< }, . l * - .: , . :':l. . ,' eg . . )',^ ? ' ',:Q. I,
. 'f :' r .
- s ,' f: #
.- -,E,v .n'.. 0'v'A._,[' ,( . :Yo.k.:**. : :: - , ..: ,~. ,
.* Y c,,; H, - . . . ..a
'I
. &.. .:.:u. . ;.. ,f. .: n;;6 ..d~ f1.lc,..,,s ' i ef'k, t! $ e !."..'
a: .e .
, 2 Wl[:.:.a :&;r'M,- b. '.. .* . : T b .ll2;.i /;.
,, C ' li::: e% ::.v ' 'y :, X.
.,, 7.:. ; n : :'. t. .
- 4- .: d :.'. .; .?. .:?
<.. . : . ." r ::i;7 . . < .+ .,3: q . y .. % .:\s'q;l %d fl.: :-:' .v.:
.. ;.;;~, :::'.:.WW.W u m m m % w'w w w ;Y :
w k rE _ nMDOCK- n o ~050004 ~ ppp 54 WWT W,fuMU
.1 - ..-
.an . ..
i D M; ;g
.g , .,, .. . . . .
g.gggg g~ ..N...Wg.g;7.j . .. .
A .g
. ~ .... . . r . ... . . .n c .
g.. gg,g;, ;
- s:.
3
- - _ _ _ _ __ _ _ _ - _ _ - _ _ - _ - - _ _ - _ _ _ _ _ - _ _ - _ _ __ _ _ _ _ __ . .- )
acassnunvvac .n.. .
WCAP-11992 JOINT WESTINGHOUSE OWNERS GROUP /
WESTINGHOUSE PROGRAM:
ATWS RULE ADMINISTRATION PROCESS Authors Contributors B. D. Sloane M. J. Hitchler G. G. Ament M. P. Osborne B. G. Cassidy A. L. Casadei D. L. Stucker December 1988 APPROVED by:
P. A. Loftus, Manager '
Transient Analysis I i
Jointly Funded by the Westinghouse Owners Group and Westinghouse (MUHU-1068)
Westinghouse Electric Corporation Nuclear and Advanced Technology Division P.O. Box 355 Pittsburgh, PA 15230 l
~~ l DE26rto/010989 l
l
m . - . . _ _ . _ . __
4 i
4 Table of Contents Page :
Section
~1 Introduction and Summary 1-1 1.0 Background and Objectives 1-1 -
1.1 Approach 1-3 1.2_ Report Organization 1-3 <
1.3 Conclusions ;
2 ATWS Rule and Basis Evolution 2-1 2.0 Introduction 2-4 2.1 Important Points of SECY-83-293 as Applied to Westinghouse PWRs 3 SECY-83-293 ATWS Probabilistic Analysis 3-1 3.0 Introduction 3-2 3.1' Conservatisms and Limitations in SECY-83-293 1 ATWS Assessment '
3.2 SECY-83-293 Assessment Model Summary 3-7 4 Westinghouse Owners Group ATWS Model
- 4-1 4.0 Introduction 4-2 4.1 Fuel Management Impact 4.2 Accident Progression 4-3 4-5 ,
4.3 Event Tree Model 4-17 4.4 Success Criteria 4-17 4.5 Plant Damage State Classification 4.6 Unavailability Values for Event Tree Nodes 4-18 '
4-24 4.7 Results 5 ATWS Rule Administration Process ,
5-1 5.0 Introduction 5-1 5.1 Process Description 5.2 Event Tree Representation For Use With the Process 5-5 5.3 ATWS Core Damage Frequency Sensitivity cases 5-8 5-11 5.4 Evaluation Process 5-16 5.5 ATWS Core Damage Frequency Criteria 6 Conclusions 6.0 Summary 6-1 6-2 6.1 Conclusion
' 7-1 7 References Os26m lo/010989 i
Table of Contents (Continued)
Section Page Appendixes A ATWS Rule History and ATWS Rule Basis Background A.0 Introduction A-1 A.1 Summary of ATWS Rule Evolution A-1 A.2 Summary of SECY-83-293 Event Tree Assumptions A-5 B Event Tree Nodes Assumptions B.O Introduction B-1 B.1 Initiating Event Frequency (IE) B-1 B.2 Power Level Greater Than 40 Percent (PL) B-1 and Main Feedwater (MF)
B.3 Reactor Trip (RT) B-6 B.4 Manual Rod Insertion (MRI) B-8 B.5 ATWS Mitigating System Actuation Circuitry (AM) B-9 B.6 Auxiliary Feedwater (AF) B-10 B.7 Primary Pressure Relief (PR) B-12 B.B Long Term Shutdown (LTS) B-24 8.9 Containment Heat Removal (CHR) B-25 l
0536rlo/010989 ii
~
List of Tables Title Pace Table WOG and SECY-83-293 Model Comparison 4-10 4-1 4-23 4-2 PR Values for the Base Case 4-26 4-3 Base Case Event Tree Node Values 4-27 4-4 Results of Quantification for the Base Case !
Tabular Summary of ATWS Core Damage Sequences 5-6 5-1 ,
5-9 5-2 Results of Sensitivities PR Values for 24 Month Cycle Length Sensitivity 5-9 :
5-3 Summary of Data From WCAP-10405 B-2 B-1 .
Plant Specific Frequency of Transients B-4 B-2 ,
from WCAP-10405 B-20 B-3 UET Versus Cumulative Fraction of Transients in the UET Period ~(Transient Time) ,
List of Figures .
Title Pace Fioure WOG ATWS Event Tree 4-7 4-1 ATWS Rule Administration Process 5-2 .
5-1 SECY-83-293 ATWS Event Tree (Turbine Trip, With AMSAC) A-8 A-1 SECY-83-293 ATWS Event Tree (No Turbine Trip, A-9 A-2 With AMSAC)
ATWS Critical Power Trajectory, Loss of Load ATWS, B-26 B-1A 2 PORV Available,100% Aux. Feed ATWS Critical Power Trajectory, Loss of Load ATWS, B-27 5-1B e 1 PORV Available, 100% Aux. Feed ATWS Critical Power Trajectory, Loss of Load ATWS, B-28 B-1C 0 PORV Available, 100% Aux. Feed ATWS Critical Power Trajectory, Loss of Load ATWS, B-29 B-1D 2 PORV Available, 50% Aux. Feed
~
iii 0526x:1o/010989-
List of Figures (Continued)
Ficure Title Pace B-1E ATWS Critical Power Trajectory, Loss of Load ATWS, B-30 1 PORY Available, 50% Aux. Feed B-1F ATWS Critical Power Trajectory, Loss of Load ATWS, B-31 0 PORV Available, 50% Aux. Feed B-2A ATWS UET Evaluation for 18 and 24 Month Fuel Management, B-32 Loss of Load ATWS, 2 PORV Available, 100% Aux. Feed B-2B ATWS VET Evaluation for 18 and 24 Month Fuel Management, B-33 Loss of Load ATWS, 1 PORV.Available, 100% Aux. Feed B-2C ATWS UET Evaluation for 18 and 24 Month Fuel Management, B-34 Loss of Load ATWS, O PORV Available, 100% Aux. Feed B-2D ATWS UET Evaluation for 18 and 24 Month Fuel Management, B-35 Loss of Lead ATWS, 2 PORV Available, 50% Aux. Feed B-2E ATWS UET Evaluation for 18 and 24 Month Fuel Management, B-36 Loss of Load ATWS, 1 PORV Available, 50% Aux. Feed B-2F ATWS UET Evaluation for 18 and 24 Month Fuel Management, B-37 Loss of Load ATWS, O PORV Available, 50% Aux. Feed 0526x:1D/010989 iv
f SECTION 1 INTRODUCTION AND
SUMMARY
1.0 BACKGROUND
AND OBJECTIVES :
l
)
This report presents the results of a joint Westinghouse Owners Group (WOG) and Westinghouse program to quantify the frequency of core damage resulting l from Anticipated Transients Without Scram (ATWS) for Westinghouse pressurized water reactors (PWRs). The objectives of this program were to:
o document the important factors involved in assessing ATWS core damage frequency, o provide a method that can be used by licensees in evaluating the impact of changes on ATWS core damage frequency, o document the application of the ATWS Rule (10CFR50.62, reference 1) and basis (SECY-83-293, reference 2) for Westinghouse PWRs, o assure ATWS core damage criteria and approach compatibility with the ,
Severe Accident Policy (references 3, 4).
This report is intended to be the vehicle to address continued ATWS Rule and basis compliance for Westinghouse PWRs, and to provide a means to assess the effects of plant configuration, fuel management, and operation changes. This '
is accomplished by establishing a process for ATWS Rule administration for use by licensees in assessing the impact of changes in important parameters on 1 ATWS core damage frequency. The approach used is also consistent with the objectives of the NRC's Severe Accident Policy.
1.1 APPROACH The approach taken in this program is to provide a measure of ATWS core damage frecuency for Westinghouse 4] ants. This is then used to establish a process that can be used by WOG licensees to evaluate the effects on AIWS core damage 1
Os26x:1o/010989 l-1
frequency of plant changes and operating experience, within the framework of the ATWS Rule and in a manner compatible with the Severe Accident Policy.
The report summarizes the history of ATWS rulemaking, and the probabilistic framework upon which the ATWS Rule is based, as it applies to Westinghouse PWRs. The approach originally used to define ATWS core damage frequency for W:stinghouse PWRs is reviewed, and simplifying assumptions, conservatisms, and limitations are discussed.
The report then presents a more detailed probabilistic model for ATWS, using the same basic approach used in SECY-83-293. As in SECY-83-293, the model assumes that ATWS overpressure occurs if the pressure limit corresponding to the ASME Boiler and Pressure Vessel Code Level C service limit criterion (reference 6), which for Westinghouse plants has been conservatively defined as 3200 psig, is exceeded. Exceeding 3200 psig is further conservatively equated with core damage. The SECY-83-293 study used an ATWS " risk" target of 1x10
-5 per reactor year. In SECY-83-293, core damage was equated with public risk for the value/ impact assessment performed there, so the " risk" values actually correspond to core damage frequency. In this study, operation of containment systems, to mitigate the public risk consequences of an ATWS core damage event, is assumed. As a result, there is a distinction between core damage frequency and public risk. For this study, a target of 1x10 -5 has been used for ATWS core damage frequency, in a manner consistent with the Severe Accident Policy and with the event sequence modeling of SECY-83-293.
Consistent with previous ATWS analyses (reference 7), a reference plant approach (i.e., a typical Westinghouse 4-loop plant with 51-Series steam generators) was used in this report. Ranges of important parameters have been defined based on actual and anticipated operation. Results obtained using the model to assess the imoact of various plant parameters on ATWS core damage frequency are presented for the reference plant operating configuration.
Os26x lo/010989 l-2
The results have been compiled in a manner that allows a licensee to establish l This is accomplished by defining ranges i conformance with the ATWS Rule basis.
of values for parameters that have been identified as important contributors j
to ATWS core damage frequency, determining the actual contributions, and providing a method for assessing ATWS core damage frequency for the plant based on the values of these important parameters that apply to the plant.
The reasons for any large contributions will also be apparent from the sensitivities to important parameters. With this information, the licensee is able to evaluate the impact of plant and operation changes on ATWS core damage frequency, and evaluate alternatives for reducing predicted values.
1.2 REPORT ORGANIZATION The report is organized into this introduction and five main sections, with appendices to provide bases and explanations for the methods and values used.
Section 2 reviews the history of ATWS Rulemaking, documents the basis for the ATWS Rule as it applies to Westinghouse PWRs, and summarizes the criteria used in formulating the ATWS Rule. Section 3 briefly discusses the SECY-83-293 ATWS model, identifies simplifying conservatisms and limitations of that model, and establishes an updated framework, consistent with the SECY-83-293 model, for assessing the impact of fuel management and plant changes on ATWS contribution to core damage frequency. Section 4 presents the detailed core damage frequency model and assumptions developed as part of this program, identifies those parameters most important to ATWS core damage frequency, and presents ATWS results for the base case configuration. Section 5 presents an ATWS Rule administration process, and shows the sensitivity of ATWS core damage frequency to the important parameters for the reference Westinghouse PWR. Finally, Section 6 summarizes the report results and main conclusions.
1.3 CONCLUSION
S The results and conclusions of this program are summarized as follows.
o The ATWS Rule basisM SECY-83-293) is an aopropriate probabilistic framework.
0526x lo/010989 1-3
L .
l 1
o Evolutionary changes in the nuclear power industry have led to the need to establish continued compliance, o The SECY-83-293 framework considered all the major elements; the
! program described herein has expanded these elements to remove several model limitations and some overly conservative assumptions.
o A viable and effective administration process has been established that provides a basis for evaluation of plant configuration, fuel management, and operating experience, allowing Westinghouse Owners Group licensees to determine compliance with the ATWS Rule. The process is also compatible with the NRC's Severe Accident Policy.
The results indicate the dependence of ATWS core damage frequency on a number of important parameters related to plant design and operation. Using aggregate industry data for these parameters over ranges defined to address expected plant-to plant and year-to year variations, the results show that the ATWS core' damage frequency target and levels of risk reduction stated in SECY-83-293 for Westinghouse PWRs continue to be achieved.
0526x:1o/010989 1-4
.- - -. - -.=
L SECTION 2 ATWS RULE AND BASIS EVOLUTION
2.0 INTRODUCTION
The final ATWS Rule,10CFR50.62, became effective on July 26, 1984. ATWS had been the subject of a multitude of studies and regulatory activities since it was first raised as a potential safety issue in the late 1960s. A brief history of the significant events leading to the final ATWS Rule follows.
In October, 1973, the NRC Staff issued WASH-1270 (reference 5), which outlined the Staff's original requirements for ATWS protection. Because of the low expected frequency of ATWS occurrence, ATWS transient analyses use best estimate initial conditions and system parameters, and assume availability of control and protection systems except for reactor trip. Westinghouse '
responded to WASH-1270 with a series of ATWS studies (WCAP-8330, reference 8, WCAP-8440, reference 9, WCAP-8404, reference 10), which demonstrated acceptable results for Westinghouse PWRs, given the above conditions and the assumption of turbine trip and timely initiation of auxiliary feedwater flow.
The NRC later requested additional ATWS analyses, per the guidelines contained in NUREG-0460 (reference 11). In response to this request, Westinghouse provided additional information (reference 7) which again predicted acceptable results.
In 1980, the Staff recommended (reference 12) publication of a proposed rule to require design changes to reduce expected ATWS frequency and consequences.
Following this, in November 1981, three proposed approaches for dealing with ATWS were published by the NRC for public comment. These included the " Staff Rule" (reference 13), which emphasized individual reactor evaluations to identify improvements, the "Hendrie Rule" (reference 14), which emphasized reliability assurance, and would have req'uired hardware modifications, and the
" Utility Rule" (reference 15), which prescribed specific hardware additions and modifications keyed to.the type of reactor and its manufacturer.
0526a:1o/010989 2-1
In 1982, the NRC established a Task Force and Steering Group (per reference
- 16) to consider the various alternatives. The results of the Task Force evaluation were documented in SECY-83-293 (reference 2), and form the basis
-for the resulting ATWS Rule.
The SECY-83-293 evaluation included a value/ impact assessment of several ATWS options for each reactor vendor. Results of that assessment, for the PWR vendors (as taken from Table S-1 of reference 2), are summarized as follows:
Westinghouse Incremental Incremental Generic Option ATWS Risk /yr. Imoact (millions) Value/ Impact O. Base Case 3.7x10
-5 __ __
la. Diverse Auxiliary Feedwater Initia-tion / Turbine Trip (Utility Proposal) 5.8x10
-6
$2.8 3.3 lb. Diverse Scram System 5.3x10
-6 52.8 3.4 (DSS)
-5 __ __
- 1. Utility Proposal 2.2x10 -5 55.5 3.2
- 2. Safety Valves or Core Modification Plus Utility Proposal 7.2x10 -6 S10.0 0.44 l
l Note: In the above, the term Risk is used per SECY-83-293, but actually refers to the core damage frequency.
l t
0526m:10/010989 2-2
Based on the results of the SECY-83-293 value/ impact assessment, the Task Force recommended installation of AMSAC (ATWS Mitigating Systems Actuation Circuitry) for Westinghouse plants. The results also indicated that, for options with similar value/ impact ratios, ATWS core damage frequency, and therefore risk, for Westinghouse plants could be reduced further than for CE or B&W plants.
The final ATWS Rule (reference 1) was approved by the Commissioners on November 11, 1983, and became effective on July 26, 1984, when 10CFR50.62 was published in the Federal Register. The requirement for Westinghouse PWRs, as stated in 10CFR50.62, Paragraph (c)(1), is as follows:
"Each pressurized water reactor must have equipment from sensor output to final actuation device, that is diverse from the reactor trip system, to automatically initiate the auxiliary (or emergency) feedwater system and initiate a turbine trip under conditions indicative of an ATWS. This equipment must be designed to perform its function in a reliable manner and be independent (from sensor output to the final actuation device) from the existing reactor trip system."
For Westinghouse PWRs, this requirement is met by the installation of AMSAC.
AMSAC consists of equipment to trip the turbine and initiate auxiliary feedwater diverse from the reactor trip system. This requirement resulted from that proposed by the Utility Group on ATWS as discussed in detail in SECY-83-293 (reference 2). For Westinghouse plants, the AMSAC requirement can be met in several ways. The NRC has reviewed three AMSAC concepts presented in WCAP-10858, Revision 1 (reference 17) and approved their use on a generic basis. SECY-83-293 contains the NRC ATWS Task Force's analysis and conclusions that form the basis of the ATWS Rule. Several relevant points of this document are discussed in Appendix A.
~
0 cs2srto/aiosas 2-3
2.1 IMPORTANT POINTS OF SECY-83-293 AS APPLIED TO WESTINGHOUSE PWRS 1
The following important points regarding SECY-83-293 and the final ATWS Rule are deemed to be significant.
3
- 1. The objective of the ATWS Rule was to reduce the risk from ATWS events to an acceptable level. This is accomplished for Westinghouse reactors by the installation of AMSAC as demonstrated by the SECY-83-293 results.
These results show that with the addition of AMSAC for Westinghouse plants, the core damage frequency due to ATWS events is reduced to the target goal of no more than 1x10 -5 /yr.
The core damage frequency predicted for Westinghouse PWRs with AMSAC in the SECY-83-293 assessnent is lower than that for other PWR vendors with the installation of both
-5 AMSAC and DSS (e.g., 2.2x10 /yr., per reference 2).
- 2. The only requirement of the ATWS Rule for Westinghouse reactors is the installation of AMSAC. The acceptability of specific plant conditions as '
related to the ATWS events is determined within the context of total ATWS core damage frequency, per SECY-83-293.
- 3. Implementation of the prescriptive rule was, in part, based on avoiding.
the requirement of extensive individual case analyses by licensees and the Staff. In addition, it was the judgement of the Staff as stated during the Commission briefing on SECY-83-293 on August 3, 1983, that ATWS need net be a design basis accident (reference 18).
The information summarized here provides some insight into the events leading I
to the ATWS Rule. The following section of this report examines the ATWS core damage frequency / risk framework for Westinghouse PWRs as defined in SECY-83-293, in light of changing fuel management and plant operations.
Os26x.lo/010989 2-4
SECTION 3 SECY-83-293 ATWS PROBABILISTIC ANALYSIS
3.0 INTRODUCTION
In developing the Final ATWS Rule, which is based on value/ impact assessment and keyed to NSSS vendor type, the NRC Task Force used simplified models and information applicable to all PWR vender designs for determining ATWS risk (impact). However, use of these simplified models and plant operation assumptions impose conservatisms and limitations which impair application of current information when attempting to appropriately reassess ATWS risk for Westinghouse PWRs.
SECY-83-293 was prepared with models intended to cover all PWR vendors, and with assumptions consistent with then-current operating experience. Since SECY-83-293 was prepared, a number of industry-driven changes in plant operation and fuel management have evolved. These changes, some of which affect important parameters which contribute to ATWS core damage frequency, are driven by economic and safety related considerations. Some provide ATWS core damage frequency benefits, while others impose penalties. Recent industry programs highlight the need to develop a more detailed probabilistic approach, based on the framework of SECY-83-293, that assures continued compatibility with the ATWS Rule and basis conclusions to assess ATWS core I
damage frequency and risk.
