ML20099D528
| ML20099D528 | |
| Person / Time | |
|---|---|
| Site: | LaSalle  |
| Issue date: | 07/31/1992 |
| From: | Payne A SANDIA NATIONAL LABORATORIES |
| To: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| CON-FIN-A-1386 NUREG-CR-4832, NUREG-CR-4832-V01, NUREG-CR-4832-V1, SAND92-0537, SAND92-537, NUDOCS 9208060095 | |
| Download: ML20099D528 (130) | |
Text
_
l NU REG /CR-4832 SAND 92-0537 Vol.1
]~Z ]
Analysis of Se LaSale Uni: 2 Nuc~ ear Power Plan"::
Risk Methoc s In:egration anc.
Eva uation Program (RMIEP)
Summary l'repared by A. C, l'ayne, Jr.
Santlin National Laboratories Operated by -
Sandia Corporation Prepared for U.S. Nuclear Regulatory Commission L
$ggeoggggojoo
- 4 P
ww-e+-
v-e-**1,yg
-,y g=.w we-pe=+=ew
- mW a--*
v c-v; Mew--r md em.-w-ar n; 3 --#W T T-'
y qw we Msa
,g.-wi 9 ' rrn v 'p q y e'
rt m T w $ y-@wFPTW'-*+4r -r j'T v-*-to-P'**"N-v"T' y
-7v""MP
e AVAIMBILITY NOTICE Aasatisfy of netwerte MatorWs CtwJ in NRC Putacatione Mott documents cited in imC pubbcations Mll be avpable from one of the fobowing sources:
1.
1he NRC PutAc Document hoom, 2120 L Street NW,, Lower Level. Weshington, DC 20555 2.
The Superhtendent of Documents U S. Goverrvnent Prhting Off ce. P.O. Box 37082. Washbyton.
DC 200134082 3.
The National 1tchnical lnformation Serme, $pthgfield, VA 22161 g
- r Although the 14 tog that follows reiprimerits the inajority of documents cited in NRC publications, it is not
-4.
hinnded to be exhaustwo Referenced documents available for hst+ction and copying for a fee from the NRC Pubbe Dowment Room include NhC correspondence and intamal NRC memoranda; NRC bulletintr, circulars, information riotices,
' hspection and investigation notices, licensee event reports; vendor r eports and correspondence; Commis-slon papers; and apphcant and hcensee documents and correspondence.
The following documents in the NUhtG series are avalable for purchase from the GDO Sa:es Program, format NRC staff and contractor reports, NRC.sponscred confer ence proceed.ngs, htetnat6onal agreement
- f eports, grant pubbcellonu and NRC booHe(s and brochures. Also avaliabie are regulatory guldes, NRC regutatsons in the Code of Federer Rey &chons. and Nuctrar negulatory Co'nmisvan issuances.
Documents available from tr a National Technical information Service include NUMEG-senes reports and technical repor1s prepared by other l'ederal agencies and reports ptepared by the Atonic Energy Commis-sion, forerunner agency to the Nucleat Regulatory Commission.
Dcruments avaliable from pubhc and special technical hbra tes include an open literature items, such as Federa hepister notices, Federal and State lep's:stion, and con.
books, journal articles, and trannactions.
r gressional reports can usuaDy be obtained from these hbraries
. Documents such as theses, dissertations, foreQn reports and trestations, and non-NRC conference pro-coedings are available for purchase from the orgaraation sponsoring the publicaHon cited SMc e copias of NRC draft reports are available free, to the extent of supply, upon writtt.n request to the Offece of Adminktration Distribution and Mail Services Section. U.S. Nucle ar RegJatory Commission, L
Washington, DC 20%$.
Copies of industry codes and standards used in a s,ubstantive manner in the NRC regu!ator'y process Ore maintained at the NhC Ubrary,7920 Norfolk Avenue. Dethesda Maryland, for use by the public, Codes and standards are usuMy ccpyrighted and mar be purchased from the originating organization or, if they are American Nattona! Standards, from the American National Standards institute,1430 Broadway. Np York.
NY 10018.
k DISCLAIMER NOTICE This report wa$ prorced as an a0 Count of work tsponsored by an agency of the United Statds GovernnwnL Neither the United States Govomment nor any agency thoroof, or any of thek employoos, makes any warranty, exprtissed or imphod, or assumes any ifrpl liabMy of respons!binty for any third party's use, or the results of such use.of any intormation, apparatus, product or process d:sclosed in th:2 report, or represents that its um t>y such third pyty would not infango private!y owtwj rights.
NUREG/CR-4832 SAND 92-0537 Vol.1 RX Analysis of the LaSalle Unit 2 Nuclear Power Plant:
Risk Methods Integration anc Evaluation Program (RMIEP)
Summary Manuscript Completed: March 1992 Date Published: July lo92 Prepared by A. C. Payne, Jr.
Sandia National laboratories Albuquerque, NM 87185 Prepared for Division of Safety issue Resolution Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN A1386 l
l
. ~. -..
. - =_ - -. - - -.. - -
ABSTRACT This volume presents an overview of the methodology and results of the integrated accident sequence analysis (Level I) of the LaSalle Unit II nuclear power plant performed as part of the Level III PRA conducted by Sandia National Laboratories for the Nuclear Regulatory Commission.
The Level 11/III results are presented in associated reports described in the Foreword. This volume contains a summary description of the LaSalle plant, describes the co6* tents of the other nine volumes of this report, their relationships to each other, and the relationship of the LaSalle program to other programs.
-A step by-step summary description of the methodology and new techniques used to perform the analysis is presented and discussed.
The final results of the Level I analyses for each subanalysis -(c. g.,
internal, fire, flood, and seismic analyses) are discussed individually and the final integrated result obtained by merging all subanalyses and performing an integrated calculation is also discussed.
General insights and conclusions from the analysis are discussed.
-111/iv-
.,a---
-. - - -. - - ~ - -.
. _.. _ _.. _ _. _ _.. ____.. _._.__. _ - _ _ _ _... _ _ -. _ - - ~ _ _ _ _ _ _
1 1
TABLE OF CONTENTS 1
Seet1on~
faga l
ABSTRACT......................................
....................111-l LI ST O F FI GUR E S................................
...................ix LIST OF TABLES......................................................xl FOREW0RD............................................................xiii EXECUTIVE
SUMMARY
...........S-1 1.0 Introduction....................................
............. 1-1 1.1 Objective and Scope........................
............. 1 1 1.2 General Description of the Plant..............
.......... 1 2 1.3 Structure of the-Report.............................
.... 1 7 l'.4 Relationship to Other Programs........................... 1 8
- i 1.5 -Contributions-to NUREG-1150..............................
1 10
- 1.6 References......................................
..... 1-12
= 2.0 -Description of the Methodology Used to Forform the Integrated
- Analysis.......................
............................ 2-1 2.1 Outline.of the General Steps Used in the Analysis....... 2-1 2.2 Description of the Methods Used in Each Step.,,.......... 2 3 2.2.1 Initiating Event-Identification..................... 2-3 2.2.2 Accident Sequence Delineation....................... 2 4 2.2.3 Construction of the System Fault Trees.......
...... 2-4 2.2.3.1' Level of Modeling Detail.................._... 2-4
-2.2.3.2
~ System Fault Trees............................ 2-4 2.2.4 Data Base..........-........................,,.....
. 2-5 2.2.5 Fault Tree Solution................................
2-6 2.2.6 Initial Accident Sequence Evaluation................ 2 6 2.2.7 -Final Accident' Sequence-Evaluation................. 2 6 2.2.8-Resolution of Core Vulnerable Sequences............. 2 7
-2.2.9 Individual and' Integrated Uncertainty Analysis....... 2-7 2.3 References...............................................
2 8 L3,0 ~ Accident. Sequence. Delineation...,,....'....................... 3.
r3.1
-Introduction............................................. 3-1 3.2 Core Damage Functional Event Trees..................
.... 3-1 3.2.1 Safety Functions..................
................ 3 5 i
i-
-y.
.... ~, -
,__._....r,.
TABl.E OF C0!1TE!4TS (Continued)
Eef.t.iED l'ILLt 3.3 Systems Availabic to Ferform required Functions.
.3 10 3.4 Systemic Event Trees.
. 3 10 3.4.1 toCAs
. 3-10 3.4.2 Transients with Scram.
.3-15 3.4.3 ATWS Event Tree
.3 22 3.5 Re ferences..
. 3 23 4.0 Discussion of Core Damage Results...
.4-1 4.1 Results of the Integrated Analysis..
.4 1 4.1.1 Introduction.......
. 4-1 4.1.2 Dominant Sequences of the Integrated Analysis...... 4 11 4.1.J Dominant Cut sets of the Integrated Analysis...
.. 4-14 4.1.4 Rick Reduction Measures for the Integrated Analysis. 4 15 4.1.5 Risk Increase Measures for the Integrated Analysis.. 4 16 4.1,6 Uncertainty Importance Measures for the Integrated Analysis.
.. 4-18 i
4.2 Summary of the Results of the Internal Events Analysis.
.4 20 4.2.1 Dominant Internal Event Sequences.....
. 4-20 4.2.2 Dominant Cut Sets for the Internal Events Analysis.. 4 22 4.2.3 Risk Reduction Measures for Internal Events.
4-24 4.2.4 Risk Increase Measures for Internal Events.
.... 4-25 4.2.5 Uncertainty Importance Measures for Internal Events. 4-25 4.3 Summary of the Results of the Internal Fire Analysis..... 4 26 4.3.1 Dominant Fire Sequences.....
................. 4-26 4.3.2 Dominent Cut Sets for the Fire Analysis..........
4-27 4.3.3 Risk Reduction Measures for Fire Initiators........ 4 29 4.3.4 Risk Increase Measures for Fire Initiators......... 4 30 4.3.5 Uncertainty Importance Measures for Fire loitiators. 4-30 4.4 Summary of the Results of the internal Flood Analysis.... 4-31 4.4.1 Dominant Flood Sequences.
. 4 31 4.4.2 Dominant Cut Sets for the Flood Analysis...
. 4-32 4.4.3 Risk Reduction Measures for Flood Initiators.
..... 4 33 4.4.4 Risk Increase Measures for Flood Initiators.
.4-33 4.4.5 Uncertainty Importance Measures for Flood Initiators.4 34 4.5 Sununary of the Results of the Seismic Analysis.
.4 34 4.5.1 Dominant Seismic Sequences...
.4 34 4.5.2 Dominant cut Sets for the Seismic Analysis..
. 4 36
-vi-
TABLE OF CONTI.NTS (Concluded)
EcLtinD EDEC 4.5.3 Risk Reduction Measures for Seismic Initiators.
.4-36 4.5.4 Risk Increase Measares for Seismic Initiators..
. 4-36 4.5.5 Urcertainty Importance Measures for Seismic Initiators.....
. 4 37 4.6 Irnportant Isruen and Inuf ghts...
. 4 37 4.6.1 Seismic hazard Curve.
.4 37 4.6.2 Relay Chatter.......
. 4 38 4.6.3 Loss of Off-site Power Frequency....
.4-38 4.6.4 Containment Venting....
.4 41 4.6.5 RCIC 1 solation....
... 4 42 4.6.6 RPS Failure Probability......
.4 44 4.6.7 Use of Qualitative rire Information In Plant Operations...
. 4-44 4.6.O Quality As!.u,.nCO,
. 4-44 o
4.7 References....
. 4 46
-vil-
LIST OF FIGURES Dtnre IL*1n bn 1,3 1 LaSalle Containment Schematic..
.. 1-5 3.2-1 LOCA Functionni Event Tree...
.3-2 3.2 2 Transient Functional Event Tree
.33 3.2 3 ATWS Functional Event Tree...
.3-4 3.4 1 LaSalle LOCA Systemic Event Tree...
.3 16 3.4 2 LaSalle Transient Systemic Event Tree..
.. 3-19 3.4-3 LaSalle ATWS Systeinic Event Tree...
. 3-24 4.1-1 Integrated Core Damage frequency Distribution for LaSalle......
....................... 4-7 4.1 2 Fire, Flood, Seismic, Internal, and Integrated Core Damage frequency CDFs.
.4-8 4.1-3 Contribution to Integrated Core Damage Frequency....
.. 4-9 4.1-4 Contribution to Internal Core Damage Frequency..
... 4-10 4.6 1 Comparison of LaSalle Seismic llazard Curves..
.... 4-39
-ix-
LIST OF TAliLLS Tnble Title far.c 3.3 1 IDCA Function / System Relationship.
.3-11 3.3 2 Transient Function /Systern Relationship.
.3-12 3.3-3 System Dependency Matrix.
.3-13 4.1-1 LaSalle Final Sequence Core Damage Statistics..
.4-2 4.6-1 Dominant Fire Areas and Associated Random Failures.
4 45 4.6-2 Important Fire Areas Given Unavailability of System.,
. 4-45
-xi-
FOREWORD LaSalle Unit 2 Level 111 Probabilistic Risk Assessment in recent years, applications of Probabilistic Risk Assessment (PRA) to nuclear power pinnts have experienced increasing acecptance and use, particularly in addressing regulatory issues.
Although progress on the PRA front has been impressive, the usage of PRA rnethods and insights to address increasingly broader regulatory issues has resulted in the need for continued improvement in and expansion of PRA methods to support the needs of the Nuclear Regulatory Commission (NRC).
Before any new PRA methods can be considered suitable for routine use in the regulatory arena, they need to be integrated into the overall framework of a PRA, appropriate interfaces defined, and the utility of the methods evaluated.
The LaSalle Unit 2 Level III PRA, described in this and associated reports, integrates new rnethods and new applications of previous methods into a PRA framework that provides for this integration and evaluation.
It helps lay the bases for both the routine use of the ine thods and the preparation of procedures that will provide guidance for future PRAs used in addressing regulatory issues.
These new methods, once integrated into the framework of a PRA and evaluated, lead to a more c orn p l e t e PPA analysis, a better understanding of the uncertainties in PRA results, and broader insights into the importance of plant design and operational characteristics to public risk.
In order to satisfy the needs described above, the LaSalle Unit 2, Level 111 PRA addresses the following broad objectives:
- 1) To develop and apply methods to integrate internal, external, and dependent failure risk methods to achieve greater efficiency, consistency, and con >pleteness in the conduct of risk assessments:
- 2) To evaluate PRA technology developments and formulate improved
~
PRA procedures;
- 3) To identify, evaluate, and eifectively display the uncertainties in PRA risk predictions that stem from l i n'i ta t i on s in plant modeling, PRA methods, data, or physical processes that occur during the evolution of a severe accident;
Mark 11 nuclear power plant, ascertain the plant's dominant accident sequences, evaluate the core and containment response to accidents, calculate the consequences of the accidents, and assess overall risk; and finally
- 5) To formulate the results in such a manner as
.o allow the PRA to be easily updated and to allow testing of future improvements in methodology, data, and the treatrtent of phenomena.
-xiii-
The LaSalle Unit 2. PRA was perforrned for the NRC by Sandia National Laboratories (SNL) with substantial help frorn Commonwealth Edison (Ceco) and its contractors.
Because of the size and scope of the PRA, various related pro 6 rams _ were set up to conduct different aspects of the analysis.
Additionally, existing - programs had tasks added to perform s ogne analyses for thu LaSalle PRA.
The responsibility for overall direction of the PRA was assigned to the Risk Methods integration and Evaluation Program (RMIEP).
RMIEP was specifically responsible for all aspects of the Level I analysis (i.e., the core damage analysis).
The Phenonenology and Risk Uncertainty Evaluation Program (PRUEP) was responsibic for the Level II/III analysis (i.e.,
accident progression, source terra, consequence analyses, and risk integration).
Other prograras provided support in various areas or performed some of the subanalyses.
These programs include the Seismic Safety Margins Research Program (SSMRP) at Lawrence Livermore National Laboratory (LLNL), which performed the seismic analysis; thn Integrated Dependent Failure Analysis Program, which devel.oped ructhods and analyzed d9.ta for dependent failure modeling; the HELCOR Program, which modifled the MELCOR code in response to the PRA's modeling needs; the Fire Research Progra.n, which performed the fire analysis; the PRA Hothods Development Program, which developed some of the new teethods used in the PRA; and the Data Programs, which provided new and updated _ data-for lBWR plants similar to LaSalle.
Ceco provided plant design and operational inforrnation and reviewed many of the analysis results.
-The LaSa11n PRA was-begun before the NUREG 1150 analysis and the LaSalle program has supplied the NUREG-1150 program with simplified location
-analysis roethods for integrated analysis of external events, insights on i
possible subtle interactions that come from the very detailed system models used ir. the LaSalle PRA, core vulnerable sequence resolution methods,- inethods for handling and propagating statistical uncertainties in an integrated way through the entire analysis, and BWR thermal-hydraulic rodels which were adapted f or the Peach Bottom and Grand Gulf analyses.
The Level 1 results of the LaSalle Unit 2 PRA are presented in:
" Analysis of the LaSalle Unit 2 Nuclear Power Plant:
Risk Methods Integration and Evaluation Program (RMIEP)," NUREG/CR-4832, SAND 92-0537, ten volumes. The reports are organized as follows:
NUREG/CR-4832 - Volume 1:
Sumrnary Report.
NUREG/CR-4832 Volume 2:
Integrated Quantification and Uncertainty Analysis.
NUREG/CR-4832 - Volume 3:
Internal Events Accident Sequence Quantification.
NUREG/CR-4832-- Volume 4:
Initiating Events and Accident Sequence Delineation.
-xiv-
I NUREG/CR 4832 Volume 5:
Parameter Estimation Analys4s and lluman l
Reliability Screening Analysis.
]
NUREG/CR 4832 Voltune 6:
System Descriptions and Fault Tree Definition.
NUREG/CR 4832 Volume 7:
External Event Scoping Quantifiestion.
t NUREG/CR-4832 Volume 8:
Seismic Analysis.
k NUREG/CR 4832 Volume 9:
Internal Fire Analysis.
1 me 10:
Internal Flood Analysis.
l The Level II/III res.
.6 of : the LaSalle Unit 2 PRA are presented in:
" Integrated. Risk Asuissment For the LaSalle Unit 2 Nuclear Power Plant:
Phenomenology and Risk Uncertainty Evaluation Program (PRUEP)," NUREG/CR-5305, SAND 90-2765, 3 volumes.
The reports are organized as follows:
NUREG/CR 5305 Volume 1: Main Report NUREG/CR 5305 - Volume 2: Appendices A-G NUREG/CR-5305 Volume 3: MELCOR Code Calculations Important associated reports have been issued by the RMIEP Methods Development Program in: NUREG/CR 4834, Recovery Actions in PRA for the Risk Methods Integration and Evaluation Program (RMIEP); NUREG/CR 4835, Comparison and Application of Quantitative iluman Reliability Analysis Metheds.for the Risk Methods Integration and Evaluation Program (RMIEP);
i NUREG/CR-4836, Approaches to Uncertainty Analysis in Probabilistic Risk Assessment; NUREG/CR 4838, Microcomputer Applications and Modifications to the Modular Fault Trees;- and NUREG/CR-4840, Procedures for the External Event Core Damage Frequency Analysis'for NUREG-1150.
Some of tlie computer codes, expert judgement elicitations, and other supporting information used in this analysis are documented in associated reports, including: NUREG/CR 4586, User's Guide for a Personal Computer-Based Nuclear Power-Plant Fire Data Base; NUREG/CR 4598, A User's G dde for the Top Event Matrix Analysis Code (TEMAC); NUREG/CR 5032, Modeling F
Time to Recovery and -Initiating Event Frequency for Loss of Off-Site Power Incidents at Nuclear _ Power Plants; NUREC/CR-5088, Fire Risk Scoping j
Study: Investigation of Nuclear Power Plant Fire Risk, including Previously Unaddressed Issues; NUREG/CR 5174, A Reference Manual for the Event Progression Analysis Code (EVNTRE); NUREG/CR 5253 PARTITION:
A-Program for Defining the Source Term / Consequence Analysis Interface in the =-NUREG-1150 Probabilistic - Risk Assessments, User's Guide: NUREG/CR-5262, PRAMIS: Probabilistic Risk Assessment Model Integration System, User's Guide; NUREG/CR-5331, MELCOR ~ Analysis - for Accident - Progression -
Issues; NUREG/CR-5346, Assessment of the XXSOR Codes; and NUREG/CR-5380, i.
-XV.
__.. -. ~. _.., -..,..._,.-.._,._,- --,-_,-- _.-,_,, _,_. - -.,..... _ -- _. -,
- a,,
A User's Manuni for the Postprocessing Prograrn PSTEVNT.
In addition the reader is directed to the NUREC 1150 technical support reports in NUREG/CR-4550 and 4551.
Arthur C. Payne, J r.
Principal Investigator Phenornenology and Risk Uncer tainty Evaluation Prograrn and Rish Methods Integration and Evaluation Prograrn Division 6412, Reactor Systems Safety Analysis Sandia National Laboratories Albuquerque, New Mexico 87185 ud==
-xvi-
EXECUTIVE
SUMMARY
S.1 OLVECTIVE AND SCOPE The objectives of the Level I portion of this probabilistic risk assessment (PRA) were.
- 1) To develop and apply methods to integrate internal, external, and dependent failure risk re e t h o d s to a c h i e.'e Ercater efficiency, consistency, and completer.uss in the conduct of risk assessments;
- 2) To identify, evaluate, and offectively display the uncertainties in PRA risk predictions that s tern from limitations in plant modeling, PRA rne thods, data, or physical processes that occur during the evolution of a severe accident up to the point where core damage begins;
- 4) To formulate the results in such a manner as to allow the PRA to be easily updated and to allow testing of future improvements in methodology, data, and the treatment of phenomena; and finally
Mark 11 nuclear power plant, ascertain the plants' dominant accident sequences, evaluate the core and containment response to accidents, and calculate the consequences of the accidents up to the point where core damage begins.
l I
I In this study, the terrn integrated risk assessment means the combination of the various constituent analysis (i.e.,
internal, soismic, fire, and flood) to forrn an expression for core damage which includes contributions from all initiators.
In subsequent portions of this analysis (i.e.,
Level II/III), the term integrated risk assesstnent takes on an expanded meaning.
That is, integrated risk assessment includes both the frequency of the accident as well as the resulting consequences for the various constituent analyses (i.e.,
internal, seismic, fire, and flood).
The scope of the Level I analysis includes:
- 1) Analysis of full power operation of the LaSalle Unit 2 nuclear power plant,
- 2) Analysis of core damage accidents that result from both internal and external events, S-1
3)
Estimation of the integr ated f requency of core damage accidents from internal and external events, and 4)
Estimation of the effects of the uncertainties of variouc mechanical failures and phenomenological necurrences on the combined uncertainty of the final integrated core damage frequency.
S.2 METHODOLOGY It was recognized at the beginning of this project that current methods in use at the time would not be adequate to satisfy the objectives of the analysin.
A parallel project was started to ident.ify the limitations in the rtethods current in PRA analysis at the start of the project and to develop techniques to extend these methods or develop new rrethods where needed.
Becauce of the objective to integrate external events into a common f ramework with internal events, it was decided to extend the level of detail of tho fault tree models to include components that would be af fected by and f ailure modes that might be induced by external events.
The result was the inclusion of components such as piping and cables which would not normally be included in an internal event PRA because their passive failure probability would be very low, the modeling of control and actuation circuitry in detail in order to represent accurately the effect of the external events on the systems, and the inclusion of f ailure modes such as spurious actuation.
These additions to the fault trees resulted in very large and logically complicated fault trees which were difficult to solve, New techniques were developed using the SETS code to overcome these difficulties.
These techniques were used in NUREG 1150 and were essential in allowing efficient solution of the fault trees in that analysis.
Since many external events involve failures of all components within a common location, methods were developed for mapping the location of all components modeled in the fault trees (including the tracing of all cables and pipes).
This allowed the evaluation of location based D
failures induced by events such as fire and floodir? and simultaneous inclusion of multiple random failures consistent with the overall probabilistic truncation probability.
This means that standard cut set
^
representations of a fire-induced failure in a certain location combined with random equipment failure in other locations could be generated.
These could be combined with the regular internal event sequences to torrr an integrated representation of core damage from all initiating events.
A simplified version of this was used in the NUREG-1150 fire analysis for the Peach Bottom and Surry plants.
In addition to extending the fault tree analysis in level of detail, the number of systems analyzed was also increased to include balance-of-plant systems that could respond to an accident (e.g.,
main feedwater and S-2
9 condensate) and their support. systems (e.g.,
normal service water and non safety electric power). These systerns were modeled in the same level of detail as the standard safety systems.
This was done in order to inore accurately model the plant response and to include the effect of l
interactions between balance of plant systems and safety systerns.
The primary motivation for this was the observation that rnany past PRAs had identified subtie interactions between safety and balance-of plant systems and these were felt to be even more important when external events, which can affect many systems at once, were to be analyzed.
The accident sequence event trees were extended to include - the interaction with the containment and reactor building response in order to. evaluate the interaction between sequence phenornenology and system performance. A method was developed to quantify these interactions and.,
simplified version was used in the NUREG-1150 WR analysis to resolve the core-vulnerable sequences.
The method involved detailed therrnal-hydraulic code modeling of the containment and reactor building in order to evaluate the - severe environments that could be generated by the various accident sequences, identification of the coroponents rnodeled in the'_ f ault tree that would be subject to these environments, expert clicitation-on the failure probabilities of components in these environments, and quantification of the system failure probabilities in the form of cut' sets which could be integrated with the standard random failures.
In order to correct 1y rnodel the accident sequence evolution and identify realistic success criteria, 49 thermal hydraulic calculations were performed (6 using RELAP5, 4 using MELCOR, and 39 using LTAS).
The end result of this process is the most detailed and comprehensive PRA plant model to date.
In order to quantify this model and satisfy the objective of identifying, evaluating, and_ displaying the uncertainties; extensive data analysis was performed and a new-code, TEMAC, was written to evaluate the uncertainties in the Level I results' and to perfarin various importance i
calculations usin5 Latin Hypercube sampling (stratified Monte Carlo).
' Tlw random failure. data f or all components was reevaluated, a new rnodel for quantifying _ human interactions based on the results of simulator studies was developed (this ' formed the basis of - EPRI's s iinula t or studies), an extensive fire data base was developed, a new method for calculating loss of offsito power and fire initiating event frequency was developed, and a new method for calculating loss of offsite power recovery was developed, All of-this data was used to various. extent in the NUREC-1150 analysis.
Expert elicitation was used to quantify issues such' as severe envirotunent failure of components.
The LaSalle issues were included in the NUREC-1150 Level I expert e11 citation process.
The data from the" internal events analysis and external event analysis was all put: -into a similar forrn and used to quantify - the model including
-uncertainties.
p 7h S.3 RESULTS AND CONCLUSIONS V
Integrated results - were obtained by merging all of the accident sequences' cut sets - from the LOCA, transient, transient-induced LOCAs,
S-3 L ~.
u.
and anticipated accidents without scram accident sequences resulting from internal initiators with the cut sets from the fire, flood, and seismic analyses accident sequences.
The final dominant accident sequences were determined and the integrated risk reduction, risk increase, and uncertainty importance measures were obtained.
Also, an overall ranking of the dominant cut sets was obtained.
The total core damage f requency at haSalle from all events has a mean value of 1.01E 04/yr. with a 5th percentile of 5.34E-6/yr., a median value of 2.92E 05/yr., and a 95th percentile of 2.93E 04/yr.
This result is' considered to be low given that all initiators (both internal and external) are included in this number and that this is the first time that a-detailed PRA has been performed on this plant.
Usually, the first time a pRA is performed certain design faults are found that lead to accidents that have significantly higher f requencies of occurrence than they would have without the design f aul t.s.
At LaSalle, because of the generally good design and - high redundancy of BWR type nuclear power plants, while sore design deficiencies were found, none compromised redundancy to the point where they created accident sequences which were significantly higher in frequency than those from other sources.
Figure S 1 shows cumulative distribution functions (CDFs) for the fire, flood -seismic, and internal core damage frequencies and the integrated core damage frequency for comparison purposes.
Figure S-2 has aie charts showing the relative. contributions of accident sequences frou various categories of initiators to the mean integrated core damage frequency.