In this section, a number of the simplifying conservatisms and limitations of i SECY-83-293 are identified, and their impact discussed. Examples of these are initiating event frequency, modeling of pressure relief and auxiliary feedwater, anc operator actions. Additional information is provided regarding parameters important to ATWS core damage frequency where necessary.
With the information identified in this section, the framework presented in SECY-83-293 for assessing ATWS core damage frequency is expanded and updated in Section 4 of this report 40 more clearly identify imoortant parameters. A orocess for implementatio.i using this framework is then presented in Section 5. l l
0526rl o/010989 .
3-1
3.1 CONSERVATISMS AND LIMITATIONS IN SECY-83-293 ATWS ASSESSMENT The ATWS assessment described in SECY-83-293, anci used to estimate the frequency of core damage due to ATWS events (Patws), includes simplifying assumptions that significantly affect the predicted ATWS core damage frequency for Westinghouse PWRs. Such simplifying assumptions may have been deemed necessary for the ATWS Task Force's evaluation of options for addressing ATWS, and, to some extent, reflect the state of information available at the time the Task Force conducted its study. However, they significa.aly overstate ATWS core damage frequency. The remainder of this section will focus on the modeling conservatisms and limitations of the SECY-83-293 assessment.
i 3.1.1 SECY-83-293 Probabilistic Assessment Conservatisms The ATWS analyses for Westinghouse PWRs (reference 7) establish that the limiting events, in terms of peak RCS pressure, are the loss of load (turbine trip) with subsequent loss of all main feedwater and the complete loss of I normal feedwater (non-turbine trip) events. These limiting ATWS events are both assumed to be initiated from normal operation at full power conditions.
For simplicity, the SECY-83-293 assessment conservatively treats all initiating transients for Westinghouse PWRs as either a turbine trip or non-turbine trip (i.e., loss of feedwater). The SECY-83-293 assessment utilizes two very similar event trees to assess the ATWS risk for Westinghouse plants with AMSAC: one for the initiating events classified as turbine trips, and the second for the non-turbine trip events. (These event trees are repeated in Appendix A of this report as Figures A-1 and A-2. The event trees used for the cases without AMSAC, and with other options, were essentially the same as these, but included several different failure probabilities and success criteria,) This treatment is overly conservative since only a fraction of events are actually events of this type initiated from full power.
An underlying premise of the SECY-83-293 study is that core damage will occur any time the reactor coolant system pressure exceeds 3200 psig, which has been selected as a conservative bound of the ASME Boiler and Pressure Vessel Code Level C service limit criterion (reference 6) for Westinghouse PWRs. This 0526n.1o/010989 3-2
assumption is conservative since there are sets of conditions for which this stress limit could be withstood without causing severe loss of reactor coolant system integrity and resultant core damage.
In addition, failure of the reactor coolant system, given a pressure above 3200 psig, could enable successful operation of the emergency core cooling system with subsequent long-term shutdown of the core.
Further, the value/ impact assessment performed for SECY-83-293 assumed that any core damage directly equates to public risk (i.e., a maximum offsite radiation exposure due to ATWS was assumed and assigned to the total ATWS core damage frequency). This assumption ignores the ability of containment systems to mitigate the severity of most releases. Results of PRA studies performed for PWRs (e.g., references 19, 20) demonstrate that offsite radiation exposure For ATWS events, the risk is significantly lower than core damage frequency.
frequency of significant releases from the plant is typically predicted to be at least three orders of magnitude lower than the core damage frequency.
3.1.2 SECY-83-293 Assessment Model Limitations The SECY-83-293 ATWS model contains simplifications made in order to allow the Task Force to apply a single probabilistic model to a diverse set of PWR vendor designs. In utilizing a simplified event tree model that would provide an estimate of ATWS core damage frequency, the Task Force-did not explicitly consider certain design features and operator actions that would be expected to reduce the frequency of core damage due to an ATWS.
The following discussion on SECY-83-293 assessment model limitations is A summary of the organized by event tree node identifier from SECY-83-293.
definitions of the SECY-83-293 event tree top events, success criteria, and failure probabilities for Westinghouse PWRs is presented in Appendix A of this report.
~
Os26x:1D/010989 3-3
These top events are:
o Number of Transients o
Failure to Scram (Electrical and Mechanical) o MTC Overpressure o Auxiliary Feedwater System Reliability o High Pressure Injection Number of Transients The SECY-83-293 evaluation assumed that there would be four significant transients per year, and that 70% of these (2.8 events / year) would involve turbine trip with bypass to the condenser available. The remaining 30% (1.2 events / year) were conservatively treated as loss of normal feedwater events.
Since the SECY-83-293 study was conducted, there have been concerted efforts within the industry to reduce the average number of transients. The Wastinghouse Owners Group sponsored Trip Reduction and Assessment Program (TRAP) has resulted in a documented reduction in the average' number of transient's experienced per year by Westinghouse PWRs (reference 21) as a result of a number of factors, including increased operating experience and awareness, improved training and procedures, and protection system simplifications. A reduction in the number of transients experienced by Westinghouse plants has the effect of reducing the ATWS core damage frequency for those plants, by directly reducing the number of reactor trip demands on the reactor protection system. A more detailed review of initiating event data applicable to ATWS analysis is presented in Section 4 and Appendix B of this report.
l Failure to Scram i
Operator initiation of manual shutdown for an ATWS event is not directly addressed, and this is both a conservatism and a limitation. The time available for the operator to manually shut down the reactor (either by j trip;ing the rods or by using the rod control system to drive in the rods), is Os25s.lo/010989 3-4
relatively short for the worst transients (e.g., on the order of one or two However, if such an event minutes for a loss of normal feedwater ATWS).
occurred, the operator would receive a substantial amount of information (e.g., alarms and annunciators) which, given normal operator training and experience, would require a check for reactor trip and then an attempt to initiate one, per plant operating procedures, within a very short period of time.
Detailed operator training and abnormal and emergency response procedures exist to diagnose and expeditiously take action for mitigation and recovery from loss of heat sink and ATWS events. Operators are given extensive training on reactor simulators to prepare them for all types of anticipated events, including ATWS. These factors support the expectation that a reactor operator will almost instinctively respond to an anticipated transient, such as a loss of heat sink, by checking for, and if necessary, taking rapid action to initiate, reactor shutdown.
SECY-83-293 modeled separate electrical and mechanical failures of the reactor protection system (RPS). As the number of cumulative operating years In increases there may be an increase in random failures of RPS components.
particular, reactor trip breaker reliability is an important parameter.
However, reliability studies of the Westinghouse RPS (reference 22) have shown that common-mode failure assumptions, which are more subject to modeling uncertainty than are random failures, dominate RPS unavailability.
Thus, a more realistic estimate of Patws is btained if some allowance is made for manual reactor trip or rod insertion. For cases where failure to scram was due to common-cause mechanical faults (e.g., multiple stuck RCCA banks), there would of course be a much lower, and perhaps zero, probability of success for a manual action, but-the probability of occurrence of such Further, Westinghouse faults is low relative to that of electrical faults.
plants have not experienced multiple stuck RCCA banks, and the insertion of only one RCCA bank adds sufficient reactivity to preclude peak RCS pressure 3-5 Os26s:1o/010989
1 concerns during the limiting ATWS events. It is important to model both system failures and operator response in assessing failure to scram contribution to ATWS core damage frequency.
MTC Overoressure For limiting transient event types and conditions for which peak RCS pressures could be of concern during an ATWS event, the occurrence of overpressure is a function of core reactivity feedback (defect), pressure relief capacity, time in core life when the transient occurs, and type of transient. The MTC Overpressure node in SECY-83-293 is limited in that it explicitly addresses only the differential reactivity (MTC) feedback from the coolant. '
RCS pressure relief capacity includes availability of the pressurizer power operated relief valves (PORVs) and safety valves (SV.s) and is a significant factor in assessing the predicted peak RCS pressure for ATWS events. The effects of PORV availability during operation, as well as random failure unavailabilities of both the PORVs and SVs, need to be considered in the ATWS event tree model.
By not explicitly modeling the interrelated dependencies of core reactivity <
fsedback, pressure relief capacity, time in core life when the transient occurs, and type of transient, the SECY-83-293 analysis shows "MTC i Overpressure" to be one of the dominant contributors to ATWS core damage frequency, and stresses MTC rather than pressure relief capability. .
Auxiliary Feedwater System Reliability '
The availability of auxiliary feedwater has a significant effect on the severity of ATWS overpressure transients. Therefore, it is important to '
consider auxiliary feedwater availability for both mitigation of unacceptable RCS pressure conditions during an ATWS transient and for long-term heat removal. The SECY-83-293 event tree model considers availability of auxiliary ,
l l
l Os26a:1o/010989 3-6 .
(-
l l.
l
feedwater in providing long-term cooling to prevent core damage for most ATWS events and, for simplicity, the Task Force event trees model long-term cooling only via auxiliary feedwater.
With AMSAC, the reliability of auxiliary feedwater initiation is improved, and both AMSAC and auxiliary feedwater functions should be explicitly modeled on the event tree.
High Pressure Injection If the peak RCS pressure has not exceeded the stress criterion early in the transient, there are several means available to bring the reactor to a suberitical state and maintain the shutdown condition. These include manual trip of the reactor trip breaker motor generator sets, manual insertion of all rod banks, boration of the RCS using the Chemical and Volume Control System or high-head charging pumps. [ Operation of High Pressure Injection is required to achieve injection of borated water into the core. For the Task Force model, it was assumed that the auxiliary feedwater system must operate to lower the pressure sufficiently so that high pressure injection could occur.
No credit was taken for potential boration via the Chemical and Volume Control System (CVCS) because it was assur.ed that manual actions would be required and the resulting failure probability would be relatively high. Thus, the term High Pressure Injection as used in this model really refers to the Safety injection System.) Although operator actions are required, there would be sufficient time to complete these operator actions, in a manner consistent with plant operating procedures and operator training.
3.2 SECY-83-293 ASSESSMENT MODEL
SUMMARY
i l
Several simplifying conservatisms and limitations of the SECY-83-293 model have been identified. These conservatisms and limitations in the SECY-83-293 model exist primarily as a result of simplifications made to assess ATWS core .
0526a:1o/010989 3-7
. i l
> damage frequency keyed to NSSS vendor type and to perform this assessment-on a '
consistent basis. The conservatisms and limitations identified are summarized !
as follows i
o All ATWS initiating events considered are conservatively assumed to be either a loss of load (turbine trip) or a loss of normal feedwater-(non-turbine trip) event, initiated from normal operation at full
A conservative bound of the ASME Boiler and Pressure Vessel Code Level C service limit criterion of 3200 psig is assumed for Westinghouse PWRs and exceeding this criterion is equated with core damage. These assumptions are conservative since there are sets of conditions for which this stress limit could be withstood without causing severe loss :
of reactor coolant system integrity which would result in core damage.
1 o Core damage is :enservatively assumed to always result in release of
- radioactivity from the containment. This ignores the ability of containment systems to mitigate the sev'erity of most releases.
o No credit is allowed for short-term operator action to manually insert control rods to mitigate the transient.
l \
o Modeling of overpressure mitigation capability places an overemphasis l on the MTC Overpressure node, rather than on an explicit combination
! of effects of core reactivity feedback, pressure relieving capacity, and, initiating event type.
o The effects of auxiliary feedwater availability on peak RCS pressure !
are not considered. Auxiliary feedwater availability is only '
considered with respect to long term cooling.
o The ability of the operator to initiate alternate long-term shutdown cotions is not considered.
t 0336m:lo/010989 3-8
1 I
1 To use the framework of that developed by the Task Force in SECY-83-293 for dppropriately assessing ATWS core damage frequency for Westinghouse PWRs based i
on current information and potential future operating conditions requires the use of a more detailed event tree model to address conservatisms and limitations of the existing model. These changes are warranted to allow consideration for important plant parameters that are truly of importance to l
ATWS core damage frequency. The development and assessment of a more detailed event tree model is presented in the following section. ,
i l
l l
l
~
0526x.1D/010989 3-9
SECTION 4 WESTINGHOUSE OWNERS GROUP ATWS MODEL
4.0 INTRODUCTION
ATWS, as modeled in SECY-83-293, was based on analyses and data consistent with pre-1979 NRC and industry assessments and operating philosophy. This section provides a model, data, and quantitative results consistent with current operating conditions for Westinghouse NSSS designs and incorporates an improved understanding of ATWS transient progression and risk related phenomena. The same areas as addressed in the SECY-83-293 models are included and expanded in this assessment. A discussion of the quantitative results is provided to identify the important features of the model and the dominant accident sequences. The objective of these analyses is to demonstrcte that Westinghouse plants continue to meet the letter and the intent of the ATWS basis in SECY-83-293 assuming currently adverse plant configuration and reactor feedback conditions.
~
The description and unavailabilities of systems and components used in the event tree model are consistent with the reference plant used in the ATWS transient analysis submittal (reference 7). The reference plant features were chosen to encompass as many plant designs as possible while still providing a basis for predicting performance of typical Westinghouse NSSS designs. This reference plant is a four-loop plant with:
o model 51 steam generators o two motor-driven auxiliary feedwater pumps and one turbine-driven auxiliary feedwater pump o two pressurizer power-operated relief valves (PORVs) and three pressurizer safety relief valves o high pressure safety injection or charging pumps.
l l
An 18 month core design is modeled and cuantified as the base case.
s Os26r1D/010989 4-1
4.1 FUEL MANAGEMENT IMPACT Core damage resulting from ATWS is dependent upon factors dealing with certain plant parameters and configurations and with the interaction of these with reactivity feedback. PWRs exhibit an inherent shutdown characteristic during a heatup (referred to here as heatup shutdown), in that reactivity (or reactor power) is reduced for a sustained coolant heatup. The magnitude of the negative reactivity inserted during a heatup is a function of fuel enrichment, burnup, loading arrangement, burnable absorber design and exposure, and soluble shim concentration. Limiting ATWS events which result in high RCS pressures are exclusively heatup events resulting from the degradation of the heat transfer capability between the primary and secondary system. The magnitude of the heatup, and therefore pressure transient, is determined by the ability to maintain primary to secondary system heat transfer, the primary pressure relief capacity, and the inherent shutdown characteristics of the reactor.
Coolant temperature feedback is an inherent component of PWR feedback in that it affects both prompt fuel temperature (always negative) and coolant /
moderator density. Coolant temperature feedback depends on the non-linear density versus temperature and pressure properties of water, optimal moderation phenomena, and the presence of the soluble shim. Coolant temperature feedback, in the absence of soluble shim, is always negative since light water is a more effective moderator than absorber. The presence of an absorbing chemical shim tends to diminish this characteristic over small range of density near optimum moderation. PWR fuel lattice design is dictated largely by optimum moderation at operating coolant conditions for economic, fuel utilization, and waste disposal reasons. It is important to note that, in the limit, all PWRs are inherently heatup shutdown limited because the endstate heatup condition is characterized by reduced water density due to the j presence of voids which cannot provide any significant moderation to sustain criticality. That is, while locally positive coolant temperatt.re feedback may exist in PWRs, all temperature (or void) defects are negative in the limit and thus, PWRs are inherently heatup self limiting.
Os26x.1o/010989 4-2
i 1
The interactions of increases in coolant temperature on reactivity feedback (and hence, peak pressure) during an ATWS event demand that an integrated approach, which considers the composite of all such effects, be utilized for evaluation of the impact of reactivity feedback on the frequency of ATWS core damage. The ATWS induced system heatup transient in the Westinghouse PWR is essentially a quasi-steady state nuclear transient where reactor power, and to a large extent peak pressure, is determined by the reactivity defect balance of reactor power, coolant temperature, and coolant density distribution effects. Details of the specific methodology to derive heatup and shutdown characteristics, or " critical power trajectories", are presented in Appendix B. (The critical power trajectory is defined as the locus of conditions that result in a peak pressure of 3200 psig in the transient analysis of the limiting ATWS event for the reference plant configuration.)
4.2 ACCIDENT PROGRESSION An ATWS event is composed of two different events; the first is an anticipated transient generating a reactor trip signal and the second is the failure to insert the rod cluster control assemblies into the core followiftg the reactor trip demand. The anticipated transient initiating events are subdivided into categories based on the severity of the pressure transient that results without reactor scram as described in the following paragraphs.
For events initiated from power levels less than 40 percent, the peak pressure attained in the primary system is not predicted to exceed the allowable stress level of components in the Reactor Coolant System (RCS) regardless of the initiating event. Below 40 percent power, AMSAC is not needed to mitigate the consequences of an ATWS event (reference 17).
For events initiated from pow.<r levels greater than 40 percent, two categories are defined based on main feedwater availability: those events with at least one main feedwater pump available throughout the transient, and those with main feedwater unavailable.
Os26x.lo/010989 4-3 l
For ATWS events with main feedwater available, a less severe power mismatch between heat source and sink results and the peak pressure attained in the primary system will not exceed the ASME Level C service limit bound for components in the RCS. This is supported by results from previous ATWS analyses (reference 7) that demonstrate that the initiation of auxiliary feedwater in lieu of main feedwater availability (i.e., AMSAC) is sufficient to preclude overpressurization of the RCS, given the availability of adequate pressure relief.
With the loss of main feedwater, a large imbalance in the t.aat source / sink relationship results when feedwater flow to the steam generators is terminated. This imbalance results in a degradation in the heat transfer between the primary and secondary system which in turn results in a primary system heatup. This heat buildup in the primary system is indicated by rising reactor coolant system temperature and pressure, and by increasing pressurizer water level due to the insurge of expanding reactor coolant.
Water level in the steam generators will drop as the remaining water in the secondary system, unreplenished by main feedwater flow, is boiled off. When the steam generator water level falls to the point where the steam generator tubes are exposed, primary-to-secondary system heat transfer is further reduced. Reactor coolant temperature and pressure would continue increasing as the pressurizer fills and releases water through the PORVs and safety valves. The peak pressure attained in the primary system would depend upon the ability of the PORVs and safety valves to release the reactor coolant volumetric insurge into the pressurizer. The volumetric relief capacities of these valves is reduced when the pressurizer fills and water is passed instead of steam. During an ATWS, the heat source and sink mismatch cause the reactor coolant temperature and coolant expansion rate to increase.
Depending on reactivity feedback conditions, these changes in coolant conditions cause core power to be reduced. In addition, if the reactor were in the automatic rod control mode, control rods would automatically begin to be inserted as the primary heatup began, reducing power and thus, preventing RCS overcressurization.
0526x:1o/010989 4-4
i 1
l l \
l l
There are several mechanisms by which a plant may be shut down following an ATWS event. Plant procedures (e.g. reference 23) instruct the operator to initiate a manual trip. A manual reactor trip signal is processed both I If this directly to the trip breakers and through the protection logic.
action should fail to deenergize the control rod drive mechanisms, the The operator is then operator is instructed to manually insert the rods.
instructed to verify or manually trip the turbine, verify auxiliary feedwater actuation and initiate emergency boration of the RCS.
If standard boration is used, borated water is supplied through the Chemical and Volume Control System (CVCS). If safety injection is used, borated water is supplied from the Refueling Water Storage Tank (RWST) through the high head safety injection charging pumps. Emergency boration will only be successful if the RCS pressure is balow charging or high head safety injection pump cutoff pressures, typically between 1500 and 2600 psi.
If reactor trip still has not occurred, an operator is dispatched to locally trip the control rod power at the motor generator set supply breakers to trip the reactor. If the breakers are tripped, the shutdown and control banks drop into the core, inserting sufficient negative reactivity to shut down the plant. Should any one of these actions succeed, the operator would be able to proceed with normdl plant procedures for plant shutdown.
I 4.3 EVENT TREE MODEL ATWS events encompass a wide spectrum of initiating events and ensuing plant transient progressions. The ATWS analyses for Westinghouse PWRs (reference 7) establish that the limiting events, in terms of peak RCS pressure approaching or exceedi g ASME Service Level C limits, are the loss of load with subsequent less of all main feedwater, and the complete loss of normal feedwater events.