These categories are: seismic, fire, flood, and internal with internal broken into LOCAs,-ATWS, transients, and transient induced LOCAs.
Figure S 3 has - a pie chart showing a finer-breakdown of-the contribution of internal events initiators to the total mean internal core damage frequency.
The internal-initiators are broken into: 1) LOSP, 2) AC Bus t
Failure (T101, T102), 3) DC Sus Failure (T9A, T9B), 4) Turbine Trip (T1, T2), 5) Loss of Feedwater (T3. T4, TS), and 6) All Others.
By examining ' the above plots and fi gure s,' one can see that scismic sequences do not contribute significantly to the integrated core damsgo frequency at LaSalle.
Flood sequences are moderate contributors at.all quantiles of the distribution.
Since the integrated core damage frequency distribution is very similar to the internal event.s core damage frequency distribution in all but the 90 to 100th quantile range, the-integrated core damage frequency distribution comes mostly from internal events; However, at the very top of-the distribution, one can see that the fire sequences contribution actually ' becomes greater than that for the-internal sequences.. This occurs at about the 95th percentile.
The dominant fire sequence is initiated by a control room fire and the sparse fire data for-calculating control room fire initiating event frequencies results -in : a - distribution wit h very wide uncertainty bounds.
The mean value of the fire core damage frequency'is dominated by a few of the 400 t
Latin-Hypeceube observations and, in-these cases, the fire contribution can be substantial, t
l S-4
!~p
., _ _ - _. - ~. _ _. _. _ _ - -
l l
i to l
e = Told n = Seismic 0.9-fB = Firo a = Flood u[
63 = Inte m ol g,3 f
\\
0.7 -
.8 3
o.s-i
.c 0.5 -
i
.a
(
Ta J
o.4 -
r 0,3 -
0.2 -
}
0.1 -
C.G u nm i um u ns u nm u nn u ng u ng num i nn i nn o n, n n, i on.
LE-14 LE-12 LE-10 LE-8 LE-6 tE-4 LE-2 Core Domoge frequency Figure S-1 Fire, Flood, Seismic, Internal, and Integrated Core Damage CDFs.
S-5
Fire (49%)
Ficod (5%)
Seismic (0%)
5h...
intomal (46%)
Percentage of Total Core Damage Frequency a.
LOCA, A (0%)
Transients (98%)
- b. Percentage of Internal Core Damage Frequency Figure S-2 Contribution to Integrated Core Damage Frequency.
5-6
N Other (0%)
Loss of Feedwater (4%)
x-TurbineTrip (6%)
DC Bus (6%)
LOSP (74%)
AC Bus (10'b) s Figure S-3 Initiator Contribution to Internal Core Damage Frequency.
S-7
L
+
The_ dominant accident, 35.4C of the mean core damage frequency, _ involves a:1'oss 'of:all_ injection as a result of failures occurring af ter a loss of
- offsite power.
The dominant cut sets of this sequence represent a short-term station blackout ~ type _accidert.
The second most likely sequence, 17.2% of_the mean core _ damage frequency, is the result of a control room fira which -. is not suppressed and becomes large enough to. require evacuation of the_ control room.
Auto' actuation of the systems fails as a result of the fire and the operators do not operate the remote shutdown f
- panel correctly due to the high stress, ioss of all injection occurs and chort terin core damage results, The events most important to risk reduction are: the frequency of loss of.
of fsite. power, the frequency of ' control room fires, the percentage of control room fires that are - not extinguished before smoke forces abandonment of the control room, the robability that the operators will e
<tuccessfully recover the plant from the remote shutdown panel, the overy of. offsite power-within one hour,_the diesel cooling water is nmon mode failure, and the non recoverable isolation of RCIC
- a tion ' hiackouts.
- ta most important to risk increase are: the internal flood pipe frequency,. the failure. of various AC power circuit breakers
' ng in partial loss of-onsite AC powers the failure to scram, and 1esel generator cooling water pump random failure rate (determines 4
ene magnitude of-the common mode contribution).
The' dominant contributors to uncertainty are: the uncertainty in control circuit failure rates,_ the uncertainty in the control room fire initiating ~ frequency, _.tne uncertainty in relay coil-failure to energize, the uncertainty in energized relay coils failing deenergized, and the uncertainty - in the - response -of systems to severe environments in the reactor. building.
- =
... = -.
=-
a-,
1,0 INTRODUCTION 1.1 OJLiective and Ssapr The objectives of the level I portion of this probabilistic risk assessment (PRA) were:
- 1) To develop and apply methods to integrate internal, external, and dependent failure risk methods to achieve greater efficiency, consistency, and completeness in the conduct of risk assessments;
- 2) To identify, evaluate, and ef fectively display the uncertainties in PRA risk predictions that stem from limitations in plant modeling, PRA methods, data, or physical processes that occur during the evolution of r.
severe accident up to the point where core damage begins;
To formulate the results in such a manner as to allow the PRA to be easily updated and to allow testing of future improvements in methodology, data, and the treatment of phenomena; and finally
- 5) To conduct a PRA on a IWR 5,
Mark II r,uc le a r power plant, ascertain the plants' dominant accident sequences, evalrate the core and containment response to accidents, and calculate the consequences of the accidents up to the pcint where core damage begins.
s In this study, the term integrated risk assessment means the combination of the various constituent analysis (i.e.,
interi.al, seismic, fire, and flood) to form an expresrion for core daicage which includes contributions from n11 initiators, In subsequent portions of this analysis (i.e., Level II/III),
the term integrated risk assessment takes on an expanded meaning.
That is, integrated risk assessment includes both the frequency of the accident as well as the resulting consequences for the various constituent analyses (i.e.,
internal, seismic, fire, and flood).
The scope of the Level I analysis includes:
- 1) Analysis of full power operation of the LaSalle Unit 2 nuclear power plant,
- 2) Analysis of core damage accidents that result from both internal and external events, 3)
Estimation of the integrated frequency of core damage accidents from internal and external events, and 1-1
_. ~ _. _ _ -
. _. _ _ _ - ~
W g.
- 4). Estimation of. the effects of the uncertainties of various
- mechanical failures and -phenomenological occurrences on the.
combined uncertainty of the final integrated core damage frequency.
1.2 ' General D.gserintion of'the Plant iThe LaSalle Unit 2 nuclear power plant is located in the area of Brookfield Township,.LaSalle County, Illinois which is 55 miles southwest of Chicago.
The LaSalle plant utilizes a Mark Il type containment to house a General
' Electric BVR-5 reactor with a rating of 3293 MWt.
The reactor is owned and operated by Commonwealth Edison Company.
There are various injection systems that can be used to cool the core and prevent core. damage at LaSalle.
Four high pressure and four low pressure inj ection - systems. are considered in this analysis.
Detailed descriptions and system - drawings can be found in Volume 6 of this report. System Descriptions and Fault Tree Definttion.
The high pressure inj ectioni systems - include the high pressure core spray system (HPCS), the reactor core isolation cooling system (RCIC), the main feedwater system (MFW), and the control rod drive system (CRD).
The HPCS system has a motor-driven pump with its own dedicated diesel (train C of emergency power).
This system draws water from either the condensate storage tank (CST) or the suppression pool and sprays coolant onto the core via a. ring sparger located above the core.
The RCIC syrrem utilizes ' a turblue-driven pump.
Steam from the reactor pressure vessel C'PV) is used-to drive the turbine which pumps water from either thr CST or the suppression pool back to the vessel via an injection nozzle 10 the reactor vessel dome.
Because RCIC takes steam from the. RPV, ope. tion of the
-system can not be assured once vessel pressure falls below 57 psig.
-Also,
+
RCIC isolates when containment pressure reaches about.15 psig.
Train A DC power is also required to control this system.
The MFW systen. draws water
=from the condenser.hotwell using two turbine-driven pumps _ and one motor-driven ' pump _ Eand-injects it into the vessel through the main feedwater lines. These pumps require offsite power (i.e., not emergency power).
The
- CRD system can be used to inject water into the vessel via the control rod drives into the lower plenum.
The '. CRD sys tem can only inj ect : several hundred gallons per minute and _is therefore only useful once the decay t energy has.heen significantly reduced-_ (i.e.', -- during a _ long term accident) or in _ conjunction; with another injection system.
The high pressure
~ injection systems can _ be used to provide coolant makeup when the RPV is at either high or low pressure. The only caveat to this statement is that the
~
emergency operating procedures require the RPV pressure to be above 57 psig
.if(RCIC is to be used.
The low pressure inj ection systems include the - low pressure core spray system.(LPCS),j the low pressure coolant inj ection system - (LPCI), the condensate system.- (CDS), and the _ diesel driven firewater system - (DFWS),
' The : LPCS system is a single train system that draws water from the 1-2 e
. ~,.,,,, -
,i.
s
-~ ~
.m.
. S
l suppression pool using a motor-driven pump.
This system is powered by train A of the emergency power system.
LPCS sprays coolant into the vessel through a ring sparger located above the core.
The LPCI system is a thrne train system that also draws water from the suppression pool using moror-driven pumps and injects into the core bypass region of the vessel.
Train A of LPCI is powered by train A of the emergency power system (EPS) and trains B and C are powered by train B of the EPS.
The condensate syste a draws water from the condenser hotwell and pumps it through the feedwat,r line into the RPV using four motor-driven condensate mmps.
Both MIN aad CDS can take water from the CST (limi,3d to a maximum vi 1'00 gpm) and must be throttled to maintain net positive suction head (NPSH) in this mode.
This system requires offsite power.
The last resort injection system that is used when all other systems have failed is the diesel-driven firewater system. This system can be manually connected to the MIN injaction line to provide injection.
The DFWS uses diesel-driven pumps to draw water from the ultimate heat sink.
Because this system has its own dedicated diesel-driven pumps, it can operate during a station blackout event.
For all of these low pressure injection systems to provide coolant to the core, the RPV must be depressurized.
The Automatic Depressurization System (ADS) is designed to depressM ize the reactor vessel to a pressure at which the low pressure injectick systems can inject coolant into the reactor vessel.
The ADS consists of seven of the eighteen relief valves Each valve is capabic of being manually opened.
For the system to be automatically initiated, a low pressure emergency core cooling (ECCS) pump must be running.
Thus, the ADS will not be automatically initiated during a station blackout.
The operator can also manually initiate the ADS, or he may depressurize the reactor vessel using the eleven Safety Relief Vaives (SRVs) that are not connected to the ADS logic.
Each valve discharges into the suppression pool.
The ADS valves are located in the drywell, and drywell pressutes of approximately 85 psig will prevent opening the valves or result in reclosure if they are already open.
The ADS also requires at least one train of DC power.
ro, the RPV can not be depressurized in sequences that involve Thera r fall w of all DC power or in accidents in which the containment pressure exceeds 85 psig.
Heat can be removed from the containment by the residual heat removal (RHR) system which uses trains A and B of the LPCI system, Suppression pool cooling (SPC) and the containment spray system (CSS) are two modes of the RHR system.
The RHR system is a tao train system with motor-operated valves and pumps.
Each train has a heat exchanger downstream of the pump.
1r. either the SPC or the CSS modes of operation, the RHR system can remove heat from the suppression pool by passing water from the pool through the heat exchangers (with service water on the shell side).
In the SPC mode, the water is injected directly back into the suppression pool and, in the CSS mode, the water is sprayed into the drywell atmosphere and drains back into the suppression pool via the drywell downcomers.
For accidents that are not LOCAs, the shutdown cooling (SDC) mode of RHR can also be used to remove decay heat from the core.
In this mode of operation, water ic drawn from the recirculation loops, passed through the RHR heat exchangers, and 1-3
---~.-__-r_.
-l then returned to the vessel.vla'the recirculation loops.
All three modes of-RHR (1,e., SPC, CSS, and SDC). require at least one train of-emergency.
lAC power. and are,. therefore, _ unavailable during a station blackout.
By
. operating..the appropriate heat exchanger, train'A or B of the LPCI mode can-also provide _ the-function of containment heat removal by drawing water from the suppression pool, passing it through the heat exchanger, and injecting
=
the water directly into the vessel..The water then must flow back tb the-suppression pool either via-a break in the primary system piping or via the SHV. discharge lines.
The interaction' between the 3njection systems and the p '
and secondary containment environments is accounted for in this Level i analysis.
Severe environments. can be created in. the reactor building from containment failure modes that result ~in steam release to the reactor building.(i.e.,
wetwell or drywell failures) or containment venting (which results in a.
. release - of steam '~into the upper floors of the reactor building).
The subsequent effect on injection system components in the reactor building is accounted for in the accident sequence definition.
Contaitunent failure via the : drywell head goes to the refueling-floor and bypasses the reactor building._with no concomitant severe environments in the reactor building.
The effects of primary containment pressure on system operability are also considered (e.g., RCIC and ADS as mentioned above).
The primary containment is a post tensioned reinforced concrete structure
- with a steel liner.
The containment, shown in Figure 1.3-1, consists of a lower cylindrical portion. founded on the base mat and an upper portion that is in the form of a frustum of a cone.
The containment is topped by an r
~ elliptical steel-dome called the drywell head. The lower _ portion is called the' suppression chamber (or wetwell).and it contains the suppression pool; the upper-portion is called the drywell and it houses the reactor pressure vessel.(RPV), -The primary containment is enclosed by a reinforced concrete reactor ' building which forms the secondary containment.
The primary containment is inerted with nitrogen which eliminates the possibility of hydrogen combustion events during the. course of the accident.
'However, combus tion = of _ hydrogen in th e_
reactor. building following containment failure _is still possible..The internal design pressure _ of the primary containment -is 45. psig.
The-ultimate containment-failure pressure was'
. assessed L by a - panel _ of structural experts -(see appendix _B.7 of: the Level
.II/III analysis _ -in NUpEG/CR-5305, Volume 2).
The assessed mean failure pressure is 191-psig; the minimum - and maximum failure pressures are 140 psig and. 275 psig, respectively.
.The containment failure locations-s
-' identified by the expert panel included the drywell. head, _the drywell wall, the wetwell wall above the' suppression pool, and the wetwell wall below the suppression pool surface.
The - pressure suppression system is the over-and-under configuration.
The
- drywell is located in : the. upper portion of the. containment. directly above the suppression chamber which forms the lower portion of the - cot. ainment.
- The drywell _ and lthe : suppression chamber are ' separated by a reinforced concrete slab which. forms the _ dryuell. floor.
The - drywell houses the reactor pressure vessel (RPV) and much of-the primary system.
The 1-4
=,u
i L
DRYWELL HEAD 3!.
- . q' Rh 9."
45
.'W M.4*
DRY WELL s
REACTOR VESSEL M.
h.
9 d
Q y
en ls.t.
d,'9 c
'\\.,t.
t
- p
..N
' /.
REACTOR SHIELD WALT.
?
s
., I a
t
.t.
-9 9.;.f.
. m..
'e'f I'.
- Q L
b' s.
m g...
.:l A 1
"'O
?
i "9.
A"/
I'.* M
,$'['t:
'd. '.
ECUtPWENT STECL LINER t-
- - g i-t N AN DLtNG P L ATF0RM
).'q' I
- 1o
..jf p.
-g..i
.I fI[
-[;..
..y t.:
4
.d... '
h.'.
?!'.
2.*,
"'9 W M
- rT
=r=T M
PT %
g'.
'g.
"...,0 '*>'
.*.^.1, n 'b:
_s ? p 9,,.
,e 0.3 t.:.e g
- 4 1.6 e..ie '. * : 1.*.. ;'. 9 (.:
p DOWNCCWER l
i
.. t' e,.
P..:.
9 Ao-I m
q 8
Vl
- .': i a
.e
- i; Q.:.
n g,T
~
PRESSURE G. 4;
. SUP P R ES$10N k
l' l
j;r e
a a
?,
I
'(
'a',*.
I g*:;
} [t t
y CHAWBER g
i Q
5 WATER LEVEL %.'
. f,
. 5 v
i s
s 4
r.-
t u
i
..P
- c. e... :e.....,g. :
,i atiNroRCEq {%,
j '.5 0,% N 4:;i i
4';
are i.:
"j
's b*e..%.*
CONCRETE i,7-2 :e* j-3-
i d
,s,Q'.
4&
- /j k %*e !.5
?
e. 4 e h...
v.f
- f.:
e ?.
< ?. :..
- 1.4 e i
' e, g =
c.
q 4.* se ? 9 **f *>
';?A
}_ ',
g.!,'
s ;'
- .. e Figure 1.3-1. LaSalle Containment Schematic I
l-5
suppression chamber contains the suppression pool.
The drywell and the suppression chamber communicate through passive vertical vents called downcomers.
One end of each downcomer is in the drywell and the other end is submerged in the suppression pool.
Cases released in the drywell are vented through the downcomers into the suppression pool where the steam is condensed and the noncondensibles are cooled.
In the event that the suppression chamber pressure exceeds the drywell pressure, the noncondensibles that have accumulated in the suppression chamber air space are vented back into the drywell through the drywell vacuum breakers and thereby equilibrate the pressure between the two volumes.
The suppression pool is also used to condense the steam and cool the noncondensible gases that are released through the safety relief valve (SRV) tailpipes when the RPV is depressurized.
The SRV tailpipes direct the steam from the RPV to suppression pool when the ADS or SRV valves are opened.
The tailpipes release the steam and gases through T-quenchers located at the end of the tailpipes near the bottom of the suppression pool.
The nominal free
~-~
volumes of the drywell and the suppression chamber are 219,800 ft3 and 16 5,100 f *.3, respectively.
The nominal volume of the suppression pool is 128,800 ft).
Directly below the reactor pressure vessel is the reactor pedestal cavity.
The cavity in large enough to contain all of the core debris should core damage occur and the vessel fail.
In addition to holding the core debris, the cavity can also accumulate a large volume of water during the accident.
When the cavity is completely flooded, a water depth of 11 feet can he established.
The potential for large amounts of water to be in the cavity has implications for the Level 11 analysis of the accident progression after core damage and vessel breach have occurred.
The LaSalle containment can be vented in the -event that the pressure cannot be controlled.
For long term containment heat removal accidents and ATWS scenarios, the containment pressure will steadily increase due to the steam released from the saturated suppression pool.
The pressure in the containment can be relieved through the containment vent and purge system.
The containment can be vented from either the drywell or the suppression chamber using either a 2 inch valve or a 26 inch valve.
The vent pipe ties into the standby gas treatment system (SGTS) which releases the gases to the stack.
The vent pipe is attached via an 18 inch pipe to the SGTS with a rubber boot.
It was assumed that this rubber boot will fall when high pressure steam is released through the vent.
Therefore, the steam will be released into the reactor building rather than being directed to the stack when the containment is vented.
Inundation of high temperature steam in the reactor building creates a severe environment for motor control cabinets and other equipment located in the reactor building.
Failure of equipment due to this steam can result in the loss of vital emergency equipment (e.g.,
coolant inj ection systems and containment heat removal i
systems).
The operators are instructed to vent the containment when the containment i
pressure exceeds 60 psig regardless of whether or not adequate core cooling is available.
Venting requires both divisions of AC power.
i l-6
1.3 Structure of the Report This report consists of ten volumes.
Each volume presents the results of a specific portion of the analysis.
In this volume, we present an ovaview of the methodology used to perform summary of summary of the individual analysis results, a this analysis, a the results of the integrated analysis, and insights and conclusions gained as a result of the analysis.
In Volume 2,
we present the details of the construction of the Latin Hypercube Sample ( LHS ), summarize the inputs into the integrated analysis from the internal, fire, and flood analyses, present the final quantification of the seismic sequences, present the details of how the integrated analysis was performed, and then present the final results.
In Volume 3, we present the details of the cuantification of the internal event accident sequences.
We discuss the procedure for calculating the sequence cut sets, the initial screening quantification of the accident sequences, the application of recovery actions, the quantification of the effects of severe enviroccents created in the primary containment and reactor building on systems responding to the accidents, the reevaluation of the data, and the final quantification of the accident sequences.
In Volume 4,
we discuss the internal analysis initiating event identification and quantificatica and the construction of the functional and systemic accident sequence event trees which were used for both the internal and external accident sequence analyses.
In Volume 5,
we discuss the preliminary selection of the data for point estimates of the probability cf occurrence of the hardware failures appearing in the,ystem fault trees, the final selection of data distributions for the important failure mechanisms remaining in the final
[
analysis, the initial human facto s analysis, and the common cause analysis.
In Volume 6, we present the system descriptionn These descriptions form the bases for the construction of the system fault trees and contain information on system layout and operation.
In Volume 7, we present the results of the external event scoping study.
In this study we evaluated a range of external initiators to determine if detailed analyses would be performed as part of this study.
No external events other than seismic. internal fires, and internal floods were found to be important enough to warrant detailed analysis for this study.
In Volume 8, we present the results of the initial seismic analysis.
The construction of the hazard curve, the response analysis, the structural analysis, the fragility analysis, and the use of the internal event logic models (both event trees and fault trees) to define and evaluata the scismic accident sequences are described.
1-7
m y
t
- In! Volume 9,: we present : the '.' results of the fire analysis.
The location
= analysis ' in which the -locations ' of all equipment and cabling used inc the.
' fault. trees models is. described, the trethod of incorporating this information Ldirectly. into the system fault' trees and evaluating the-
- accident sequences /using:the same_ accident sequence end system models_used-
~
- in the - internal' events analysis is. described.
The quantification of the-
~
fire ; initiating' event frequencies is discussed and the definition of the fire J scenarios. and_ final quantification 'of the accident sequences is presented;
^
In Volume -10. we present the.results of the flood analysis.
The location asialysis in which. the locations of all equipment and piping used both -in the fault tree models=and in the balance of plant systems, not included in the accident' analysis model, is described.
The method of incorporating this ' information directly into the system fault trees and evaluating the
- accident sequences using the same accident sequence and system models used
- in the internal. events analysis is also described.
The quantification of-the~ flood initiating event frequencies is discussed and the definition of the flood-rcenarios and : final quantification of, the accident sequences is
-presented; 1.4 Relationship to other Programs Because = of l the size and _ scope o f - the LaSalle - analysis, an extensive 1
_ planning-activity : was - undertaken to'. identify all of the tasks in the analysis, which programs would'be rerponsible for the performance of each task, and what: the input _. requirements and output: products of each task would!be.. The' Risk Methods Integration and-Evaluation Program (RMIEP) at-
. Sandia National ' Laboratories - (SNL) was given overall responsibility for the -
~
LaSalle PRA.
In' addition to coordinating all' the various programs contributing to the. FRA, the -RMIEP program also _was responsible for quality assurance, interfacing with the utility to obtain and supply needed plant
- information to o all the - other programs the - performance of - the internal L
events : Level _ I-analysis, the performanceLof - the internal flooding Level 1
- analysis, ) the---integrated Level I analysis, _ and the location analysis done in'supportcof'the. fire.and flood analyses.
Separate NRC' programs working in conjunction with RMIEP performed certain portions of the analysis,
- The FRA Methods? Development-Program at
- SNL'was responsible for developing procedures _to. consistently model internal _and external system _ faults. _This
' included?the - incorporation of passive failures such as piping,_ spurloas-actuation failures, =. and cabling-into the fault treesc Methods for ~
tincorporatLing location-based: failures into the internal' event system fault trees : for. the L consistent =and integrated eval.uation of the seismic, fire,
- and flood accident sequences were developed.
The program _ also --identified
- and evaluated the :various human reliability analysis techniques for their use in RMIEP. - In conjunction with the-PRUEP - program performing the Level
- 1 1 / 1 I 11 analysis, me thods - for performing uncertainty _ analys t s were
=investigatedJ 1-8
'w-ty e
_J g
me e-n.-
v--
1,r T7 e-
The Integrated Dependent Failure Analysis Program at SNL was responsible for the development of inethods for identifying, and modeling common causn failures due to internal event conunon causes such as grit, vibration etc.
and certain external event common cause such as fire and flood.
The Seismic Safety Margins Research Program (SSMRP) at Lawrence Livermore National Laboratories ( LLNL) was responsible for the seismic Level I screening analysis.
This involved determining the seismic hazard curve for LaSalle, performing the response analysis, the hydrodynamic load analysis, and the structural and equipment fragility analyses.
Using the detailed system fault trees enhanced to include piping failures and the accident sequence fault trees from the RMIEP internal event analysis, they solved for the seismic accident sequence cut sets and quantified the results.
These results along with uncertainty distributions for the seismically-Induced failures and the scismic hazard curve were given back to RMIEP for application of recovery, final quantification, and inclusion in the integrated core damage analysis.
See Volumes 2 and 8 of this report for a more complete description of this process.
The Division of Risk Assessment (DRA) Fire Program at SNL was responsible for the identification and quantificatica of the fire initiating events, the definition of the fire locations and zones, the definition of the fire scenarios, the calculation of the fire propagation and effects, and the quantification of the fire teams emergency response.
A fire data base was developed for use in quantifying the fire initiating event frequencies.
The location and zone definitions and the zene propagation table were supplied to the RMIEP program which then identified all the cabling important to the modeled system, mapped all the components and cables in t'ne system fault trees into I c,c a t ion space, and solved for the accident acquence cut sets containing both location and random failures.
The locations were transformed to fire zones and cut sets which were physically unrealizable were eliminated.
Recovery actions were applied to the random failures taking-into account the possible effects of the specific fire in the cut set.
After determination of the dominant cut sets, the cabling in
[
each important location was mapped.
The fire program then determined fire scenarios to be eva}unted for each location, COMPBRN models were constructed for each scenario, the COMPBRN code: was improved, and calculations were performed on all the imporeant scenarios.
An evaluation of the fire response was performed and all this information was fed back to the RMIEP program to perform the final sequence quantification and incorporate the results into the integrated analysis.
See Volume 9 of this report for a more complete description of this process.
The DRA Data Program at Oak Ridge National ' Laboratories (ORNL) which developed the In-Plant Reliability Data System (IPRDS) was responsible for providing supporting data for the quantification of component faults appearing in the system fault trees.
The data program was redirected to collect data from several EWRs deemeo similar to the LaSalle plant in some respects.
This data was then analyzed at Los Alamos National Laboratory (LANL) esing the FRAC 3 code to determine component failure rates and 1-9
+.
y _- _..
_m possible' factors that. might contribute to different failure rates for the' same component.. This_ data was supplied to RMIEP as additional.information for the. deternination of the final data distributions.
See Volume 5 of this report.- for a complete description -of the data analysis methods and results.
- Tho ? Phenomenology and Risk Uncertainty Evaluation-Program (PRUEP) l at SNL
- was responsible-for the performance of the Level II/III analysis.
This consisted of-the accident progression analysis, the source term analysis, the consequence analysis, the final integrated rfsk evaluation, and MELCOR' code calculations to evaluate the evolution of several dominant severe
-accident sequences.
The LaSalle analysis was the first application of MELCOR to _ integrated accident sequence evaluations.
See Volume 3 of:the Level II/III analysis reported in NUREG/CR-5305 ' for a complete description of<the MELCOR code calculations performed for this analysis, The'MELCOR program at SNL helped'in the review of the MELCOR calculations performed by PRUEP'and provided support to fix code problems encountered in the course of performing the-calculations.
A Brookhaven National Laboratories (BNL) human error study 5 took pre liminary. ' acc ident sequence cut sets af ter the application recovery but before final quantification for the dominant internal event accident sequences a at LaSalle and performed various sensitivity studies involving the human error rates.
8 for seismic events took A: Future Resources Associates relay chatter study 3
system fault tree information and evaluated the -- potential effects of the Lchattering:of relay contacts as the result of a strong earthquake.
'A IRA' based 1 inspection of the LaSalle plant was performed - by the NRC in
- 1986, Finally, the LaSalle simulator studies 7 were the precursors to the EPRI simulator-studies.
i 1,5 Cont ributions to NUREG-1150 l -I "
Tho ' LaSalle: PRA: was started.before the 3NUREG-1150 analysis and was
?
performed.- concurrently with NUREG-1150 when that program started.
The LaSa11e f program was significantly. impacted by NUREG-1150.
Resources from l'
the LaSalle analysis.were diverted to NUREG-1150 which was much higher in l-priority and - the LaSalle schedule-was stretched out considerably.
However.
l
- work on. the LaSalle. analysis was never halted completely and there were j
.many interactions between the'two programs, L
The LaSalle analysis is a much more. detailed analysis than that performed l
-for NUREG 1150.
However, in many cases, methods developed for LaSalle were simplified for use,in or-used directly in NUREG-1150.
The following is a partial list of the contributions -of the LaSalle Level I analysis to the 1-10
[.
1'
}
NUREG-1150.c program.
The contributions to the Level' II/III analysis are
. described in the'FRUEP reports.
1 1.
As'a result-of the level of detail of 'he LaSalle models, some t
interesting interactions between systems and within systems were
'found.
Interactions i between safety and non-safety ' systems and interactions.between isolation -logic and components were
-identified.
The NUREC 1150 plants vere examined for interactions with similar characteristics.
'2.
A detailed method for defining plant damage states for the~ Level I/II interface was developed for the LaSalle analysis and used-for the Peach Bottom NUREG-1150 analysis. The other.NUREG-1150 plants used a. simplified version of _ this method.
See Volume 1 of the Level-II/III" reports in' NUREG/Ck 5305 for a complete description of. this method.
3.
A. method for resolving core vulnerable sequences appearing on the accident; sequence event trees was developed for the LaSalle ' PRA.
- The method used in the Peach _ Bottom analysis is _ very similar to -
that used for LaSalle.
See Volume 3 of this report for a complete description of this method.
The following is a brief description:
F a)' A detailed 1 MELCOR model of the - LaSalle reactor building was constructed and calculations of severe environments for different containment-failure modes' vere performed.
b). The Level I NUREG-1150-expert elicitation panel was-given this environmental information and list of equipment used in BWR
_ systems: that might appear in the reactor building, They determined equipment failure probabilities for various ranges
'of severe environments, j-
.c). Simplified system models were_ constructed and quantified using r
L this information' and the feedback to ' the mitigating -systems -
was evaluated in the event' trees.
d) -For the LaSalle analysis, the Level I and Level II LHS samples
_, vere - consis tent '(i. e., they used the - same samples values = for the Level I and II analysis t and both sampled the containment failure pressure and modes in the same manner); but,~for. Peach Bottom, this level _-of. integration was'not achieved (i.e, the Level. I analysis used mean -values for the probability of containment failure while the.. Level II analysis sampled L the containment failure similar to the LaSalle Level II analysis).
~4.. The, TEMAC81 code was developed for the LaSalle. PRA to evaluate uncertainty and importance measures for ~ the ~ accident sequence frequency represented by the sequence cut sets.
This code was used in,NUREG-1150.
1-11
5.
In order to evaluate the loss of off-site power initiating event frequency distribution and probability distributions for the recovery of off-site power by a certain time, a new computer code was written.S This code was used to evaluate the loss of off-site power frequencies and recovery probabilities for all the NUREG-1150 plants.
In addition, this code was used to evaluate the fire initiating event frequencies for Surry, Peach bottom, and LaSalle.
6.
The location based methodology used to perform the Surry and Peach Bottom fire analysis was developed in the LaSalle PRA and a simplified version was used in NUREG-1150.
See Volume 9 of this report for a complete description of this method.
7.
Advanced methods were developed in the LaSalle analysis for using the SETS code to solve for th( accident sequence cut sets.
These methods were ussd in the Peach Bottom analysis.
See Volume 3 of this report for a complete description of these techniques.
8.
The generic data base used in NUREG-1150 was influenced by the LaSalle generic data base.
See Volume 5 of this report for a complete description of the generic data base.
9.
Significant upgrades were made to the COMPBRN code used to perform the fire propagation analysis for various fire scenarios.
Sec Volume 9 of this report for a description of these upgrades. This version of the code was used for the NUREG-1150 fire analyses.
- 10. The fire data base 10 developed for the LaSalle analysic was used to calculate the fire initiating event frequencies.
See Volume 9 of this report for a description of the results.
1.6 References 1.
M.
P.
- Bohn, T.
A.
Wheeler, and G.
V.
Parry, " Approaches to Uncertainty Analysis in Probabilistic Risk Assessment," NUREG/CR-4836, SAND 87-0871, Sandia National Laboratories, Albuquerque, NM.
January 1988.
2.
J.
A.
Lambright, S.
P Nowlen, V.
F.
Nicolette, and M.
P.
- Eohn,
" Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fi re Risk, including Previously Unaddressed Issues," NUREG/CR-5088, SAND 88-0177, Sandia National Laboratories, Albuquerque, NM, January 1989.
3.
H.
F.
- Martz, R.
J.
Beckman, and C.
R.
McInteer, " FRAC (Failure Rate Analysis Code): A Computer Program for Analysis of Variance of Failure Rates," NUREG/CR-2434, lA-9116-MS, Los Alamos National Laboratory, Los Alamos, NM, 1982, 1-12
)
4.
R. M.
Surrune r s, et.
al.,
"MELCOR 1.8.0: A Computer Code for Severe Nuclear Reactor Accident Source Term and Risk Assessment Analysis," NUREG/CR-5531, SAND 90-0365, Sandia National Laboratories, Albuquerque, NM, June 1991 5.
S.
- Wong, J.
- liiggins, J.
O'Hara, D.
Crouch, and W.
Lukas, " Risk Sensitivity to Human Error in the LaSalle PRA," NUREC/CR-5527, BNL NUREC-52228, Brookhaven National Laboratory, Upton, NY, March 1940.
6.
R. J. Budnitz, H. E. Lambert, " Relay Chatter and Operator Responne After a Large Earthquake: An Improved PRA Methodology with Case Studies," NUREC/CR-4910, Future Resources Associates, Inc.,
Berkeley, California, June 1987.
7.
L. M. Weston, D. W. Whitehead, and N. L. Graves, " Recovery Actions in Pra for the Risk Methods Integration and Evaluation Program (RMIEP), Volume 1: Development of the Data-Based Method,"
NUREG/CR-4834 Vol 1 of 2,
SAND 87-0179, Sandia National Laboratories, Albuquerque, NM, June 1987.
D.
W. Whitehead, " Recovery Actions in Pra for the Risk Methods Integration and Evaluation Program (PJ1IEP), Volurne 2: Application of the Data-Based Method," NUREC/CR-4834 Vol 2 of 2, SAND 87 0179, Sandia National Laboratories, Albuquerque, NM, December 1987.
8.
R.
L.
Iman and M.
J.
Shortencarier, "A User's Guide for the Top Event Matrix Analysis Code (TEMAC) " NUREC/CR-4598, SAND 86-0960, 3'ndia riational Laboratories, Albuquerque, NM, August 1986.
9.
R.
L Iman and S.
C.
Hora, "Modeling Time to Recovery and Initiating Event Frequency for Loss of Off-Site Power Incidents at Nuclear Power Mants," NUREG/CR-5032, SAND 87-2428, Sandia National Laboratories, Albuquerque, NM, January 1988.
1C
. T. Wheelis, " User's Culde for a Personal-Computer-Based Nuclear Power Plant Fire Data Base," NUREG/CR-4586, SAND 86-0300, Sandia National Laboratories, Albuquerque, NM, August 1986.
t 1-13
l l
2.0 DESCRIPTION
OF THE METil0DOLOGY USEl> TO PERFORM Tile INTEGRATED ANALYSIS 2.1 omline of the Genentl_Elers Ur.ed lo_the /Lnal ys.13 One of the primary purposes of the LaSalle PRA was to develop methods for incorporating external event analysis into the PRA on an equal footing wit.h t.h e internal events analysis.
A second primary purpose was to represent the uncertainty in the various analyses in a uniform way :.rd to propagate this uncertainty through the analysis to obtain a final integrated result that represented the contribution to core damage from all types of initiators and displayed the uncertainty in the overall result.
The relative importance of the contributors from the different initiators could then be evaluated in a consistent manner.
In order to realize these goals, improvements were made in the state-of-the-art of PRA techniques.
Improvements were made in various aspects of the internal and external event modeling of the plant.
New computer codes and techniques were developed in order to solve the large and detailed models.
Data was analyzed and represented in a uniform manner for both internal and external events.
New techniques and codes were developed to perform the integrated uncertainty and importance analysis.
The general process used to analyze the accident sequences and obtain the core damage frequency can be broken down into the following series of steps:
1.
Define the initiators to be analyzed.
This involves a screening analysis of external events as described in Volume 7 of this report and the detailed Internal event initiator search described in Volume 4 of this report, 2.
Determine the accident sequences that can result from these initiators and the systems necessary to mitigate the accidents.
~
This was done in Volume 4 of this report.
3.
Develop fault tree models for the systems appearing in the event trees defining the accident sequences (front-line systems) and their support systems.
This was done in Volume 6 of this report.
Include in the models any additional detail / components necessary fo r the external event analyses.
The specific location based information needed for the external event analyses is included in the appropriate external event analysis volume of this report (see Volumes 8, 9, cnd 10).
4.
Develop a data basc consisting of point estimate values to use in the screening analysis and continue to refine to get values for the final analysis with uncertainty distributions.
This was done for random mechanical failures and screening human errors in Volume 5 of this report.
External event specific failures were 21
1 1
developed in the appropriate volume dealing with that external event (see Volumes 8,
9, and 10).
Severe envi ron: rent equipment failure and final human error probabilities are described in Volume 3 of this report.
5.
Solve the fault trees of the front-line systems in terms of their basic failures and include their support systems and the interactions between front-line systems, between support systems, and between front-line and support systems.
The basic method used to analyze the internally initiated accidents is reported in Volume 3 of this report.
The specifics of the location based method used to analyze the seismic, fire and flood sequences is reported in Volume 8 for the seismic analysis. in Volume 9 for the fire analysis, and in Volume 10 for the flood analysis.
6.
Combine these system fault trees into accident sequences using point estimatc data to calculate screening estimates of the accident sequences.
This analysis is reported in Volume 3 of this report for internal events, in Volume 8 for the seismic analysis, in Volume 9 for the fire analysis, and in Volume 10 for the flood analysis.
7.
Analyze the sequence cut sets (i.e.,
combinations of basic failures that can result in the accident sequence) to determine if they mcke physical sense and evaluate the potential for operator recovery actions mitigating the accident.
Define and classify the recovery actions.
Add events representing the failure to mitigate the accident (i.e., non-recovery actions) to the cut se t:., develop a method for quantifying the probability of operator failure, and quantify the actions and add to the data base.
The definition, classification, procedure for adding recovery actions to the cut sets, and quantification of the non-recovery probabilities for the internal in'tiators are reported in Vob ne 3 of this report.
The development of the method of evalu.
ng human actions from simulator data is presented in Reference 1.
A review and comparison was conducted of various HRA methods and is reported in Re fere nce 2.
The recovery actions specific to the individual external event analyses are reported in Volume 8 and in this volume for the seismic analysis, in Volume 9 for the fire analysis, and in Volume 10 for the flood analysis.
8.
Develop a method for resolving accident sequences which have uncertain end-states as a result of the inability to quantify the interaction between sequence phenomenclogy and system performance (i.e.,
core-vulnerable sequences, sequences which may still proceed to core dauiage as a result of the interaction between containment phenomenology and the responding systems).
Apply this methodology to resolve the core vulnerable accident sequences.
This is reported in Volume 3 of this report.
2-2
9.
Using the uncerts,inty distributions developed for the data, quantify each individual accident sequence, the combined sequences for each analysis (internal, fire, flood, and seismic), and the combined accident sequences (i.e.,
the integrated results) to
]
obtain the individual sequence, individual analysis and integrated core damage frequency distributions.
The implementation of the data base to quantify the basic events appearing in the f aul t trees with all of the final uncertainty distributions is presented in Volume 2 of this report.
The evaluation of t.he sequence and intc6 rated result uncertainty distributions and the importance calculations are reported in Volume 3 of this report for internal events, in Volume 2 for the seismic analysis, in Volume 9 for the fire analysis, in Volume 10 for the flood analysis, and in Volume 2 of this report for the final integrated analysis.
2.2 Description of the Methods 1Lsed in Each Sten 2.2.1 Initiating Event Identification A detailed review of internra event initiators was conducted and plant specific Failure Mode and Effect Analyses (FMEAs) were conducted to identify plant specific initiating events.
For external events, a screening methodology was developed to identify those general categories of init'ators for which detailed analyses would need to be done.
This vue thodology is described in Reference 3 and its specific application to the LaSalle plant is presented in Volume 7 of this report.
For each of the external events selected for detailed analyses (seismic, internal fire, and internal flood), plant specific initiating events were defined.
This analysis-specific initiating event identification is described in the volumes describing each external j
initiating event analysis.
The seismic analysis screening results are described in Volume 8 of this report.
Using the SSMRP methodology developed at LLNL for the NRC, a plant specific hazard curve with uncertainty bounds was calculated.
The internal fire analysis results are described in Volume 9 of this report.
Using a fire data base' and a new method for calculating loss of offsite power - initiating event frequencies 5 developed for the LaSalle analysis, fire initiating event frequencies were defined for every location rled in the analysis.
The plant was subdivided into a large number of locations for use in both the fire and flood analysis.
Fire frequencies were calculated for each location.
The internal flood analysis results are described in "olume 10 of this report.
All piping in each location was traced and specific piping failures were identified as initiators depending on their impact on the systems being used to mitigate the accident.
2-3
2.2.2 Aec h nc Sequence Delinettion There ne two general methods that can be used to define accident seguroces.
The first, which has been used in a majority of previous PRAs, i nvo'i ve s the construction of a separate accident sequence event tree for each initiator.
The effect of the specific initiator on each system is included directly in the accident sequence definition.
The second method, which is used in this PRA, is to construct a general accident sequence event tree for a class of initiators and then to model the specific effects of the each initiator in the system fault trees.
Only three accident sequence event trees are used in the LaSalle analysis: Transient, LOCA, and
The development of the accident sequence event trees for the internal events analysis is described in Volume 4 of this report.
The specific application to each external event is described in the appropriate volume (see Volumes 8 9, and 10).
2.2.3 Construction of the System Fault Trees In addition to reviewing thermal-hydraulic calculations done for the LaSalle FSAR accident analysis 6 and the GE generic BWR accident analyses,7 thermal-hydraulic calculations were performed using the RELAPS and LTAS codes to determine realistic system success criteria for specific initiating eve.nts.
These success criteria were used to define the fault tree top events.
The results of these calculations are reported in Volume 4 of this report.
2.2.3.1 Level of Modeling Detail For the LaSalle PRA, the inclusion of external initiators on an equal footing with internal initiators required the expansion of the model to include passive failures, diversion paths from spurious operation, additional components not usually modeled, and a greater level of detcil in the fault tree modeling to accurately represent the effects of some of the external events.
This additional level of detail required the use of the most powerful tools available and their extension by the development of new techniques to: (1) effectively include the additional level of detail in the system fault
- treec, (2) to include some information in the fault trees via transformation equations, and (3) to aid in the process of evaluating the accident sequences in an efficient and cost effective manner.
2.2.3.7 System Fault Trees For each system identified as being able to mitigate an accident, a detailed fault tree was developed.
This fault tree included a detailed representation of system pipe failures to represent the direct effects of 2-4
-~
specific pipe fativres on the. systems for the seismic and flood analyses and detailtd modeling of both control and actuation circuitry to accurately reflect the - ef fects of fire induced failures.
As' part of this effort, exact locations vere obtained 'for al1~ components represented in the fault tree.
The effect of cable failure for fire initiators was represented by identifying all ' the cables in the modeled circuits, all electrical power cabling = and creating a. mapping which attached each cable to the appropriate components in the fault trees so that the effect of failure of the cc.ble would be accurctely propagated through the fault treo models.
The locations through which the cable pcssed were identified.
Additional mappings were set up to include the pipe and cable locations in the fault tree model, The external event analysis volumes of this report - (see Volumes 8, 9, and 10) describe, in U tail, the location analysis effort and
- in appendices present the location transformations.
2.2.4 Data Base The random failure data base for internal events evolved la a series of steps.
First,. a complete list of all the types of equipment and the failure modes to be modeled was generated.
Second, a generic data base was created in dBase that contained screening values for.- all of the failure rates.
Third, another data base was created that contained the specific component failures appearing in the fault trees and information about thir generic failure type and test and operacing intervals.
A dBase program was then run to calculate the unavailabilities of all the fault. tree events using the generic data base and the component specific information.
This created the screening data base and is - reported in Volume 5 of this report, f
This screening data base was us.ed in the initial fault tree solution and initial accident sequence evaluation for internal events.
A new
= methodology was' developed for determining human error-probabilities for the screening analysis and is also described in Volume 5 of this report.
Af ter the screening analysis had been-performed, the data for all of the remaining event types were ' reviewed and probability distributions were
' generated for_all of the remaining failure mod s.
The generation of these 4
probability distributions isf also described in volume 5 of this report. As reevaluation, a new method 5 was developed for calculating the part of this_
initiating event frequency and _ the probability of loss of offsite power l
- non-recov.ory of.offsite power within-time t.
-Uncertainty distributions.for both 'are. also created.
- The - IPRDS program at ORNL was - re-directed to
~
- evaluate - data from several BWRs similar - to LaSalle and - the data was annlyzed. by LANL using their FRAC code.
The final distributions were incorporated into a Latin flypercube sampling-scheme - for use in the. final accident sequence quantification as described in Volume 2 of this report.
For the ' fire analysis, a new fire ~ initiating. event data base was constructed.'
This fire data base was analyzed using the same method used for - the loss of offsite - power analysis to obtain fire initiating event frequencies.. Also, separate ' malys e s were conducted to determine probability distributions for: the probability of failure of fire barriers, 2-5
n..-
~. -.
k
,n
.the percentage:of small_vt large ' fires, _ the probability; of suppression _ of fires in various : locations, and the ' fraction c.f fires from various causes.
This. data-is presented in Volume 9 of this report.
'For the flood-analysis, pipe 1and-valve initiating-event frequencies were
- generated as reported in Volume 10 of this report.
JThe ~ seismic analysis was performed by LIRL, the_ seismic hazard curve and the plant-response data - was generated using their SSMRP methodology and used'a-plant specific structural response analysis as reported in Volume 6 of this. report.
2.2.5-Fault Tree Solution For internal events, the front-line system fault trees were merged with their support systems and solved using the screening data base.
Because of the very la se size of the LaSalle fault trees, new techniques were ideveloped to solve tho' trees in an-efficienti' manner.
These techniques are
-described in detail in Volume 3 of this report.
The screening cut sets were truncated, based on probability, at 1.0E-08.
For the seismic, fire, and flood analysis, the system fault trees were resolved 'inct rporating ' the location information through transformation equat'ons.
This resulted in system cut sets containing both location based
'f ailures.- and multiple random failures.
The random failures were probabilistically: truncated in a manner consistent with the 1.0E-08 cutoff used for the. internal events. analysis.
The details of-the transformations and system solution methods are described in the respective volumes of this report (see. Volumes 8,'
9, and 10).
~
2.2.6 Initial Accident Sequence Evaluation For boch internal and external events analysis, the front-line system fault tree solutions were-then combined to create:the accident sequence cut sets.
As wit h : the fault. tree solutions, new techniques had to be developed.~ to obtain - the complete sequenco solutions because of the very large_ size o_f the. fault trees and ' uumber of inter.nediate cut sets - generated during ~ the sclution _ process. jThese methods' are ' described in detail in Volume 3 of this report ; and the - specific _ screening -analyses _are described in the
- appropria_te- _ sub analyses volume (Volume ' 3 fc.r internal, Volume 8 for seismic, Volume 9 for fire, and Volume 10 for flood).
2.2.7 Final Accident Sequence Evaluation
~
For all of the analyses, the data for the random events was re-evaluated as D
described in Volume 5 of this report.
Recovery actions appropriate for the particular analysis, component. and cut set were identified and are described in _ the. appropriate volume of this report (Volume 3 for internal, Volume'9 for fire,-and Volume 10-for flood) except for the seistic analysis where _ the final quantification-is described in Volume' 2 of this report.
2-6
. a a.
Thermal-hydraulic calculations were performed using the REi.A P, LTAS, and MELCOR codes to determine the timing of evente for various accident coquences.
A new method 1 using the simulator was developed to quantify human error rates where appropriate.
The recovery actions were then added to the cut sets.
2.2.8 Resolution of Cort 7ulnerable Sequences For accident sequences involving loss of containment heat removal but continued success of primary injectien, core damage could occur as a result of the interaction between containment response and phenomena and the injection systems operability.
Examples of this are: (1) high containment pressure (i.e., >85 psig) can cause the ADS valves to reclose resulting in the loss of low pressure injection, (2) high containment pressure can result in isolation of the RCIC system, and (3) venting of the containment at 60 psig or structural failure of the containment can result in loss of 11PSil for pumps taking suction from the suppression pool (not considered likely at LaSalle due to pump design) or equipment failure for equipment located in the reactor building due to the severe environments created in the building from the blowdown of the primary contairunent.
The first example was taken into account in the event trees by al' wing sequences with only low pressure injection to go to core d arra g - ofter failure of containment heat removal and venting as a result of r, pressurization of the vessel upon reclosure of the ADS valves.
The second example was accounted for by allowing RCIC to fail when containment pressure reached 30 psig and then requiring some other high or low pressure system for success.
The third example was accounted for by adding events to the event trees to determine whether the contalument was vented or structurally failed by leakage (containment takes g eater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to depressurize) or rupture (containment takes less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to depressurize).
Given various locations and sizes of containment failure, the severe environments created in the reactor building were determined by developing a detailed reactor building model and using the MELCOR code to calculate environmental conditions in the reactor building due to the containment blowdown.
Separate expert judgement clicitations were used to y
evaluate equipment failure probabilities in the severe environments and to determine probability distributions for containment failure size and location under dif ferent loads.
(This was done in conjunction with the NUREG-1150 expere clicitation process.)
Simplified Boolean expressions were used to evaluate the system failure probabilities and to define cut set specific survival events which were added to each accident sequence cut set for
.ne core vulnerable accident sequences.
This process is described in detail in Volume 3 of this report.
2.2.9 Individual and Integrated Uncertainty Analysis A review of methods 8 for representing and propagating uncertainty in PRAs was conducted and the Latin liypercube approach was adopted.
A new code, TDIAC,9 was developed to perform the final quantification of the accident 2-7 h.--..
l sequences using the Latin Hypercube sample generated by the LHS codo.M The TEMAC code also calculates various risk importance measures and ranks the basic events by their contribution to mean core damage frequency.
Individual accident sequence cut sets were evaluated, and uncertainty distributions and importance measures weie calculated.
For each analysis (seismic, fire, flood, and internal), the cut sets from all of the surviving sequences were combined and evaluated to obtain the total core damage frequency and importance measures for that specific set of initiators.
The individual accident sequence results and the integrated re sul *;s for each subanalysis are presented in the appropriate volume of this report (Volume 3 for internal, Volume 2 and 8 for seismic, Volume 9 for fire, and Volume 10 for flood).
Finally, all of the cut sets from all of the analyses were combined into one global expression and an integrated calculation was performed to obtain an overall core damage f requency and uncertainty distribution and global importance measures.
These final global results are presented in Volurce 2 of this report.
2.3 References 1.
D.
W. Whitehead, " Recovery Actions in PRA for the Risk Methods integration and Evaluation Program (Rril CP' Volume 2: Application of the Data Based Method," NUREG/CK 9o34/2 of 2,
SAND 87-0179, Sandia National Laboratories, Albuquerque, NM, December 1987.
2.
L. N. Haney, H.
S.
- Blackman, B.
J.
- Bell, S.
E. Rose, D.J. Hesse, L.
A.
Minton, and J. P. Jenkins, " Comparison and Application of Quantitative Human Reliability Methods for the Risk Methods integration and Reliability Program (RMIEP)," NUREG/CR-4835, EGG-2485, BMI-2159, Idaho National Engineering Laboratory, Idaho Falls, ID, January 1989.
3.
M. K. Raviadra and H. Banon, " Methods For External Event Screening Quantification: Risk Methods Integration and Evaluation Program
(".M I E P ) Methods Development," NUREC/CR-4839, SAND 87-7156, Sandia National Laboratories, Albuquerque, NM, February 1992.
4.
W. T. Wheelis, " User's Guide for a Personal-Computer-Based Nuclear Power Plant Fire Data Base," NUREG/CR-4586, SAND 86-0300, Sandia National Laboratories, Albuquerque, NM, August 1986, 5.
R.
L.
Iman and S.
C.
Hora, "Modeling Time to Recovery and Initiating Event frequency for Loss of Off-Site Power Incidents at Nuclear Power Plants," NUBEC/CR-5032, SAND 87-2428, Sandia National Laboratories, Albuquerque, NM, January 1988.
6.
"LaSalle County Station: Final Safety Analysis Report," through Admendment 63, Commonwealth Edison Company, Chicago, II.
2-8
1 l
7.
" Additional Information Required for NRC Staff Generic Report on Boiling Vater Reactors," NEDO-24708A, Volumes 1 6 2,
Class 1,
Revision 1, Nuclear Fuel and Services Division, General Electric Company, San J ose, Ca., 95125, December 1980.
8.
M.
P.
- Bohn, T.
A.
Wheeler, and G.
W.
Parry, " Approaches to Uncertainty analysis in Probabilistic Risk Assessment," NUREG/CR-4836, SAND 87-0871, Sandia National Laboratories, Albuquerque, NM, January 1988.
9.
R.
L.
Iman and M.
J.
Shortencarier, "A User's Guide for the Top Event Matrix Analysis Code (TEMAC)," NUREC/CR-4598, SAND 86-0960, Sandia National Laboratories, Albuquerque, NM, August 1986.
- 10. R.
L.
Iman and M.
J.
Shortencarier, "A
FORTRAN 77 Program and User's Guide for the Cencration of Lctin 11ype rcube and Random Samples ior Use With Computer Models," NUREC/CR-3624, SAND 83-2365, Sandia National Laboratories, Albuquerque, NM, March 1984 M
i A
2-9
3.0 ACCIDENT SEQUENCE DELINEATION 3.1 Introduction One of the major purposes of the RMIEP program was to develop methods for the integrated evaluation of all Level I initiating events.
So while only one set of event trees will be presented in this section, these trees were used in four different analyses: internal events, seismic, fire, and flood.
The fault trees to be used with these event trees were expanded from the usual level of detail used in the internal eve r.ts analysis to include information necessary to perform an integrated evaluation of the internal and external events.
This development is presented here so that the reader can understand the accident sequence results presented in Section 4 of this report without having to refer to other volumes.
In this section, the functional and systemic event trees used for this analysis will be presented and described.
The accident sequences are followed until the end state is resolved into no core damage or core damage.
No core damage, or success states, are those in which sufficient nystems work in order to prevent core damage.
This may mean that only core heat removal is successful or that both core and containment heat removal are successful, depending on the particular systems being used.
For some sequences, in which core heat removal is successful but containment heat removal fails, core damage does not result directly from the system failures but from phenomenological events in the containment which can possibly lead to failure of the core heat removal function and result in subsequent core damage.
The event trees include the feedback effects on the core heat removal systems as a result of the containment phenomenology in order to predict if core damage will occur given failure of the containment heat removal systems and the subsequent containment phenomeno1ogy.
The end states of the accident sequences are either:
(1) success-no core damage but containment may or may not have failed, (2) core damage without direct containment failure or (3) core damage with containment failure (either controlled, venting, or uncontrolled release, structural failure).
3.2 Core Damage Functional Event Trees The functional core damage event trees are presented in Figures 3.2-1, 3.2-2, and 3.2-3.
The functional event trees delineath the general plant response to loss of coolant (LOCA) accidents, anticipated transients (TRANS), and anticipated transients without scram (ATUS).
The delineation is presented in terms of the success or failure of safety functions required to mitigate the transient or loss of coolant initiator.
These safety functions (i.e.,
the top events in Figures 3.2-1, 3.2-2, and 3.2-3) are described in this section.
3-1
~.
s i
SEQ _
L RS VS:
CCM1 CHR CCM2
-CCM3 g
S ATE 1
OK-2 OK 3
CD 4
'CD 5'
CD 6
(1) 7 (1) 8 (1) 9 (1) 10 (1) 11 (2)
(1) Sequence proceeds similar to VSS success except much faster. CHR success may be unitkely.