These limiting ATWS events are both assumed to be initiated from normal operation at full power conditions. If favorable reactivity feedback a conditions exist, the reactor core is expected to shut down prior to re the camage following any anticipated transient without reactor scram pro a er. l turbine trips and auxiliary feedwater flow is initiatec in a timely no l 4-5 0526m:1o/010989 !
I
l l
However, if unfavorable reactivity feedback conditions exist, there is the possibility that allowable component stress limits could be exceeded, with resultant possible loss of reactor coolant system integrity which could lead to core damage.
Consistent with previous assessments, it is conservatively assumed that core damage will result if any one of the following occur during an ATWS transient:
aximum RCS pressure exceeds the pressure limit corresponding to the-ASME Boiler and Pressure Vessel Code Level C service limit stress criterion (reference 6), which for Westinghouse plants has been conservatively defined as 3200 psig.
- 2. RCS heat . oval function is inadequate (either before or after the core is brought suberitical).
- 3. The operator fails to initiate activities to achieve suberiticality within approximately 10 minutes.
An event tree e gure 4-1) was constructed to model the accident progression of anticipated transient events that could lead to an ATWS condition. The event tree structure is subdivided into the following subtrees to model the following conditions that include all anticipated transients, except transients caused by automatic or manual reactor trips.
- 1. The reactor is either automatically or manually scrammed. The accident progression is not modeled and the event tree path is designated as "NOATWS".
0326rlo/010989 4-6 i
i Figure 4-1 l WOG ATWS EVENT TREE
(
ME M PR LT3 Oft E RT PL W IN AM !
1ICATV3 ,.
t REXE3 i 3 TEC I
i 4 TE 5 TEE I
' 6 TE 7 suctE3 8 TEC I
' 9 TE la SEXE!
11 TEC I
' 12 TE 13 TEC I
' 14 TC 15 ELEXE3 la TEC I
' 17 TE '
J' $$ TE r
19 TE I
B TEC -
r
' DE j 24 SuctE3 I
5 TEC
' N TE E7 TEC
- I
- N TE 29 SuttE3 '
30 TEC ,
I -
' 3 TE M TEC I
' 33 TE ,
34 TEC ;
i t
' W TE ,
36 TEC I
' 37 TE .
f Elf 10 tytNY Trit A884tVIAi!ONS t f
UIE} UIE M UM M l
tre arws tAety cost annast wifw cout.wt. eta it .Tuttisttus tvtwT erwi (Aalf CORE DAMAGE Ws0 Conf.Mt.Rtu. '
- f 8tACf0s felt it upafws inan5!tui WItu et fatt tuom.atwse PL P0 wit LettL e 80% !
per malm f((0 SUCC(5 $UCC155 Patu FOR ATwi (Vtaf ,
- 81 RANUAL RbN5tRf!ON )
AN AMAC AFI FULL Past!AUI!LIAff f(tewaf(R AL aus. Fttpuatta af Pt 7t[550t( B(L1ty '
LT5 LOmr 1[98 Suyf00hel CNR COMfAIMMt#1 MtAf efuCVAl i t
4-7 0536x:10/101388 r
l 1
- 3. The reactor is not scrammed, initial power is greater than 40 percent and main feedwater is available to the steam generators.
- 4. The reactor is not scrammed, initial power level is greater than 40 percent, main feedwater is not available, but the operator successfully initiates manual rod insertion of one control rod bank for at least one minute prior to the peak pressure predicted for the limiting transient in previous ATWS submittals (reference 7).
- 5. The reactor is not scrammed, initial power is greater than 40 percent, main feedwater is not available and no control rod insertion is accomplished.
This structure allows an evaluation of ATWS events, including transients with main feedwater available and transients initiated at initial power levels less than 40 percent.
The lower paths of each event tree node indicate failure and the upper paths of each event tree node indicate success, except where noted. Letter ,
identifiers (underlined) are assigned for each event tree node as follows. .
l The event tree nodes are:
IE -
Initiating Event 4 RT -
Reactor Trip PL -
Dower Level greater than 40 percent (lower path)
MF - Main Feedwater MRI - Manual Rod Insertion by operator AM -
ATWS Mitigating System Actuation Circuitry AF2 - Auxiliary Feedwater (100% flow)
AF -
Auxiliary Feedwater (50% flow)
PR - Pressure Relief LTS - L_onger Term Shutdown of reactor CHR - Containment H_ eat R_emoval 0326a:1D/010989
The correlation between this event tree model and the model presented in SECY-83-293 is summarized in Table 4-1.
Consistent with the SECY-83-293 analysis model, the WOG model addresses the same basic elements. In the WOG model, however, a number of the limitations of the SECY-83-293 model are explicitly treated.
For example, the WOG event tree includes nodes PL and MF, which are not included in the SECY-83-293 event tree, in order to explicitly treat initial power level at initiation of the transient (via PL) and the availability of main feedwater (via MF). The WOG model takes appropriate credit for manual rod insertion (MRI) and the potential for the operator to manually scram the reactor, which are not credited in the SECY-83-293 model.
AMSAC is also explicitly addressed in the WOG event tree model, in conjunction with the recognition that auxiliary feedwater flow can have an effect early in the transient as well as long-term. The SECY-83-293 model assumes that an auxiliary feedwater flow actuation signal is generated by AMSAC, but AMSAC unavailability is not addressed. Containment heat removal capability of Westinghouse plants is not addressed (or credited) in the SECY-83-293 assessment, which, in its value/ impact evaluation equates core damage with release of radioactivity from the containment; it is included in the WOG model to estimate the expected split between release and non-release sequences.
The fellowing subsections provide a summary description of each of the event tree nodes. Detailed information on each node is provided in Appendix B.
4.3.1 Initiatina Event (IE)
This event tree node is the frequency (per Reactor year) of anticipated transients that could lead to an ATWS event.
~
l l
0526n lo/010989 4-9
Table 4-1 ,
i WOG and SECY-83-293 Model Comparison l
1 I
SECY-83-293 Model Node WOG Model Node AT (Number of Transients) IE - Initiating Event RPS Elect / Mech RT - Reactor Trip ,
AutomaYic Manual (Treats only full power events via PL - Power Level event tree) ;
(Treats only events with loss of MF - Main Feedwater
- ~
main feedwater via event tree)
(Not credited in analysis) MRI- Manual Rod Insertion by operator t (Addressed via adjustment in Auxiliary AM - ATWS Mitigating System feedwater node) ActuaYion Circuitry (Full / partial auxiliary feedwater AF2- Auxiliary Feedwater (100%
effects not addressed) Tiow)
AFWSReliability AF - Auxiliary Feedwater (partial (for long-term shutdown only) Tiow for ATWS events, long i term heat removal for all events)
MTC Overpressure. PR - Pressure Relief (including effects of reactivity feedback, pressure relieving <
devices, and time in cycle)
HPI (High Pressure Injection) LTS- Long Term Shutdown of reactor (No distinction between core damage CHR - Containment Heat Removal categories) l 0526x:1o/010989 4-10
4.3.2 R_e_ actor Trio (RT)
Success of this event tree node requires generation of a reactor trip signal and either automatic insertion of the control rods by the Reactor Protection System (RPS) or an operator initiated manual trip action.
Unavailability of the RPS logic, reactor trip breakers, or RCCAs to move will cause the failure of the RPS to trip the reactor. If the reactor is not tripped, plant procedures instruct the operator to manually trip the reactor.
The manual trip function operates through the shunt coil to the trip breakers. If the reactor trip unavailability is not related to the trip breakers or RCCAs, then manual scram through the shunt coil is possible.
Therefore, the probability that the manual scram is successful is included with the success of automatic reactor trip. Reliability of the RPS has been assessed by the Westinghouse Owners Group as detailed in WCAP-10271 (reference 22) and accepted by the NRC. Failure of both the undervoltage coil and the shunt coil are included in the unavailability of the automatic reactor trip signal. In this assessment (reference 22), common cause failure of the reactor trip breakers dominate (90 percent) the unavailability of the automatic trip function. Thus, manual scram which trips these breakers would have minimal benefit.
4.3.3 Power Level Greater than 40 percent (PL)
This event tree node represents the fraction of transients that occur above an initial power level of 40 percent (downward path) and those that occur below an initial power level of 40 percent (upward path). Anticipated transients (including loss of main feedwater) occurring from an initial power less than i I
70 percent will not result in RCS pressures greater than that corresponding to the ASME Level C service criterion, but the transients are conservatively divided at 40 percent power because AMSAC will be activated at initial power levels of 40 percent. However, consistent with AMSAC design (reference 17),
l for ATWS events initiated from below 40 percent power , AMSAC actuation of auxiliary feecwater flow and turbine trip is not required to mitigate the consecuences of the event.
0526mlo/010989 4-11
4.3.4 Main Feedwater (MF)
This event tree node addresses transients with initial power levels greater than 40 percent and is the probability that main feedwater will not be available after initiation of the event (downward path). For ATWS events where main feedwater is available (regardless of power level at initiation of the event), the peak RCS pressure will not exceed 3200 psig. For ATWS events initiated at or above 40 percent initial power, loss of main feedwater could result in RCS pressure exceeding 3200 psig, depending on reactivity feedback and available primary system pressure relief capacity. If an ATWS occurs at initial power levels greater than 40 percent, main feedwater to the steam -
generators will prevent overpressure of the RCS. For ATWS events initiating from less than 40 percent initial power, main feedwater availability is not required to preclude RCS peak pressures from reaching 3200 psig as discussed in Section 4.2. The auxiliary feedwater system can provide sufficient feed to the steam generators to prevent RCS overpressure. To simplify the event tree, main feedwater availability is not addressed for ATWS events initiated from less than, 40 percent initial power.
4.3.5 Manual Rod Insertion (MRI)
This event tree node is addressed for the fraction of transients with loss of main feedwater and initial power levels greater than 40 percent and models operator manual rod insertion, if both automatic and manual scram fails.
Plant procedures will instruct the operator to step the control rods into the core, if the control rods are not in the automatic mode. If there is no mechanical failure associated with the control rods, one minute of RCCA bank insertion at the nominal rate is expected before the peak RCS pressure occurs, inserting negative reactivity. Success of this node reduces the amount of reactivity feedback necessary to mitigate the ATWS event.
4.3.6 ATWS Miticatino System Actuation Circuitry (AM)
This event tree noce addresses the availability of AMSAC which is to be installec in Westingnouse designec plants as a result .cf the final ATWS Rule.
0526m:1 o/0109E9 4-12
i If the reactor fails to scram, AMSAC provides two functions: turbine trip and auxiliary feedwater flow actuation. Tripping the turbine early in an ATWS l loss of feedwater event causes a rapid reduction in steam flow out of the steam generator, and resultant rapid increase in steam pressure to the steamline safety valve set pressure. Turbine trip extends steam generator inventory and results in an increase in core coolant temperature. The increase in coolant temperature causes a decrease in core power, early in the Later, as transient before steam generator tubes have begun to be encovered.
steam generator tubes begin to uncover, the rate of increase in RCS temperature (and peak RCS pressure) is lower because it started at a lower core power level. AMSAC is actuated if an ATWS event is initiated at or above an initial power level of 40 percent. Normally the RPS would actuate turbine trip and auxiliary feedwater flow before the conditions that cause AMSAC actuation of these features are reached. However, if a common mode failure in the RPS were to fai.1 to initiate auxiliary feedwater flow or turbine trip in addition to prohibiting a reactor trip, then AMSAC is an alternative method of providing auxiliary feedwater flow and turbine trip.
Three alternate AMSAC designs have been approved by the NRC for installation in Westinghouse plants (reference 17). All three alternates activate on loss of main feedwater flow, but the means to sense the loss is different. The first will activate on low steam generator level, the second will activate on low main feedwater flow and the third will activate on main feedwater pump trip or main feedwater valve closure (e.g. pumps and valve status). As stated in Section 4.3.2, the RPS failures are dominated by reactor trip breaker failures rather than actuation logic, so that RPS failures do not significantly affect actuation of auxiliary feedwater. However, in this evaluation, no credit is given for actuation of auxiliary feedwater by the low steam generator level signal or for manual actuation of auxiliary feedwater j for ATWS events initiated at or above initial power levels of 40 percent.
Os2Sx:1c/010989 4-13
4.3.7 Auxiliary Feedwater System (AF)
This event tree node addresses the availability of the auxiliary feedwater ,
system if the main feedwater system is not available. The auxiliary feedwater l
system must remove heat from the RCS to prevent core damage. l Three success criteria are mode' Mr the auxiliary feedwater system depending upon the ATWS condition.
- 1. Following an ATWS event with initial power level less than 40 percent, one auxiliary feedwater pump must deliver flow to the steam generators (AF).
- 2. If reactor trip fails and the power level is greater than 40 percent, the success of auxiliary feedwater is partitioned into two availability conditions:
(a) All auxiliary feedwater flow is available (100 percent flow): 2 motor driven auxiliary feedwater pumps and the turbine-driven auxiliary pump deliver flow to the steam generators (AF2) or (b) Either two motor-driven auxiliary feedwater pumps or the turbine-driven auxiliary feedwater pump deliver 50 percent of the total available flow to the steam generators (AF1, which is the AF branch for sequences above 40% power).
The amount of auxiliary feedwater flow changes the allowable critical power trajectory and thus, has a direct impact on the pressure relief node.
These success criteria are based on the reference plant design, which includes two motor-driven auxiliary feedwater pumps and one turbine-driven auxiliary feedwater pumo. The turbine-driven pump provides the flow equivalent to the two motor-driven pumps. ,
O 0526x 1D/010989 4-14
i
(
4.3.8 Pressure Relief (PR)
This event tree node addresses the probability that pressurizer pressure I relief capacity is adequate to prevent peak RCS pressure in excess of 3200 psig. This node is only addressed for ATWS events with loss of main feedwater (either as an initiating event, result of main feedwater isolation l or random failure of the main feedwater system) and initial power levels l
greater than 40 percent, as all other conditians are not expected to lead to a peak RCS pressure greater than 3200 psig.
The probability of adequate pressure relief capacity depends upon a number of variables, including:
o ATWS initiating event, l
l o initial power level, I i o time in cycle life that transient occurs, o manual insertion of an RCCA bank, o reactivity feedback as function of cycle length, or Unfavorable Exposure Time-(UET),
o auxiliary feedwater flow, and o pressurizer pressure relief and safety valve capacity.
Unfavorable exposure time (UET) is defined as the time during cycle life when
-the reactivity feedback is not sufficient to prevent exceeding 3200 psig for a given plant configuration (initiating event, power level, manual rod insertion, auxiliary feedwater flow, and PORV_ availability).
Although the PORVs may be blocked for part of the cycle life, the pressurizer safety valves are assumed to be available throughout the cycle life and only random failures are assigned to the safety valves.
As stated earlier in this section, 3200 psig is a conservative lower bound for I
the RCS. Below this pressure, there is an insignificant probability of a pressure-induced RCS leak.develeping that would lead to breach of the RCS and consequential core damage. For transients above this pressure, it is l 4-15 Os26a:1D/010989
conservatively assumed that the result is early core damage. Further development of the event tree only considers containment heat removal functions.
4.3.9 Lono-Term Shutdown (LTS)
This event tree node addresses the alternate means to achieve suberiticality and maintain the shutdown condition if the peak RCS pressure has not exceeded 3200 psig within the first few minutes of the transient. If manual trip does not shut down the reactor early in the transient, the procedures instruct the operator to open the reactor trip breakers at the motor generator (MG) sets, "
open breakers to control rod MG sets at the switchgear and close the appropriate interlock contact. Boration of the RCS is also initiated by utilizing the high head charging pumps and borated water from the RWST (if sufficiently borated) or the emergency boration (or normal borate mode) via the CVCS. In addition, if there is not a mechanical failure associated with the control rods, the operator would be able to manually insert all of the control rod banks. These additional shutdown actions are expected to take less than 10 minutes to initiate. Hence, this event tree node includes a number of operator actions and alternatives that would be necessary if manual reactor trip failed. If long-term shutdown fails, core damage is conservatively assigned.
4.3.10 Containment Heat Removal (CHR)
This event tree node addresses containment integrity if core damage occurs.
Public risk from radioactive releases, resulting from core damage, is only postulated if the containment heat removal functions fail, i.e., the containmect fails. If core damage occurs, the containment heat removal systems are expected to be available to protect the containment. These systems arc plant specific and could include the containment fan coolers, containment spray system, the ice condenser, or combinations of systems. For this analysis only containment sprays are modeled. Containment heat removal is a long term function which can be initiated automatically or manually.
Inis event tree node is adcressed only if core damage is postulated to occur.
Os26m:1o/010989 4-16
)
i i
4.4 SUCCESS CRITERIA In order to avoid degraded core conditions following an anticipated transient, the following event tree nodes or combinations of nodes must be available:
If reactor trip is not successful (ATWS event):
- 1. With reactor power less than 40%
A. auxiliary feedwater or main feedwater flow feeding the steam generators, and B. long term shutdown.
- 2. With main feedwater initially available and power greater than 40%
A. main feedwater continues to be available, and B. long term shutdown successful.
- 3. With main feedwater not available and power greater than 40%
A. AMSAC (turbine trip and auxiliary feedwater actuation), and B. auxiliary feedwater flow feeding the steam generators, and C. adequate primary pressure relief capacity, and D. long term shutdown.
If any of the functions listed as a letter identifier (A, B, etc.) fail, core damage is postulated and containment heat removal (CHR) is addressed.
4.5 PLANT DAMAGE STATE CLASSIFICATION All event tree secuences except those that result in successful mitigation conditions, or success, are classified by the degraded core conditions that would exist for each sequence. Classification is based on time of core damage with respect to heat removal, type of accident and containment heat removal status.
1
~~ j l
l Os26rlo/010989 4-17 1
The plant damage state classifications are composed of the following identifiers for type of accident and containment system status as follows:
T - Transient event E - Early core damage, failure of containment heat removal !
C - Containment heat removal successful Only two plant damage states are considered. TEC implies Transient event, Early core damage, with successful Containment heat removal and no significant radioactive release and 3 implies Transient event, Early core damage with radioactive releases.
Sequences with and without containment heat removal are shown on the event tree if core damage is postulated. If containment heat removal is successful, containment integrity is maintained, preventing radioactive releases.
4.6 UNAVAILABILITY VALUES FOR EVENT TREE NODES The unavailabilities or fractions for each of the event tree nodes are summarized in the following sections. The assumptions, generic unavailabilities, definitions of typical ranges for important nodes, and details of the quantifications are discussed in Appendix B. Use of these values is further discussed in Section 5 of this report.
4.6.1 Initiatino Event Freouency (IE)
Based on WOG TRAP results (reference 21) for Westinghouse PWRs over the 1985 and 1986 operating years, the mean number of anticipated transients is 4.0/ Reactor year and includes all classes of transients.
IE = 4.0/ Reactor year.
0926clo/010989 4-18
4.6.2 Reactor Trio (RT)
The unavailability of the reactor trip function includes the unavailability of the RPS (including unavailability of the breakers and the signal), failure of the operator to scram the reactor (if the breakers did not fail) and failure of the control rods to insert (mechanical failure). l
\
-5 RT = 1.5x10 ,
4.6.3 Power Level Greater than 40 percent (PL)
PL is quantified as the fraction of anticipated transients above (lower path) 40 percent initial power and is the probability that the transient is initiated at an initial power level greater than 40 percent. The complement of PL (1-PL) is then the probability that the transient is initiated at a l power level less than 40 percent.
PL = 0.662 4.6.4 Main Feedwater (MF)
MF is quantified as the fraction of anticipated transients with initial power levels greater than 40 percent and is quantified as the probability that main feedwater is not available at initiation.of the event (downward path). The complement of MF (1-MF) is then the probability that main feedwater is available at the beginning of the transient and continuing to feed the steam generators at least until the reactor is suberitical. .