' (2) Transfer to ATWS Tree Figure 2.3.
Figure 32-1 LOCA Functional Event Tree 3-2
- =
i RCS SEQ END T
-RS CCM1 CHR CCM2 CCM3 INT STATE 1
OK 2
OK 3
CD 4
CD 5
CD 6
(1) 7 (2)
(1) Transfer to LOCA tree (2) Transfer to ATWS Tree Figure 3.2-2 Transient Functional Event Tree 3-3
SEQ END T
RS1 CCM1 CHR CCM2 CCM3 RS2 STATE 1
OK 2
OK 3
CD 4
CD 5
CD 6
OK l
7 CD 8
CD 9
CD 10 OK 11 CD 12 CD 13 CD 14 CD Fir:re 3.2.* ATWS Functional Event cee 34
. - -. ~ ~. - - - - - - - - - - - -.. - - - - - - -. - - -.. _
i!
I t
. 3.2.1 Safety Funct ions Reactor Suberii!cality f i,<1.RS21 a LOCA or transient, it is necessary to limit the core heat Following generation by shutting down the nuclear reaction.
This is normally done by inserting t.h e &ntrol rods into the core.
For ATWS scenarios, normal mechanisms for inserting the control rods into the core have already been assessed to have fe' led.
The most likely reason for failure to scram given the existence of the alternate rod insertion system, which makes electrical failure to scram probabilistically small, is mechanical failure of the rods to insert.
Backup systems and procedures are available fot reducing core power given a mechanical failure to insert the control rods.
Failure to reduce core power following a LOCA or transient can result in quickly boiling off of the core coolant until the reactor water level has
- stabilized due to the balance between the amount of water being injected into the core and ' the amount of water being boiled off due to the power l
Icvel consistent with the water level.
For LOCAs, the normal heat removal system would be bypassed and the energy would be transferred directly to the drywell.
For transients, if-a turbine trip doe., not occur and the reactor continues as before, then no accident resuitt..
For transients with turbine trip or transient induced LOCAs (stuck. open SRVs), since the turbine bypass capability is only 25 percent of full power, the normal heat removal system (if available) would not be capable of removing all the generated steam.
The vessel pressure would increase rapidly due to the high energy-generation rate which would equilibrate at a rato consistent i
with ' the particular injection system being used or decay heat if no injection was available.
Excess pressure would be relieved to the suppressiren pool through the SRVs.
Containment and core damage are possible if the operator falls to teduce core ~ power.
Sequences involving failure. of the reactor suberiticality function are transfered to t.he ATWS event tree and evaluated there.
If the reactor suberiticalit" fu-tion is successful, it is still necessary to remove boot from the core at.J replace lost coolant.
.The event RS represents failure to shutdown the reac or early in the accident.
The event RS2 represents the ultimate shutdown of the reactor after it has been stabilized.
Reactor CoolanLSyst em Interrit y (RCSINT)
Whether or not reactor suberiticality is successful, energy will continue to_ be produced either at como equilibrium power level consistent with the inj ection = rate. or_ at the decay heat level.
For LOCA initiators, reactor coolant system _ integrity - has by definition failed and the energy will be transfered -directly to the drywell or, if-the LOCA is small enough, partially to the suppression pool via the SRVs.
For transients, the RCS integrity function allows the reactor coolant system pressure to be 3
3-5
. ~
~.. -
.. ~.
o safety / relief valves relieved by the opening of a sufficient nun;be r o f th e and the transferring of the steam to the e.uppression pool if the normal heat removal path (pCS) has failed.
F. von if the turbine bypass is available, the transient offccts of the reactor shutdown may scquire the opening of some SRVs.
Multiple and/or continuous openings of the relief valves will occur if turbi.ie bypass is not available.
For transient sequences, failure of the relief valves to open will result in overpressurization and possibic rupture of the reactor vessel.
In thts analysis, it is assumed that the vessel rupture will result in tne equivalent of a large IDCA and would transfer to the LOCA event tree.
The rupture is most likely to occur at the ouie ga seal on the reactor head.
Successful operation of the injection systems could mitigate this event.
It has been assumed in some previous studies that all of the check valves on the injection lines would f reeze shut from the high pressure and would not be abic to reopen after pressure decreased from the induced LOCA.
This assumption seerns rnuch too severe given the proof testing pressure of ths valves and vessel.
The cressure rise is not instantaneous but quasi-static and would result. in slow pressurization of the RPV from a mechanical standpoint.
Also, af ter pressure decreased, the injection systems wouLi tend to force water back into tne vessel.
Failure of suf ficient SRVs to open is an unlikely event and these sequences are probabilistically negligible and not developed further.
If overpressure protection succeeds, the pressure in the vessel is reduced but coolant is lost from the vessel to the vapor suppression pool.
It thus becomen necessary to provide coolant to the vessel to keep the core covered.
For non ATWS sequences, once the pressure in the vessel is relieved, the safoty/ relief valves should recicae to rninimize coolant loss.
If one or more of the valves fall to reclose, a continuous flow of steam from the vessel to the suppression pool will occur.
Soch an occurrence wculd require that the suppression pool remain intact, that makeup water be suppiled to the vessel, and that the heat transferred to the suppression
)
pool be eventually transferred to the envirm
- nt.
These sequences transfer to the IDCA tree because they have an un.utigated loss of primary coolant from the RFV.
They are not equivalent to a LOCA because the flow is df rectly to Se suppression pool instead of to the drvwell.
They are callei transient-induced LOCAs and were evaluated separately.
For AiWS sequences, the LOCA aspects of these sequence, do not affect the ovent tree because the systems used to mitigate an ATWS event can mitigate LOCAs if any size and, for sequences without reac tor suberiticality, the ADS vaives will be open anyway to transfer the energy to the suppression pool.
For the above reasons. this event coes not appear explicitly on the ATVS functional event tree.
Successful reclosure of the safety / relief valves must be followed by decay heat removal from the vessel.
3-6
Early Cont ainTent OveI.pff mff_Protec11on. (Vapor E 2pntitipn. VS)
During a LOCA, the normal heat removal path is disrupted by the pipe break and coolant is released to the containment.
The steam generated by the hot coolant released during a LOCA is relemed into tha drywell and forced by its own pressure to flow through downco..tra into the wetwell.
The wetwell contains a pool of water, called the tuppression pool, for condensing the steam and thus reducing the temperature and pressure of the dryvill.
This vapor suppression pool has sufficient heat capacity for storing all the heat released to the containment for several hours af ter a LOCA before it becomes necessary to transfer heat from the containment to the ultimate heat sink.
If the steam released during a LOCA is not condensed by the vapor suppression pool, pressure will quickly build up in the primary contaltunent and the containment will need to be vented or it will mechanically fail (for large LOCAs, the time to mechanical failure could be as short at 30 sec).
For transients, given failure of the RCS integrity function, heat from the vessel la transnorted to the suppression pool either di;ectly through a stuck open SRV or via a large LOCA to the drywell and then through the downecmcrs.
Failure of the ouppression pool to condense this steam will result in overpressurization and failure of the containment within a very short time (30 see tn 15 min).
Containment venting or failure may result in failure of the coolant injection systems and containment heat removal equ ipnient due to the severe environments produced in the reaccor building, where most of the systems modeled in this analysis have components, Icading to core damage and a radioactive release.
Failure of this function is asswmed to result in the core being vulnerable to damage.
Sequences with failure of the RCS integrity function are transfered to the LOCA tree and evaluated there.
This function does not, therefore, explicitly appear on the transient a ce.
For ATWS sequences, failure of the vapor suppression function is probabilistically negligibic and it is, therefore, not developed on the ATWS functional event tree.
The vapor suppression pool, also removes radioactivity released during a LOCA accident that proceeds to core damage.
This occurs as radioactive particles released during the core damage process are forced through the suppression pool water where the particles are essentially filtered and e
retained in the water.
Noncondensible gases are not affected and remain in the primary containment atmosphere.
Successful vapor suppression operation must be followed by makeup of reactor vessel coolant and removal of heat released to the containment.
C_cre Coolant Makeun (CCril CCM2. CCM3) o A LOCA by definition results in loss of coolant from the reactor core that must be replaced in order to prevent core damage.
For transients, boil-off 3-7
_.-___________.____.m.__.-__
of the. coolant through the SRVs to the suppression pool will also result in l
a loss of coolant that must be replaced.
The emergency core cooling (ECC) systems are designed to provide cooling water to the core from an external source or from the suppression pool. This cooling water passes through the core, removing heat and transferrin 6 it to the vapor suppression pool.
If l
the ori inal source of water was external, the ECC systems would be S
realigned to take suction from the suppression pool to form a continuous circulation loop for cooling the core upon high level in the suppression pool or low level of the source.
Eventually, the stored heat in the suppression pool must be transferred to the ultimate heat sink.
Non+ emergency related systems are also capabic of injecting water from external sources -into the vessel during a transi nt.
Iloweve r, these i
systems are not capable of recirculating water from the suppression pool.
Failuro of the coolar.t makeup function will result in losa of core cooling and core damage. _ Success of this function must be followed by removal of heat stored in the suppreesion pool.
CCM1 represents successful initial core coolant makeup early in the accident to : provent immediato cote damage.
CCH2 represents core coolant makeup continuinB. - to be successful _ af ter failure of containment heat removal but~ before containment-failure or venting.
CCH3 represents cont!nued successful core coolant makeup after containment failure or 2
venting.
CCH2 and C:M3 are necessary because of the feedback of fects of the containment add eactor building environments on the injection systems performing the coolant makeup function that are described below under the contaitutent heat removal function.
' Containment Heat Removal (CHR)
In the later stages of a LOCA or transient initiated accident, the heat buildup in the suppression pool can reach the pool's storage capacity.
If this storago capacity is exceeded, the suppression pool will boil and the evolved steam can cause overpressurization and failure of the cc,ntainment.
Containment failure can potentially result in core damage.
I The' containment -heat removal (CHR) systems transfer heat to thef ultimate heat _ sink from the suppression pool via heat exchangers.
The containment
- heat removal systems are aligned to take suction-from the suppression pool, pass the water through heat exchangers, and inject it into the core (LpCI mode), into the drywell-(CSS _ mode), or back into the suppression pool (SPC mode).
If the containment heat rnmoval and core coolant makeup function are su6cessful, _ the plant is stabilized and core damage is averted.
Th#
acci. dent is thus-mitigated and no other functions are required.
For ATWS - sequences, even if the normal heat removal path is available for removal of energy 'being generated after failure of the reactor suberiticality function, the reactor power 1cvel will be in the range of 9-3-8
17%, depending on the systems operating.
This is much higher than the capability of the RllR system (about 3t).
The energy beinc, generated in the i
vessel will be deposited in the suppression pool via the SRV discharge lines cr directly to the drywell if a iDCA exists. The excess energy, over i
and above the RilR systems heat removal capacity _, will result in rapid cont aliment pressurization.
p Failure of the containment heat removal function can have a feedback eff$ct that results_in failure of the core coolant makeup function.
This failure can come about either before or af ter containment venting or structural failure of the containment frotn overpressure created by the failure to remove decay heat.
As the containment p r e s s u ri r.c s, the contninment pressure, temperature, and suppression pool temperature all increase.
liigh containment pressure can result in isolatfor, and failure of the RCIC system.
Low pressure injection systems will fail to inject when the ADS valvos reclose ned the RPV repressurizes (this is not important for LOCAs l
vhore the RPV will remain depressurized from the break itself).
Very high pressures and temperatures can result in direct failure of the ADS valves which are not designed for such environments.
lii gh suppression pool temperatures can result in failure of nystems pumping such high temperature r
water or from lous _ of NPSil when the pool becomes saturated.
After containmant venting or _ failure, high t ernpe rature stearn may be blown into the reactor building depending upon the location af the failure (failure to the refueling floor will not blow steam into the reactor building).
This blowdown will create severe environmants in the reactor building well beyond tho harsh environments usually evaluated.
Most sys t erns have components in the reactor building that would be subject to such 1'
enviror.ments and failure of the - Ecc and other systems af ter containment talluro due to these bnvi onments would re s.ul t in core damage with an already failed <containnent.
For ATWS acquences, if only low pressure injection systems are working and lutR works, LTAS-calculations, described in Volume 4 of this report, show that the containment pressure will equilibrate near the ADS reclosure pressure.
The low pressure inj ec tion systems ' stop injecting as the i
containment pressure rides due to. the energy generated when - the core is refloodod, the. ADS valves reclose, and the RPV repre ssuri::es.
As the reactor goes suberitical, with injection stopped, the RllR system can then reduce con ta inn.ent pressure below the reclosure pressure, and t.he ADS
. valves reopen.
The low pressure injection systems can re-inject water into the core snd the process starts over again.
If venting occurs, or both RHR and venting are successful, the containment pressure will equilibrate above the vent-pressure but below the - ADS reclosure pressure, Low pressure injectica.will go on and of f as the - RpV pressure goes below and above the low pressure inj ection - pumps. shutof f head.
These scenarios assume that injection does not : fail f tc.m the severe environments produced in the reactor _buildingfafter venting or.from the s Ive cycling in the inj ec tion lines as the RPV pressure varies (this is accounted for elsewhere in the model).
-Successful residual heat removal can result in core stability if core coolant makeep continues to be available.
3-9
__.__ _ _m
_.m._,_.____.m t
L3 Systems Availabic to Perform Recuired Functions The front line systems available at LaSalle for mitigating LOCAs and transients are presented in Tables 3,3-1 and 3.3-2 respectively.
De t. ailed descriptions of the systems listed are given in the corresponding fault tree analyses sections presented in Volume 6 of this report.
A dependency matrix showing the system interdependences is given in Table 3.3-3 for all of the systems for which fault tree models were develcped in this analysia.
Detailed descriptions of all of the systems can be found in J
Volume 6 of this report.
The primary systems are listed across the top and the support systems they depend on are listed down the side.
3.4 Systemic Event Treen The logic and supporting calculations used to develop the systemic accident
-sequence event trees are described in detail in Volume 4 of thfa report.
-Por this summary, we simply present the results of that analysis.
3.4.1 LQMa The three LOCA initiating events are evaluated on a single LOCA event tree.
This'is possible since the general plant response is similar for all three sizes of.LOCAs.
However, the success criteria for safety related systems vary with'the size of the 14CA.
The difference in the success criteria is accounted for by inclusion of the initiating events in the system fault
- troom, i
A:
Large LOCA A large LOCA is any break in the reactor coolant system piping which could lead to the loss of a sufficient amount of coolant to result in a rapid depressurization of the reactor system.
h; Medlum LOCA.
A medium LOCA is of a size such that rapid vessel depressurization does not j
occur.
Therefore a high pressure coolant injection system is required or the vessel must be depressurized.
The size of a medium LOCA is dependent 2 cr a steam break upon location. ' A liquid break between.0005 and.0.3 ft in -the range- 0.1 to 0.3 f t - vill result in. a medium LOCA.
2
$2L Small LOCA ;
- A small LOCA is characterized by slow or no vessel depressurization at.d a gradual inventory loss from the vessel.
The high pressure coolant makeup systems including RCIC can be utilized to mitigate a small_ LOCA..A small 1DCA' is defined as a liquid break less than or-equal to 0.0005 f t2 or a 2
steam' break 50.1-ft.
The. LTAS code, developed at-Oak Ridge National Laboratory (ORNL), was modified to represent the LaSalle plant.
The code was base-lined to a 3-10
.m
-....s..
Table 3.3 1 LOCA FUNCT10!i/ SYSTEM REIATIONSilIP Function Systems Reactor Suberiticality Reactor Protection System (RPS)
Recirculation Purnp frip (RPT)
Alternate Rod Insertion (ARI)
Standby Liquid Control System (SBLC)
Early Contsininent Overpressure Vapor Suppression Systern (VSS)
Protection Core Coolant Makeup (lligh Pressure)
Main Feedwater (MFW) liigh Pressure Core Spray (llPCS)
Renetor Coolant Isolation Cooling (RCIC)
Control Rod Drive (CRD)
(Low Pres.sure)
Automatic Deptessurization System (ADS)
Low Pressure Core Spray (LPCS)
Low Pressuro Coolant Injection (LPCI)
Condensate System (CDS)
Containment lleat Removal Residual lleat Retnoval System (RilR)
Supptession Pool Cooling (SPC) mode Containtment Spray System (CSS) rnode c
Shutdown Cooling (SDC) mode e
3-11
.._..=...
- _. = = _.._.._.- _
i Table 3.3 TRANSIENT FUNCTION /SYSTDi REIATIONSHIP -
Function Systems Reactor Suberiticality Reactor Protection System (RPS)
Recirculation Pump Trip (RPT)
Alternate Rod Insertion (ARI)
Standby Liquid Control Systea (SBLC)
- RCS Integrity Safety / Relief Valves (SRV) open SRV Closure Early Contaitunent Overpressure Vapor Suppression System (VSS)
Protection 4
.. Core. Coolant Makeup (liigh Pressure)
Main Feedwater (MFW) liigh Pressure Core Spray (IIPCS)
Reactor Coolant 1 solution Cooling (RCIC)
Control-Rod Drive (CRD)
- (Low Pressure)
Automatic Depressurization System (ADS)
- j Low Pressure Core Spray (LPCS)
Low Pressure Coolant Injection (LPCI)
Condensate System (CDS)
Diesel Driven Fire Water (DDFW)
- Contaitunent llent: Removal Residual-lleat Removal' System (RHR)
Suppression Pool Cooling (SPC) modo Containment Spray System.(CSS) mode Shutd wn Cooling (SDC) mode Power Conversion System (PCS)_
(
f j.
P 3-12
--6.
r.
~,, E
-m
-=.e.w.
w h E*--
.+.r,
-*v-L.
e
. - -,, -,.+---w,,nE.x,,,w.-
vw-r-.',w.
.rw..--v..*v---wrw-.w,--re, e--
6
- - ~ _ - -. - _. -.. - ~....
.... ~ ~,... -.,..
l Table 3.3 3 System Dependency Hatriz Tront Line Systems Support-RPS MrW littS RCIC CRD' ADS CDS Lit! LPCS ITS SCS SIC CSS VENT RP7 SBLC System j
l l
AC X
X X
X X
X X
X X
X X
X X
X X
DC X
X X
X X
X X
X X
X X
X X
C5CS X
X X
X X
X 1A X
X X
X X
i l
IN X.
X X
RBCCW X
TICCW X
X SW$.
IfVAC X
X X
X X
X X
X LCC3 HVAC DG Support Systemn-f Sur1ert AC DC CSCR 1#.
IN. EBCCW TBCCW SW3 ECCS DG System ifVAC. HVAC
- AC -
X X
X X
X-X X
X X
DC' X
X CES -
X X
X i
4 IA X
X X
IN RBCCW X-TBCCW X
SW5 X-X t
ECCS-HVAC DG "
X IIVAC 3-D I
- . n -.. - -
Table 3.3 3 (Concluded)
Syntem Dependency Matrix Acronym Description AC AC Power System ADS Automat' pressurization System CDS Condensate System CRD Control Rod Drive System CSCS Core Standby Cooling Systen CSS Containtrent Spray System DC DC Power System llPCS liigh Pressure Core Spray System llVAC DG Diesel Cencrator Room Cooling System llVAC ECCS ECCS (llPCS, LPCS, LPCI) Room Cooling System IA lustrument Air / Service Air Systems IN Instrument Nitrogen /Drywell Fneumatic System LPCI Low Pressure Coolant Injection System LPCS Low Pressure Core Spray System MPW Main Peedwater system PCS Power Conversion / Main Steam System RBCCW Reactor Building Clos,ed Cooling Water System RCIC Reactor Cote Isolation Cooling System RPS Reactor Protection System
- < PT Recirculation Pump Trip System SBLC Standby Liquid Control System SCS Shutdown Cooling Syctem SPC Suppression Pool Cooling System SUS Service Unter System TBCCW Turbine Building Closed tooling Water System VENT Containment Venting System 3-14
REIAPS :nodel used to evaluate transient response one REJAPS calculation and twelve small break and three ne diurn break LTAS calculations were performed and are described in Volume 4 of this report.
The systemic event tree for a LOCA initiator is shown in Figure 3.4-1.
3.4.2 InttuLient s With Scram The eight transient initiating event categories and ten special transient initiating event categories ide ntified in this st udy aru delineated in a single transient event tree.
The success criteria for the systerns required to mitigate each transient can vary.
This variation in the success criteria is accounted for by including the specific effects of the initiator on the responding synterns in the system fault trees in a manner that appropriately models the initiators impact on the system response.
The eight transient initiators are:
T1: Turbine ~-ip with Turbine Bypass Available T2: Turbine Trip With Turbine Bjpass Unavellable T3: Total Main Steam Isolation Valve Closure T4:
Loss of Normal Condenser Vacuum T5:
Total Loss of Feedwater T6:
Partial less of Feedwater 07:
Inadvertent Opening o a Safety / Relief Valve T8:
Loss of Offsite Power The ten special initiators are:
1.
DC bus 2A 2.
DC bus 2B 3.
AC bus 241Y 4,
AC h.is 242Y 5.
Loss of instrument air 6.
Loss of drywell pneumuic 7.
Loss of 100# drywall pneumatic s
8.
Total loss of reactor vessel narrow range level instrumentation 9.
Loss of train A and C of reactor vessel narrow range level instrumentation
- 10. Loss of train B and D of reactor vessel narrow range level instrumentation A detailed discussion of the identification of the initiating events is presented in Volume 4 of this report.
The event tree for a transient ini.'ator is shown in Figure 3.4-2.
This event tree was developed by referring to the accident analyses reported in Chapter 15 of the FSAR,1 LaSalle operating procedures, generic BWR operating procedures,2 and generic transient thermal-hydraulic calculationsJ
?
3-15 e__.-..-__ _ _._
- _ -. = _ _ _ _ _ ~ _... - - _ _ _ -.. _ _ _ _ -
L m
ve urs mu wr Ats cus vu uu arc
<ss cum Ats as u,u uu vsxt was sme sta ssa s stA ms I
I I
Am i
to I
C b
i C
I n
1 1
C n
?,
L_
=
T:
=
n s
4)
Z 3
'd
- -4 Z
ll M
i (3)
=.
- (2)
I i
=
=
n
=
n (1)
C E.
7
=
n C
n C
n
($)
C 0
M C
n
=
0
~~
C n
C
~.
m.
a.eme.
W t
I, s.
~
m to N
r-C M
C
'J n
St L A.
=,
c m
I tr M
I C
ll n
C n.
t 1
(4)
C
'J C
0 n
(6) g I
=
n
~
'--4 C
lJ kr iO I
e C
n
.8, M
+-
i
-=
2
'l I
h W.
L9 C
0 n
'hC 0
=
=.
n.
V a
m (1) TRANSTER FTtOM TRANSIENT SEQUENCIi 101 (2) TRAN31731 IT:OM TRAN3IENT SEQUDiCE i IN.
g (3) RCIC SUCCESS POSSIBLE FOR SMA111.DCA ONLY.
(4) CRD SUCCESS POSSIBLE IVR SMAI114X'A OR STEAM BREAK ONLY.
(6) }Vit VERY LONG-TERM SEQUD'CES WInf A LARGE 1DCA WlIERE DIE CDRE 13 AT :h3 TAF MAY GET SUDCOOLD4G AND MELT TIIE TDP OF 'llIE CORE LF ONLY ONE IJCI IVMP 13 OPERATE 3G.
(6) 1RANSTEld TO (2). DOWNCOMER, VACUUM DREAKER, OR SRV DISC 11ARGE llNE FAILURE, S AME SYSTEM SUCCESS CRITERI A. SEQUENCE OCCURES IN SHOtrlTR TIME.
(7) TRANSTI*R1D ATWS TREE.
Figure 3.4-1 LaSailo LOCA Systemic Event Tree 3 16 l
1 i
w
Figure 3.4 1 (Continued)
LaSalle IDCA Systemic Event Tree Event Descriptor Description L
LOCA Initiator Any loss of coolant initiator RPS/ARI Reactor Suberitical:
Use of the RPS or ARI systems to Reactor Protection render the reactor subcritical by System (RPS) or inserting the control rods Alternate Rod Insertion (ARI)
VS Vapor Suppression Successful operation of the downcomers u.d vacuum breakers to mitigate the effects of the vessel blowdown on the containment.
MIN Feedwater Available Use of the motor-driven feedwater pump for initial coolant injection.
11PCS PPCS Available Use of flPCS system for initial coolant injection.
RCIC RCIC Available Use of turbine-driven RCIC pump for initial inj ection, small LOCA only.
ADS Reactor Vessel Use of ADS system to depressurize Deptersurization RPV for medium and small LOCAs.
CDS Condensate Available Use of CDS system for initial coolant injection.
LPCI LPCI Available Use of LPCI system for initia' coolant injection.
LPCS LPCS Available Use of LPCS system for initial coolant inj ec t ion.
SPC Suppression Pool Cooling Use of SPC mode of RilR for containment heat removal.
CSS Cantainment Spray Use of CSS mode of RllR far containment heat removal.
CRD2 Intermediate Control Use of two CRD pumps late in accident Rod Drive for small LOCA cnly.
ADS I Intermediate Reactor Use of ADS to depressurites and use Vessel Depressurization low pressure injection system af ter RilR and RCIC failure.
1 3-17
l Figure 3,4 1 (Concluded)
- LaSalle LDCA Systerric Event Tree Event Descriptor.
Description
{
i CDS 1 Intertnediate Condensate Use of CDS, af ter PJtR and RCIC Available failure, to coel the core.
i LPCI I Intermediate LPCI Use of LPCI, after Rl!R and RCIC 3
Available failure, to cool the core.
4 i
LPCS 1 Interrnediate LPCS Use of LPCS after RllR and RCIC Available failure to cool the core.
VENT Contaitunent Venting Use of containment venting to reduce containment. pressure af ter failure of lutR.
5 CRD1 Late Control Rod Drive-Use of one CRD pump in very lon6* term accidents with loss cf containtnent heat removal and failure of other injection to cool the core, small IDCA only.
SRUP=
Containment Failure Mode Structural failure of containment Leak (upper branch) or rupture (lower branch),
. SUR-.
Injection System Survival of any available inj ection Survival systems in severe reactor building environroents af ter containment failure or venting.
l
[-
jn l'
u I:~
j" l
I, 3 18
lmSlsurlsavluru sul wst] aasl cs:t luu Mzl sta j eKl tzej c ja wjcmj sst Ez sus shs nAns t
n t._E i
[
c n
i 1
C n
C f.
n i
n I
' -I i
ll I
C 1
0
=
n g
g i
=
0 0
=
ll 1"
r 2
n I
~
'J n
C i
1 C
0
=
i
=
0
=
7.
=
'L=
n C
n
=
E
!! n
=
n
=
f, O
I C
ll
=
1 to m
" C~_ ~
L I;l
=
ll
=
C U
O FH
=
0 n
f h!!
=
e I
r Lf
=
=
=
=
=
=,
I i
=
to e
=
M l;l O.
L _j
=
o l
=
- l n
=
L a
I
=
i w n C
l'
.n !l 5
n
=
n
=
ll I
=
n 1
a n
.E.
- n. [l C
e 3
'.m tea m
(1) USED M12 SOLVE CURE DAMAGE IECDVERY 1DW !YESSUF2 SYSTEMS FAIL ON ADS CID3URE AT ADOU't 85 PSIO, BOIID}T AND CORE DAMAGE OOCUR B12VPI CONTAINMEhT FMLURE (MEAN VALUE,195 i%0).
(2) TRANSITR M IDCA 1TtEE (t $RV FIC = SMAllIDCA. 2 SRV F1C = MEDIUM IIX'A, AND
(3) TRANS)TH 1D IDCA 11EE ( OVERPIE30URE CREA* X; ACA, IYOB. OF 18 'RV PlV NEC11ABII).
(4) 'ITtANSFIR TO ATWS TITE Figure 3.4 2 LaSalle Transient Systemic Event Trec 3-19
Figure 3.4-2 (Continued)
LaSalle Transient Systemic fvent Tree 1:ve nt Descriptor Description T
Transient Initintorn Any transient or special transient initiator.
RPS/ARI Reactor Subcritieni Use of the RPS or ARI systems to Recetor Protection render the reactor suberitical by Syst<.m (IWS) or inset t ing the cont rol reds Alternate Rod Insertion (AR1)
SRV O Safety Relief Valves The SRVs open to relieve RPV Open prest,ure.
SRV C Safety Relief Valves The SRVs reclose preventing a Reclose transient induced LOCA.
MPW Feedwater A.'allable Use of the feedwater system for initial coolant injection.
IIPCS llPCS Availablo Use of the llPCS system for initial coolant i nj ec tion.
FCIC RCIC Available Use of the RCIC system for initial coolant inj e c ti on.
ADS Reactor Vessel Use of ADS system to depressurize Depressurization the RPV to use low pressure inj ec tion.
CDS Condensate Available Use of the CDS system for initial coolant inj ec t lon.
LPCI LPCI Available Use of tle LPCI system for initial coolant injection.
LPCS LPCS Available Use of the 1.PCS system for initial coolant inj e c t ica.
PCS PCS Avnilable Use ef PCS for contaiturent heat removal.
SCS Shutdown Cooling Use of SDC mode of RilR for i
containment heat removal.
3-20
m.--
t 1
l l
rigure 3.4 2 (concluded)
LaSalle Transient Systemic Event Tree Event Descriptor Description l
$PC Suppression Pool Cooling Use of SPC mode of RiiR for j
containment heat removal.
i CSS Containment Spray Use of CSS mode of RilR for contal' nt heat removal.
CRD2 Intermediate Control Use of two CRD pumpa. late in Rod Drive accident for injection.
- ADS I Intermediate Reactor.
Use of ADS to depressurize and use Vessel Depressurization low pressure injection system af ter RilR and RCIC tailure.
CDS.I Intermediato ':ondensate Use of CDS, after RilR and RCIC Available-failure, to cool the core.
LPCI 1
-Intermediate.LPCI Use of LPCI, after RllR and RCIC Availabic failure, to cool the core.
LPCS I Intermediate LPCS Use of LPCS, after RilR and RCIC Availabic failure, to cool-the coro.
' VENT Containment Venting Use of containment venting to reduce containment pressure after failure of.R)!R.
. CRD1 late Control Rod Drive Use of one'CRD pump in very long-term accidents with less of containment t.
heat removal and! failure of other injection to cool the wre.
SRUP Containment Failure Morle Structural tulture of containment Leak (upper branch) or rupture
.(lower branch).
SURL Injection System
- Survival of any available injection Survival systems.in severe reactnr building environments after contair. ment failure or ventinE.
grensee
_ wee as== wee =
m
'- b 3 21 l-d-
et m-m 4.ee m+uma imm
-r u
FW+WtWey-e-@r-b ze 5ef4*pg-^-
";-=gy(y-t g +t t +=Hy r g m-p -
y y w' ilyrw-mer$ wvmqa yy yqwwv yt Tyy y yy w v v y1yww-g gr6
In additicn - LaSalle specific _ calculations were verformed with RELAPS,
LTAS, and -MELCOR for various accident sequences.
As montioned in so. tion 3.4,1, the LTAS code was modified to rerresent the LaSalle plant and five transient calculations tarn performed.
In addition, an integrated model was constructed for use with the MELCOR code.
HELCOR calculations
- beginning at reactor trip and progressing through core damage, melt, vessel breach, containment heatup and failure, and release of radionuclides to the environment wt re performed.
The results of these calculations are described in Volume 3 of the Level 11/111 report and were mainly used for the Level 11/111 analysis.
3.4.3-AIVS Event Tree Because of the unique -characteristics of the ATVS e"ents, the differences among _ the various initiating events in their effect on the accident progression are judged to be small.
One general systemic ATWS event tree has been constructed and the effects of the various initiators will be inserted into the system fault. trees for th9se 7ystems that are affected.
- Individual ATWS. trees for each initiator were constructed to determine if any differences were significant enough-to warrant separate trees.
There were none.
The LaSalle Unit i 2 ATWS procedure was revised to correspond to the BWR Emergency Procedure Guidelires (EPGs) Revision 3.8 The EPCs address an ATUS. situation in Contingency #7 " Level / Power Control".
The EPGs were used in guiding the construction of the ATWS event tree.
4 The EPC, strategy for ' dealing with an ATWS can-be summarized.as follows:
(1) attempt manual scram, (2) begin manual insertion of control rods and l
initiate SBLC if manus 1 scram fails, (3) reduce. core tower by taking manual control of the reactor vessel injectiov systems and lowering the reactor vessel water level to the top of the core _(which increases the core Mold
- f fraction but also - prevents boron mixing), (4) once. sufficient sodium pentaborate has boen-inj ected, increa3e the rate of reactor vessel i
- injection s_o that normal reactor vess al uacer level is restored to promote natural circulation flow and boron mixing, and (S) bring - the reactor to
- cold shutdesn.
A study pericrmed at Oak Ridge as part of the SASA program of ATVS sequences for Browns Ferry Unit one' indicates that the " instructions-provided ' by the EPGs, if properly interpreted and. implemented by the operators, would provide a satisfactory reactor shutdown and_ accident _
- t termination"'.of the MSIV closure ATWS anelyzed-in the study.
However,.the Oak Ridge study also ' indicated some potential problem l areas.
'The most important of'these is that the operator can be directed to manually reduce reactor pressure - duringf an AWS.. (this is to ensure thet ' the thermal
. energy released durinn _ a LOCA can-be condensed --in a suppression pool.
As the suppression pool temperature increaser above 165
'F, the operator is - to The calculations depressurize the-vessel according to a supplied graph.).
is very performed indicate that -manual depressurization during ' an ATWS tricky and, depending on the situatit n, can resultL in reactor - power and 3-22
s--C,-
.-.441.
,L..s,.-.,
, ~,,,,,.
,-i...=[.
e
,-.%a
,,.4,,-
mv.,.
,y
-,.<.m
vessel pressure fluctuations.
The recommendations f roin this study were to eliininate such a rnanual depressurizat ion during an ATWS.
According to the EPCs, if the reactor cannot be shut down during a transient, if the suppression pool temperature reoches 110 6F, and if the drywell pressure is above 1.69 psig, then the oparator is to lower the RPV water level by terrninating and preventing all injection into the RPV except from the SBLC.
The operator is to maintain the water level at the top of the active fuel (TAF) with a high pressure injection system until the boron has been injected atgl the control rods have been manually inserted.
t Feedwater would be the first. choice of injection systems for some transient initiators since the rnotor driven pump should automatically start if it is available.
The high temperature of the feedwater is also desirabic since it results in less reactivity than the relatively cold vster contained in the condensate storage tank.
RCIC and CRD are assumed insufficient for maintaining the water icvel at the TAF.
The Browns Ferry Study indicated that the two systems could raaint a i n 2/3 of the core covered with the rernaining 1/3 cooled by steam flow.
This reduced level has the benefit of further reducing core power.
Iloweve r, the laSalle RCIC system is dif ferent than the system at Browns Ferry.
The LaSalle system sprays at the top of the vessel while the Browns Ferry system injects int o the downcomer.
The spray system is assumed not to be as effective as the injection system rnd thus no credit was taken for its operation.
For this study, the RELAP5 model used for the transient analysis was modified to perform two ATWS calculations.
In order to perform more efficient calculations and to evaluate more sequences, the LTAS code was modified, as described in section 3.4.1, to represent the LaSalle plant and basis lined to the RELAP5 model.
A REMONA 3-D calculation was used for the power vs 1cvel correlation.S Mneteen different NrW,c calculations were performed using the 1lTAS code to investigate different possible system success criteria and to evaluate the accident sequence timing, 9
The Browns Ferry ATWS study also indicated that the effect of one or two SORVs upon an ATVS sequence is negligible.
This is because several SRVs are open during the early part of an ATWS sequence so that the occurrence of an 50kV would not be recognized until the reactor power had decreased to within the capacity of the SORV.
This is also expected to be true for the LaSalle plant.
For LOCA sequences, these sequences act like sequences with ADS operation and can be evalanted the same way.
The general ATVS event tree is shown in Figure 3.4-3.
s 3-23
w-
.a.~.~,
-.a_..
.a.
wn
.. =
+w_
a-
~r
. w x
.s.
~
r i
wv m
wrw art na rwt saw m3 Aus tas ex I mu m
wr om su sua uuso sew s m us AM B)
I 11N UN
=.
WO f A t kS i
t tm IN I
f Da 1
3 rJa o.
~*t t
CD 6
Qu M
f t
to 1
9 W
e CD 10 be I
be= emus 91 (0
(6)
'I CD l
is pa (N
M
~"
$4 Cs g
tj CD 1
t--f'~~
'7 Ea
,8 eD
$N se ni lut I
fa t' 08 1
et. er os
=0 nu m
29 M DN (7) d
.z.
74, a Ca nm u
74.08 CU F F. gR De I
F$ M 04 l
Pt. 4W1 t*4
- 30. tDi f 13 St. 9 0r 08 y
3r SG9 CJ l
1
- 3. 1,0,4 31 pe
. e er I
a, i ts t0 M.10 7 De l
- 37. t@
De 1
31, trJII DN 30 tip 00 M tti Od
-====
N I
41 1 t
- CD l
[
er 1'S LH g
43 h4 CD a.
44 148 CD m.
41 lie i,0 44 it t 00 d a, t 18 04
- 44. t 49 t.0 43 170 CD 30, iFi Du t-t -
. in co f6 nr. ira cn t 174 Os 1
k-64, '76 CD 1
91, tra CD kN at,177 UN 1
3 7, 178
'CD 60.179 CD e
fML t 3D DW kb I
3Q 131 CD
=
si. in cu IN 02, I33 Os r
83.134 CD L
M in to I
08.1 %
DW a
M 137 CD
=
or. t aa en (gg)
. (N, Leo CD
- 88. I N Da r
we I (gg)
& ist CD E
P1,147 00 s
($
Pf,14J D#
j i
F1444 CD i
- 74. 14%
CO l
% tes DM
~
PN
% leF
.00 yp, tal.
00
{
%4 on (N.
i 78 150 00
(-
- 00. til CD 33 i t?
On IN M
67.5%3 CD R11%4 CD
$4. Its 04
(
M et 13e CD i
Nil
$,Ite f,
L.
88 159 CD H..if0 CD 1
l w
.se m
Figure 3A 3 LaSalle ATWS Systemic Event Tree 1
3-24
.. ~..
Pigure 3.4-3 (Continued) 1.aSalle ATWS Syst ernic Event Tree Event Descriptor Description T
Transient Initiators Any transient, special transient, or LOCA initiator.
RPS/ARI Reactor Suberiticality Use of the RPS or ARI systems to React or Pr ot ect ion render the teactor suberitical by Systein (RPS) or inserring the control rods Alternate Rod Insertion (ARI)
MW Feedwater Available Use of main feedwater for initial coolant i nj ec t ion.
RPT Recirculation Pump Trip Usn of RPT to reduce reactor power j
after failure to scrmn.
PCS Power Convercion System Use of PCS in conjunction with tiFV to remove power being produced by failure to scram.
WL Peedwater Level Cnntrol Operator controls feedwater injection to CST makeup rate after failure of PCS.
i SBLC Standby Liquid Control LN e ot~ SBLC t o inj ect Boron into the System vessel to rendor the reactor subcritical after RPS/Anl failure.
HPCS llPCS Available Use of IIPCS for initial coolant.
inj e c t ion.
ADS Automatic Depressuri-Use of ADS to depres!.urize the vessel zation System and use low pressure i nj e c t i on systems af ter llPCS and tiW f allute.
LPCS 1.,PCS Available Use of LPCs for initial coolant injection.
LPCI LPCI Available Use of LPCI for initial coolant inj ec t ion.
SPC Suppression Pool Cooling Use of SPC mode of RHR to remove decay heat if reactor is shutdown or partially remove energy if reactot is not shutdown.
'f.
3-25
- . --m _.. -.
Figure 3.4 3 (Continued)
LaSalle ATWS Systemic Event Tree Event' Descriptor Description CSS-Containment Spray Use of CSS mode of RiiR to remove decay heat if reactor is shutdown or partially remove energy if reactor.s not shutdown.
VENT Containment Venting Use of containment venting, with or without SPC or CSS to maintain containment pressure below l
structural failure limit.
CRD1 Late Control Rod. Drive
.Use of one CRD pump late in the accident to mainta!n coolant injection.
SRUP Convainment :*ailure Mode-Structural failure of containment Leak (upper branch) or rupture (lower branch).
SUR Injection System Jurvival of any available injection Survival.
systems in severe reactor building environments af ter containment failure or venting.
ULTSD Ultimate Shutdown
. Use of. any injection path to put 15oron into the core or repair of control rod mechanisms to render reactor suberitical.
O l
l 6
- 3 26-
.. -~ -
Figure 3,4 3 LaSalle ATUS Systet.de Event Tree (Continued)
Notes 1) 11 M W succeeds, RPT failure will be negligible since it depends upon the sarne power sources as MW.
If power fails MW, then it will also fail the RCPs.
If RPT does fail, either PCS will have succeeded in which case we have an Ok sequence or, if PCS fails, MW will behave as in note (3) and the RCPs will fail on low suction pressure (the peak pressures will be below level D stress limits).
2)
If MFW fails, RPT is not relevant since RPV level can not be maintained and the resulting low level will result in RCP failure on: low suction pressure.
Sequences transfer to (4).
- 3) MW can not continuo to run for more than about 8 minutes without depicting the main condenser unless the operator controls level.
_The injection rate rnus t be controlled to s 1800 gpm, the makeup rate from the CST.
This means that RPV level will be bnlow TAF.
- 4) Transfer sequences from (2).
6)
For cases where no choice is given, ADS success or failure will not affect sequence timing or end result significantly.
If the operator opens the SRVs to bring pressure down or auto ADS occurs due to low level, power will increase from about 12% to about 18%.
LTAS code calculations show that ADS and subsequent llPCS, LPCS, or LPCI injection'will not produce excessive power spikes.
Level will remain at about 2/3 TAF, the low pressure injection systems will inject enough to raise pressure above their shutoff heads, and,1f HPCS is working, they will remain shutoff since the pressure will not - decrease back below their shutoff heads.
If itPCS is not
('
working then oscillatory behavior results ( mil'd pressure
. variations).
- 7) Containment pressure increases until containment failure occurs.
- 8) RHR and Venting success. Containment pressure. (90 psia, 321 F)
' remains below ADS reclosure pressure.
Oscillatory behavior results rom RPV pressure. exceeding low pressure system shutoff heads,
' inj ection valves cycle : (16 times /hr. ).
- 9) RHR OK and Venting failure - Containment pressure increases.to-ADS reclosure pressure then oscillatory behavior results (100 psia, 321 F) from'RPV pressure - exceeding low pressure system shutoff heads, injection valvas cycle (11 times /hr.).
3 3-27
- ~.
~
Figure 3.4 3 1.aSalle N!WS Systemic Event Tree (Concluded) 110tes Containment pressure (90 psia, 321 F)
- 10) PilR fails and Venting OK remains below ADS reclosure pressure. Oscillatory behavior results from RPV pressure exceeding low pressure system shutof f heads, injection valves cycle (16 times /hr.).
ADS valves reclose at about 85 psig, RPV
- 11) RilR and Venting fail repressurizes above LPCS and LPCI shutoff heads, boiloff and core damage occurs long before containment failure.
- 12) Upor containment leak or rupture to the reactor building, severe environments rnay result in equipment failure.
- 13) 111timate Shutdown - Requires alternate rod insertion or Baron injection by some alternate means.
3-28
-~ _
+
3,5 References 1
1.
"LaSalle County Station Final Safety Analysis Report," through Admendment 63, Commonwealth Edison Company, Chicago, 11, July 1983.
j I
2.
"BVR Emergency Procedure Guidelines," Revision 3, from Cormnonwealth Edison Company, Chicago, II, December 1982.
3.
" Additional Information Required for NRC Staff Generic Report on Boiling Water Reactors," NEDO 24708A, Volumes 1 6 2, Class 1,
Revision '1, Nucicar Fuel and Services Division, General Electric Company, San Jose,. Ca., 95125,- December 1980.
4.
R.
M.-
Ilurrington and S. A. 11odge, ' " ATWS a t Browns Ferry snit One Accident f-Sequence Analysis," - NUREG/CR-3470, ORNL/TM-8902, Oak Ridge i
National Laboratory, Oak Ridge, Tennessee, July 1984.
5.
Ri M.-llurrington and Li C.. Fuller, "BVR LTAS: A Boiling Water Reactor LLong+ Term Accident Analysis Sitoulation Code," !RfREG/CR-3764, ORNL/TM-
.9163, Oak Ridge National Laboratory, Oak Ridge, Tennessee, February 1985; p
k 3-29 e
m
-w
=
e-.
%e--
..--,e,-
.----e--r....
..n,-
--.-i.w-,,
2.---.
v-.-w,,-
,..ww-.
,9--.,
,-c.
..ee-
--.,e
.,.-...<--g w,c--
m ts -
4.0 Discussion of Core Damage Results This section summarizes the results of the individual internal, fire, flood. - and seismic analyses and the final integdated Level 1 analysis.
Section 4.1 discusse: the general results of the integrated analysis:
J section 4.2, the results of the internal analysis; section 4.3, the results of the fire analysis; section 4.4, the results of tha flood analysin; and
=section 4.5, the.results of the seismic analysis.
Es,.n section discusses :
i the dominant. accident sequences, the dominant cut sets, the events most si nificant to rish significant to rlsk reduction, the events most 6
increase, and the events most itoportant to uncertainty, i
(
4.1 Besults of the I-ter. rated Atudysht j
g 4;1'1 Introduction Table 4.1 1 shows the TE!i4C code results for-the final quantification of i
all the sequences that remained in the analysis af t er the initial screening quantification.
Some of the results.are very low due to the application of recovery actions, the impact of the severe environment _ analysia, and the data - revision performed f,r the final quantification.
Sinco the general truncation 1 criteria for this analysis was 1,0E 08/yr. In the screening phase,- accident sequences remaining in Tahic 4.1 1 with final - f requencies below11.0E 08/yr. can not be said to be ranked correctly in terms of their absoluto-contribution to the total frequency of core damage.
Other sequences,- which did not survive the initial screening, are not in their apuropriate placos on the table.
These sequences, which were dropped.from the analysis, may or may.not have-significant recovery, severe environment, or data effects to reduce their. frequencies roughly proportionally to that of the sequences retained in the analysis.
For ' the LaSa11o-internal events analysis, the initiating events were included in the fault trees.
The result _was that there were no_t as many
_ sequences:to_ solve as in other.pRAs.
There were;a-total of 50 transient sequences', 45 LOCA sequences,_ and 95 ATVS sequences that lead to core damage. !Of these.1901 sequences, 54 remained to be evaluated in the final
.quantification and these all' appear in. Table 4.1 1.
. The other 136 sequences that did not survive ~ the screent'ng process are in most aspects i
very similar to the -~ sequences that did survive.
- The offect of the application - of f recovery, the severe environment effects, and the data revision upon the frequency of the sequences that did survive was. reviewed.
Then similarities of the components appearing in the cut sets between those sequences: which survived and those which did - not were e amined.
We conclude that the_ sequences whf th ' did not - survive screening would have 1
their; frequencies. reduced roughly. the same' as similar sequences which ild
. survive f the screening. - Since sequences with mean frequencies greater than or equal to 1.0E 08/yr. comprise 99.9% of the total _ core damage frequency J
Tof those sequences analyzed, -ve: conclude that'. the sequences which did not
" survive the screening process would have-a negligible impact on the final result.
^1 i
u.
a x
e4 me e4 e4 e4 e4 em e4 ed e.4 & H ea H A
.~4 en e
,+ e4 c-. en i-4 m aa a e a+
O. O O O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. C. O. O. O. C. O. O O, OOC
'J i i i
e i i 1
W W W L4 (d L4 W 14 W W W W L4 LG !.d W W W W id N W W WW W Id WWW mn4 N @ N@ N to O & c r" m C 4 to c N O en N N rn O A C 7 OZ sc4 O sn 4 c c co c rn o in N awsO w & in m nan mN m, m - ?
4 e cc o O N s cN M momoN en to en N ON in rc O N oaN a & c ANOo o o en e cv O H m4 4
.A sn c c N N N N to to m cc to e to O mD c c N rs tototo m m W o O'
m 7 Ch m3 momm&W&G &O o-H O
e4 M N NNN CJ N N N N N en en en en m rn to to en to en en m m mmma i
HN O O C: O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. OO
+
CD e
e i
1 LU L4 W td 10 Ld td td W W td (4 W W W W Ld W td Le 14 W W 14 W W W W W LJ W O
m ** c in N O cc O O N 4 N rnto e m 4 n-cN N to m to 4 N e-u V
H n&N. - en m ed a
.-4 & CON ro o rn 4 C to m m m
-A rn W m m c.
d 4
e-4 N inincc N O N N N ON to 4 N o r-c r.o ry 7 ma U. tu, sn rs N eoOmO -
j O..w e4. m. og N
,-4 c4 O c e4 en en to O N cnmocc a e4 e4 a y
rn e4 to cc c d m N N N e4 H ts c c c 4 rn m N N NN N
,-..m
,-4 e-m to LA c@ ccc@ N fs Ps is N N N N ts N N N ts N N cr' T 02 N oC o$ r O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O. O C. O. O. O. O. C O C i i W W 14 W Id W !J 14 td W 14 W W tu la N (d 14 Lu Ld W W Ld W W W W N Id W g
id g
OOOOOOOOOOOOOOOOOOOOOOOOOOO OOC N
OOOOOOOOOOOOOOO OOOOOOOOOOOOOOC gg 4 to N rs H 4 4 to to em e4 N4 e4 m e-4 mN c4 m-N e-4 in cN eJ N 1
- c.4 N N N r-O N ch O cc o r$ tA c 4 co & en rs o to e-4 en c en tA N c a r'.
g H
C4 N m J N CJrn N c N 4 to 4 4A 4 e4 e-d N ed ed N ** to N LA ** rn m e l
p<
in c in m e c in e c c c c c c c e e is ceN N N m to N rs t-N
- O O O. O. O O O. O. O O, O O O. O. O. O. O. O. O. O O O O. O. O. O. O. O. O i
e i
e i
e i
i e
i g
N Lu W W LO 14 td W 14Ld W W W N N 14 14 14 14 Ld W W LO 14 14 W W WWu e
(A OOOOOOOOOOOOOOOOOOOOOOOOO OC OC -
[f 1
m OOOOOOOOOOOOOOOOOO OOOO O OC OOC OO a rs to - m o in to N
.-4 re ch cc & m in N N H e4 o4 N e a O m o rc.
c,)
N c rn 4 O 0; O N c0 @ OmN N ON O 4 ON A @ 4N 4 W c r"
4 H,
m m e-4 N N fs e-4 N ed e4 co en N NN e4 ed LA e4 e4 eN 0 ? co N o e-c' 4 ga r-H N fO in on e e e c c c c c c c rs N rw N rs N rs r, N rs N ts N N r~
.c to w i
O O O O O O O. O. C. C. O. O O. O. O. O. O. O. O. O. C. C. O. O. O. O. O. O. O. O e i e
i e
e i
[y "2
14 W W W I4 14 W N 14 Ld 14 W 14 L4 La L4 td W W La W W L4 14 W W W W W t.u l
$ P,)
OOOOOOOOOOOOOOOOOOOOOOOOOOC OOC r
Lj id O O,O O O O O O O O O O O O O O O O O O O O OOOOOOOc gy M
N o ew en m a co N O e rn 4 en N ecN 4 m o rn O o m in 1 4 moo m en N NwNN - N 4 O m sn m 4N ~s& c re. m~N &
g n c} rn c.4 td f
N e4 ec4mMN t-4 eH e4 H LA iA LA 4 cmrn N N N N ed e4 e4 m ed L? CO '
g i
J cNOcOOcN OOOOOON N O C5 cc O m c0 m O O m to o co r 4
O ed O O. OOOOOOOOOOO. O O O. O. O O. C. O. O O C. O. O. O C, e
"y V
i e
+
+ + i e + + + + + +
e +
4
+ +
ef.
14 W td Ld td (d 14 W id Ld Ld Ld Ld Ld Ld 14 Ld W Ed Ld Id Ld W W Ld W Ld (4 W W y
H OOOOOOOOOOOOOOOOOOOOOOOOO OC OOO O
OOOOOOOOOOOOOOOOOOOOCOOOOOOOC :
g W
N DO7 O O m Ts OOOOOO@ NOO n a o e-* m OO cc to O "
31 O N.O M O O O N.
O O O O O O O 4 O. N 4OM cc C C O m O M m 2 4
4 Ch H O N O O r4 c O O O O O O e-* aOmcC M m4 OOM '^ N s e-g N*f c4ON O O cocc O O O O O O & cc O N & O e4 &C CCN & N OC OH O O. OOOOOOOOOOO. O O em O O em O. O. OO& O.
e~
~ H e
+
+ + i e + + + + + +
e + i i + i
+ +
1 i
4 e
i 14 14 W W Id Ld W Lu L4 (4 Ld L4 W W La N N W Ld LO W LG W W L4 L4 L4 WWW OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO i
A OOOOOOOOOOOOOOOOOOOOOOO OOOOOOO O cc O cc O O e4 cc O O O O O O 4 to O rs en O N in o O O cc tA e to c i
O. H.
OO.OOOO& in O C. H O O' O O to 4 H N O O 4 in c & N i
e4
+-4 e-4 @ O m O O & 4 O O O O O O c e-4 OCO4ON N NOOA-4 omo i
Hel H
q d
A H
m N
W W
[K &
M V.
m U
MN N
v<
c4 O s a
O.
O O
V.
U *s H
H ;t H N < ta tn,
- 2.
' IW i
W s
e s
e s
e e
e
^
D C 14 14 Ed Ld 14 (d (d 14 uJ sq m ew N N W mWe C
O' O % Cd N CO MNMNMON N *- M C4 c. t.d O O 4 CC e* & Ch xN OxCO c.
Ld e4 H H c
,A H Ln
- 4 m mN H m e-. O J& N m.4 4 m mAm Jam M
H LA. 6 H H k. W A A A I4 H L N N H L H H t-. N H H k. H H L H 4 4-2
HHH ew H H H H HH H HH H H H H H H H H H H H H H H H H H l
000 0 0 0 0 0 0 0 0 000 0 0 0 0 000000 0 0 0 0 00 i
o e
a i i i
s s
e i
i
b OE b b E & $ $ Os M cs M b b b ci $ os M M b os b os osEbbbo&
HO 4 4444 4444444444 444444444D DD Dmc HW 000 0 0 0 0 0 0 0 0 0 0 0 C. O. 0 0 0 0 0 0 0 0 0 0 0 0 00 O
s i
e i
NU L4 W La L4 f414 L4 Ld Ld La $4 LO 14 1413 LQ id 14 is.3 14 W I4 Ld 14 W W (4 N W W O
@ N H N & m e m a n g e m m ers mc@ CN H N N H & mm4 mo
?
in & O N W N N e4 t' Co to N N O D H@ @ @ @ to W H 4 @ b LO & HO Uk D4mm@ OOmH 4&DNmW4 45 &OO& @ NH NDm4N W
H @ NONH H N4m&@ H om@.mN 44H OOOOmW @ nN R
g
&mN N @ @ @ m4mNNNoH H H H H H ew H H H mS@ mmm to co to cc to m os co m to to os e ft & O m m to & & & co & & &&&C&
O O. O. O, O O. O O O O. O O. OCOH O. O. O. O. O O O O O O. O. OH O.
e i
i e
e i
i i i i i i W LQ L4 L4 (4 LJ 14 56 W M Ed W W W W L0 L4 L4 10 W W (4 L4 L414 L4 L4 N N W g
W 000000000000 OOOOOOOOOOOOO OODOO p
A 0000000000 00000000000000000000 g
H N m m N O in N m O in o @ Ninso e in N vi m toe-a 4 N 4N H cc m g
M
[
N H m H e4 0@ NmHH e rd ecmH mH NH M H H @ mH m% H N wsmemmmN N mmmmmmmmmw nmme ommmme 0 0 0 000, 0, 00000 0 0 0000 0 00 0 0 00000, 00 i
e i
e i i i
e i
i e
e e
i i
Q N W W N td W W W W W W W W W W W W W W LQ W W W W W W W W W W W
C0000000000C 000000000000000000 e
gh 000000000000000000000000000000 ggQ
& mN N O m o to m e o O to CO m O Os 44N 4Omm@ NNN @ 4 O. H.