T MF = 0.4 4.6.5 Manual Rod Insertion (MRI)
MRI is quantified as an operator action to manually drive the control rods into the reactor for approximately one minute prior to the predicted time of ceak pressure for the limiting transient, if the control rod system is not in j
4-19 Os26n:1o/010989 l
, . - - . . e- % , ,,
l automatic mode and the control red mechanisms have not failed. This action ,
must be initiated within the first minute of the event.
MRI = 0.21.
4.6.6 ATWS Miticating System Actuation Circuitry (AM)
The unavailability of AMSAC has not been specifically modeled.with fault tree analysis. AMSAC designs (reference 17) currently being installed for Westinghouse plants are very similar in actuation logic, sensors, and actuators. Fault tree analysis performed on similar circuitry configurations in WCAP-10271 (reference 22) demonstrated that unavailabilities for these types of circuits range from approximately 2x10 ~3 to 5x10 -3 Therefore, a conservative unavailability of 1.0x10 -2 is assigned for failure of AMSAC.
l
- 2' AM = 1.0x10 ,
4.6.7 Auxiliary Feedwater Three auxiliary feedwater unavailabilities are used in the event tree, depending on the success criterion.
- 1. If the reactor is not scrammed and the initial power level is less than 40 percent, the unavailability of auxiliary feedwater-(50 percent "
flow) is: -
AF = 1.0x10 -3 ,
- 2. If the reactor is not scrammed and the initial power level is greater than 40 percent and both motor-driven pumps and the turbine driven pump auxiliary feedwater are available, the unavailability of auxiliary feedwater is:
^
AF2 = 6.3x10 -2 ,
l 0326x:1o/010989 4-20 m
l
- 3. If the reactor is not scrammed and the initial power level is greater than 40 percent and either the 2 motor-driven pumps or the turbine driven pump fails, the unavailability of all auxiliary feedwater is the probability that 50 percent auxiliary feedwater flow fails given that 100 percent auxiliary feedwater flow is not initially available:
-2 AF1 = 1.6x10 ,
The unavailability calculated for AF1 is used in the event tree under the event tree node, AF. This is because the value for AF2 multiplied by the value for AF1 is AF. Therefore, a separate event tree node is not included in the event tree.
4.6.8 Pressure Relief (PR)
The event tree node primary pressure relief (PR) addresses the possibility that RCS pressure will be in excess of 3200 psig (see Section 4.3.8). PR includes the Unfavorable Exposure Time, or time during which the reactivity feedback will be unf avorable such that peak RCS pressure will exceed 3200 psig as a function of available RCS pressure relief capacity. If no unfavorable ,
exposure time is expected, i.e. with main feedwater available or for events occurring at less'than 40 percent initial power, then this event tree node is not addressed.
UET will vary from plant to plant and may be zero for some core designs, plant transients and/or plant configurations. The UET ranges presented in this report are based on the following conservative assumptions.
- 1. All transients addressed for initial power levels greater than 40 percent are analyzed as transients initiated at 100 percent power.
Os26x:1o/010989 4-21
S
- 2. Transients with partial loss of feedwater are assumed to lead to a consequential complete loss of feedwater 50 percent of the time.
I The unfavorable exposure time is calculated for the conditions of successful I manual rod insertion and failure of manual rod insertion for all transients !
initiated at greater than 40 percent initial power with main feedwater unavailable. PR is a function of UET, availability of pressurizer PORVs and safety valves, and distribution of transients over time during the cycle, as described in Appendix B. UET is determined as a period of time during core life as a function of PORV relief capacity. That is, as that period of time during cycle life when, assuming availability of al.1 PORVs and safety valves:
availability of both PORVs is not sufficient to maintain RCS pressure below 3200 psig; availability of two PORVs is required to maintain RCS pressure below 3200 psig; availability of one PORV.is sufficient to maintain RCS pressure below 3200 psig; and when transient pressure above 3200 psig is not-anticipated even if no PORVs are available. The safety relief valves are required over the-entire cycle life. The calculated UETs are normalized to one reactor year, and the resultant PR values are averaged over the length of the cycle, as explained in Appendix B.
UET also depends on successful manual rod insertion and availability of <
auxiliary feedwater flow. The UETs are calculated with the conditions of all auxiliary feedwater available ana 50 percent auxiliary feedwater available.
These UETs are also calculated for manual rod insertion (MRI) successful and manual rod insertion failing (no MRI). Therefore, there are two sets of PR corditions, which depend upon availability of auxiliary feedwater for each branch of event tree node MRI. The details of the calculations are presented in Appendix B and the results of these calculations for the base case are as given in Table 4-2. ,
1 i
0926x.lo/o10989 4-22
Table 4-2 PR Values for the Base Case PR Branch Value
MRI successful, 50% auxiliary -2 1.5x10 feedwater flow available (PR2) 1 No MRI and feedwater 100%
flow auxiliary (PR3) available 2.80x10 No MRI and 50% auxiliary _3 feedwater flow available (PR4) 3.28x10 '
(Assumes both PORVs available) 4.6.9 Lono Term Shutdown (LTS)
The long term shutdown event tree node addresses the ability of the operators to trip the MG sets locally, start emergency boration via the CVCS or borate In addition, the operators the RCS with the high pressure pumps via the RWST.
will continue to drive the control rods in manually.
~3 LTS = 5.0x10 .
This event tree node is only addressed if RCS pressure relief capacity is sufficient to preclude core damage, i.e., event tree node PR succeeds, or pressure relief capacity is not required (main feedwater is available or the transient is initiated at initial power levels less than 40 percent).
J 4.6.10 Containment Heat Removal (CHR)
Containment Heat Removal will depend upon plant specific systems such as: l reactor f an coolers, contaigment spray, containment spray recirculation,the l ice condenser, or combinations of systems. For this analysis only containment sorays are moceleo. This-event tree node has been modeled on the event tree 052 Solo /010939 4-23
in order to provide additional insight into the potential for radioactive release, given an ATWS core damage sequence. However, the value used does not affect ATWS core damage frequency as this event tree node is only addressed if core damage is postulated to occur. The unavailability of containment heat removal is:
CHR = 1.5x10
-3 ,
4.7 RESULTS Table 4-3 provides a summary of the values used for the base case ATWS event tree quantification. Table 4-4 provides the results of the quantification of l the base case. The percent contribution for failure paths from each subtree (initial power less than 40%, initial power level greater than 40 percent with main feedwater available and events occurring at initial power levels greater than 40 percent with main feedwater not available) are also given on this table.
The total frequency of core damage is 1.6x10-6 / year. The dominant sequence (path 27) for the base case is:
1 l
- PL
- MF
- MRI * (AM)' * (AF2)'
- PR3 * (CHR)'
which accounts for approximately 54% of the total ATWS core damage frequency.
(Identifiers (*)' denote non-failed nodes.) This sequence includes failure of manual rod insertion (MRI) and a correspondingly high value for failure of pressure relief (PR3). Although this is the dominant sequence for core j damage, containment heat removal is successful (CHR)' and the containment is not expected to fail; therefore, this does.not represent releases from the ,
containment, or public risk. The release frequency resulting from core damage is listed under the column for CHR (faiiure of containment heat removal) in Toole 4-4. This ATWS release frequency is estimated as 2.4x10~9/ year, which
( is aoproximately 3 orders of magnitude smaller than the frequency of core
! damage.
0336tio/010989 4-24 -
Contribution from PR dominates the frequency of core damage because PR has been modeled to include a number of parameters that have an adverse effect on the analysis. The UETs used to calculate PR are based on the limiting transient, but used in the model for all of the transients; auxiliary feedwater availability is factored into the UET calculation; and the availability of manual rod insertion has a substantial impact.
The calculated base case ATWS frequency of core damage is well below the core
-5 Further, current regulatory practice damage frequency target of 1.0x10 .
is to base value/ impact assessments on health effects, not core damage frequency. As mentioned above, the calculated ATWS release frequency, which provides a closer measure of health effects than does core damage frequency, is smaller than core damage frequency by three orders of magnitude. These results were obtained using a model and data assumptions that retain a number of the SECY-83-293 conservatisms. This demonstrates compliance with the ATWS Rule as specified in SECY-83-293 for Westinghouse PWRs.
The,next section of this report presents a process for establishing plant-specific compliance, and discusses the important parameters to be considered.
~
0526x;1o/0109E9 4-25
TABLE 4-3 f Base Case Event Tree Node Values ATWS EVENT NODES:
NODES VALUE COMMENT IE 4.0/RY RT 1.5x10
-5
~1 PL 6.62x10
-1 MF 4.0x10
~1 MRI 2.1x10
-2 AM 1.0x10
-3 50% auxiliary feedwater flow, events AF 1.0x10 below 40% power
-2 100% auxiliary feedwater flow AF2 6.3x10
-2 50% auxiliary feedwater flow, given AF2 AFI 1.6x10 fails
-2 manual rod insertion successful, both PRI 1.5x10 PORVs available when required with 100%
auxiliary feedwater flow
-2 manual rod insertion successful, both PR2 1.5x10 PORVs available when required with 50%
auxiliary feedwater flow
~1 PR3 2.80x10 manual rod insertion fails, both PORVs available when required with 100%
auxiliary feedwater flow
~1 PR4 3.28x10 manual rod insertion fails, both PORVs available when required with 50%
auxiliary feedwater flow
-3 LTS 5.0x10
~3 CHR 1.5x10 0526m 1D/010989 4-26
l Table 4-4 Results of Quantification of the Base Case Contribution by Subtree and Event Tree Node Event Tree Node i i
LTS CHR TOTAL AM AF PR SUBTREE (PERCENT)
-7 -10 -7
-8 1.0x10 1.8x10 1.2x10 Power level <40% 2.0x10 (7.6%)
-7 -10 -7 1.2x10 1.8x10 1.2x10 Main Feed Available (7.4%)
Power level >40%,
-8 -10 ~7 No Main Feedwater -7 -8 -7 6.1x10 5.8x10 3.9x10 MRI Succeeds 1.3x10 1.3x10 1.9x10 (24.0%)
-9 ~7 -8 -9 9.8x10
~7
-8 3.3x10 9.3x10 1.2x10 1.5x10 MRI Fails 3.3x10 (61.1%)
-6 ~7 -9 -6
-7 ~0 1.1x10 2.9x10 2.4x10 1.6x10 TOTAL 1.6x10 3.6x10 (2.2%) (69.5%) (18.2%) (0.2%)
Percent (9.9%)
TEC TEC TE Plant Damage TEC TEC State
~
4-27 Os26x.1D/010989 l
SECTION 5 ATWS RULE ADMINISTRATION PROCESS
5.0 INTRODUCTION
A reassessment of ATWS core damage frequency for Westinghouse PWRs, using a methodology consistent with that used in SECY-83-293, has been presented in Section 4. This methodology provides the basis and framework for establishment of compliance with the ATWS Rule. Using plant configuration and operation information representative of Westinghouse plants, it has been demonstrated that ATWS core damage frequency is less than the target used in SECY-83-293.
In developing the methodology used in Section 4, it was recognized that plant configuration can change over time, and that there may be plants for which some parameters are beyond the range of the assumptions made in the base case assessment of Section 4. The event tree models and important assumptions have therefore been structured for use in a process that allows an estimate of the effects of plant changes on ATWS core damage frequency to be made as such changes occur. This ATWS Rule Administration Process is described in the following paragraphs.
5.1 PROCESS DESCRIPTION The ATWS Rule Administration Process involves several steps to verify compliance with the ATWS Rule. Figure 5-1 provides an overview of the important steps in the process. Compliance will be based on a comparison of the predicted plant ATWS core damage frequency with the target. This comparison will be made by evaluating the differences in important parameters between the plant and the base case of Section 4.
The process enables licensees to evaluate ATWS con damage contributions from
) several important parameters. Appropriate plant operating and configuration parameters that have been identified as important to ATWS core damage frequency in this study are entered into the model. Such plant operation Os26m:10/010989 5-1
Core Damage f,,9ng, Frequency (CDF) anstnt Analysis *
, vitim (Base Model)
Tm UET Core Damage (Step 3)
Frequency (CDF) If I '
Core Damage AP g < 1x10 5 Frequency .
Recalculation
, g t
1r-
'o Design
'sctivity (Step 1) (Step 2) riback Yes 1f .
CDF OK W
Additional Operating < 1x10 5 Analysis Emperience Tm Mant Changes (Step 4)
Yes if OK Figure 51. ATW5 Rule Administration Process l
1 l
l l
0526x:1D/101388 5-2 c- + , , y . , . ., , . . . . .,- ,
parameters as PORV availability, main and auxiliary feedwater availability, and so forth may have an impact on ATWS core damage frequency, as described in Section 4, and enter into the model as indicated by the " Operating Experience" block on Figure 5-1. Fuel management similarly affects ATWS core damage freguncy, and is factored into the model via unf avorable exposure time, as indicated by the "UET" block on the figure. Specific UET information can be generated as part of the normal core design activities.
Once the plant parameters are known, the model is used to determine whether the target value for core damage frequency is met.
If the target value is exceeded, then the licensee can evaluate the potential for reduction of ATWS core damage frequency resulting from reductions in one or more of the values assigned to the individual plant configuration or operation parameters addressed in the model, using the information provided in Section 4 and the guidance provided later in this section. This is represented on the figure by the " Base Model Core Damage Frequency Sensitivities" block, and is a part of the process whereby trade-offs can be made in terms of core damage frequency contribution from the various parameters as selected to be representative of the plant. A number of such sensitivities have been performed, and the results are provided in Section 5.3.
If the calculated core damage frequency is still above the target, then the licensee could perform more detailed analyses to determine the values to be used for the parameters in the model, or attempt to relate the core damage results to public risk. Since the base case contains a number of conservative assumptions made to cover a broad range of plant configurations, a more plant-specific analysis can generally be expected to result in a reduction in the calculated core damage frequency, through appropriate trade-offs in the parameters. Alternatively, an assessment of public risk could be made to demonstrate that ATWS risk for the plant is within the criteria established in the Severe Accident Policy.
The process provides levels of screening in order to minimize the need for cetailed evaluation by licensees and to minimize the impact on plant economics anc operation. It further provides relevant information that enables a Os26x 1o/010989 5-3
licensee to identify and proactively implement programs to manage further ATWS core damage frequency reductions, in accordance with plant performance objectives.
Summary of Steps in the Process The steps in the process may be summarized as follows.
L
- 1. Verify the applicability of the assumptions made in the base case for the important parameters. Determine if any plant-specific conditions may require reevaluation of the parameter values.
- 2. Check the event tree parameter values to be used for the plant against the corresponding base case values. If all the base case parameter assumptions apply to the plant (and all plant specific values are at or below the base case values), then the plant's ATWS core damage frequency is less than the 1x10 -5 target and the plant is in compliance.
If some base case assumptions do not apply, and one or more values is higher than the base case values, calculate the core damage frequency using the plant parameter values with the process model. If the core damage frequency is still less than than the 1x10-5 target, the plant is in compliance.
- 3. If step 2 fails (core damage frequency is significantly above the target), then there are two alternatives. For the first, based on core damage frequency, identify plant condition, operation, or configuration parameters to be analyzed in greater detail in order to identify ways to reduce the calculated core damage frequency to below
-5 1x10 . For the important parameters, perform plant-specific
! analyses to determine where margin exists for frequency trade-offs, respecify model input values consistent with these analyses, and recalculate the core damage frequency.
l l
OG26mio/010989. 5-4 i i
The second approach could involve an evaluation of ATWS-related public risk (rather than core damage frequency), based on the estimated core damage frequency and an assessment of expected containment response.
- 4. If calculated core damage frequency or plant risk from step 3 is still significantly above the target, even after analysis and parameter trade-offs, assess the need for further actions.
5.2 EVENT TREE REPRESENTATION FOR USE WITH THE PROCESS The event tree developed in Section 4, and shown in Figure 4-1, can be represented as a series of equations representing the various success and failure sequences. The sum of the frequencies for all the core damage paths recresents the total core damage frequency. Table 5-1 presents this representation of the event tree.
The table presents only those sequences from the event tree that affect ATWS core damage frequency. The "non-ATWS" path and the " success" sequences (paths 1, 2, 7, etc. on Figure 4-1) are not included in Table 5-1. The ATWS core damage sequences are grouped, for convenience, into three sets, the first (top set) representing core damage sequences for operation below 40% power, the second (middle set) representing core damage sequences for operation above 40%
power with main feedwater available, and the third (bottom set) representing sequences for operation above 40% power with main feedwater unavailable.
Parameters shown in parentheses on Table 5-1 indicate the upward path at those event tree nodes. For illustratdon purposes, the table also shows, along with the event sequence equations, the sequence frequencies as calculated for the base case discussed in Section 4.
Conversion of the event tree to this format allows straightforward calculation l
of ATWS core damage frequency for a given set of plant conditions (i.e., event tree node failure rates), and provides insights as to how changes in the f l
various carameters affect the core damage frequency.
l 0526m:1o/010989 5-5
, =
Table 5-1 Tabular Representation of ATWS Core Damage Sequences
IE*RT*PL*(MF)'*LTS*(CHR)' 1.19x10 9 -10 IE*RT*PL*(MF)'*LTS*CHR 1.79x10 11 IE*RT*PL*MF*(MRI)'*(AM)'*(AF2)'*(PR1)'*LTS*(CHR)' 5.73x10 -8 12 IE*RT*PL*MF*(MRI)'*(AM)'*(AF2)'*(PRI)*LTS*CHR 8.60x10'11 13 -7 IE*RT*PL*MF*(MRI)'*(AM)'*(AF2)'*PR1*(CHR) 1.74x10 14 IE*RT*PL*MF*(MRI)'*(AM)'*(AF2)'*PR1*CHR 2.62x10 -10 16 3.79x10
-9 IE*RT*PL*MF*(MRI)'*(AM)'*AF2*(AF)'*(PR2)'*LTS*(CHR)'
17 IE*RT*PL*MF*(MRI)'*(AM)'*AF2*(AF)'*(PR2)'*LTS*CHR 5.69x10 -12 18 1.15x10
-8 IE*RT*PL*MF*(MRI)'*(AM)'*AF2*(AF)'*PR2*(CHR) 19 -11 IE*RT*PL*MF*(MRI)'*(AM)'*AF2*(AF)'*PR2*CHR 1.73x10 20 IE*RT*PL*MF*(MRI)'*(AM)'*AF2*AF*(CHR)' 1.25x10 -8 21 IE*RT*PL*MF*(MRI)'*(AM)'*AF2*AF*CHR 1.88x10 -11 22 -7 IE *RT *PL *MF*(MP.I ) ' *AM*( CHR) ' 1.25x10 23 IE*RT*PL*MF*(MRI)'*AM*CHR 1.88x10 -10 Secuences show success (in parentheses with prime)' or failure of the various event tree nodes (see Section 4). Note that for node CHR, success imolies that the containment systems substantially limit releases, even thougn core damage is assumed to have occurred.
Os26m10/010989 5-6 ;
l Table 5-1 (Continued)
Tabular Representation of ATWS Core Damage Sequences
- l PROBABILITY PATH PATH PROBABILITY STATEMENT
.g l 1.11x10 j 25 IE*RT*PL*MF*MRI*(AM)'*(AF2)'*(PR3)'*LTS*(CHR)' ~11 IE*RT*PL*MF*MRI*(AM)'*(AF2)'*(PR3)'*Li;*CHR 1.67x10 26 ~7 8.65x10 27 IE*RT*PL*MF*MRI*(AM)'(AF2)'*PR3*(CHR)' ~9 1.30x10 28 IE*RT*PL*MF*MRI*(AM)'*(AF2)'*PR3*CHR
-10 6.87x10 30 IE*RT*PL*MF*MRI*(AM)'*AF2*(AF)'*(PR4)'*LTS*(CHR)' -12 1.03x10 31 IE*RT*PL*MF*MRI*( AM) '*AF2*( AF) ' *(PR4) '*LTS*CHR -8 6.71x10 32 IE*RT*PL*MF*MRI*(AM)'*AF2*(AF)'*PR4*(CHR)' -10 1.01x10 33 IE*RT*PL*MF*MRI*(AM)'*AF2*(AF)'*PR4*CHR
-9 3.32x10 34 IE*RT*PL*MF*MRI*(AM)'*AF2*AF*(CHR)' -12 4.99x10 35 IE*RT*PL*MF*MRI*(AM)'*AF2*AF*CHR -8 3.33x10 36 IE*RT*PL*MF*MRI*AM*(CHR)' ~11 5.00x10 37 IE*RT*PL*MF*MRI"AM*CHR
-6 1.61x10 TOTAL ALL PATHS l
l l
- Secuences show success (in parentheses with prime)' or failure of the Note that for node CHR, success various event tree nodes (see Section 4).
implies that the containment systems substantially limit releases, even tnough core damage is aslumed to have occurred.