N mNmHmNN 4NmNNNNH NmNmNHcN& mmh
., c g
gy e.4 @ H ci m M MNNH mmN H ed N c N 4 r.a N c m @ m N N e4 N m oNhh memmmmmmmmmmmmmmmmmmmm&mm&&&mm C00000000 0 0 0 0000 0 0 00000 0000000 i
e e e
i e
i e
i e
i i
e e
i i
e i i i i T d.
P (41414 W Ld (4 14 L4 L4 [4 54 Ed E4 LO 14 Ld 1414 14 W (414 L4 W W LO 14 L4 W '4 g f 000000000000000000000000000000
,Q C00000000000000000000000000000 x
NH O4mmm4mOminNeNem4m4mmOOH oN mN H y3 g 40&Nammmmm4H N @ ecc4H Hmmcmmmomm@
[
N N O4 4
mNNH H
H H
mem AA NN A*N momomOOmOOOH OOOOmaesOomM 000ONH h6 OHOO70COOOMM OH HOOH CH O O O. HOOOOH H y
7 e
i e
- i + + i + + i e + i i + e e
e i + +
i + + + + e i
d 14 LG La t4 La L4 W E414 N L4 C414 W (4 (4 L4 td L4 L414 L4 L4 W LO W W Ed W L4 g
H C000 30000000000000000000000000 C
000 s O0000000000000000000000000 g
W 4C 4 0@ OOOOON NomN OccomOOm4OOOON H ga x
NmmONOO4CO@ NONOONOmmOON 4OOOOCm h
hH mOH bOH ObbN bNH b enNbbNH 5bOODw OMOONOONOON4CMMOH 4 04 COO 4COOO4m H e* HOH OOH OOMM OHH CH m H M OOM M. OOOOH H i
s i + i + + i t w e e + i e + i i e
i + + e
+ + + + i i 14 L4 td Ed LO 14 W Ed Id (4 N L4 LG (4 L4 W W td W id 14 N tri W 14 La La W C4 t4 sw C00000000000000000000000000000 m
C C000000 000000000 D000000000000 Nm4 0mOOnOOc4000OD H DDCOM 70OOON ~
"N @ co O. @ O O. cc. O O in N.
O 4. vi m m O O. ed O@ N 5 O O O O O in H & N O m O O 4 O O :a N O e N O M N H D00H NOOOOA 7 HA m
4 &
D@
N m
D A
J hA J A.
,e J
J H
J 84 m
e-a H m HH m
m m
d m
U O
O O.O CO O
O O<
i O
Z i
IN I I D.I I
l l
l<m i
W N
A
- AA A
A A
A.
A D
mm mWmmm mm m
m m W '.c m J m O
OQWOONN ONNOQ4 O 7@ mQH Q@ NmONNH H
'N W
D AdN mW 4AH H JAH J DDA44H H N JH H JJ N
m H H H t-+ H H H H W < H H 1 6 H H H H b H J < H H % W H H H <
4-3
!l*
- { ;
[
- [!
,!I[if?
5 y.
~
t 11111111111111111111111 11000000 0000000000000000000000000000000 C
- - - - - - - - - - - - - - - - - - - - - - - - - + + + 4 + +
A EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE R
8135790134566778889999999000000 F
788888999999 9999999 99 9999000000 9999999999999999999 999999000000 M.
9999999999999 9999999999000000 9 9 9 9 9 9 9 9 9 9 9 9 9'.9 9 U
C 9999999999991 11111 TO 55555555555666666666666667'777 7
TF 0000u000000000000000000000000G0
- D FC EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE O
1317889335366755573369937062504 N
395495736523 1 563 6524207763 27 943 CA 239336084175737842271 5061365396 AE 0 7.,2 1 7.f.3 2 2 1 0 3 9 9 6 1 181998310961627 RM F
322211111118644332211 111 1976443 9900000000000'. > u a11001 11 11 12121 0011111 1111 11 1111111 111111 1 EEEEEEEEEEEEE' EEEEEEEEEEEEEEE S
E 0O000 000000000000000 00000000,0 C
0000000 000(
- 0000000000000000 P
I 85823095
. 4 0 e720956025 5549683906 T
019470454652929177186012 2686192 S
.I 12586118134124112111127455661 41 TA T
9999900909909000011O00000001121 S
0000011010010111 111' 1 1 1 1 1 111 1 11
) E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE dG 5
0000000000000000000000000000000 eA 9
0000000000000000000000000000000 uM 41 09771 2133247 41114493 697 1 2 S 8 2 4 nA 7 545613617981456438750761 83S 252 iD tnE 5914657274111263163661121221384 oR CO 9000000000000001111' 1 1 11 99999999 (C
00000000U111 1 111 1 11 1111111 1 1 111 1E N
EEEEEEEELEEEEEEEEEEEEEEEEEEEEEE
- CN A
0000000020000000000000000000000
- 1. E 00000000'" 0000000000000000000000 E
M 52631 564 497 5098 59205066451 968 5 4U 4287 4 3 0 0 0.G.6 7 6 0 7 5 5 2 7 6 5 5 0 4 2 0 2 9 7 40
.Q
. ~
eE 22111 11119r,6543222111 1198864333 lS b
aL 322334110203024043 1021020000101 TA 1011010 u0010111111111010101 1011 N
N
- + - - + - + + + + - + - - - - - - - - - + - + - + - - + - -
IF A
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE I
0000000000000000000000000000000 E
D 0000000000000000000000000000000 E
9075020000606406231150507013006 LL
.M 8029000000003532653180306T 81 025 A
- 7301 2 402701000020137321821 0105 0 S
A I
405306000040464466633057 037 076 1 011010000101111 1111 101 4 011 011
- + - - + - + + + + - + - - - - - - - - - + - -
+ - - + - -
EEEEEEEEEEEEEEEEEEEEESEE,EEEEEE d000000000000000000000000000000 5
0000000000000000000000000000000 1 073070000707838406200500078019 4093030000303952 651860707097098 4027070000203321 221640501015012 6
1
. L 1
1 34 5
6 5
6L L
L 1
21 1 L. L L.2 3 A 1 LL L
L L.
LL E
L 3
L L
C 0_
N 1
a 1
1311 333 1
1 3
31 P
0 0
00 E
0_
v_
0_
0_0_0_0_0_0_0_
0_
~
~
S 6
9 0
U
.Q 12O381 92411 41111 1 112281 21 5 81 01 2 E
L5L91 L438LL3 LLLLLLL1 1 5 LLL5 5 L4LL S
TATAATTTTTTTTTTTTTTLATTTTAATTTT I#
jji!l l
,ll!ilbI ll llllllll' j ;
)
0000000000000000000000 e) 0000000000000000000000 "o o n
C
+ + + + + + + + + 4 + + + + + + + + + + + +
A EEEEEEEEEEEEEEEEEEEEEE bi 000000000J 000000000000 at RF 000000000N000000000000 a
0000000000000000000000 f u M
0000000000000000000000 ol a
U 11 11111 1111 11 1 1 1 11 1 1 1 1 mv C
ue T
s e O
77 7 7 7 7 8S8 6 SS 888 S 89999 1 r
TF 0000000O00OO000O000001 c
D i d FC EEEEEEEEEEEEEEEEEEEEEE a e O
4 9 3 4367 93 091 07 47 451 62 0 r n N
9 01 2 7 8 1 4913617 503 92 56 0 bi CA 88 1 4552443 4829 08 8 5 8 1 3 7 eb A E.
63 053291 83 39 205 4080599 gm R
l o F
33 21 117 64 43 2221 1 1 S 853 9 AC
( (
21 21222222222 3 3 3 3 4 2 33 5 5 5 111 1 1 11 1 1 1 111 1 1 1 1 1 1 1 1 1 0 0 EEEEEEEEEEEEEEEEEEEEEE E E S
E 0000000000000000000000 9 0 C
P 0000000000000000000000 6 0 I
22 66 8 1 51 5 803 1 4 1 36 0S 68 4 7 7 T
607823 426327 14 93 1 6A109 8 '
S I
6251 653221611 46868 1 43 2 66 TAT 10111 11222122222 23 223 4 4 4 S
w 11 1111 1 1 1 11 1 11 1 1 1 1 1 11 1 00
) E EEEEEEEEEEEEEEEEEEEEEE E E dG 0000000000000000000000 00 5
eA 9
00O0000000000000000000 3 0 dM 97 O17 0931 268 63 941 9 6 1 2 1 3 3 uA 7 1 i61 7 098527 20281 00060 2 9 l D L
c 311421 1 6841 31 21 1 531 51 2 2 nE oR CO 1 1 11 1 12 2222222 22333 33 5 5 4
( C 11 11 1 1 1 1 1 11 111 1 1 1 11 11 0 0 1E N
EEEEEiEFEEEEEEEEEEEEEE EE C
A 00G0000000000000000000 3 0 1 N E
0000000000000000000000 4 0 E
M 943 5 02 2S3 1 1200208 8 5 7 98 01 4U 9762104 9957487 227 1 541 0 1 0 Q
eE 22 11 1 16433 221 1 1 1 876 438 8 1 l S baL 300333 4 44404 4055504557 55 TA 001 11 1 1 1 1011 011 1 01 11 1 00 N
N
- + + - - - - - - - + - - - 4 I
F A
EEEEEEEEEEEEEEE2EEEEEE EE I
0000000000000000000000 7 0 D
0000000000000000000000 1 0 E
L E
0006301 01 1 06006 7 804 325 72 L
M 2 00921 355S03 8062 1 02 65 2 3 9
~
A 30051 1635 1031097 3043 1 2 1 2 S
A 1
500066667707 707 78067 80 5 6 100011 1 1 1 1 01 101 1 1 01 1 1 2
' 0
- + + + - - - - - -
4
- - + - - - + - - - -
EEEEEEEEEEEEEEEEEEEEEr EE i
0000000000000000000000 2 0 S
0000000000000000000000 3 0 3 2 208 0008 6 01 26 4 9 4
%000043 000337 6090850056 0648 0 5 3 200011 1 1 7 808 7 0 t 2 8 05 1 47 1 5 1
D L1 23 1 4 23 4S 6 S6 E
C AR i
1 1 1 1 1 1 1 1 1 1 1 1 1 l
LG 000 0 0_2 AE 0_0_
0_0_0_0 0 0[8 E
~
8 U
6 Q
05 233222323 3 38 32 204 33 3 TT E
31 7 LLLLLLLLLL1 LLL21 LL1 ON S
T aTTTTTTTTTTTLTTTLATTA TI (1lll l!llflI I
lfll jl ll l
The sequences are labeled as follows:
- 1) transient sequences are Tx from Figure 3.4-2,
- 3) ATWS sequences are Ax from Figure 3.4-3,
- 4) fire and flood sequences are labeled by the scenario they originate from (FIRE-x or FSx), and
- 5) seismic sequences are labeled by seven different hazard levels used in the analysis which is shown by the.LFX extension on the requence name.
TLOSP-01 corresponds to internal event sequence T63.
TLOSP-03 corresponds to internal event sequence T100.
The TLX-0Y sequences are sequences which have the additional failure oi 1,
2, or 3 of the SRVs to reclose and, therefore, are transient-induced LOCAs similar to those in the internal events analysis except that they occur with a simultaneous LOSP.
The TL1-01 i similar to sequence corresponds to internal sequence TL60 which T63.
The TL1 03, TL2-01, and TL3-01 sequences correspond to internal sequence TL9 7 which is similar to T103.
The total core damage frequency from all events has a mean value of 1.01E-04/yr. with a 5th % ile of 5.34E-06/yr., a median value
.f 2.92E-05/yr.,
and a 95th t-ile of 2.93C-04/yr.
This result is considered to be low given that all initiators (both internal and external) are included in this number and that this is the first time that a detailed PRA has been performed on this plant.
Usually, the first time a PRA is performed certain design faults are found that lead to accidents that have significantly higher frequencies of occurrouco than they would have without the design faults.
At LaSalle, because of the generally good design and high redundancy of BWR type nuclear power plants, while some design deficiencies were found, none compromised redundancy to the point where they created accident sequences which were significantly higher in frequency than those from other sources.
The overall integrated core damage cumulative distribution function (CDP) is shown in Figure 4.1-1.
A density plot showing the fraction of the Latin Hypercube observations with final core damage frequencies within each frequency interval is overlaid on the inter, rated core damage CDF plot.
Figure 4.1 2 shows CDFs for the total fire, flood, seismic, and internal core damage frequencies and the integrated core damage frequency for comparison purposes.
Figure 4.1-3 has pie charts showing the relative contributions of accident sequences from various categories of initiators to the mean integrated core damage frequency.
These categories are:
seismic, fire, flood, and internal with internal broken into LOCAs
- ATES, transients, and transient-induced LOCAs Figure 4.1-4 has a pie chart showing a finer breakdown of the contribution of internal events initiators to the total mean int ernal c, ore damage frequency.
The internal initiators 4-6
LO 0.250 f
Mean: e 0.9 -
- 0.225 0.8 -
- 0.200 0.7-
- 0.f75 C
-e
.9 3
0.6 -
- 0.150 0
.'-c t
.9 e
in a
- 0.125 o.o 0.5 -
2
?
t c
0.4-
- 0.10 0. 9 0
~
w 0.3 -
- 0.075
- /
0.2 -
-0.M0 0.1 -
- 0.025 T$l4,uq
~
b ie Q i iiino 0.000 0.0 -
, i i i no 4 ii tE-6 LE-5 1.E-4 LE-3 tE-2 LE-1 Core Damage Frequency Pigure 4.1 1 Integrated Core Damage Frequency Distribution For LaSalle
.E.
4-/
to -
e = Total u = Seismic 0.9 -'
Ef1 = Fire a = Flood j
a = Inte m al o.8 -.
Y 0.7 -
'l C
[
.9 30.6-
}
c5 i
5 0.5 --
.2 Ti
~d 0.4 -
E 8
0.3 -
o.2 -
i 0.1 -
+
G.G ii;ig iii;q i imq, iin, i, ug i i n,,,, i cy i u i.13 6 n m, i iot., i iin.g i i nas i i u.
LE-14 LE-12 tE-10 LE-8 LE-6 1E-4 tE-2 Core Damage Frequency Fig,ure 4.1-2 Fire. Flood, S e i str< i c, Internal, and Intebrated Core Damage CDF 1
4-8
l Fire (49%)
stEnSeismic(
Flood (5%)
i
^
s Intemal (46%)
- a. Percentage of Total Core Damnge Frequency T-LOCA (1%)
1 Transients (98%)
- b. Percentage of Internal Core Damage Frequency Figure 4.1-3 Contribution to Integrated Core-Damage Frequency.
4-9
N Other (0%)
s,,
Loss of Feedwater (4%)
3%
%~
TurbineTrip (6%)
DO Bus (6%)
LOSP (74%)
AC Bus (10%)
l Figure 4.1-4 Initiator Contribution to Internal Core Damage Frequency.
4-10
-.~
~.. _ -
.st are broken into: 1) LOSP,'2) AC Bus Failure (T101, T102), 3) DC Bus Failure (T9A, T98), 4) Turbine Trip (T1, T2), 5) Loss of Feedwater (T3, T4,. TS ), _
and 6) All'Others.
By examining - the above plots and figures, one can see that seismic sequences do not ' contribute significantly to the integrated core _ damage irequency at LaSalle._
Flood sequences are moderate contributors at all quantiles of the distribution.
Since the integrated core damage frequency distribution is very similar.to the internal events core damage frequency distribution-in all-but the 90 to 100th quantile range, the integrated core damage frequency distribution comes mostly fram internal events, flowever,
at - the very rop of the distribution, one can see that the fire sequences contribution actually becomes greater than that for the internal sequences.
This occurs at about the 95th. percentile The dominant fire sequence is initiated by _a control room fire and the sparse. fire - data for calculating control-room fire initiating event frequencies results in a distribution-with very wide' uncertainty bounds.
The mean value of the fire core damage frequency is dominated by a few of the 40G Latin 11ypercube observations and, in these cases, the fire contribution can be substantial.
The results - of the integrated analysis are presented and discussed in
- detail in Volume 2 of this. report.
4.1.2 Dominant Sequences of the Integrated Analysis In this section~we will discuss the characteristics of the dominant sequences which individually' contribute greater than.1% of the total core damage frequency-These sequences are listed in Table.4.1-1.
The dominant sequence at_LaSalle is T100.
This sequence contributes 35.4%
oflthe total-mean core damage frequency and involves a transient initiator
- followed by successful scram, successful opening and reclosing of the SRVs, failure of. all high pressure inj ec tion, successful depressurization of the 4
primary system,' and failure of all low pressure injection.
The failure of l injection can be either immediate or delayed depending on the particular cut set; however, the dcminant cut sets have immediate failure.
The dominant cut sets have a' loss of offsite power _ initiator followed by loss of onsite ^ power to the' safety buses by common mode failure of the diesel
. generators' leading to a station blacknut. 'RCIC fails either'immealately'or.
--delayed and core-damage results before injection can be restored.
_The sccond most dominanto sequence _ at - LaSalle _ is FIRE-CR.
This sequence contributes 1T. 2 % = o f t he total mean core damage ~ frequency and involves a-control room cabinet - fire..The fire grows into a large-fire that is-not
-suppressed in time and control room evacuation is necessary.
The fire-results: in failure of the injection systems and control is not successfully reestablished using ' the remote shutdown panel.
Core damage - results from-the loss of all. injection.
The third most dominnt sequence at LaSalle..is FIRE-W2.
This sequance contributes ' 8 3% of the total mean core damage frequency and involves a 4 11
fire in the Unit 2 division 2 essential switchgear room.
This is a transient combustible fire that grows large enough to damage the train B equipment cabling that passes through the area.
The result is failure of train B RllR and any train B injection systems.
Random failure of the other RHR train results in a long-term loss of containment heat removal sequence injection into the core is successful from either train A injection systems or llPCS depending on the cut set.
The containment pressurizes, venting is t.o t possible because of the loss of train B cabling, and the containment fails on ov( pressure either by leak or rupture.
Depending upcn its location, this containment failure (e.g.,
in the react or building not to the refueling floor) will produce an environment which could cause inj ec t ion systems that are operating or that may be able to operate to fail.
The overall time available to the operators to perform their recovery actions is approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />.
The amount of time available depends on the failures t.h a t constitute the cut set and what recovery action is being considered.
~-
The fourth most dominant sequence is T62 which contributes 8.1% of the total mean core damage frequency.
In this sequence, we have a transient initiator followed by successful scram and SRV operation.
All high pressure i nj ec tion except RCIC fails and containment and primary system heat removal fail.
The ADS system works but the low pressure systems are failed.
The overall time available to the operators to perform their recovery actions is approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
In some cases (e.g.,
restoring offsite power when a DG has run for some period of time) more time is available.
The amount of time available depends on the failures that constitute the cut set and what recovery action is being considered.
9 The fifth most dominant sequence is T18 which contributes 6.2% of the total mean core damage frequency.
In this sequence, we have a transient initiator followed by successful scram and SRV operation.
The m a i. n feedwater system fails but 3PCS and one train of the CRD system work providing high pressure inj e c t i on. The normal contaironent and primary heat removal systems fail, and venting fails.
Containment pressure increases until a leak develops.
Depending upon its location, this leak will produce an environment which could cause inj ec tion systems that are operating or that may be able to operate to fail.
The overall time available to the operatorn to perform their recovery actions is approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />.
In some cases (e.g.,
venting) less time is available.
The amount of time available depends on the failures that constitute the cut set and what recovery action is being considered.
The sixth most dominant sequence is FIRE-Y2 which contributes 4.2% of the total rae an core damage frequency.
This is started by a transient combustible fire in the Unit 2 division 1 essential switchgear room.
The fire is not supprussed in time and results in failure of train A injection system and RHR.
Random failure of train B RHR occurs and results in a long-term loss of containment heat removal sequence.
Inj ec t ion into the core is successful from either train B injection systems or tiPCS depending on the cut set.
The containment pressurizes, venting is not possible 4-12
.m m _. _ _ -.
'..j
'because of the loss of train A = cabling, and the containment fails on overpressure either by leap;or rupture.
Depending upon its Incation, tais containment failure : (e;g.,: in-the reactor building not to the refueling
- floor) will produce an environment which could cause injection systems ' that tare operating or that may be-able to operate to fail.
The ovarall time available; to the operators to perform their recovery actions is approximately 27. hours.
The. amount. of time available depends on the failures that constitute the cut set and what recovery action _ is being considered.
The - seventh ' most dominant sequence is' FS2 which contributes 3.9% of the total mean core damage-f requency.
This sequence is_ initiated by a flood n
. resulting,from the rupture-of a valve in the service water piping in the southeast corner of-the ground f3oor of the unit 2 reactor building and the operator fails to - isolate the - 21ood within 7.3 minutes.
The flood directly
!results ~ -in the failure of all systems. depending on service water.
The flood _ propagates to the. corner rooms rerulting in failure of all injection and core damage results, The eighth ' most dominant sequence is FIRE-T which contributes 2.8% of.the
- total mean core damage: -frequency.
This sequence involves a transient combustible fire in the linit 2 auxiliary equipment room.
The fire results in the ' failure of - train A cabling - and the loss of train A injection end RER.
However.-the cabling does not resul t in the loss of power to the ventin5-system-and_ venting.is possible.
Two sets of cut sets occur, with and without venting.
Random failure-of-train B RHR results in a long term losa of containment heat-removal sequence similar to FIRE-W2.
The. ninth most dominant sequence is FIRE-V1-which contributes 2.2% of the total mean ! core ' damage _. frequency, This sequence is the same as FIRE-W2 except that-tho fire _-is in a switchgear cabinet.
. The i tenth - most dominant cequence is FIRE-Y1 which contributes 2.2% of the total mean1 core s damage. frequency.
This sequence is the same as FIRE-Y2 except-.that thrv fire is inia.switchgear cabinet.
7 The eleventh most dominant ' sequence - is lT20_ which contributes 1,6% of the total' meani core damage frequency.
In this sequence, we have _ a transieut Linitiator - followed by successful scram _ and - SRV 1 operation.
-The main feedwater: _ system fails but HPCS and - one train of - the CRD system work providing high pressure injection..Tha normal containment and' primary hsat removal systems failr and venting fails.
Containment pressure increases until rupture occurs; Depending upon its location,. this rupture will produce an environment which could ' cause in.) e c tio n systems th'a t are-Loperating : or _that may._ be able to ' operate
.to fail.
The overall time L
~ available to the L operators to perform their recovery actions is approximately - 27' hours.
In some cases (e.g.,
venting) less time is available.
.The amount of time available depends on the _ failures that constitute the cut. set and what recovery action is being consider 3d, 4-13
The twelf th most dominant sequence is T22 which contributes 1.4% of the total mean core damage fruquency.
In this sequence, we have a transient initiator followed by successful scram and SRV operation.
The main feedwater syctem and the CRD system fail but the HPCS system works providing high pressure inj ec t.i on,
The normal containment and primary heat removal systems fail, and venting fails.
Containment pressure increases until a leak develops.
Depending upon its location, this leak will produce an environment which could cause injec tion systems that are operating or that may he able to operate to fail.
The oveva11 time available to t.h e operatots to perform their recovery actions is approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />.
In some cases (e.g.,
venting) less time is available.
Tho amount of time availab'e depends on the failures that constitute the cut set and what recovery action is being considered.
All other sequences contribute less than 1% each to the total core damage frequency and in sum contribute less than 7% of the total core damage frequency.
4.1.3 Dominant Cut Sets of the Integrated Analysis In this section we will discuss the dominant cut sets appearing in the integrated cut set expression for core damage.
The percent contributions are based on the point estimate calculation and are not from the means calculated from the distribution, As a result, the relative importance of the cut sets is not evaluated on the same basi.s as th; sequences.
Only cut sets that contribute greater than 11 to the total core damage frequency are discussed.
A more complete list of the cut sets can be found in Volume 2 of this report.
The dominant cut set, responsible for 32.2% of tne total mean core damage
~
frequency, is the cut set that represents the fire in the control room sequence PIRE-CR.
From Table 4.1-1, we see that the mean value of this sequence contributes 17.2% of the total mean core damage f requency while its point estimate is 321.
This cut set represents a fire initiated in the control room, not being suppressed before it grows large enough to require evacuation of the control room. and failure of the operators to recover control of the plant from the remote shutdown panel.
The second and tHrd most dominant cut sets, cach responsible for 9.8% of the total r 'a e s. :e damage frequency, are from the TiOO sequence.
These cut sets rep esent a loss of offsite power followed by delayed failure of the three diesel generators as a result of the common cause failure of CSCS cooling vater.
This results in station blackout.
RCIC f a il e, due to closure of the the inboard isolation valve due to either high room temperature (while onsite AC power is working) or a RCIC isolation sneak circuit on loss of offsite power.
The onsite AC power fails before the operator can restore the isolation valve to its open position and all inj ec t ion is lost.
Offsite AC power is not rescored in time and core damage occurs in a minimum of 80 minutes,
\\
4-16
-r-l The. fourth most dominant cut-set, responsibic for 3.9% of the total mean l
core fdamage. frequency, is from the internal flood sequerae, _ FS2.
This cut
- set' represents:an internal flood, initiated by a service water valve rupture in ' the southeast. corner of-the-ground: floor.
The loss - of service - water directly fails main feedwater and condensate.
The operator fails to ridentify und' isolate the _ flood within 7.3 minutes 'and the flood fails the RHR:B MCC and-floods the HPCS, CRD..and LPCS,-RCIC corner rooms.
Overflow also reaches the RHR A room. All' injection systems have, therefore, failed
.and core damage results.
- The fif th most ' d6minant cut-set, responsible ' for 1.1% of the total-mean core damage frequency, is from the T62 sequence.
This cut set involves a loss of offsite power followed by. failure of all three diesel generators from common cause failure of the CSCS cooling water pumps. This results'in a - station blackout.
Unlike the T100 sequence RCIC is successful and runs-for ~ about
- 6. hours when it fails on either battery depletion or high pressure in the ' primary containment resulting in system trip.
Offdite power is not restored'within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and-delayed core damage results.
These five cut Lsets contribute 56.6% of the total mean core damage frequency.
All other cut sets contributs less than 1.0% each to the total core.-damage frequency.
There are, however, a lot of them anJ they make up
- .the other 44%.
4.1.4. Risk Reduction' Measures for the Integrated Analysis The risk' reduction measure-describes the effect on the core damage frequency oi decreasing the failure probability cr frequency of a specific.
- failure to-zero._
The-component failure or event is assumed not to occur.
The total core damage ~ frequency is-then reevaluated with this event at zero and the' change _ in total core damage frequency is the risk reduction measure.
C complete -list -- of the risk - reduetion measures for all events contributing to thef integrated core damage ' frequency is given in Volume 2 of-:this report. Only those events with a risk reduction greater than about l.0E-05/yr. are discussed here.
This - measure identifies - those events lL
. where, if one could ' reduce the' failure probability or modify - the -design to t
l eliminate the dependency on this event, significant - reduction in core
~
damage frequency could-be-obtained.
The: dominant ' event. for risk reduction -is the loss of offrite _ power initiating event frequency with a risk reduction - of 2,96E-05/yr.
This event directly? affects the frequency of the dominant sequence T100.
Three ' events are of second., third, and fourth importance for _ risk
- reduc tion.. They=are.all associated with the control-room fire sequence:
the control room fire -initiating event frequency,'the failure to suppress the f tre, _ and the. failure to recover using the remote shutdown panel.
4 Reduction - of any. one - of these events reduces the secor.d most dominant sequence.
Each has a risk reduction of-2.18E-05/yr.
4-15
~.-
The fifth most dominant event is the failure to recover offsite power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with a risk reduction of 1.89E-05/yr.
This event is in most of the dominant cut sets for the T100 sequence.
The sixth and seventh most dominant events are the diesel generator cooling water pump common cause beta factor and the pump random failure event associated with this failure.
Each has a risk reduction of 1.77E-05/yr.
The eighth most dominant event is high RCIC toom temperature resulting in closure of the RCIC inboard isolation valve in station blackout sequences where one of the train A or B diesels runs for a while before failing.
The risk reduction is 1.08E-05/yr.
The ninth nost dominant event, with a risk reduction of 9.56E-06/yr., is the probability of containment failure by leakage.
This event represents the long-term structural failure of the containment from overpressure in loss of containment heat removal sequences.
Depending on the location and sino of the failure, severe environments ca-be created in the reactor building which can fail injection systems supplying water to the core whose components are in the reactor building.
The tenth most dominant event, with a rf sk reduction of 9.26E-06/yr., is FS2 which represents the severity ratio for large fires.
This event appears in many of the fire sequences and is the percentage of fires which can be classified as large.
In many cares only large fires can result in sufficient damage to create the sequences.
All other events reduce risk less than 1. 0 E - 5 /y r.
Their descriptions can be found in Appendix B of Volume 2 of this report.
There are two events which have negative risk reduction.
For these events, the risk can increase as their probability of occurrence decreases.
These two events represent the probability that the operator will vent the primary containment within two hours of reaching the venting setpoint.
Since venting the containment will result in severe environments being created in the reactor building, there is some high probability that the s ys t e n.s which are maintaining core cooling and have equipment in the reactor building vill fail and core damage will result.
If the operator does not vent, the containment will pressurize until it fails on overpressare; however, the most likely containment failure mode is by leakage through the drywell head to the refueling floor. This failure mode will not produce severe environments in the reactor building so nystems which are currently working would not fail.
The conclusion is that the conditional probability of core damage is less for contair. ment structural failure to the reactor building and subsequent system failure (since most is to the refueling floor) then for venting followed by system failure.
4.1.5 Risk Increase Measuces for the Integrated Analysis The risk increase measure describes the effect on the core damage frequency of increasind the failure probability of a specific event to 1.0.
Since 6 16 i
e
initiating event frequencies can be Ercater than 1.0/yr., they are not, in general, included in this risk measure (i.e., all events beginning with IE-are e nsidered initiators and not evaluated for this calculation, all events which can have values larger than 1.0 must be identified in this manner).
For this measure, the component failure or event is assumed to occur all the time.
The total core damage frequency is then ree"aluated with this event at 1.0 and the chaege in total core damage frequency is the risk incresse measure.
This measure identifies those events where an increase in the failure probability from the current level of reliability can result in a significant increase in core damage frequency.
It is important, therefore, to insure that these events remain at or below their current failure probabilities.
A complete list appears in Appendix A of Volun.c 2 of this report.
Only events with a risk increase greater than 1.0E 03 yr. are discussed.
The dominant event for risk increase with a risk increase of 1.58E-01/yr.,
is the service water pipe failure frequency for internal floods.
This a
event represents the frequency of pipe failure and is multiplied by the number of feet of pipe of a particular type to get the initiating frequency for a specific flood initiator.
Since the nuniae r of feet of pipe is greater than 1.0, the event representing the length of pipe was defined with the IE-described above and the actual pipe failure frequency being significantly less than 1.0/yr. was Afined as a basic event.
Because this particular flood fails all of the responding systems in itself, the core damage frequency of this accident is directly proporticnal to this event.
Since this failure rate is very small, an increue to 1.0 results in a large increase in core damage frequency.
The second most dominant event, with a risk increase of 2.89E-02/yr.,
is failure of the emergency AC power breaker from 4160 VAC ECCS safety as 242Y tis 480 VAC MCC 236.
This event results in failure of much of the train B safety und non-safety equipment and contributes to the dominant core damage sequences.
The third most dominant event, with a risk increase of 1.16E-02/yr., is the reactor protection system failure to scram probability.
ATWS accident sequences at LaSalle are not significant contributors to the total core damage frequency; but, their frequency !s directly proportional to the failure to scram probability which is 1.0E-05/D.
If this event is increased to 1.0 these sequences frequencies increase dramatically.
4 The fourth most dominant evant, with a risk increase of 7.05E-03/yr.
is the random failure of the CS cooling water pumps usad in the cal:uinti.on of the CSCS cooling water common cause f ailure probability.
The CSCS pumps l
supply cooling water to the diesel generators and to all of the ECCS equipment rooms and some of the ECCS pumps.
Since loss of offsite power followed by common cause failure of the diesel generators resulting in st lon blackout is the dominant accident sequence at LaSalle, this event will clearly be important.
4 4 17 v_________-
The next three events, fif th to seventh most dominant, all represent the failure or unavailabilities of parts of the electric power system and have risk increases of 2.24E-03/yr., 1.41E-03/yr., and 1.12E-03/yc respectively. They are failute of the circuit breaker from 480 VAC MCC 236 to 480 VAC MCC 236Y, the maintenance unavailability of 4160 VAC bus 242Y, and the failure of the circuit breaker to from 4160 VAC bus 241Y to 480 VAC MCC 235.
These events all contribute to a partial loss of AC power.
All other events increase risk by less than 1.0E-03/yr. and their descriptions can be found in Appendix B of Volume 2 of this report.
There are three events that can have negative risk increase measures.
This implies that increasing these failure probabilities decreases risk.
The two events representing the failure of the operator to vent the containment that lead to negative risk decrease measures also appear here.
The interpteration is that, since the most likely structural failure is to thu refueling floor which does not create severe environmants in the reacccr building, converting venting into structural failure reduces risk.
That is, 5,ome percentage of the sequences which would have gone to core damage if venting occurred do not if ventin5 fails and structural failure eccurs instead.
The CONT - LEAK event represents the probability of structural failure by leakage.
Since the containment must fall by some mode in these sequences, as the probability of leakage increases the complement evert, containment failure by rupture, decreases.
If rupture occurs, then lov pressure inj ec tion systems can be used to cool the core when containment pressure drops below the ADS reclosure pressure Some of these low pressure systems auch as condensate and diesel-driven firewater are not directly affected by severe environments in the reactor building.
This would imply that increasing leakage would increase core damage probability; however, a substantial portion of the leakage probability is leakage to the refueling floor which does not create severe environments in the reactor building. There is a trade-off between thasc two effects and the reduction in core damage probability from redirecting leakage outside tha reactor building is larger than the increase in core damage probability from not being able to usc some low pressure systems.
Therefore, the core damage probability is reduced by converting ruptures to leaks (Note: this depends j
critically on the dominent sequerce characteristics and should not be generalized to all plants).
4.1.6 Uncertainty Importance Measures for the Integrated Analysis The uncertainty importance calculation is done differently than the r!.'
reduction end r is increase calculations.
The other two importance calev iers are done on the point estimate for each individual basic event or init!rt-ag event appearing in the cut sets.
The uncertainty importance is calculated for groups of basic events all of which have the same underlying' distribution (i.e.,
all basic events represented by the same LHS variable).
In the Latin Hypercube sample, a certsin distribution might have been selected for motor-operated valv, failure to open.
Every basic
(
event appearing in the model that repres ats a motor-operated valve failing 4 19
s a:..e UlS variab' and has the to open is correlated, is represented by the same value for a particular Uls sa:rple member.
The uncertainty importance calculation in done by performing a polynomial regression on the expected value of the iog of the top event conditional on the sampled values of the selected Uls variable The uncertainty importance is calculated as: (the unc onditional variance in the log of the top event -
the expectation ot the variance of the log of the top event conditional on the selected UlS variable)/(the unconditional variance of the log of the top event).
This calculation is performed both for basic events and initiating events A complete list of events contributing to the uncertainty in the integrated risk appears in Appendix A of Volume 2 nf this report.
Only events which effect a greater than 5% reduction in the variance of the log of the top event will be discussed.
The dominant class of events is that class representing control circuit
~
failure This class contributes a 20.8% reduction in the <ariance of the log of the top event.
Valve, pump, fan, and circuit breaker control circuits are included in this class The second most dominant cinas is the variable representing the fire in the control room initiating event frequency _
This class is respons N. for o 15.3% reduction in the variance of the log of the top event to the 7
sparse data base for control room fires, the distribution for this
' ant is
}
highly skewod and very wide.
The third most dominant class is relay failure to close This class is re sponn ',bl e for a 12.8% reduction in the variance of the log of the top event.
2 The fourth most dominant class is relay failuce to remain closed.
This class is responsible for a 12.7% reduction in the varlunce of the log ot the top event.
The fifth and sixth most dominant classes are again relay failure to close and failure to remain closed, These classes are each sponsible for a 12.5% reduction in the variance of the log of the top event.
The difference between these two classes and the previous classes is that a separate but Latin liypercube variables were used to represent these two classes.
The two sets of relays have significantly different test intervals from the previous two that result in ve y different y
unavailabilities.
This difference in test interval was assumed to break some of the correlation between the failure probabilities.
h The seventh and eighth most dominant classes are failure of some SBLC relays which also have a unique test intervais.
The two classes again represent failure to close and failure to remain closed.
Each class is responsible for a 12.4% reduction in the variance of the log of the top eve t.
4-19
c
=
i
' The ninth.- to -: eleventh - most I dominant classes are events which represent failure ~ of ' equipment Cn-the severe environments produced in - the reactor building ~ af ter ~ containment f ailure by. leakage.
These events are a combination of the conditional probability of containment failure to the reactor building and the failure of'various systems equipment. due to l the
- severe-envirohments.
The classes represent 9.8, 8.8, and 8.7% reductions
--in.the variance of the log af-the top event, respectively.
The twelfth and thirteenth most dominant classes are composed of events which. represent ' circuit-breaker failure to remain closed These classes represent 5. 2 ' and S.1% reductions in the variance of the log of the top event, respectively;
-The difference is again in the different. test
- intervals for the two sets of ' circuit breakers.
~All oth3r classes represent less than 5% reductions in the variance of the log of the % m ot.
The events that. compose them can be understood by looking up the event uen.w.ptions in Appendix B of Volume 2 of this report, 4;2 ' Summar.y_of the Results of t he Internal Events Analysis 41.2.1 Dominant 1 Internal _ Event Sequences The : results ' of-the' internal events analysis ' are presented and discussed in -
detall-in Volume 3 of this report. ' Table'4.1-1 includes all fifty-four of
. t}un sequences that? survived ' the internal events screening process.
The sequences are ordered from most dominant to least dominant as determined by the mean value-from the TEMAC calculation.
The mean core damage frequency for internal events is 4.41E-05/yr.-for the h
- LaSalle plant.
_The lower ' 5th %-ile 2;05E-06/yr., the median - 1.64E-1.39E 04/yr.
A CDF of the core damage
. 05/yr._,- - and - the ~ 95 th % ile f requency-resulting from internal event initiated sequences is given in Figure L 1-2.
.y
_damagn frequency is low enough that the NRC's tentative The : mer.n-core safety. goals can be met and is low considering that this is the first time j
azdetailed PRA~has been performed. on. the plant.
Typical internal event-I core damagel frequencies obtained in the past for first time PRAs have been
- in the low L OE-4/yr. range.
This is-usually due to the_ identification of
=.some' design :and construction errors that resulted in a' loss of_ redundancy and _some core-damage sequences _ with' high frequencies of occurrence.
The LLaSalle plant, being.a modern BWR design, has -highly redundant _ and independent! systems.which tends L to ameliorate these types of problems.
While ~ some designi f aults - vere found in the - 'ana lysi s, none were -- of
. sufficient severity _ to re sul t --: in sequences with high core. damage
. frequencies.
. The dominant internal sequence is-T100 which contributes 64.1% of the mean cote damage frequency from internal events.
In this sequence, we have a transient initiator followed by successful scram and SRV operati m All i
s 4-20
~,
- )
l Ni hi and low' pressure injection systems fail and co.e damage ensues.
The 6
cut sets fall into two groups: -(1) an car'e core camage scenario where all AC is. lost initially. and PCIC fails-and (2).a late core damage scenario where AG works for a while and then fails; For the late scenario, there is
-about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> for recovery actions to be cocpleted.
For the early scenario, there is about 80 minutes.
The second most-dominant internal sequence 'is T62 which contributes 14. n of the mean core damage f requency from internal events.
In this sequence,
'we have a transient initiator followed by successful scram and SRV operation. - All' high pressure injection except RCIC falls and containment
. and -primary system - heat removal fail.
The ADS system works but the low pressure systems are failed.
The overall time available to the operators to perform their recovery actions is approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
In some cases (e.g.,
restoring offsite power when a DC has run for some period of time) more; time _. is available.
The amount of time available depends on the failures that - constituto the cut set and what recovery action is being considered.
The third most dominant-internal sequence is T18 which contributes 11.1% of the mean core damage frequency from internal-events.
In this sequence, we have a transient initiator followed by successful scram and SRV operatf or..
The main feedwater system fails but ilPCS and one train of the CRD system work providing high pressure inj ec tion.
The normal containment and primary heat _ removal. sys tems fail, and venting fails.
Containment pressure increases until a leak develops.
Depending upon;its location, this leak will' produce -an environment which could cause inj ec tion systems ' that are operating or that may-be able to operate to fail.
.The overall time
.available to the _ operators. to perform their recovery. ac tions is approximately. ' 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />.
In-some cases (e.g.,
venting) less time is lavailable.
-The amount of-- time available depends on the failures. that
- constitute the cut set and what recovery action is being con sidered, The-fourth most dominant-internal sequence is T20 which contributes 2.9% of-
~
the mean core' damage frequency from internal events.
In this sequence,.we have a -transient Linitiator_ followed-by successful scram and SRV operation.
I-__
The main feedwater ' system fails ' but. IIPCS and one train of ' the CRD system work _ providing high pressure injection. The normal containment and primary
. heat. removal. systems fail, and : venting' fails, Containment pressur, g
L increases until< rupture occurs.
Depending upon Its locationi this rupture will produce an environment which_could cause injection systems that are
- opot ating-or that. may be able = to operate to. f ail.
The overall time available. to the _ operators _ to perform - their recovery actions is capproximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />.
In some cases.-- (e. g., venta g) less time. is ava_ilab le,
The amount of time available ~ depends 7 the. failures that constitute.the cut set and what recovery action is being considered.
The fifth most dominant internal. sequence is T22_which contributes 5% of the mean core damage frequency from internal events.
In this.seque.,cc; we have a-transient initiator followed by successful scram and SRV operation.
4-21
The main-feedwater system and the CRD system fail but the llPCS system works providing high pressure injection. The normal containment and primary heat removal systems fail, and venting fails.
Containment pressure increases until a leak develops, Depending upon its location, this leak will produce an environment which could cause inj ec ti on systems that are operating or that may be able to operate to fail.
The overall time available to the operators to perform their recovery actions is approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />.
In some cases (e.g.,
venting) less time is available.
The amount of time available depends on the failures that constitute the cut set and what recovery action is being considered.
All other internal sequences contribute less than 5% total to the mean core damage frequency from internal events.
The highest internal ATVS sequence is A49 at 8.94E-08/yr, and is the twcItth most dominant sequence contributing only 0.2% of the mean core damage frequency from internal events.
In this sequence, we have a transient initiator fol; owed by initially successful main feedwater The PCS system fails which leads to the failure of the feedwater turbine-driven pumps from loss of steam or inadequate level in the condenser.
The operator then fails to control the motor-driven feedwater pump inj ec tion rate to less than the CST makeup rate of 1800 gpm (the corresponding RPV level ir 2/3 TAF) resulting in pump trip and loss of all feedwater.
The llPCS system works; but the SBLC system fails and the reactor continua.s to operate at about 9% power.
The containment heats up until pressure reaches 60 psig when the operator vents the containment.
The resulting severe environments in the reactor building fail HPCS and any other available injection systems and core damage results with a failed containment.
The highest internal LOCA sequence is Ll4 at 1.72E-08/yr, and is the twenty-first most dominant sequence contributing only 0.04% of the mean core damage frequency from internal events.
In this sequence, we have a LOCA initiator followed by successful scram and vapor suppression operation.
The main feedwater system fails but ilPCS and one train of the CRD system work providing high pressure J nj ec tion.
The normal conrainment and primary heat removal systems fall, and venting fails, Containment pressure increases until a leak develops.
Depending upon its location, this leak will produce an environment which could cause inj ection systems that are operating or that may be able to operate to fail.
The overall time available to the operators to perferm their recovery actions is approximately 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />.
In some cases (e.g,,
venting) less time is available.
The amount of time available dependa on the failures that constitute the cut sot and what recovery action is being considered.
4.2.2 Dominant Cut Sets for the Internal Events analysis In order to obtain an integrated result for internal events, all of the cut sets from all of the sequences were merged together to form one large expressien representing the total internal core damage frequency.
A point estimate TEMAC run was made and the cut sets were truncated at 99$ of the 1
4-22 i
point _ estimate for - retention in the uncertainty calculations.
Originally there were 11,452 cut sets and-af ter truncation 3589 cut. sets rema i ntsd.
TEMAC was then used - to. perform _ a_ full uncertainty cniculation on the remaining cut sets.
A' complete list of the internal initiator cut sets af ter truncatioa can be found in Appendix A of Volume 3 of this report.
The two dominant cut sets represent short term station blackouts resulting
.from'a loss of offsite power followed by a common mode failure of the CSCS cooling water pumps which fails the diesel generators and ECCS room cooling.
In the first douinant cut set, responsible for 21.2% of_the mean_
core darrage-frequency from internal events, the RCIC. inboard isolation valve closes due to a sneak circuit that occurs when offsite power is lost
.and the~ emergency DCs are started.
The operator fails to reopen the valve in the short-time between the DCs starting and then failing soon after due
.to the loss of. cooling and, since the isolation valve is AC powered, it can not bel teopened.
Offsite power is not restored within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and core damage results af ter-primary coolant boilof f in about 80 minutes.
In the'second' cut set, also responsible for 21.2% of the mean core damage irequency from internal events, the valve isolation occurs because RCIC room cooling has fai'ed and the room heats up-to the isolation temperature.
'In an event-wher) All AC power has failed immediately, thir high tempe ra ture " i sola tion is bypassed and RCIC would continue to work,
.llowever, in.this f.ase, AC power works for scme period.of time until the DCs fail on iloss of: :ooling., RCIC is on train A and, if the train A diesel
~ falls before the train _B diesel, then the RCIC rsom temperature will rise on loss of room cooling and RCIC. wil3 isolate since train B AC power is available.
When train B AC power is - then los t, - the valve can not be reopened.
This event ivas conservatively modeled as alws.ys resulting in
' isolation. -This clearly is not the case, since: (1) some of_the time the train B.DG will fail before the train A DG, (2) the operator may reopen the valve ~before the train;B DG fails, (3) the time interval between the train A-.and train B DC Lfailures may tre be sufficient for the room to-reach the
- isolation temperature,- or - (4) the RCIC system could be isolated from the sneak' circuit described above.
The - thir< ~ cut set, ' responsibic for 2.3% of the mean core damage frequency
. from ' internal-events, is - similar. to the. first two except that -RCIC
-continues to work.
RCIC fails at about 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> when _ either the battery depletes or the containment pressure ' results in isolation - of the - steam discharge - line, _ Core damage _ occurs about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after t_he loss of all injection _ at about - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
The ' top three cut: sets, while correct -i n themselves, _ doubled count 'some of the frequency - contribution. because they are not completely independent.
Due to the complexity of the interactions between the sneak circuit and the system isolation on room temperature for
.various'AC power states,_it was not possible to easily _ model-this process exactly in - the fault trees.. The' sneak circuit will always occur if the appropriate, DC restarts 'af ter the loss of offsite power; - but, _ only if the operator reopens the valve can.the room temperature isolation come in to play.
If the operator reopens the valve in both cases, then RCIC can continue to work; 4-23
The next set of seven cut sets, responsible for 10.3% of the mean core damage frequency from internal events, consist of train A AC or DC power failure and common mode failure of the CSCS cooling water pumps.
The cooling water failure resulcs in the tailure of all ECC systems including RCIC (since train B AC is working, RCIC will isolate on high room temperature), the train A DG (train B may start and fail but train B AC is still available from offsite), and the CRD system whose pumps are in the llPCS room.
Main feedwater fails when the MSIVs drift closed on loss of instrument air and the motor-driven pump injection valve fails closed or a turbine pump locks up on loss of DC power resulting in high RPV level, MSIV isolation, and main feedwater high level trip.
4.2.3 Risk Reducticn Measures for Internal Events Risk reductions for each individual sequence and the integrated internal event results are presented in the TEMAC outputs shown in Appendix A of Volume 3 f this report.
In this section, we will discuss only the integrated internal event results.
One important item to note is that since some complement events appear in the LaSalle fault trees and, therefore, in the accident sequence cut sets; some events can have negative risk reductions.
That is, decreasiag a certain events failure probability can actually result in an increase in risk not a decrease.
These events appear at the bottom of the risk reduction list, so you must not look just at the top events in the list.
I The importance of this is much more obvious if one looks at 'ndividual sequences rather than for the integrated results.
In some sequences only an event or its complement shows up, for example, sequences T18 and T22.
Sequence T18 has the event CONT-LEAK while sequence T22 has the event
/ CONT-LEAK.
Reducing the probability of containment failure by leakage increases the containment failure probability by rupture.
In the integrated result these effects are balanced out somewhat.
How-r, two events even in the integrated analysis have negative risk reduction measure These two events, OPFAIL-VENT-2H and RA-5V-1-2H, represent success operator venting of the containment. Venting, using the current procedures, creates severe environments in the reactor building that can result in failure of inj ection systens and lead to core damage sequences.
If venting fails and then the containment fails by overpressure, the failure is often to the refueling floor which bypasses the reactor building and no severe environments are created, For the dominant long-tetm containment heat removal failure sequences which appear in this analysis, HPCS is the system supplying i nj e c tion.
Since HPCS is a nigh pressure system and does not fail from high containment pressures, the conditional probability of core damage is actually higher if venting occurs than if contai ment failure occurs.
This is because venting always results in severe environments while containment failure only results in severe environments if the failure is in the reactor building.
The most important event for risk reduction is the loss of offsite powet initiating event with a risk reduction measure of 2.31E-05/yr.
The second 4-24 1
klE
-...-.n.-
tost importarit event is the non-recovery of offsite power within one hour with-a risk reduction - measure-of _1,89E-05/yr.
The third and fourth most clinportant events are concerned with_ the CSCS cooling water pump common mode failure and -are _the _ pump random failure probability and the. common. mode
' beta factor which links-the pumps together, each with a risk reduction of 1 77E-05/yr.
The fifth and sixth most'important events are related to the
)
- s
_ RCI::' ' >1ation problem: either the isolation on room high temperature or
~
the sneak - circuit with risk reductions of 1.09E-5/yr. and 8.87E-06/yr.,
j respectively.
p 4.2,4 Risk Increase Measures for Internal Events Risk increases for-each individual sequence and the integrated internal event results are presented in the TEMAC outputs shown in Appendix A of
' Volume 3 of this report.
In this section, we will discuss only' the integrated internal event results.
As with the - risk decrease measure, certain events can have negative risk increase ' implying that the risk decreases as their probability. is increased.
In fact, the same two events that have negative risk decreases
-have negative risk increases.
In additica, the-CONT-LEAR event also has a negative. risk-increase.
For examplo, as the probability of the operator failing-to ventL increases the core damage frequency'goes down because, for
-the dominant sequences,Jthere is less probability of severe environments if the containment fails than if its vented as described above.
- The most-important event for risk increase is the failure of the circuit breaker from '4160 VAC emergency bus 242Y (train B) to 480 VAC' buses 236X and 236Y with a risk increase of 2.89E-02/yr, This falls all of train B emergency. AC power.
.Tho second most important. event is reactor scram g
failure with a risk increase of 1.19E-02/yr.
Even.though ATWS sequences at 4
LaSalle.are very low and do not dominant.the core damage frequency, if the failure to scram probability increased, they would become very important.
The _ third most important event is the. CSCS cooling water pump random L
failureiprobability which determines the level of the cooling water common L
mode event.
This event has a risk increase of 7.05E-03/yr.
The next ten events are electric power circuit breaker failures or unavailability due to maintenance which result;in-degraded.AC and DC power states.
4.2.5 Uncertainty Importance Measures for Internal Events
~
For the LaSalle analysis, the-result of this calculation for each accident
- sequence and for ~ the -integrated internal event results are presented in Appendix A of Volume'3 of this report...Only the integrated internal event results'will-be discussed in this section.
The. ' dominant class of events, responsible for a 28.6 %. reduc tion in the.
variance of.the log _of the top event, is uncertainty in the probability of control circuit failure.
This class includes valve, circuit breaker, pump,
_ and _ fan control circuit failures.
The second= and -third most dominant 4-25
-=
classes are deenergized relays failure to-energize, responsible for a 16.5%-
andy 16.3% _ reduction (two. class were modeled with different exposure times which decoupled the LilS distributions in the LilS sample; they were correlated, ' however).
The fourth and _ fif th most dominant classes are failure --ofj energized relays to remain energized, responsible for a 16.1%
and 15;8% reduction (these were _ also divided into two groups).
The sixth
-most dominant clas's is the loss of offsite. power. initiator which is responsible for a 12.5% reduction.
The seventh. most dominant class is diesel-generator failure to start which is responsible for a-6. 8%
reduction.
The eighth to tenth most dominant classes are the severe environment-failure probabilities of various types of equipment,
~
responsible for 6.5%, 5.4%, and 5.3% reductions, respectively.
-4.3 Summarv - of the Resul ts of the Internal Fire Analysis 4.3.-1 _ Dominant Fire Sequences The results _of the internal fire analysis are presented and discussed in
-detail in Volume 9 of-this report.
Table 4.1-1 lists all fif teen of the sequences that survived the screening process.
The sequences are ordered from mostLdominant to 1 cast. dominant as determined by ~ the mean valve from the TEMAC calculation.
The mean core damage frequency for fire events is 3.21E-05/yr. for the 1.32E-07/yr., the median - 1.99E--
)
- LaSalle plant.
The -lower 5th %-ile 5.94E-05/yr.
A CDF of the core damage
-06/yr, and ' the ' 95th %-ile frequency resulting from internal fire initiated sequences is given in Figure 4.1 2, The _ most dominant fire sequence at LaSalle is FIRE-CR.
This sequence contributes 43.3% of the total mean core damage frequency from fires and involves ~ ai control room cabinet fire.
The fire grows into a large fire
- that is,' not suppressed in time and control room evacuation is _ necessary.
The fire results in failure of the. injection. systems _ and control. is not successfully reestablished. using the remote shutdown panel.
Core damage
.results from'the loss of all_ injection.
The L second most dominant fire sequence at. LaSelle is FIRE-W2.
-This sequence contributes - 20.9%- of the total mean core damage frequency from
- fires and involves a fire in the Unit 2 -division 2 essential switchgear
. room.
This is a transient-- combustible fire that grows large enough to
-damage the train B equipment cabling that passes ' through the area.
The result is -failure of train B RilR and any train B injection systems.
Random failure.of the -other 'RilR train results in a-long-term loss of containment heat removal sequence.
Injection into the core is successful from either train - A injection systems or ~HPCS depending on the cut set.
The containment. pressurizes, venting is not possible because of the loss of train B-cabling,: and the containment fails on overpressure either by. leak or rupture.
Depending upon its location, this containment failure - (e.g.,
in; the reactor - building not to the refueling floor) will produce an 4-26
~.
1 envirotunent Witch could cause injection systems that are operating or that may be able to operate to fail.
The overall time available to the operators to perform their recovery actions is approximately 27 haurs.
The amount of time available depends on the failures that constitute the cut set and what recovery action is being considered.
The third most dominant fire se g nce is FIRE Y2 which contributer 10.61 of the total mean core damage frequency from fires.
This is started by a transient combustable fire in the Unit 2 division 1 essential switchgear room. The fire is not suppressed in time and results in failure of train A injection system and R11R. Random failure of train B RilR occurs and results in a long-term loss of co*ainment heat removal sequence.
Inj ectior. into the core is successful from either train B inj e c t ion systems or llPCS depending on the cut set.
The containment pressurizes, venting is not possible because of the loqs of train A cabling, and the containment falls on overpressure either by leak or rupture.