Os26m:1D/010989 5-7 l
1
- _ _ -= -. . _
i 5.3 ATWS CORE DAMAGE FREQUENCY SENSITIVITY CASES Several parameter sensitivity cases have been performed using the WOG ATWS model in order to indicate the effect of changes in event tree input data assumptions on predicted ATWS core damage frequency. Table 5-2 provides the results of these quantifications of the base case event tree with different values for the following event tree nodes: MF, MRI, PR and IE. These parameters were chosen because of their impact on the overall frequency of core damage, as indicated in Section 4. The availability of main feedwater may depend upon the plant design and plant recponse after an ATWS event; manual rod insertion is dependent on operator action assumptions; and PR, for a given cycle design, will depend upon the availability of pressurizer pressure relief and safety valves. '
Referring to Table 5-2, Case 1 is the base case of Section 4, repeated here for comparison. Cases 2 through 5 are the base case but using the upper and lower range assumptions identified in Section 4 for MRI and MF (as indicated),
i with no PORVs blocked (i.e., both PORVs available when required).
Cases 6 through 10 are similar to Cases 1 through 5, but with both PORVs blocked (i.e., no PORVs available at any time during the cycle). Case 11 assumes the upper bound value of both MRI and MF, and further assumes that both PORVs are blocked. As anticipated, there is a significant increase in the frequency of core damage with the PORVs blocked over the entire fuel cycle. Case 11 yields a core. damage frequency of about 9x10 -6 , still below the target value. i Cases 12 and 13 were calculated under the assumption that 2 PORVs are available for the first 19 days of the cycle, and at least 1 PORV is available for the first 3 months. These cases illustrate the ability of the model to be
-used for assessment of the effects of plant changes during a cycle. They also show, in comparison to Cases 6 and 7, the potential benefit in core damage frequency that can be derived from even limited PORV availability during the early part of a cycle, particularly when manual rod insertion can be credited. ;
Cs26m lo/010989 5-8
Table 5-2 Results of Sensitivities Both PORVs:
Frequency of Blocked (B) or Case Unblocked (U)
Case Description Core Damage Number U
1 Base Case 1.6x10f 3.1x10 U 2 MRI Upper Bound (.554) -6 1.2x10 -6 U 3 MRI Lower Bound (.121) 4 MF Upper Bound (.551) 2.1x10 -6 U 1.1x10 U 5 MF Lower Bound (.247)
B l 6 Base Case 5.3x10ll 6.3x10 B j
7 MRI Upper Bound (.554) -6 8 8 MRI Lower Bound (.121) 5.1x10 -6 9 HF Upper Bound (.551) 7.2x10 -6 B 10 MF Lower Bound (.247) 3.4x10 B
-6 B 11 MF, MRI upper bound 8.5x10 12 Base Case 2.2x10 6
- 13 MRI Upper Bound (.554) 4.5x10
-6 14 IE=16.5, PL = .65 6.5x10 U U
15 24 month cycle 1.7x10 6 16 24 month cycle 5.9x10 B
- This case is with 2 PORVs unblocked for 19 days and at leact 1 available for 3 months.
l Table 5-3 PR Values for 24 Honth Cycle Length Sensitivity PORVs PORVs Sensitivity Case Unblocked Blocked
- MRI successful, 100% auxiliary
.015 .323 feedwater flow available (PRI)
MRI successful, 50% auxiliary
.211 .345 feedwater flow available (PR2)
No MRI and 100% auxiliary
.275 .441 feeowater flow available (PR3)
No MRI and 50% auxiliary
.305 434 l feedwater flow available (PR4) i l
- Both PORVs are assumed blocked for the entire fuel cycle.
0526m:1D/010989 5-9
Case 14 was quantified with the highest combination of IE and PL consistent with the data (reference 25) discussed in Section 4 and Appendix B, and with both PORVs unblocked. The frequency of core damage is about 7x10 -6 for this case. However, the use of these values implies a much higher than anticipated frequency of transients for which peak pressure will exceed 3200 psig (analyzed as a loss of load with loss of main feedwater). That is, the combination IE*PL*MF is, for this case, 16.5 (transients per year) times 0.65 .
(greater than an initial power level of 40 percent) times 0.4 (loss of main fcedwater fraction), or 4.3 limiting transients per year. Even though such a i I
high frequency of loss of load with loss of main feedwater events is not expected for Westinghouse plants, the core damage frequency target can be met in some circumstances with this value. This sensitivity illustrates how the
- model can be used to compensate for adverse plant values in one parameter i through trade-offs with other parameter values, and demonstrates some of the conservatism retained in the event tree model.
Cases 15 and 16 assume a 24 month cycle fuel design instead of the base case 18 month cycle, with no PORVs blocked and with both PORVs blocked, respectively. In order to perform the cycle length sensitivity, UETs were determined for a 24 month cycle,'and PR was evaluated for the same conditions as for the base case. PR was calculated for each UET (with and without manual I
rod insertion, for cases of full and partial auxiliary feedwater), with both PORVs unblocked and with both PORVs blocked, consistent with the calculations discussed in Section 4.6. The results of these calculations are as given in Table 5-3.
The core damage frequency calculated for the 24 month cycle (Case 15) is essentially the same as that calculated for the 18 month cycle with both PORVs available. The increase in core damage frequency for the 24 month case with both PORVs blocked is a reflection of the longer time during the cycle during which PORVs are required for the 24 month case.
These sensitivities indicate the manner in which the process allows for trade offs among the important parameters in order to achieve the target under a wice variety of plant configurations and experience.
Os25m 1o/010989 5-10
5.4 EVALUATION PROCESS A number of important assumptions were made in selecting the ranges of values for the important parameters in the ATWS model. In applying the ATWS process, the licensee should be aware of these assumptions (identified in Section 4 and Appendix B of this report), and select values for its plant in a manner consistent with these assumptions.
The following sequence of steps illustrates the use of the ATWS Rule Administration process and the information to be reviewed to verify acceptable ATWS core damage frequency. This sequence assumes that' specific UETs (in real time, e.g., days) have been defined for the limiting transient, for the four PR conditions (per Section 4.6.8) for each appropriate PORV condition (i.e.,
O PORVs blocked, 1 PORV blocked, 2 PORVs blocked).
STEP 1 Review Assumotions for Imoortant Parameters The following paragraphs provide,a review of the key assumptions used in the base case model; more detailed information is provided in Appendix B.
Initiatino Events. The transient history of the plant should be reviewed. In assessing this frequency for a plant, an acceptable accumulation time for operating data should be used. An average over the last four years of operation has been cited (reference 3) as an acceptable criterion.
The plant transients should be sorted in terms of feedwater related transients, those that could lead to feedwater isolation (e.g., SI transients), and those with main feedwater available. The number of transients above and below 40% power should also be determined.
The initiating event frequency (IE) and the fraction of events that occur at greater than 40% power (PL), as used in the event tree model, are dependent parameters. 3 is the total of all plant transients. PL can be estimated frcm the plant data.
Os26m:1o/010989 5-11
It is the frequency of feedwater-related transients occurring above 40%
power that is important for the ATWS model evaluation, and this frequency is equal to IE
- PL. If the number of feedwater transients above 40%
power is less than or equal to about 2.7 (4.0*0.66 as used in Appendix B.2), the plant initiating event frequency is within the assumptions of the base case.
Reactor Trip. The probability of failure of reactor trip (RT) has been estimated based on generic experience data for Westinghouse plants, and also includes a number of assumptions regarding operator action. While the base case value for RT is a reasonable estimate for Westinghouse plants, the assumptions described in Appendix B.3 should be reviewed for consistency with operating procedures and experience at the licensee's plant.
Main Feedwater. The fraction of events for which main feedwater is unavailable (MF) is also based on generic experience for Westinghouse plants. For this study, an assignment of partial losses of feedwater (or low level in one steam generator) to the full loss of feedwater category was made based on whether or not conditions resulting from the partial loss of feedwater would be expected to result in a safety injection system actuation, which would then cause main feedwater isolation.
It was noted in Appendix B.2 that full load rejection capacity might lead to low steamline pressure and a reruiting SI actuation following a partial loss of feed. The licensee should review main feedwater assumptions inherent in the process against the plant's main feedwater system to determine the applicable value for MF. The lower bound value for MF (Appendix B.2) applies to plants for which main feedwater isolation would not be expected for a partial loss of feedwater event. Plants with full load rejection capability should use the upper bound value.
1 Os36x:1o/010989 5-12
Manual Rod Insertion. Failure of manual rod insertion (MRI) is influenced by control rod operating mode and by operating procedures and operator training. If the plant is operated with control rods in the automatic mode, particularly early in the cycle (during the unfavorable exposure time), the lower bound value for MRI (Appendix B.4) may be used. If the plant is expected to be in manual operation early in the cycle, but plant operating procedures and operator training clearly indicate that the operator should attempt to rapidly drive the control rods into the core given a failure to trip, the base-case value for MRI may be used.
Otherwise, the upper bound value should be used.
AMSAC. An AMSAC system unavailability (AM) has been selected to bound the unavailability values expected for AMSAC configurations similar to those presented in reference 17. The licensee should review the plant's AMSAC design to ensure ,that the value selected for AM in the base case is applicable.
Auxiliary Feedwater. For auxiliary feedwater (AF), the configuration modeled consists of two motor-driven pumps and one turbine-driven pump, consistent with the reference ATWS analysis assumptions (ref.7). The unavailability values used in the base case for AF, AF1, and AF2 (Appendix B.6) were selected to bound values expected for most such configurations, j
and may be used for plants that have this configuration.. However, factors such as shared equipment, alternate configurations, or a historically poor system performance record could have a significant effect on the actual unavailabilities.
The plant's AMSAC logic should also be reviewed to determine whether or not all auxiliary feedwater pumps receive actuation signals from AMSAC.
If not, the value for AF2 must be set to 1.0.
j Pressure Relief. Successful pressure relief (PR) is dependent on fuel l
L management (for unfavoracle exposure time), availability of pressurizer relief and safety valves, availability of auxiliary feedwater, and the success of manual rod insertion.
I Os26a:10/010989 5-13
The operating history of the PORVs and plant operating procedures should be reviewed to determine whether PORVs are likely to be blocked (and unable to relieve pressure) during the UET of the cycle, and the time in cycle at which PORVs are typically blocked. If the PORVs are typically blocked early in the cycle (during the unfavorable exposure time), the UETs corresponding to the appropriate blocked valve cases (see below) should be used in the initial ATWS core damage frequency calculation. If not, the no PORVs blocked UETs may be used.
The fact that the limiting transients (loss of load with loss of feedwater) occur more frequently during the early part of cycle life must i be accounted for in the translation of UET values into PR values. This adjustment is discussed in detail in Appendix B.7, as part of the PR calculation process.
The prs are calculated as indicated in Appendix B.7: each adjusted UET for the PR in question is multiplied by the failure of the corresponding numbers of PORVs and/or safety valves to open on demand; if PORVs are blocked, the failure value for the interval in' question is 1.0. The products are summed and averaged over the appropriate intervals to obtain PR. This process is repeated for each of the four PR conditions (with MRI, full auxiliary feedwater; with MRI, half auxiliary feedwater; no MRI, full auxiliary feedwater; and no MRI, half auxiliary feedwater).
A generic PORV/ safety valve failure rate has been assumed in the base case, and may be used unless plant operating experience indicates a substantially higher failure rate.
Long-Term Shutdown. Successful long term shutdown (LTS) has been modeled as the requirement for the operators to initiate boration and trip the MG sets. Plant configuration and operating procedures should be reviewed to verify consistency with these assumptions.
0926m.1D/010989 5-14
-1r- -- 7-w m ___a.-___ _ __ _ __ -
Containment Heat Removal. This (CHR) has been modeled on the event tree in order to provide additional insight into the potential for radioactive However, the release (public risk), given an ATWS core damage sequence.
value used for CHR does not affect ATWS core damage frequency.
STEP 2 Determine ATWS Core Damace Frecuency Once all the input values have been determined, the plant's ATWS core damage frequency can be determined.
o If all of the event tree input values to be used for the plant are less than or equal to those of the base case (or any of the sensitivity cases of Table 5-2), then the ATWS core damage frequency for the plant is acceptable, and the process is complete.
o If any of the event tree input values exceed those of the base or sensitivity cases, then the ATWS core damage frequency must be calculated using the event tree of Figure 4-1, or its equivalent mathematical representation (Table 5-1). In using Table 5-1, note that parameters in parentheses indicate " success" branches, for which the numerical values are 1.0 minus the corresponding failure values determined in Step 1.
o If the ATWS core damage frequency calculated using these input data is
-5 less than about 1x10 , then ATWS core damage frequency for the plant is acceptable, and the process is complete.
STEP 3 Detailed Evaluation (if needed)
If Step 2 fails (core damage frequency is significantly above the target),
then the licensee should identify plant condition, operation, or configuration parameters to be analyzed in greater detail in order to identify ways to
-5 For the important parameters, reduce the calculated value to below 1x10 .
s 5-15 0526rlo/010989
l 1
psrform plant-specific analyses to determine where margin exists for frequency trade-offs, respecify event tree model input values, consistent with these analyses, and recalculate the core damage frequency. Alternatively, evaluate ATWS-related public risk for the plant for compliance with the criteria of the Severe Accident Policy.
STEP 4 Further Actions (if needed)
If the calculated core damage frequency or public risk from Step 3 is still significantly above the target, even after analysis and parameter trade-offs, the licensee should assess the need for further actions.
5.5 ATWS CORE DAMAGE FREQUENCY CRITERIA ATWS core damage frequency should be evaluated whenever a plant change occurs for which the licensee identifies some susceptibility to an increase in ATWS core damage frequency. This is consistent with the Severe Accident Policy guidance (reference 3).
Per SECY-83-293, "the estimated core melt frequency due to ATWS events should probably be no more than 1x10 -5 per year." Using this as a basis, calculated ATWS core damage frequency under the ATWS Rule Administration Program should be on the order of 1x10 -5 per reactor year. The NRC Staff previously accepted core damage frequency risk values of 2.2x10 -5 per reacter year for CE and B&W plants (per SECY-83-293), apparently recognizing the uncertainty inherent in probabilistic calculations, and indicating that there is some range of acceptability of results.
os2sx:io/olosas 5-16 l
SECTION 6 CONCLUSIONS 6.0
SUMMARY
A reassessment of ATWS core damage frequency for Westinghouse PWRs, using a methodology consistent with that used in SECY-83-293, has been presented.
This methodology provides the basis for establishing compliance with the ATWS Rule. Using plant configuration and operation information representative of Westinghouse plants, it has been demonstrated the ATWS core damage frequency is less than the target used in SECY-83-293.
This evaluation retained a number of model and data conservatisms from SECY-83-293. These include the following.
o All ATWS initiating events are treated in the event tree model as the most severe ATWS event (loss of load with loss of normal feedwater).
o It is assumed that core damage occurs any time the RCS pressure exceeds the ASME Boiler and Pressure Vessel Code Level C service limit criterion (3200 psig for Westinghouse PWRs).
o The failure values used for AMSAC and auxiliary feedwater were conservatively high relative to values expected for individual plants.
This process allows The ATWS Rule Administration Process has been defined.
the monitoring of important parameters on an integrated basis, and provides a systematic means to factor in industry trends and programs as they affect those parameters that have been shown to be dominant contributors to ATWS core damage frequency.
~
l Os26m:10/010989 6-1
i
6.1 CONCLUSION
The results of the analysis presented for the base case show that the ATWS frequency of core damage is well below the core damage frequency target of 1x10
-5 .
The sensitivity cases presented indicate that Westinghouse PWRs also continue to achieve the target under a wide range of assumptiens for plant configuration and experience.
Further, current regulatory practice is to base value/ impact assessments on health effects, not core damage frequency. As mentioned above, the calculated ATWS release frequency, which provides a closer measure of health effects than does core damage frequency, is smaller than core damage frequency by three orders of magnitude, even with the retention of the SECY-83-293 conservatisms mentioned above.
This demonstrates compliance with the ATWS Rule, as specified in SECY-83-293, for Westinghouse PWRs.
t i
l l
Os26x.1o/010989 6-2 l
SECTION 7 REFERENCES
- 1. " Reduction of Risk From Anticipated Transients Without Scram (ATWS)
Events for Light-Water-Cooled Nuclear Power Plants," ATWS Final Rule, US Code of Federal Regulations, 10CFR50.62, June 26, 1984, as amended.
- 2. Dircks, W.J., " Amendments to 10 CFR 50 Related to Anticipated Transients Without Scram (ATWS) Events," SECY-83-293, USNRC, July 19, 1983.
- 3. " Policy Statement on Severe Reactor Accidents Regarding Future Designs and Existing Plants," Federal Register, 50 FR 32138, August 8, 1985.
- 4. Generic Letter No. 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10CFR50.54(f)," US NRC, November 23, 1988.
- 5. " Technical Report on Anticipated Transients Without Scram for Water-Cooled Power Reactors," WASH-1270, USNRC, September,1973.
- 6. "ASME Boiler & Pressure Vessel Code, and American National Standard," ACI Standard 359-83,Section III, Division 1, Subsection NB-3224, July, 1980. j
- 7. Letter NS-TMA-2182, Anderson, T.M., (Westinghouse Electric Corporation) l to Hanauer, S.H. (USNRC), "ATWS Submittal," December 30, 1979. {
l
- 8. Burnett, T.W.T., et.al., " Westinghouse Anticipated Transients Without l Trip Analysis," WCAP-8330, Westinghouse Electric Corporation, l l
August, 1974 <
- 9. " Anticipated Transients Without Trip Analysis for a Four Loop 3817 MWt Westinghouse PWR," WCAP-8440, Westinghouse Electric Corporation, November, 1974.
- 10. " Anticipated Transients Without Trip Analysis for Westinghouse PWRs With 44-Series Steam Generators," WCAP-8404, Westinghouse Electric I Corporation, September, 1974.
Os26m:1o/010989 7-1
- 11. " Anticipated Transients Without Scram for Light Water Reactors,"
NUREG/CR-0460, U.S. Nuclear Regulatory Commission, April, 1978.
- 12. Denton, H., " Publication of Federal Notice of Proposed Rulemaking to Amend 10CFR50 Regarding ATWS Requirements," SECY-80-409, U.S. NRC, September 4, 1980.
- 13. Federal Register, 46 FR 57521, " Staff Rule".
- 14. Federal Register, 46 FR 57521, "Hendrie Rule."
- 15. " Electric Utilities; Filing of Petition for Rulemaking," Docket No.
PRM 50-29, Federal Register Vol. 45, No. 215, November 4, 1980, and
, Supplement, Vol. 46, No. 22, February 3, 1981, Utility Group on ATWS,
! (" Utility Rule").
- 16. Dircks, W. J., "Public Comments on NRC, Hendrie, and Utility Group Proposed ATWS Rules, and Current Status of Rulemaking Effort,"
SEC-82-275, U.S. NRC, June 28, 1982.
- 17. Adler, M., "AMSAC Generic Design Package," WCAP-10858P-A, Rev. 1, Westinghouse Electric Corporation, July, 1987.
- 18. Aug. 1983 NRC briefing on SECY-83-293.
- 19. " Zion Probabilistic Safety Study," Commonwealth Edison Company, 1981.
- 20. " Millstone Unit 3 Probabilistic Safety Study," Northeast Utilities, August, 1983.
l
- 21. " Westinghouse Owners Group Trip Reduction and Assessment Program, Westinghouse Inadvertent Plant Trip Experience," WCAP-11632, Westinghouse Electric Corporation, September, 1987.
l l
Os26a lo/010989 7-2
- 22. " Evaluation of Surveillance Frequencies and Out of Service Time for the Reactor Protection Instrumentation System," WCAP-10271, Supplement 1-P-A, Westinghouse Electric Corporation, May, 1986.
- 23. " Background for Emergency Response Guidelines - High Pressure," Rev.1, Westinghouse Electric Corporation, September,1983.
- 24. Burnett, T.W.T., "Feedwater-Related Plant Trips: Operating Experience in Westinghouse PWRs," WCAP-10405, Westinghouse Electric Corporation, December, 1984.
- 25. " Data Summaries of Licensee Event Reports of Control Rod Drive Mechanisms at U.S. Commercial Nuclear Power Plants from January 1, 1972 to April 30, 1978," NUREG/CR-1331, U.S. Nuclear Regulatory Commission, February, 1980-
- 26. " Development of Transient Initiating Event Frequencies for Use in Probabilistic Risk Assessments," NUREG/CR-3862, U.S. Nuclear Regulatory Commission, May 1985.
- 27. " Individual Plant Evaluatior. Methodology for Pressurized Water Reactors,"
Technical Report 86.3A* . IDCOR, 1986.
- 28. " Clarification of THI Action Plan Requirements," U.S.' Nuclear Regulatory Commission, (NRR), NUREG 0737, January, 1981.
- 29. " Generic Evaluation of Feedwater Transients and Small Break Loss of Coolant Accidents in Westinghouse-Designed Operating Plants," NUREG 0611, U.S. Nuclear Regulatory Commission, January, 1980.
- 30. " Handbook of Human Reliability Analysis With Emphasis on Nuclear Pc'wer '
Plant Application," NUREG/CR-1278, U.S. Nuclear Regulatory Commission, August, 1983.
- 31. "Sequoyah Nuclear Plant- Individual Plant Evaluation," WCAP-11769, Westinghouse Electric Corporation, March, 1988. ,
Os2Ex:lo/010989 7-3
1 i
l APPENDIX A ATWS RULE HISTORY AND ATWS RULE BASIS BACKGROUND l
l A.0 INTRODUCTION In this appendix, a summary of the evolution of the ATWS Rule is presented in I order to provide some insight into the ATWS rulemaking history and assumptions. In addition, a summary of assumptions used in the SECY-83-293 event trees is provided.
A.1
SUMMARY
OF ATWS RULE EVOLUTION The objective of the ATWS rule is to reduce the predicted frequency of core damage resulting from ATWS events to an acceptable level. The three alternative ATWS proposals (the Staff Rule, the Hendrie Rule, and the Utility Rule) reviewed by the NRC Task Force in formulating the basis for the ATWS Rule are briefly discussed in the following paragraphs.
The proposed Staff Rule alternative (reference 13) emphasized individual reactor evaluation to identify needed improvements. This rule proposed to resolve the ATWS issue by establishing performance criteria for which plant specific analyses would be required to demonstrate compliance.
The proposed Hendrie Rule alternative (reference 14) emphasized reliability assurance in addition to requiring certain hardware modifications. This rule proposed to resolve the ATWS issue for PWRs by establishing a reliability assurance program for systems that prevent or mitigate ATWS accidents and prescribing certain hardware modifications. The reliability assurance program part of this proposed rule was for assuring that the instruments necessary for the diagnosis of and recovery from ATWS accident sequences will not be disabled. The hardware modifications would provide for prompt, automatic initiation of the auxiliary feedwater system for conditions indicative of an ATWS. 1
~
l Os27m:1o/010989 A-1 l
The proposed Utility Rule alternative prescribed specific changes keyed to the the type of reactor and its manufacturer. This third alternative was proposed by the Utility Group on ATWS in petition for rulema' king PRM 50-29 (reference 15) and contained the proposal that all Westinghouse reactors have initiation of the auxiliary feedwater system and turbine trip diverse from the reactor protection system. For Combustion Engineering and Babcock and Wilcox reactors, the Utility Group proposed diverse initiation of auxiliary feedwater and turbine trip (similar to Westinghouse) and a diverse scram system (OSS).
l After consideration of both prescriptive and evaluation model rule formats, public comments on the three proposed alternatives, the substantial technical evaluations performed over the past 15 years, and the potentially large i
expense of performing evaluation model analyses, the ATWS Steering Group (responsible for the approach to the alternatives) directed the Task Force (responsible for the technical basis) to evaluate prescriptive options for each generic reactor manufacturer.
This method of evaluation is similar to that proposed by the Utility Group and consists of defining the various fixes and estimating the reduction in ATWS risk as each additional requirement is added. This Value/ Impact analysis process provides a reduction in risk l (Volue) associated with a cost in dollars (Impact) for each additional requirement added.
l Generic Value/ Impact (V/I) calculations were performed by the ATWS Task Force in order to determine the degree of prescribed requirements for each vender.
In consideration of the potential consequences of an ATWS core melt accident, the Task Force set as a goal that the estimated core melt frequency due to ATWS events should be no more than about 1x10-5. per reactor year.
The Utility Group on ATWS performed probabilistic risk assessment (PRA) analyses in which the chosen index of ATWS hazard was the probability of an ATWS sequence leading to unacceptable plant conditions. Recognizing the difficulty in relating core damage frequency to plant conditions, the Task l
l 4
Os27x.1 o/010989 A-2 l
l 1
Force adopted the Utility Group PRA study index and equated the consequences of core damage to the likelihood of unacceptable plant conditions .
The definition of unacceptable plant conditions used by the Task Force was exceeding the pressure limit corresponding to the ASME Boiler and Pressure Vessel Code Level C service limit criterion (reference 6), which for t!estinghouse plants has been conservatively defined as 3200 psig. 3 In performing the probabilistic analysis for PWRs reported in the Enclosure "D" of SECY-83-293, " Recommendations of the ATWS Task Force", simplified event These trees for each generic reactor design were used by the Staff.
simplified event trees were constructed to include the accident sequences which have been shown to represent the important ATWS events from both NUREG-0460 (reference 11) and the Utility Group PRA.
Based on the likelihood and success criteria values and the simplified SECY-83-293 event trees, the PRA results for Westinghouse plants showed the following core damage frequencies: ,
3.7x10-5/yr for the base case without AMSAC, 5.8x10-6/yr with AMSAC, 5.3x10-6/yr with DSS, and, 1.9x10-6 /yr with AMSAC/ DSS I
l l
\
' This assumption was succorted by the Staff at an ACRS ATWS subcommittee meeting on May 27, 1983. At that meeting, the Staff indicateg they were aiming for an ATWS core damage frequency of approximately 10 i
Os27m:1o/010989 A-3
l l
l The resulting Value/ Impact ratios reported are:
i 3.3 for AMSAC, 3.4 for DSS, and, l 1.1 for AMSAC/ DSS l l The Task Force used the above results from the probabilistic risk assessment j analysis in combination with engineering judgement to develop the final rule l alternatives prooosed to the Commission in SECY-83-293. Two alternatives were proposed. Altet ?tive 1 was to withdraw the proposed rule thereby adopting I
the position that operating plants as designed are safe enough. Alternative 2 was to issue a final rule that prescribes generic safety improvements keyed to the reactor's type and manufacturer (i.e., the Utility Rule) and issue a proposed rule to include Westinghouse plants among PWRs that would be subject to adding a diverse scram system (DSS). Issuance of a proposed rule for the latter rather than a final rule was necessary since the 1981 proposed rules l (entered formally into the Federal Register for public comment) did not explicitly include DSS for Westinghouse plants.
Of the two alternatives presented to the Commission, the Task Force recommended Alternative 2. In recommending Alternative 2 to the Commission, the Staff cited the following key points (reference 2):
The prescriotive rule approach avoids extensive individual case analyses by licensees and the Staff. The regulatory treatment of ATWS provided in the proposed rule should reduce the amount of Staff time currently required to communicate with applicants and intervenors on the ATWS issue.
The prescribed changes would be cost effective in reducing the risk of ATWS events.
l The procosed rule for Westinghouse plants (i.e., the proposed I additional requirement of DSS) would alleviate the potential for common cause failure of the Westinghouse trip system.
i l
0327m:1D/010989 A-4 i
- Implementation of two rules (e.g., the prescriotive rule and the precosed rule that Westinghouse plants include DSS) could lead to completion of the ATWS rulemaking proceeding and to maintaining an acceptable level of risk from ATWS events without the expense to the NRC and the industry of plant-specific evaluations.
- Generic treatment of plants causes difficulty in performing regulatory analyses because of risk-important variations in design and operations among the plants.
- A prescriptive rule discourages consideration of alternative ways of achieving desired safety for individual plants.
- Variations among the plants mcy result in differences from plant to plant in which the effectiveness of the prescriptive design changes will not be quantified.
As a result of the SECY-83-293 Staff recommendations to the Commission, the final ATWS Rule, 10CFR50.62, became effective, in July of 1984. For Westinghouse plants, the ATWS Rule requirement was the implementation of AMSAC. On December 3, 1984, the Commission decided not to issue the proposed rule on ATWS that would require DSS for Westinghouse plants.
A.2
SUMMARY
OF SECY-83-293 EVENT TREE ASSUMPTIONS A summary of the definitions of the event tree nodes, success criteria, and failure probabilities as assumed in SECY-83-293 for Westinghouse PWRs is presented in the following paragraphs. The event trees used in that report are repeated here as figures A-1 and A-2. These event trees represent the cases with and without turbine trip, respectively; both cases assume installation of AMSAC.
~ l l
I os27,:1otoicsss A-5
)
SECY-83-293 Event Tree Too Events o Number of Transients (AT)
This is the number of transients per year that could lead to ATWS-induced core damage. The value used in SECY-83-293 was 4 events per year. (The SECY-83-293 evaluation utilized initiating event data -
from references 22 and 31 to obtain this estimate.) Of this, 70% (2.8 events) were assumed to be turbine trip events (either turbine-trip-initiated or with subsequent turbine trip), with bypass to the condenser; the remaining 30% (1.2 events) were assumed to be non- turbine-trip events, and conservatively treated as loss of normal feedwater events.
o Failure to Scram This was treated as two separate event tree nodes: failure to scram electrically (RPS Elect), and failure to scram mechanically (RPS Mech). The total failure to scram probability was assumed to be 3x10-5/yr, distributed between the two nodes as 2x10 -5 for RPS Elect and 1x10-5/yr for RPS Mech.
o MTC Overpressure MTC Overpressure was used as a measure of the severity of the ATWS events, and, correspondingly as a measure of the ability of the plant to withstand an ATWS (i.e., reactor coolant system pressure remaining below 3200 psig). The Task Force assigned values of 0.1 to this node for non-turbine trip events, and 0.01 for turbine trip events, based on their assumption that the pressure transient for the latter type of ATWS is relatively mild. This implies that, for non-turbine trip ATWS events the MTC would be such that 10% of the time the RCS pressure would exceed 3200 psig. For turbine trip events, this value was 1% of the time. For either type of initiating event, failure at this event Os27rlo/010989 A-6
~
tree node (i.e., exceeding 3200 psig in the RCS due to unfavorable reactivity feedback) is assumed to lead directly to core damage (end state "CD"). Successful branching at this node (the upward path) implies that core damage may be avoided, depending on the success or failure at subsequent event tree nodes.
o Auxiliary Feedwater System Reliability (AFWS Reliability)
Even if the reactivity feedback test at the previous node has succeeded, auxiliary feedwater or other long-term cooling techniques will still be required to prevent subsequent core damage for most ATWS events. For simplicity, the Task Force event trees model only auxiliary feedwater. For the Westinghouse PWR cases with AMSAC, an auxiliary feedwater system unavailability of 0.001 was assigned. (For non-AMSAC cases, the Task Force assumed that if the failure to scram was due to electrical faults, there could be a common failure to initiate auxiliary feedwater. Thus, the unavailability for such cases was assumsd to be 0.16, taken as the probability that an operator would not manually initiate auxiliary feedwater within 12 minutes.)
o High Pressure Injection (HPI)
Operation of High Pressure Injection is required to achieve injection of borated water into the core. This can only be accomplished if the RCS pressure is reduced below the shutoff head of the injection ,
system. For the Task Force model, it was assumed that the auxiliary feedwater system must operate to lower the pressure sufficiently so that high pressure injection could occur. No credit was taken for potential boration via the Chemical and Volume Control System (CVCS) because it was assumed that manual actions would be required and the Thus, the l resulting f ailure probability would be relatively high.
term High Pressure Injection as used in this model really refers to the Safety injection System. A high pressure injection failure i
probability of 0.0 bwas assigned.
A-7 Os27(lo/010989
Figure A-1 SECY-83-293 ATWS Event Tree (Turbine Trip, With AMSAC) ;
gps RPS NTt Over.
. AT AFHs imacceptable 11Js}, jk$h, Ftt8vM_ Reliability jg[ Consecuences Pm b.
OK OK CD 2.8a10*I
- E 1 10-5 CD 2.tx10 4
.01
.7s4.0/Ry
=2.8/RY CD 2.tx10 7 OK CD 5.Ex10"7 2x10 4
.M CD 5.Sa10 4
CD 5.Ex10~7 Total = 1.tx10""
0337m:10/100688 A-B
-l
. l l
Figure A-2 SECY-83-293 ATWS Event Tree (No Turbine Trip, With AMSAC Unseceptable -
NTC Over. AFW5 AT RPS Elect RPS Mech seessure Ralfabf11ty E Consecuences % b.
OK OK 0.9 CD 1.1x10*I
- E CD 1.1x10 4
1x10 5 0.1 4 CD 1.2x10
.3x4
=1.2/RY OK
.~
0.9 CD 2.2x10*I 2x10-5 .001 4 CD 2.2x10 i
- 4
. CD 2.4110 4
Total = 4.0x10 ,
i l
i N
l l
0527m:1D/100688 A-9
i APPENDIX B EVENT TREE NODES ASSUMPTIONS B.0 INTRODUCTION This appendix provides the assumptions and calculations for unavailabilities used in the event tree nodes. Upper and lower bounds are calculated for These upper and lower Manual Rod Insertion (MRI) and Main Feedwater (MF).
bounds are used in the sensitivities reported in Chapter 5. The criteria for using the event tree nodes are discussed in Chapter 5.
B.1 INITIATING EVENT FREQUENCY (IE)
Based on WOG TRAP results (Reference 21) for all Westinghouse PWRs over the 1985 and 1986 operating years, the mean number of anticipated transients is 4.0/ Reactor year and includes all classes of transients. Therefore, the Frequency of Initiating Events used in Section 4.6.1 is:
IE = 4.0/ Reactor year.
B.2 POWER LEVEL GREATER THAN 40 PERCENT (PL) AND MAIN FEEDWATER (MF)
The transients reported in WCAP-10405 (Reference 24) are the source of the data used to determine the probability of Power Level Greater than 40 Percent (PL) and the unavailability of Main Feedwater (MF) as well as the distribution of transients as a function of cycle life. The anticipated transients reported in this WCAP include all of the following.
- 1. Main feedwater related transients from 0 to 100% power, including plant trips caused by malfunctions in the feedwater system and plant trips in which normal main feed was interrupted after the plant trip. These plant trips are caused directly by high or low steam generator level or by loss of feed flow or loss of feed pumps, whether initiated as a reactor trip or
' I as a turbine trip.
0527m:1o/010989 6-I
4
- 2. Transients not associated with the feedwater system from 80 to 100% power, including events which will isolate or lead to the loss of main feedwater. These include safety injection actuations, closure of MSIVs, and loss of condenser vacuum.
1 Thirty transient events that actuated the safety injection system are reported I in WCAP-10405. Five of these are excluded from the data base since 3 occurred during recovery phase when the nuclear power was reduced to low level and two steam generator tube rupture events are excluded as they are not classified as anticipated transients. The SI events retained included 3 MSIV closures and one excess steam flow (spurious steam dump valve opening).- These remaining transients were then grouped by power level, partial loss of main feedwater, and total loss of main feedwater categories to determine the fractions for PL and MF. The number of transients in each category determined from this data base are reported in Table B-1.
Data on transients in~WCAP-10405 were collected for the years 1979 through 1982. It is important to note that there has been a significant reduction in the number of anticipated transients (including main feedwater related transients) in recent years. However, although the frequency of events has decreased, it is assumed that the distribution of transients has not changed.
Therefore the probabilities and distributions obtained from this data are applied to current plant conditions. Hence, probabilities for the event tree nodes PL>40% initial power and MF are determined from the data reported in Table B-1.
Table B-1 Summary of Data from WCAP-10405 Number of Events less than 40%: 225 Numoer of Events >40% Power Number of events with No loss of main feedwater: 198 Partial loss of main feedwater 141 Total loss of main feedwater 102 Total of all transients categories ooo Os27x:10/010989 B-2
i B.2.1 Power Level Greater than 40 Percent (PL)
Based on the data provided in Table B-1, the pooled fraction for PL (initial power level > 40*4) is 441/666 = .662, or the value used in Section 4.6.3 is:
l PL = 0.662 Table B-2 provides the plant specific frequency of transients for each plant The frequency of all transients, as calculated from the data in WCAP-10405.
frequency of transients at greater than 40 percent initial power level and the plant specific fraction for power level greater than 40 percent (PL) are listed for each plant in the survey. Each plant will have a plant specific frequency of transients and a plant specific number of transients occurring at initial power levels greater than 40 percent. The plant specific frequencies of transients and plant specific fractions for PL vary (from 0.46 to 1.0), but the joint number (frequency of transients per year *PL), not just the individual values for IE and PL, is the important value to determine the frequency of feedwater related trips with pressure relief capacity required.
The largest value for the frequency of transients (16.53) and the associated value of PL (0.65) in Table B-2 are used as a sensitivity and the result of this sensitivity is reported in Chapter 5.
B.2.2 Main Feedwater (MF)
No failures of the main feedwater system were recorded after the initiation of a transient in the 198 events with feedwater available. To estimate the l failure probability if no failures have occurred, a conservative estimate is obtained from the 95th percentile of the CHI-Square distribution. An estimate for the failure of the main feedwater system is calculated as CHI 2(2R+2)/2N with 2R+2 degrees of freedom (R is the number of failures and N is the number of events). With no failures (R=0) in 198 events (N) and CHI 2 = 5.99 (from CHI 2 tables with 2 degrees of freedom at 957.), the CHI 2 estimate is
-2 -2 Therefore, a failure of 2x10 is calculated as 5.99/(2*198) = 1.5x10 .
assigned for the random fai hre of the main feedwater system after the initiation of the transient.
l Os27m.1o/010989 8-3
Table B-2 Plant Specific Frequency of Transients from WCAP-10405 Total Number of Frequency Frequency of Total Number of Transients of all Transients Plant Years Transients >40 % cower Transients >40% PL 1 4.9 81 53 16.53 10.82 0.65 2 5.5 80 50 14.55 9.09 0.63 3 4.5 74 34 16.44 7.56 0.46 4 2.3 34 18 13.60 7.02 0.53 5 4.0 42 25 10.50 6.25 0.60 6 6.3 56 38 8.89 6.03 0.68 7 6.5 41 34 6.31 5.23 0.83 8 5.6 50 29 8.93 5.18 0.58 9 4.0 32 19 8.00 4.75 0.59 10 1.8 13 8 7.22 4.44 0.62 11 4.0 25 16 6.25 4.00 0.64 12 1.8 6 7 4.44 3.89 0.88 13 8.0 44 27 5.50 3.38 0.61 14 4.0 14 13 3.50 3.25 0.93 15 4.0 12 12 3.00 3.00 1.00 16 3.2 9 9 2.81 2.81 1.00 17 9.0 19 18 2.39 2.25 0.95 18 8.0 16 16 2.00 2.00 1.00 19 4.0 7 7 1.75 1.75 1.00 20 8.0 8 7 1.00 0.88 0.88 21 4.0 1 1 0.25 0.25 1.00 0537m:10/010989 B-4
If the initiating event is a partial loss of main feedwater from a power level greater than 80%, then consequential conditions (such as low steam line pressure due to maximum load rejection capacity) could initiate an SI signal that will isolate main feedwater. If the partial loss of main feedwater is the loss of one main feedwater pump from a power level less than 80 percent (4 trar>1s %s), the failure of the remaining main feedwater pump is classified as l a random failure of the system. This increases the number of transients with feedwater available at the initiation of the anticipated transient from 198 to 202.
The worst case is that all the remaining partial losses of feedwater will The unavailability of result in the immediate loss of all main feedwater.
main feedwater for this case is: [(number of transients subjected to random failures (202))*(failure of the main feedwater system (.02))+ (the remaining partial losses at initial power level < 80% (12) + all partial losses of feedwater at initial power level >80% (125)) + (all loss of feedwater events (102))]/(all transients greater than initial power levels greater than 40%), or MF = ((202)*0.02 + 12 + 102 +125)/441 = 0.551.
The best case would be that no consequential SI signals or failures would result. The unavailability of main feedwater for this case is: ([all non-loss of feedwater events (202) + all partial loss of feedwater events at initial power levels greater than 40% (12 + 125)]*[the random failure of the feedwater system (.02)) + [all total loss of main feedwater events (102)))/[all transients at initial power levels >40% power 441)), or MF = ((339)*0.02 + 102]/441 = 0.247.
For purposes of the base case analysis, a mid range is calculated under the assumption that 50% of the partial losses will result in the loss of the main feedwater system as (202*0.02 + .5*137 + 102)/441 = 0.40.
~ 1 Os27x 10/010989 8-5
The unavailability of main feedwater used for the base case and reported in Section 4.6.4 is:
MF = 0.40 The upper bound (0.551) and lower bouna (0.247) are used in sensitivities and the results of these sensitivities are reported in Chapter 5. The criteria for using the unavailability of main feedwater are also reported in Chapter 5.
B.3 REACTOR TRIP WCAP 10271 (Reference 22) reports the mean unavailability of the RPS as
-5 1.44x10 . This includes failure of the shunt and undervoltage coils to open the breakers and failure of the signals. The unavailability of the RPS is dominated by the common cause failure of the breakers to open (90%).
A common cause mechanical failure of the RCCAs to insert is not considered as a credible event for Westinghouse plants. Single RCCAs have failed to insert (Reference 25), but no multiple failures (two or more RCCAs) have occurred in Westinghouse plants. As of February 1988, there are 428 reactor years of operation for Westinghouse plants. Assuming an average power operation of 70%, there are 300 power years of operation (0.7*428). The surveillance requirements on the RCCAs are to test these assemblies for movement every 2 w:eks, with a maximum time of 20 days, or 12 tests during operation. In addition, the average number of transients per year over this time period is approximately 8 in NUREG/CR-3862 (Reference 26) and each plant must test the RCCAs during each , refueling (0.5/ year). Therefore assuming at least 20.5 demands on the cc,ntrol rods per year and an average of 45 control rod assemolies per plant for Westinghouse plants, there are:
(300 operation years)*(20.5 demands / assembly year)*(45 control assemolies/ plant) = 2.77x10+5 demands.
Os27tlo/010989 6-6 s
C
There are O failures /2.77x10+5 demands for more than 1 assembly (RCCA) failing due to mechanical failures. Assume a 0.5 chance that the next failure would be the failure of multiple rod assemblies; then the failure of more than on) would be:
-6 per demand.
5.0x10 -1/2.77x10+5 = 1.8x10 The total unavailability of the reactor trip function is failure of the breakers and signal (1.44x10-5) + failure of the control rods to insert (1.8x10-6) or:
1.44x10-5 + 1.8x10-6 = 1.62x10-5 ,
The manual scram action would be successful if there are not gross mechanical
. failures in the rod system or if the breakers have not failed. Ninety percent of the calculated unavailability of the RPS is due to common cause failure of the breakers, including failure of the undervoltage coil and the shunt coil.
Hence there is only a 10 percent chance that the. manual scram function (signal) would succeed. Therefore the possible actions are partitioned as follows:
Failure of the breakers: 1.3x10-5 (90% of 1.44x10-5)
Failure in signal portion: 1.4x10-6 (10% of 1.44x10-5)
-6 Mechanical failures: 1.8x10 ,
-2 per demand (Reference 27) is assigned A human error probability of 1.0x10 for the operator failing to initiate a manual trip or drive the control rods into the core within one minute. This human error probability is based on the familiarity of this action, control room indications and the fact that no problem solving is involved. Therefore, failure to initiate manual scram is modeled as the probability that the breakers or mechanical scram portion has not failed but the signal has failed and the operator fails to initiate the manual scram action. Failure of manual scram is:
1.4x10-6*1.0x10-2 = 1. x10-8 ,
I l
0527x.lo/010989 8-7 j l
i Failure to trip the reactor (RT) is: (failure of breakers) + (mechanical failures) + (failure to initiate manual scram), or failure of RT is:
1.3x10-5 + 1.8x10-6 + 1.4x10-8 = 1.5x10-5 ,
l i
The failure of RT used in the base case and reported in Section 4.6.2 is:
RT = 1.5x10 -5 ,
B.4 MANUAL ROD INSERTION (MRI)
If the reactor trip function fails (RT fails), the operator will use the rod control system to start to drive the rods into the core. If the rod control is in the automatic. mode, the rods will start to insert automatically and the procedures may then instruct the operator to continue the rod insertion manually. If the control rods are not in automatic control, the operator will immediately start to insert the rods manually.
A human error probability of 1.0x10-1 is assigned that the operator will fail to insert the control rods manually within the next minute. Failure to drive the control rods into the reactor is modeled as the probability that the L
breakers have failed (manual scram fails) and mechanical faults in.the control rods have not occurred, but the operator fails to initiate the manual rod insertion. The failure of the manual rod insertion action is:
1.3x10-b*1.0x10'1 = 1.3x10-6 ,
The joint failure of reactor trip and manual rod insertion is: -(failure of l
manual rod insertion) + (failure to initiate manual scram) + (mechanical failures), or 1.3x10-6 + 1.4x10-8 + 1.8x10-6 = 3.1x10-6, osa7rio/oiosas B-8
1 l
l The conditional probability that manual rod insertion fails, given RT fails (the joint failure of reactor trip and manual rod insertion / failure of RT), is: l
)
-6 3.1x10 /1.5x10-5 = 0.21.
i l
Failure of MRI used for the base case and reported in Section 4.6.5 is:
MRI = 0.21.
There is uncertainty in this number. If the failure of the operator to initiate manual rod insertion is changed to 5.0x10 , the joint failure is
~1 and the (1.3x10-5)*(5.0x10-1) + 1.4x10-8 + 1.8x10-6 = 8.3x10-6 conditional probability that MRI fails is 0.554. On the other hand, if the control rods are in automatic mode, the joint failure, ass'uming an
-3 unavailability of the rod control system of 1.0x10 , is 1.0x10~3*1.3x10-5 + 1.4x10-8 + 1.8x10-6 =and failure of 1.83x10-6 MRI is 0.121.
The upper bound (0.554) and lower bound (0.121) are used in sensitivities and the results of the sensitivities are reported in Chapter 5. The criteria for MRI is also reported in Chapter 5.
B.5 ATWS MITIGATING SYSTEM ACTUATION CIRCUITRY (AM)
Three different designs have been approved for ATWS Mitigating System Actuation Circuitry (Reference 17). This system has not been specifically modeled using fault tree analysis. A review of the unavailabilities of signals determined from the analysis of the reactor protection instrumentation system in WCAP-10271 (Reference 22) indicates that the maximum unavailability
-3 On this basis, an of one signal train was less than 5.0x10 .
unavailability of 1.0x10 -2 is assigned for AMSAC for this study. This unavailability is conservative with respect to the unavailabilities of one signal train and the design criteria applied to AMSAC by the Westinghouse Owners Group. ~
Os27x:1o/010989 B-9 1
Failure of AM used for the base case and reported in Section 4.6.6 is:
AM = 1.0x10
-2 ,
B.6 AUXILIARY FEEDWATER (AF)
The unavailability of auxiliary feedwater will depend upon the substructure of the' event tree: l l
- 1. unavailability, with no reactor trip and initial power level less than 40 percent,
- 2. unavailability, with no reactor trip and initial power level greater
- than 40 percent, l
UET as a function of plant configuration depends on the availability of auxiliary feedwater. Specifically, UET is calculated with full auxiliary fcedwater flow (AF2) and 50 percent auxiliary feedwater flow (AF1).
(
Domestic PWRs have had an auxiliary feedwater analysis performed as a result of NUREG 0737 (Reference 28) requirements or NUREG 0611 (Reference 29) analysis. Based on previous PRAs and the IPE analysis of an auxiliary feedwater system with 2 motor-driven and I turbine-driven pumps, the unavailability of either the turbine driven pump or 2 out of 2 motor driven '
pumps is less than 1.0x10 -3 , therefore, an unavailability of 1.0x10 -3 is a conservative value for this criterion and is used in the event tree for the unavailability of AF.
A typical value for the unavailability of the turbine driven pump is'in the range of 3.0x10 -2 to 4.0x10 -2 . If a mean value of 3.5x10 -2 is utilized for.the failure of the turbine driven pump,. failure of the 2 motor driven pumps can be estimated as failure of AF, given failure of the turbine-driven L
pump, or 1.0x10~3/3.5x10-2 = 2.9x10-2 0327m:1o/010989 B-10
Two auxiliary UET depends on the availability of auxiliary feedwater.
If all auxiliary feedwater is feedwater values are used in the event tree.
available (100 percent flow), AF2 is addressed. Failure of AF2 is failure of either the turbine-driven pump or the 2 motor-driven pumps or the joint failure of both: ,
-2 AF2 = (1-3.5x10-2)*2.9x10-2 -2 + (1-2.9x10-2)*3.5x10 ;
(2.9x10-2*3.5x10-2) = 6.3x10 ,
if only the turbine-driven pump or the 2 motor driven pumps fail, there is still the possibility of adequate pressure relief if the remaining pump (s) are available (50 percent flow). The conditional probability that all pumps fail, given that one has failed is failure of both motor-driven pumps and the turbine driven pump, given the failure of either both motor-driven pumps or
-3 the turbine driven pump, or AF1 = AF/AF2 = 1.0x10 /6.3x10-2 = 1.6x10-2 ,
Therefore, if AF2 fails, AF1 representing the criterion of either the 2 i
motor-driven or the turbine-driven pump available is addressed with a conditional probability of failure:
~2 AFl= 1.62x10 .
4 If AF1 succeeds, pressure relief capacity changes from that calculated for AF2. If AF1 fails, then auxiliary feedwater flow is not enough and the sequence results ia core damage.
The failures of auxiliary feedwater used in the event tree and reported in Section 4.6.7 are:
~3 AF,(power < 40%) = 1.0x10
~2 AF2-(power > 40%, 100 % flow) = 6.3x10
-2 AF1 (power > 40%, 50 % flow) = 1.6x10
'I
~
0527m:1o/010989 0-11
Success of AF2 requires that all auxiliary feedwater pumps are available and success of AFI requires that either the turbine-driven pump or both motor-driven pumps must be available.
B.7 PRIMARY PRESSURE RELIEF (PR)
As discussed in SECY-83-293, the basis for the final ATWS Rule, a criterion
.that has been established for Westinghouse plants for demonstrating acceptable results due to an ATW event is a peak reactor coolant system pressure limit of 3200 psig. This value corresponds to a conservative bound for the ASME Boiler and Pressure Vessel Code Level C service limit stress criterion as determined for all the components that comprise the primary reactor coolant system of Westinghouse plants.
Based on the above criteria, previous analyses of ATWS events (e.g.,
Roferences 7 and 8) focused on establishing the range and sensitivities of various plant parameters and conditions with respect to peak RCS pressure during ATWS transients and to demonstrate compliance with the limit. The ATWS analyses results show that in addition to the availability of a secondary heat sink, there are two key conditions that significantly influence RCS pressure; RCS pressure relief capacity and reactivity feedback. Furthermore, these results show that there exist possible combinations of these two conditions that can result in peak RCS pressures in excess of 3200 psig. This fact has been recognized by the NRC in the final ATWS rulemaking and is a fundamental reason for addressing ATWS on a core damage frequency basis and for including the event tree node NTC Overpressure in the NRC model presented in SECY-83-293 (discussed in Section 3.0 of this report). MTC Overpressure in the NRC model is defined as the fraction of time per reactor year that reactivity feedback conditions are such that the peak RCS pressure will exceed the stress criterion. As an example, for non-turbine trip transients, a MTC overpressure value of 0.1 was assigned in the NRC model presented in SECY-83-293. This
-implies that for 10 percent of the time, the reactivity feedback conditions are such that the peak RCS pressure would exceed the pressure criterion.
{
0927mlo/010989 6-12
. j 1
The PR node addressed for the event tree presented in this report is The synonymous with the MTC Overpressure node defined for the NRC event tree.
fundamental differences between them are the components and methods used to determine the appropriate values.
PR is However, the PR node is more complex than the MTC Overpressure node.
dependent upon a number of variables, including:
o ATWS initiating event, o initial power level, o time in cycle life that transient occurs, o reactivity feedback as function of cycle length, or as unfavorable exposure time (UET),
o auxiliary feedwater flow, ,
o pressurizer pressure relief and safety valve capacity, and o manual rod insertion.
The impact of peak RCS pressure, due to reactivity feedback, improves with time. That is, during ATWS transients, reactivity feedback effects due to moderator density, Doppler power and Doppler temperature, result in higher RCS pressure transients at the beginning of any given cycle than they do at end of cycle. However, this relationship is not linear with respect to cycle length.
The capacity to relieve RCS pressure is an important factor during postulated ATWS events. This capacity depends on the availability of the power operated relief valves (PORVs) and safety valves (SV). Although there is not a significant variation in the configuration of these devices among Westinghouse plants, (i.e., in regards to total relieving capacity), a variation in the available relief capacity at any given time can exist due to possible periods l of operation with the PORVs blocked. ,
1
~
1 I
l 0527x.1o/010989 B-13
l Both reactivity and pressure relief capacity are factored in to the probability value for the PR node by determining an unfavorable exposure time (UET). UET is expressed as the time during cycle life that the combination of reactivity feedback and RCS pressure relieving conditions will not be sufficient to prevent peak RCS pressure exceeding the stress criterion.
A description of the method to establish UET values will be given before the details of the calculations to determine PR.
B.7.1 ATWS Critical Power Trajectory Methodolooy As mentioned earlier, prior Westinghouse analyses of ATWS events (Reference 7) exist that focus on various plant parameters and conditions and how they influence peak RCS pressure during the transient. These analyses also established the acceptability of using the reference plant configuration derived from a composite of typical parameters to conservatively bracket all Westinghouse plants. The reference Westinghouse plant is defined to be a 4 ,
loop, Model 51 series steam generator plant. In addition, the results of these analyses established the limiting ATWS transient with respect to peak RCS pressure. This event is'the loss of electrical load and/or turbine generator trip event. In the ATWS analysis of the loss of load event, the loss of the turbine condenser vacuum was also conservatively assumed. This latter assumption results in the loss of the turbine driven main feedwater pumps, and, therefore, a coincidental loss of main feedwater flow. This loss of main feedwater coincident with the loss of load event results in more limiting peak RCS pressures than the loss of normal feedwater ATWS event.
Using the results of this limiting ATWS event for the reference plant configuration, the reactivity feedback conditions required in the transient analysis to yield a peak RCS pressure equivalent to 3200 psig, are determined for various RCS pressure relief capacity conditions. Since the transient analysis uses relatively simple point kinetics modeling, the transient model reactivity feedback conditions must be transformed into equivalent steady state reactor conditions to allow comparison with steady state core evaluation models generated using multi-dimensional neutronic modeling. The approach of Os27x:1o/010989 B-14
transforming transient analysic reactivity feedback conditions for comparison at steady state conditions is possible since the limiting ATWS transients are characterized by a relatively slow heatup and pressurization of the RCS and the conditions at important times during the transients have been demonstrated to be quasi-steady state.
With the transient reactivity feedback conditions transformed for various RCS
pressure relief capacity conditions, the reactor heatup shutdown characteristics, or critical trajectory, are determined for each pressure relief capacity. These resulting critical trajectories, which are in the form l of steady state reactor power versus inlet coolant temperature, represent the locus of conditions (power vs. Tin) that result in a peak RCS pressure of 3200 psig in the transient analysis of the limiting ATWS event for the reference plant configuration. The critical trajectories for the loss of load limiting ATWS event are shown in Figures B-1A through B-1F.
To perform a core specific evaluation, the reactor specific statepoint analysis uses core models appropriate to the heatup and pressurization ,
conditions being analyzed and on a consistent basis with the reactor condition transformation described earlier. Multi-dimensional core models were used to evaluate the heatup shutdown characteristics and are the same models used for the nuclear design of Westinghouse cores. Core specific heatup shutdown characteristics are generated with such models considering: (a) initial conditions are assumed to nominal equilibrium conditions (HFP, ARO, equilibrium xenon), (b) a power search is performed for criticality conditions as a function of core inlet temperature and, i.f appropriate,-RCCA position (for MRI), assuming a pressure of 3200 psig.
The resulting calculated critical state powers are compared to the critical trajectories established from the transient analysis. This comparison will show any core design conditions (in terms of power versus inlet temperature) !
that are greater than the transient conditions (e.g., those which would result in peak RCS pressure exceeding the stress criterion). Unfavorable Exposure Time (UET) is determined by7 omparing the calculated critical power with the limiting value derived from the transformation for a given inlet temperature.
0527r1D/010989 B-15
in other words, the UET is that time during the core cycle life that the core design critical trajectory is greater than the transient critical trajectory (i.e., available core reactivity feedback is less than the reference analysis). The value of UET is obtained from the intersection of the curve with the O power excess point. UET evaluations are presented in Figures B-2A through B2-F.
B.7.2 Ouantification of PR Based on the previous discussion, PR addresses the occurrence of RCS pressure in excess of 3200 psig. The PR event tree node depends on the reactivity feedback as a function of cycle length, primary pressure relief capacity (availability of PORVs and safety relief valves), and distribution of transients as a function of cycle life. For conditions under which the peak RCS pressure can exceed 3200 psig, UET is defined as the time during cycle life when the reactivity feedback will not be sufficient to prevent an RCS pressure > 3200 psig. UET also depends on successful manual rod insertion and amount of auxiliary feedwater flow. For conditions of known zero UET, i.e., with main feedwater available or for events initiated at initial power levels less than 40 percent, this event tree node is not ad'ressed.
d Using the methodology outlined in Section B.7.1, UET values must be determined for the following conditions:
- 1. UET calculated for successful manual insertion of control rods for one minute for all events initiated at initial power levels greater than 40 percent with main feedwater unavailable and 100 percent auxiliary feedwater flow.
- 2. UET calculated for successful manual insertion of control rods for one minute for all events initiated at initial power levels greater than 40 percent with main feedwater unavailable and M percent auxiliary feedwater flow.
- 3. UET calculated for failure of manual red insertion for all events initiated at initial power levels greater than 40 percent with main feedwater unavailable and 100 percent auxiliary feedwater flow.
0527m:1o/010389 B-16
- 4. UET calculated for failure of manual rod insertion for all events initiated at initial power levels greater than 40 percent with main feedwater unavailable and 50 percent auxiliary feedwater flow.
.Each of the four UET calculations must also be provided with pressure re lief capacity of 2 PORVs, 1 PORV and no PORVs. The three safety valves are also required for each PORV requirement.
UETs for an 18 month cycle core design were used for the base case for this analysis. As a sensitivity, a projected 24 month cycle core design was evaluated. If the PORVs are designated as blocked, this means that the block l
valve will not open on the same signal that opens the PORVs.
The UETs for each condition and each core design are:
Base Case (18 Month Cycle Core)
Days in 18 Month Cycle Requiring PORVs O PORVs 1 PORV 2 PORVs Blocked Blocked Clocked Condition With MRI, all aux feed 0.0 0.0 76.3 With MRI, half aux feed 0.0 18.9 82.6 No MRI, all aux feed 81.7 138.9 192.9 No MRI, half aux feed 110.7 154.8 209.1 Sensitivity Case (24 Month Cycle Core)
Days in 24 month Cycle Requiring PORVs O PORVs 1 PORV 2 PORVs.
Blocked Blocked Blocked Condition With MRI, all aux feed 0.0 124.5 177.7 With MRI, half aux feed 81.0 136.8 197.4 No MRI, all aux feed 134.6 193.0 257.6 J
No MRI, half aux feed 160.2 210.5 280.0 es27,;1o/otosas 8-17 t
-_2____-________________-___-_______ _
)
The UETs are calculated based on real time days for the worst case transient, loss of load with loss of main feedwater. The operating capacity factor (assumed to be 85% for the above UETs) must also be factored into the real time UET calculations.
The UETs in the above tables must be adjusted to account for the frequency of transients as a function of cycle life. The number of transients (loss of main feedwater and all partial losses) with initial power levels greater than 40 percent from WCAP-10405 (Reference 24) as a function of cycle life are:
B Cycle Life Number Fraction i
Cumulative Fraction i 0-1.1 9 4.2x10 -2 4.2x10 -2 1.1-5 29 1.4x10 ~1 1.8x10
-1 5.1-12 1.2x10 ~1 25 3.0x10 -1 12.1-25 29 1.4x10 -1 4.3x10
~1 25.1-50 45 2.1x10 ~1 6.4x10
~1 50.1-75 2.0x10 ~1 43 8.5x10 -1 75.1-100 33 1.6x10 ~1 1.0 This distribution is over a 12 month cycle. Safety injection events are not included in this distribution as these events occur randomly during the cycle life and are not correlated with the time of cycle life.
The number of feedwater related transients is much higher in the first months of operation after refueling, or equivalently, the probability of a transient is much higher in early core life. For example, thirty percent of the transients occurred in the first 12 percent of core life. This means that the probability of core damage associated with ATWS events is greater early in core life. If the event tree were quantified on a monthly basis, the number of transients would change (decrease with cycle life) and the probability would change as a function of the number of transients. To adjust for this change in the number of transients, the percent of cycle life was converted to months and the number of transients was normalized to fraction of transients in each month from the above table. The occurrence of transients is assumed Os27x:1o/010989 0"10
i to be a function of plant operation and not a function of the reactor core, therefore, the fraction (or probability) of a transient in the early months would be essentially the same for a 12 month cycle, 18 month cycle or 24 month cycle. The fraction of transients in each time interval, after 12 months, is l
assumed to remain constant for either an 18 month cycle or 24 month cycle core design. Using a constant fraction, the fraction of transients was expanded to 24 months. The cumulative fraction of transients at each point in time (months) is then equivalent to the fraction of transients at that time in cycle life.
This cumulative fraction of transients in that fraction of calendar time is defined as transient time. Therefore, there is a one-to-one correspondence between the transient time and calendar time. Because UET time is also in calendar months, UET may be converted or adjusted to transient time; specified as " adjusted UET". UET time (in calendar months), the fraction of transients in each interval and the cumulative fraction of transients are given in Table B-3. The fraction of transients are accumulated for one year and then (based on a constant fraction in each interval), accumulated again for the second year. This allows the calculation of UET for the first year and UET for any l part of the second year (6 additional months for an 18 month fuel cycle or 12 j
additional months for a 24 month fuel cycle). The adjusted UET necessary for the calculation of PR may be interpolated from Table B-3 for the two time l 4
periods. PR is then averaged over the total cycle time to calculate the l average PR per year.
As an example, for the base case (18 month cycle) with no manual red insertion and 100 percent auxiliary feedwater flow, the supplied UET for 0 PORVs blocked is 81.7 days (2.69 months), the UET for 1 PORV blocked is 138.9 days (4.57 l months), and the UET for 2 PORVs blocked is 192.9 days (6.34 months). From Table B-3, 2.69 calendar months of UET is equivalent to interpolating the cumulative fraction of transients between 2 and 3 calendar months as 0.3446 +
(.69*.0.0873) = 0.405 year. The cumulative fraction, 0.3446 is the cumulative fraction of transients in one year corresponding to 3 calendar months (or UET months). Interpolating for1 .57 UET calendar months, the adjusted UET is 0.5023 - (.57*0.0704) = 0.542 year, and interpelating for 6.34 UET calendar months, the adjusted UET is 0.6432 + (.34*0.0673) = 0.666 year.
I 0527x:1o/010989 B-19
Table B-3 UET Versus Cumulative Fraction of Transients in the UET Period (Transient Time)
Month Fraction of Cumulative Fraction (UET) Transients of Transients
- 0.12 0.0423 0.0423 0.6 0.1362 0.1784 1 0.0559 0.2343 2 0.1104 0.3446 -
3 0.0873 0.4319 4 0.0704 0.5023
~
5 0.0704 0.5728 USED FOR 6 0.0704 0.6432 FIRST YEAR 7 0.0673 0.7105 8 0.0673 0.7778 9 0.0673 0.8451 10 0.0516 0.8967 11 0.0516 0.9484 12 0.0516 1.0000 13 0.0516 0.0516 14 0.0516 0.1033 15 0.0516 0.1549 16 0.0516 0.2066 17 0.0516 0.2582 USED FOR 18 0.0516 0.3099 SECOND YEAR 19 0.0516 0.3615 20 0.0516 0.4131 21 0.0516 0.4648 22 0.0516 0.5164 23 0.0516 0.5681 24 0.0516 0.6197
" transient time (fraction of year) 0927m 10/010989 B-20
The UET for 0 PORVs blocked means that for the adjusted fraction of cycle life (0.405), the pressure relief capacity is not sufficient and the 3200 psig peak pressure would be exceeded. This is designated as " none are enough" (to relieve RCS pressure). The adjusted fraction of UET cycle core with 1 PORV blocked (0.542) means that for this fraction of cycle life, 1 PORV will not be sufficient relief capacity and the 3200 psig peak pressure would be exceeded.
I But for the portion of this time beyond the first 2.69 months, 0.542 - 0.405 =
0.137 year, 2 PORVs (O PORVs blocked) would provide sufficient relief capacity. This is designated as "2 PORVs are required" (to relieve RCS pressure).
The adjusted fraction of UET cycle life with 2 PORVs blocked (.666) means that for this fraction of cycle life, 2 PORVs blocked (or only the safety relief valves available) would not provide sufficient relief capacity and the 3200 psig peak pressure would be exceeded. But for the portion of this time beyond the first 4.57 months, 0.666 - 0.542 = 0.124 year, 1 PORV (or with 1 PORV blocked) would provide sufficient relief capacity. ,This is designated as "1 PORV required" (to relieve RCS pressure).
There is no UET for the remaining fraction of cycle time (1-0.556) = 0.334 year. This is designated as "O PORVs required" (or the safety relief valves are enough to relieve RCS pressure), i However, for each PORV case, even if the PORVs are not blocked, there is still the possibility that the PORVs would fail to open due to other causes. The l safety relief valves may also fail to open.
The adjusted UETs calculated in the above paragraphs are for the first year of j
operation. A constant fraction in each time interval is assumed for the tecond year. Therefore, for the remaining 6 months of an 18 month cycle design, there is no UET and only the safety relief valves are required. From j
Table B-3, the cumulative fraction (transient time) for the remaining 6 months f is 0.31. ~
0527x:1o/010989 8-21
PR is then calculated as the probability that RCS pressure relief fails. This calculation depends on the pressure relief requirements over the cycle life.
If the UET is designated as none are enough, then the probability that RCS pressure is exceeded is 1.0. For the remaining cases, random failures of the PORVs and safety valves will fail the pressure relief requirements.
The type of plant modeled for this analysis is one with 2 PORVs and 3 safety relief valves (SV). A failure of 5.0x10 -3 was assigned for the failure of the PORVs and the safety relief valves to open on demand, given that the PORV(s) is not blocked. The failures (or unavailabilities) are:
Recuirement Failure 2 PORVs and 3 SV 2.5x10
-2 1 PORV and 3 SV 2.0x10 -2 3 SV 1.5x10
-2 1
The calculation for the example is as follows:
First Year Fraction Failure of of Year (PORVs Required) Failure Relief Capacity Probability year 0.405 (none are enough) 1.0 0.405 0.137 2 PORVs 2.5x10 -2 3.4x10 -3 0.124 1 PORV 2.0x10 -2 2.5x10 -3 0.334 -2 0 PORVs 1.5x10 5.0x10 -3 Total 0.420 Second Year Fraction Failure of of Year Failure (PORVs Recuired) Relief Caoacity Probabil-:ty year C.31 0 PORVs 1.5x10 -2 4.6x10 -3 Os27x:lo/010989 B-22
The fraction of year listed in the first column is multiplied by the failure listed in column 3 (corresponding to the requirement in column 2) to calculate the failure probability of PR at each adjusted UET interval in the cycle life. The failure probabilities in column 4 are then added for each year to obtain the total probability that PR will fail in each year. The mean failure l probability is then normalized to one year.
The mean failure probability of PR for an 18 month cycle is:
-3 year)/(1.5 years) = 0.280 (0.420 year +4.6x10 l PR was then calculated under two conditions for all cases presented in this report: both PORVs available when required and no PORVs available when required (blocked). The safety valves are assumed to always be available with only a random failure assumed. The weighting calculation illustrated in the above example was applied to all cases with the assumption that no PORVs are blocked during the fraction of cycle life when they are required for pressure relief capacity and with the assumptions that PORVs are blocked during the .
fraction of cycle life when they are required for pressure relief capacity.
For this calculation, all failures of relief capacity with PORVs required are 1.0. The failure of PR for each case is:
l Base Case (18 Month Cycle Core)
Both PORVs No PORVs Sensitivity PR Condition Available Available Case
-2 -2 With MRI, all aux feed 1.5x10 0.269 1.5x10 PR1 -2
-2 0.281 1.5x10 PR2 With MRI, half aux feed 1.5x10 No MRI, all aux feed 0.280 0.450 0.450 PR3 No MRI, half aux feed 0.328 0.474 0.474 PR4
.The sensitivity cases listed assumed that 2 PORVs were available for 19 days and 1 PORV was available for 3 months. This is only one possible combination of time with 2 PORVs and 1 Jt0RV available for part of the cycle. However, the ,
l UETs for PRI and PR2 have the same value in this sensitivity case as k
0527n:1o/010989 B-23 l
calculated for the case with all PORVs available when required and PR3 and PR4 have the same value as the upper bound case. If manual rod insertion were successful in this scenario, the probability of core damage would be reduced.
This sensitivity as well as the case with an upper bound on MRI is reported in Chapter 5.
1 Srnsitivity (24 Month Cycle Core)
Both PORVs No PORVs PR Condition Available Available PRI With MRI, all aux feed 1.5x10
-2 0.323 PR2 With MRI, half aux feed 0.211 0.345 PR3 No MRI, all aux feed 0.275 0.441 PR4 No MRI, half aux feed 0.305 0.434 Both PORVs available when required is the best case and rio PORVs available when required is the worst case.
There is a distribution between these values that will depend upon the availability of the PORVs (not blocked).
The case with no PORVs available when required (PORVs blocked when required) is used in Chapter 5 as a sensitivity and the results of the sensitivities are reported in Chapter 5.
1 B.8 LONG TERM SHUTDOWN (LTS)
The event tree node, long term shutdown, addresses the ability of the l operators to trip the MG sets locally, start emergency boration via the CVCS I
or borate the RCS with the high pressure pumps via the RWST. In addition, the operators will continue to drive the control rods in manually. Failure of LTS is modeled as failure of the operators to borate the RCS and failure of the operators to trip the MG sets locally. A human error probability of 5.0x10 -2 (Reference 30) is assigned for failure of the operators to initiate boration. If the operators failed to initiate boration of the CVCS, there is an increased probability that the operators will fail to trip the MG sets. A 0327m:1o/010989 8-24
l 1
~1 is assigned for failure of the operators human error probability of 1.0X10 to trip the MG sets, gwen that the operators f ailed to initiate boration of {
l the RCS.
The joint failure of both actions is 5.0X10-2*1.0x10-1 , or
-3 .
LTS = 5.0x10 .
l This node is only addressed if pressure relief (PR) is not required or PR is l' i
successful. i B.9 CONTAINMENT HEAT REMOVAL (CHR)
Containment Heat Removal will depend upon the plant specific systems such as:
containment fan coolers, containment spray system or the ice condenser. The containment spray system is modeled in this analysis. A system unavailability J
~4 of 5.0x10 is assigned for failure of the containment spray system and a human error probability of 1.0x10-3 (Reference 31) is assigned for failure '
of the operator to initiate and complete the action. The unavailability of containment heat removal is:
-3 CHR = 5x10-4 + 1.0x10-3 = 1.5x10 ,
1 i
i 0527x.1 o/010989 B-25
3.2 3.1 3
2.9 -
2.8 -
2.7 -
2.6 -- t 2.5 i "a 2.4 \
- 2.3 \
$j 2.2 \
l
- s. O 2.1 - \
l
$$ 2 N ,
[$ 1.9 \
1.8 - \
1.7 - \
i 1.6 - \
1.5 h i 1.4 \
1.3 1.2 \
580 600 620 640 1
Core Inlet Temperature (Deg-F)
Figure B-1A ATHS Critical Power Trajectory -
Loss of Load ATWS, 2 PORY Available, 100% Aux. Feed 052 /m:10/101388
+ -----__-----_____
N .
h
\ d e
h F e
x
\ A u
\ %
0 0
1
\ l e
\ O E yi b
l a
h G )
F g
ra ov tA c
eV e
\ (
D jR T
aO rP 1
e N r u
r e
wS t oW a
N r e
PT l
ad A
p ca N m e
io tL i
rf T Co N t l
e Ss Ws n T o 0 Al K 0 G
T e
r B 1
o N C B e
r u
g i
F N 8 8
0 3 1
0 0 i
j - 5 1
/
D 54 3 21 1 1 21 9 07.*5 4 3 2 1 29 101 7.1 1 G.
1 1 1 1 1 7 m
33 2 2 2 z2 22 2 2 2 5
0 hgg0
^h[fys. eb mb$
\
3.2 3- -
2.0 2.6 2.4 3 vm nj 2.2 h
Cn n Sg 1.0 uv to G yy 1.6 1.4 1.2 1
0.0 500 GOD G20 G40 Core inlet Temperature (Deg-F) figure B-IC ATWS Critical Power Trajectory -
Loss of Load ATWS, O PORY Available, 100% Aux. Feed 0527m:10/101388 -
-_ -m
l l1 )
1 0
4 G
\ d e
e F
x u
A 0
5 e
l O b a
E l N G )
F-yi ra ov tA g c N (
D e eV jR aO rP e T 2
r r t
u e ,
wS a oW x r e
PT A
p l ad
\ T m
e io i
ca tL rf t Co l
e Ss 0 n Ws T o I
0 AL 1 0 e r 0 o 1 C -
B e
r u
\ i F
g x
N 8
0 5 k 0 3 1
(
5 0 1
/
- 7. G. 5 4 21 /
0 21 9 O 7. 6 54 3 2 t 3 9
1 10 1 1 1 1 1 1 1 3 3 2" 2 2 2 2 2 2 7 2
m 5
0
- 9e ad" 0L tsjy "4*
l , lIl ll
i
! \
2.9 '
2.8 - s 2.7 \
2.6 2.5 -
^ 2.4' 2.3
[m 2.2 \
fc. 2.1 2 N 1.9 -
\
O 1.8 \
I 1,7 h 1.6 h 1.5 -
\__
f 1.4 \ (
1.3 \
1.2 \
1.1 \
0.9 1 \ Il 580 600 GEO G40 Core Inlet Temperature (Deg-F)
Figure B-1E ATWS Critical Power Trajectory -
Loss of Load ATWS, 1 PORV Available, 50% Aux. Feed 0527m:10/101388
= _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
jl ll!l 3
0 4
3 6 x
\ d F
e e
x u
A 0 _
5 _
0 l e _
I 2 b _.
6 ) a l
yi F-ra -
g ov
\
e tA c
D eV
( jR aO e rP r T x
\ t u
a r
r e
wS oW O
e PT p l A
m ad ca e i o T tL i
t rf e
l Co N 0 0
6 n
I e
r Ss Ws T o Al o
C F I
B e
r u
g i
F
\
0 8 8 8
R 5 3 1
3 2 6 4 2 1 8 6 0 1
2 3 8 6.42 3 2
'1 1 1 0 U
/
0 3 2 2 1 m
7 2
5 0
gc@E5" G
m9.v bhS 5U L m
I>ll! !Ilj l ll}l lll iIIll tcl
t 5
X e
o o
- e CQ
)
/ -
/ i E
en'?
82 i
$ 75 O
- i
/ '
k z To 4 at D d
/ = / '
/ S g
m:
/ % / p E$
he w 4 N
c
) {w .9 vi
/ / /A o o
y %?
3 x 3<
/ / 4 m C "
EE
/ h o
- $t mm 9 A t 58
, 4 <a l N 4 e 1 8 a
3 .l"
_ . o m C
e o e o o o o o o 2 :
o o o o o o o o g ra e2 w w eg o w e o -
j 1 i l i i " R E
k (g) ssaox2 .zanod U E i
B-32 '
l 1
I l
1 I
l N
x 0
C o
- O N
<3 l .:c I
%i A
ae 3 o S 7
/ /
/ $
N N
oY 28 SS
- c
- O Ei N .a 3 A
v cv e eC F
/ V T5 e' #
- c
- y. .? d f ! [
k .E
/ /
5
=
4
/ C z w3 23 y / @
" Ow 4 .::) O
)
T e
Y, D
4 m +
mm Eo
<a
\ H 1 ES 5
4 a.
.2 e '
5 3
e o
f C C C C o o o o e 3 E O C o o o o e g O C C C C
~ + N n w c e C
- n N ' I i i l i
- g '
o I
O g (xx) sesora xmd i l
B-33
, m M
m C
o o
- c N
/ f .
D
/ lll
&T 82 o m
/
/ - o X
X ,;
TJ da o
/ e3 To D $ $'
~
- 6 %5 w /, / I
,=
==
c' 7 it m L8 o n.
2 }' e S vi 6 / o M
'
- x %E
/ t*
k /
/ o 2
3*
El y e "3 C bo w * $0 s %3 Y
m 3
S e
- o .!'
e w e o o e o o o e o o 3 o o o o o o o o o e e,,
g
- O CJ w w ca n , o w o i l i i i O
iii O g (EN) SEGOIS Jmd 8
l B-34 l l
l i
O a N
2 C
C C +
/ C3 N 4
- I Q
e-- C *
/ / O C
a N
35 F"
/ /
% ei D Et S m:
/ ./ / f *$
is X
/ F on
~
C c C
?vi
} c E $$
/ / / @ "
/ / i 2 li-a -
- et t
C s N f 2 4 ~ +
i b $
(J a.
, 3 O
c
- C ,,
I C C C C C C C C 2 p, C C C C C C C o O C C C T Y $ i Y h i
2 D o (g}ssoorsJe d B-35
~
M M
C e
o
- n N
[
i
' E EE I t
l -f /
f 2 o S
-x
/ / / o
- EE
/ j/ /
E To hs si i
Z_5 l / . s / 5
/ Ys
/ 5 "i e-g
/ s c & Y l
/ i n /
/ I e
fi a
4 E
~
/ +
Es
( ) N w E 7 q =
J E ,
S a
- . o C o '
o o o e o o o o o o 2 =
$ $ $ $ 3 3 8 $ $ e E I I I i
- o
?
(m) ssacra .xmd O B-36
a- mA-, ,
=
0 C
o *
' 5 lll
&v 8 1 Q"
/ O O
m ;g
/ / -
50 e
e o'
/ / /
/ g 22
- E Y/ / / E $>
d /
!$ C o a Q O bh ff$ ,8 E EE d
$ i?
wo
?C ic s
$o i< s u
t + 1.s Id n
lie
- a.
E il &
c O
i
, ,. , I C C C C C C C C 2 =
C C C o e o o o o o o o o ,4 ea n
- c 10 m
c
- n ca .
I i l l l $
s o
T.
N (M) SSGOX3 .IMd B-37 l
__ _. . _ -I