Depending upon its location, this containment failure (e.g.,
in the reactor building not to the refueling floor) will produce an environment which could cause inj ec t i on systems that are operating or that may be able to operate to fail.
The overall time available to the operators to perform their recovery actions is approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />.
The amount of time available depends on the failures that constitute the cut set and what recovery action is being considered.
The fourth most dominant fire sequence is FIRE-T which contributes 1.1% of the total mean core damage frequency from fires.
This sequence involves a transient combustible fire in the Unit 2 auxiliary equipment room.
The fire results in the failure of train A cabling and the loss of train A inj ection and RHR.
Iloweve r, the cabling does not result in the loss of power to the venting system and venting is pos ible Two sets of cut sets occur, with and without venting.
Random failure of train B RilR results in a long-term loss of containment heat removal sequence similar to FIRE-V2.
1 The fifth most dominant fire sequence is FIRE-W1 which contributes 5.6% of the total mean core damage frequency from fires.
This sequence is the same as FIRE-W2 except that the fire is in a switchgear cabinet.
The sixth most dominant fire sequence is FIRE-Y1 which contrii mes 5.5% of the total mean core damage frequency from fires.
This sequence is the same as FIRE-Y2 except that the fire is in a switchgear cabinet.
All other sequences contribute less than 5% total to the core damage 3
frequency from fires.
4.3.2 Dominant Cut Sets for the Fire analysis In order to obtain an integrated result for internal fire events, all of the cut sets from all of the sequences were merged together to form one large expression representing the total fire cor; damage possibilities.
TEMAC was then used to perform an uncertainty analysis and all of the cut i
4-27 l
~
setswere_ included [
_ A complete list of the cut sets for the individual and integrated _ calculations can.be found in Appendix F of Volume 9 of1this report.
Thes dominant cut set, responsible for 64.5% - of the_ mean core damage f requency from fires,- is the cut' set that represents the fire in the control - room sequence FIRE-CR.
This cut set represents a fire initiating in the control room, not being suppressed before it grows large enough'to require evacuation of the control room, and failure of the operators to recover control _of the plant from the remote shutdown panel.
~he second mos t - dominant cut set, responsible for 1.6% of the mean core damage _- frequency from fires, is the - dominant cut set in the FIRE-W2 sequence.
This cut set represents a large transient combustible fire
- starting - in a - switchgear room, and fail! 3 train B RHR and any train B injection systems.
Random failure of the other RHR train by blockage of the.RHR heat - exchanger results in a long-term loss of containment heat removal sequence.
Injectieu into the core is successfu? from HPCS.
The containment' pressurizes, venting is. not possible because of the loss _ of
. train B c $ ling, and the containment fails on overpressure by leakage. The failure is to the reactor building, not to the refueling floor,
-containa e
'and p rodt.s_ e 4 severe environment which causes. the HPCS system to fail resulting in core damage.
Thotthird most' dominant cut set, responsible for 1.5%-of the fire mean-core d_amage' frequency, is_the dominant cut set in the FIRE-E-S3 sequence.
This cut set represents a transient combustible fire in the corridor adjacent to the Unit 2,
Division 1, _ essential switchgear room.
The fire. is not suppressed in. time - and _ failure of offsite power and train A and B power to ECCS systems occurs.
AC' power is still available. for venting and venting is successful.
Af ter venting, severe environments are produced in - the reactor building and fail the HPCS and diesel-driven fire water systems
-resulting.in core damage The fourth most dominant cut set, responsible - for 1.2% of the fire mean core __ damage 1 frequency, is the dominant. cut set in the FIRE-T_ sequence.
This cut set-involves a transient combustible fire in the Unit 2 auxiliary equipment room.
The. fire results.in the failure of train A cabling and the
]
~
loss of train A injection and RHR.
Random failure of the train B RHR heat exchanger by blockage results'.in a _ long term loss of containment heat removal. sequence similar to FIRE-W2.
However, the - fire. did not fail cabling to the venting system and venting is succ e s s ful.~
After venting, severe environments are produced in the reactor building and fail the HPCS land diesel-; driven fire water systems resulting in core damage.
-The fifth most_ dominant cut set, responsible for 1-.1% of th_e fire mean core damage - - f reque ncy, is the dominant cut set in the FIRE-Y2 sequence.
This cut set -- represents.a. transient combustible fire _in the Unit 2 division 1 essential switchgear room combustible fire.
The fire is not suppressed in time and results in failure of train A injection system and RHR.
Failure-4-28
~
_ _ ~..
of thettrain B_RHR heat exchanger by blockage occurs and results in a long-term loss of containment heat removal sequence.
Injection into the core by HPCS l's successful. -The containment-pressurizes, ' venting is not possible because ' of, the loss of train A cabling, and the containment fails on
-overpressure by. leakage.
- Depending upon its - location,- this containment failure - (e.g.. in ' the - reactor building-not to the refueling floor) will
' produce. an environment which could cause. HPCS to fail resulting in core.
' damage.
'4.3.3 Risk Reduction Measures for Fire Initiators For the internal fire analysis, the fire initiating event frequencies were not labeled with IE-and so they appear on the same table with the basic events.
Tho' calculation is correct so no change was made.
For the integrated calculation described in section 4.1.of this report, the event
. names ' wore modified to include the IE-and the fire initiating event frequencies appear with the __other initiators.
Risk reductions for each individual sequence and the integrated. fire results are presented-in the TEMAC : outputs shown in Appendix _ F of Volume 9 of this report.
In this
- section, we will-discuss only the integrated' fire results.
One-important item to note is that since some complement events appear in the LaSalle ' fault trees and, therefore, in the accident sequence cut sets; some. events can _ have. negative : risk reductions.
That is, decreasing a certain events failure probability-can actually result in an increase in
' risk not a _ decrease.
'lhese events - app lar at the bottom of the risk reduction list,_so you must not look just at the top events in the list.
.The importsnee.of this is. much more obvious.f one looks at individual sequences then for the integrated results.
In the fire sequences, unlike
-the internal event sequences, both the event and its. complement can appear in the same sequence but in different cut sets.
For the fire analysis,one event-has l u negative risk reduction measure.
This event, OPFAIL-VENT-2H, represents Jauccessful - venting of _ the containment.
Venting using the current procedures creates severe environments in the reactor building that can fail. injection J systems and thus the sequence proceeds to core' damage, If vene.ing fails : and' then the containment fails; by overpressure,. the 1 failure.is-often te the refueling floor which bypasses the reactor building
.and no ' s eve re environments are 1 created.
' For - the dominant c long-term containment heat removal failure sequences --which appear in this analysis, HPCS-is. the system supplying inj ec tion.
Since HPCS is a high pressure system and does -not fail.- from high containment pressures, the conditional probability :of core - damage is ' actually higher - if venting occurs than if containment failure occurs.
This is becauso venting always. results in severe environments while containment failure only results in severe environments _if the failure is in the reactor building.
i The three ' most : important ' events for. risk reduction for - fire initiated sequences all occur _in the ? dominant _ fire sequence _ and' are related to control room fires: the probability that-the operators will unsuccessfully control. the plant ' from the remote shutdown panel, the control room fire 4-29
_. ~. _.._,__ -
initiating event frequency, and the fraction of control room fires that are not suppressed before smoke forces abandonment of the control room.
Each with a risk reduction measure of 2.18E 05/yr.
The fourth most dominant event is the fraction of fires that are large fires with a risk reduction measure of 9.32E 06/yr.
The fif th most dominant event is late failure of
]
HPCS from severe environments in the reactor building after containment leakage with a risk reduction measure of 8.80E-06/yr.
4.3.4 Risk Increase Measures for Fire Initiators Risk increase measures are in general calculated only for basic events.
Since initiating events are frequencies and can have values greater than 1.0, this calculations is not usually applicable to them.
For the fire analysis, since that fire initiating events were not labeled with IE, the fire frequencies, which are all less than 1.0/yr., were included in the risk increase calculation.
For these events, the risk increase calculation shows the impact of increasing their frequencies to 1.0/yr.
This labeling error is corrected in the integrated results presented in Section 4. ' of this report.
Risk increases for each individual sequence and the integrated fire results are presented in the TEMAC outputs shown in Appendix F of Volume 9 of this report.
In this cection, we will discuss only the integrated fire results.
As with the risk decrease measure, certain events can have negative risk increase implying that the risk decreases as their probability is increased.
In fact, two events that have negative risk increases.
For example, as the probability of the operator failing to vent increases the core damage frequency goes down because, for the dominant sequences, there is less probability of severe environments if the containment fails than if its vented as described in the previous section.
The dominant event from a risk increase standpoint is the frequency of control room fires with a risk increase measure of 3.40E-03/yr.
The second most dominant event is the frequency of switchgear room fires with a risk increase measure of 5.56E-04/yr.
The third most dominant event is the failure of the operator-to successfully control the plant from the remote shutdown pane' with a tak increase measure of 3.18E-04/yr.
The fourth most dominant event is the area ratio of fire area AC to the area of the auxiliary building.
The fifth most dominant event is the fraction of controi room fires that are not suppressed before smoke forces abandonment of the contcol room.
4.3.5 Uncertainty Importance for Fire Initiators As described in section 4.1.6, the uncertainty importance is calculated for groups of basic events all of which have the same underlying distribution (i.e., all basic events represented by the same U!S variable).
For the LaSalle fire analysis, the results of this calculation for each accident sequence and for the integrated fire results are presented in Appendix F of Volume 9 of this report.
Only the integrated fire results will be discussed in this section.
4-30
The most dominant class it the event representieg the failure of the IWCS system from the severe e nvi ronmen t s created in the reactor building after c onta i nme r.t failure by leakage It is responsible for a 33.84 decrease in t '... variance of the log of the top event The r.econd most dominant class is
- t. he variable representing the fire in the control room initiating event frequency.
This class is responsible for a 17.1% reduction in the variance of the log of the top event.
Due to the sparse data base for control room firen, the distribution for this event is nighly skewed and very wide The
.hird most dominant class in the event representing the late failure of IIPCS and diesel-driven fire water from severe envi rotmient s in the reactor building after containment venting.
This class is responsible for a 12.5%
reduction in the variance of the log of the top event.
The fourth most 1
dominant class is the event representing the f requency of fires initiated in the auxiliary building This class is ro1ponsible.for a 7.2% reduction in the variance of the log of the top event.
The fifth most dominant class is the event representing the area ratio of fire area T to the area h,
of the auxiliary building.
This class is responsibic for a 5.14 reduction in the variance of the log of the top event.
j 1
All othe1 classes contribute less than a 56 reduction in the variance of the log of the top event.
Many of the random Silures begin cont ributing just below the $t icvel.
If one looks at the n.plete set of importance uncertainty results in Appendix F of Vo1+ m t f this report, it can be seen that both random failure and fire events contribute significantly at all levels of importance and uncertainty.
This result comes about because the LaSalle design requires both random and Iirt events
'o occur in most cut sets leading to core damage ar, therefore, uncertainties in both groups of events are relatively equal.
This resuit would not occur for plants which had less physical separation of redundant safety systems.
4.4 Summar'L.nL_tJw Pen!1t c ni the Inint!al 100'l Analys i s 4.4.1 Dominant Plood Sequences 4
The cesults of the internal flood analysis are presented and discussed in detail in Volume 10 of this report, Table 4.1-1 lists the two sequences that survive d the internal flood screening procev.
The sequences are ordered from rnost dominant to least dominant as determined by the mean value from the TEMAC ce.lculation.
Tbc trean core damage frequency for internally initiated flood events is 9.62E 08/yr.,
3.39E-06/yr. for the LaSalle T.lant.
The lower 5th %-ile the median - 1.13E-06/yr., and the 95t h t-ile - 3.23E-06/yr.
A CbF of the coro damage frequency resulting f rom internal flood initiated sequences is given in Figure 4.1-2.
p g
The ino - dominant sequence is FS2 which contributes 93. 7% of t he total mean core d eage frequency from internal floods.
This sequence is initiated by a flood resulting either from the rupture of the pipe or e valve in the
- O A
4-31 4
service wat er piping in the southeast corner of the ground floor of the unit 2 reactor hu11 ding (location 3G.1) and the operator fails to isolate the flood within 7.3 minutes.
'I h n floa direedy results in the failure of all systems depending on service water (i.e.,
MIV and CDS).
The flood falls the I.PCI train B and C 480.AC MCC on tuat level falling those trains of EllR.
The flood also prepagates to the cornar rooms 312 (southwest) and 314 (northeart) resulting in lailure of IIPCS and CRD and LPCS and RCIC, respectively.
The operator does not isolate the flood in time and the water invel in corner room 314 gers high enough to drain lato room 315 (notthwest) f'iling LPCI t rain A.
All injection has failed and core damage results.
The second dom i tu,n t.
sequence is ISI which contributes 6.3% of the total k
tr:e n n core damage frequ.ncy from internal floods.
This sequence is initiated by a flood resulting from *be rupture of service water pining on an upper level (3E) of the reactor building.
The flood rer.11ts in direct failure of filN and CDS.
This flood fails the low pressure inject ion system pressure permissives on that floor resulting in the failure c. f LPC1 trains A,
B, and C.
The finod will propagate to the 312 and 314 corner rooms and f ail liiCS and CRD and LPCS and RCIC, respectively.
It will also drain into room 315 from 314 and fail LPCI A.
A11 inject inn has failed and core damage results.
4.4.2 Dominant Cut Sets for the Flood analysis 1
In order to obtain an integrated result for internal flood initiators, all of the cut sets from all the sequences were ste r ge d to form one expression representing the tot 6 internal flood core damage frequency.
An uncertainty cniculation was made usf ng TEMAC that included all of the cut retn.
A complete list of the cut sets appears in Volume 10 of this report.
The dominant cut set, responsible for 82.5% of the internal flood r..ean core damage frequency, represents a ficod resulting from iallure of the service water system piping on the ground floor of the reactor ouilding, i.e.,
flood sequence FS2.
The flood is initiated by the rupture of a valve in the piping in the southeast corner of the floor.
Flood annunciators succeed but the operators are not successful 4 identifying and isolating the flood within 7. 3 minut es.
The flood fails all mitigating s.ystems as described abovo under flood seauence FS2 and core damage results.
'Ne second most dominant cut set, responsibla for 10.7% of the internal (lood mean core damage frequency, represents the same flood as in the most dominant cut set.
The only difference is that the flood is initiated by a pipe break not a valve failure.
The third most dominant cut set, responsible for 5.8% of the internal flood mean core damage frequency, represents a flood resulting from failure of the service water piping on an upper level of the reactor building, i.e.,
flood r,equence FSl.
The flood fails the LPCI low pressure permissives on that floor and then fails the othet mitigating systems, as described in th-discussion af flood sequence FS1 above, resulting in core damage 4-32 9
All other cut sets contribute less than 14 each to the total internal flood core damage frequency.
4.4.3 Risk Reduction Measures for Flood Initiators For the internal flood a n sil y s i s, the event representing the pipe failure frequency was not labeled as an initiating event.
In TDiAC, variables whose values can be greater than 1.0 must
'.e labelled as initiators.
Since the flood initiating event frequency is revily the product of the length of pipe availabic for the flood under consideration times the frequency of pipe fallute per unit lengt' of pipe, i t-was decided to define the length of pipe as the initiating event and leave the pipe failure f requency per unit length of pipe as a basic event.
Risk reductions for each individual sequence and the int e gr a t ed flood results are presented in the TD1AC outputs shown in Appendix r of Volume 10 of this report.
In this section, we will discuns only the integrated flood results.
The e ve n t, AVAI L-FAC has the highest risk reduction value, 3 23E-06/yr This makes ser.a because if the plant was never available the accident could not occur.
However, this does not. hel:
us iruch because we want the plant to operate as much as possibic and vot i d not want to reduce this event's probability, The next highest risk reuuetion, 3.20E-06/yr is for the event OP FTISOL.r1 MOD.
This event represent s failure of the operator to identify and isolate the ilood within 7.3 minutes.
!;ormally, reactor building flooding indication is aot too specific and to identify and isolate a particular flood before suf ficient wate is released to damage crit ical equipment will not he straight forward.
The third highest risk reduction, 2,69E-06/yr.,
is for the event I E VALVE-RlH' This event represent s the ficquency of external valve rupture with no leak before break.
4.4.4 Risk lucrease Measures for Flood initiators i
Risk increases for each individual sequence and the integrated flood results are presentou in the TEMAC outputs shown in Appendix F of Volume 10 of this report.
In this section, we will discuss only the integrated flood results.
The event with the highest risk increase, 1.58E-01/yr., is PIPE-FREQ.
This event represents the pipe rupture before leak frequency.
TLMAC does not calculate risk increase measures for initiating events ident if ied with the IE-prefix as normally initiators can have values greater than 1.0/yr However, in this case, we labeled the pipe length an the initiating event so the P1PE FREQ event was set to 1.0 and a risk increase was calculated.
A similar number could have been calculated for the IE VALVE-RUP event since !t's frequency is much less than 1.0/yr.
If this had been done, the valve rupture event would also have had a large risk lucrease obviously, keeping the fre]uency of pipe and valve ruptures low is import ant to maintaining a low core da ange frequency since these floods in and of 4-33
themselves can fail nuff!clent equipment to cause core damage.
The next highest events are AWtic-FAILURE and OP Pf150L-FLOOD.
Each of which has a risk lucrease of 3.73E-05/yr, Identifying and isolating the flood are of equai value in risk increase it in intere-ting to note that the AVAIL-FAC event is the lovent in risk increase while the highest in risk decrease Thir implies that improving the availability will not significantly increase the frequency of core damage while decreasing the availability will significantly doca, n.o
.a core damage frequency.
4.4.5 Uncertainty 1mportance Measures for Flood Initiators As described in seetion 4.1.f;. the uncertainty impoi tance is calculated for groups of basic ev:nts all of which have the same underlying dis.tribution (i
e.,
all basic events represented by the same IJIS variable).
For the LaSalle internal flood analysis, the results of this calculation for each accident sequence and for the integrated flood results are presented in Appendix F of Volume 10 of this report.
Only the integrated flood results will be discussed in this sectior..
The dominant class of events, responsible for a 74.8% reduction in the variance of the log of the top event, represents the valve rupture frequency.
The second most dominant class, responsible for a 10.5%
reduction in the variance of the log of the top -vent, represents the pipe failure frequency.
The third most dominant class, responsible for a 7.0%
reduction in the variance of the log of the top event, represents the failure of the operator to identify and isolate the finods within 7.3
- mlnutes, 4.5 h wary o Lihe Renults of_ the reismic Annivsfr.
4.5.1 Dominant seismic Sequences The results of the seism.c analysis are preacnted and discussed in detail in Volumes 2 and 8 of this report.
Table 4.1 1 presents the teruits of the TEMAC calculations for each individual accident sequence which survived the initial screening analysis.
".ach sequence is ident ified by initiator type and seismic level.
The mean core damage frequency was 7.58E-07/yr. with a 5-tile of 4.07E-11/yr., a Ledian of 1.74E 08/yr., and a 95%-Lle of 1,21E-Of>/yr.
A CDF of o
the core damage frequency resulting f">m scismically initiated sequences is given in Figure 4.1-2.
The primary characteristic of the dominant sequences at LaSalle is that the only explicitly seismic events appearing in the final cut sets are the scismic initiating e v e n t-frequencies for each ievel and the seismically-induced loss of offsite power conditional probabilities at each level.
No other selsric failures o r se f sn,1 c related events survived the initial and final quant i fication.
This is very dif ferent than the results for many J
4-34
other plants.
T5 LaSalle plant is very well designed from a seismic view-point.
The detailed structural analysis performed in Volume 8 did not. find any structural icilures wheri valls might fall and damage critical equipment, the cabinets and panels were bolted down correctly, and the piping penetrations were designed appropriately to handle any shifting as a result of the seismic event.
The accident sequences look, therefore, like seistnically-induced t ranslents.
If 1 ASP was not likely to occur as a result of the seismic event, there would be na dominant seismic sequences at LaSalle.
No ot.her seismically-induced initiator has a significant conditional probability and compromises redundancy enough to result in accident sequencer with a substanttal frequency.
The dominant sequences at LaSalle are, therefore, all seismically induced losses of offsite power and look exactly like the equivalent internally initiated sequences except that no credit is given for recovering offsite power after the seismic failure.
Another characteristic of the scimmic sequences that follows from that in the previous paragraph is that, for a particular accident sequence, the cut sets for the sequence will be the same for all of the seven seismic hazard levels being analyzed except for the hazard frequency itself and the conditional probability of the IASP at that icycl.
When one looks at Table 4.1 1, you see, for exaraple, that se i stnic sequence TLOSP-01 is replicated for each of the seven levels.
If one examines the TEMAC output in Appendix C of Volume 2 of this report, you will see that the cut sets for each level are identical except for the level indicator on the initiating event frequency and tha conditional LOSP probability.
The frequency of the sequence is directly proportional to the hazard f requency at that level and, since the conditional probability of ceramic insulator failure increases at a slower rate than the rate at which the hazard frequency decreases, the accir'ent sequence f requency drops with increasing hazard level.
(
There were six sec uences that survived for final quantification: TLOSP-01 TLOSP-03, TL1 01, FL1 03, TL2-01, and TL3-01.
Each of these sequences was evaluated for each of the seven different hazard levels used in the analysis which is shevn by the.LXX extension on the sequence name.
TLOSP-01 corresponds to internal e rent sequence T63 and is an intermediate term station blackout where RCIC works for about six hours and then fails on high containment pressure or battery depletion.
itPCS may also be working but the llPCS diesel fails at eight hours and in either case core dmtage ensues.
TLOSP-03 corresponds to internal event sequence T100 where RCIC falls initially due to the closure of the inboard isolation valve on high room temperature before all onsite AC power is lost and can not be unisolated later because of the secondary failurc of AC power.
HPCS works initially; but, again, the llPCS diesel fails at about eight hours and core damage ensues.
The T LX - 0Y sequences are sequences which have the additional failure of 1, 2, or 3 of tbc SRVs to reclose and, therefore, are transient-induced LOCAs ;1mtiar to those in the internal events analysis except that they occur wi th a simultaneous IDSP.
The TL1-01 sequence cor.esponds to intTrnal sequence TL60 which is similar to T63 described 4-35 g
above.
The 101 03, TL2 01, and TL3-01 sequences correspond to internal sequence Ti/37 which is similar to T100 described above, 4.5.2 Dominant Cut Sets for the Seismic Analysis In order to ol>tain an integrated result for seismic events, all of the cut sets from all of the sequences were merged to form one large expression representing the total seismic core damage possibilities.
TDIAC was then used to perform an uncertainty analvsis and all of the cut sets were included.
A :omplete list of the cut sets for the individual and integrated seismic calculations can be found in Appendix C of Volume 2 of this report.
The top seven cut sets all con;c ftom the TlDSP 01 sequence and correspond to the dominant cut set in that sequence evaluated at er.ch of the seven seismica',1y induced IDSP followed seismic levels.
The cut sets represent a by a common mode failure of the diesel generator CSCS cooling water pumps.
11CI C works for six hours when it tails on battery depiction or high f
cont a itunent. prensure Core damage ensues several hours later after boil-off.
These cut sets are responsible for 73.7% of the mean core damage frequency f seismic events.
.S.3 Itisk P. eduction Measures f or Seismic initiators itisk reductions for each individual sequence and the integrated seismic results are presented in the T DiAC outputs in Appendix C of Volume 2 of this report.
In this section, we will discuss only the integrate ' seismic resultn.
Tbo dominant events at Lasalle for the seismic analysis are the two events associat ed with the common mode failure of the CSCS cooling water pumps.
The events are the random pump f ailure probability and the common mode beta factor that multiplies it to create the common mode failure probability.
Each event has a risk reduction value of 2.20E-07/yr.
The third and fourth dominant events are the L1 level hazard frequency and seismically-induced LOSP probabili ties.
Each of these has a 1.44E 07/yr.
risk reduction.
The initiating ev,nts for each 1cvel have a monotonically decreasing risk reduction an the hazard level increases and their corresponding contribution to the core damage frequency decreases.
The fif th most dominant event in the non-recovery probat.lity of offsite power within eight hours.
Since no credit is given for recovery of offsite power in this aralysis, clearly an improved estimate of the possibility of recovering of fsite power af ter seismic events would be worthwhile.
This event. has a risk reduction of 1.14E-07/yr.
4.5.4 Risk increase Measures for Seismic Initiators illsk increases for each individual sequence and the integrated seismic results are presented in the TEMAC outputs shown in Appendix C of Volume 2 4-36
of this report.
In this section, we will discuss only the integrated s c i sir. i c results.
The donii nun t event for /isk increase in the C5CS cooling water punp con. mon mode beta factor with a risk increase of 1.81E-05/yr.
The second most dominant event is tha random failure of the CSCS cooling water punps r e s p,,ns ibl e for a 8.59E-06/yr. risk increase.
The next three events (the third, fourth and fifth) represent failure of o*>
of the diesels to run.
Since the t.ystem configuration is not quite symmetrical the "2A" DG has a 2.50g-06/yr. risk increase, the "2B" DG has a 1.83E-06/yr increase, and the "O" DG has a 1. 80E 06/yr, increase.
Similarly for the sixth, seventh, and eighth dominant events represent failure of the diesels to start.
The "2B" DG has a 1.69E-06/yr. risk increase, the "0"
DG has a 1.66E 06/yr.
risk increase, and the "2A" DG has a 1 lSE 06/yr risk increase 4.3.5 Uncertainty importance Measures for Seismic Ini t. int ors For t he LaSalle analysis, the result of this calculation for each accident sequence and for the int egrated seismic results are presented in Appendix C of Volume 2 of this report.
Only the integcated seisale results will be discussed in this section.
The dominant class is the c o nd i t i ota.1 probability of ceramic insulator failure resulting in loss ci offsite power.
This class is responsible for a $?.5% reduction in the variance of the log of the top event The second through eighth most dominant classes are the seismic initinting frequencies a t.
the various levels These events have disforent distributione but are correlated and are responsible for 33.5-3?.04 reductions in the variance of the log of the top event.
The ninth most dominant class, responsiblo for a 7.3% reduction in the variance of the lag of th' top event, is the diesel generator failure to run.
The tenth most dominant class, responsible for a 6.3% reduction in the variance of the log of the top event, is the diesel generat or failure to start.
All other events are responsible for less than a 5% reduction in the variance of the log of the top event.
4.6 litpo r t an t Issun and Insight _s 4.6.1 Seir.mic hazard Curve The seismic hazard curves used in this pRA were based on nr early method where the hazard curve was developed for a hypothetical rock outcrop and a site specific soil correction was applied.
Since that time. the LLNL 4-37
1 method has changed.
In the new method, the sites are pnt into one of eight categories and a generic correction for a given soil category is appliei
'Ibe soil cot rec tion model s are signifIrantly different.
In additlon, there is the curve produced by the glectric Power Research Institute (LPRI) methodology.
ligure 4.6-1 shows the three seismic hazard curves.
Pieccuse of the dilferent fashion in which the curves are produced and the different.
factors included in the curves, it is not possible to simply scale the results to perform a sensitivity analysis.
In order to determine the i ttpa c t of the different curves on the final core darage frequency, the analysis would need to b redone.
4.6.2 Relay Chatter l
In a separate report,1 the possible effects of seismically induced relay chatter on the Lasalle core damage frequency were analyzed.
System design information, fault trees, and the seismic hazard curve, irngilities, and utructural analysis results were all supplied to the analysis team.
In this analysis, relay chat t er was found to be potent tally important in the eleci t ic power system, the aut ornat ic depres sur l:'at ion sys t em (ADS), and in the reactor core ' solation cooling (RCIC) system.
T1,e analysis in this report takes no credit for operator recovery, so the resuh only indicates the potential Importance For t he LaSalle l evel 1 PRA, those failures were considered; but, they were det ermim d to be pt ohabilistically unbrportant in the seismic core damage frequency.
This was because, in all. cases, t'a e seal-ins can be recovered by the operator and, in the most pessimistic sequence, the operator has about 80 minutes before core dama ge begins.
The mean operator failure to recover probability would be of the order of 2.0g 03 and these cut sets would be significantly less likely than t he current dominant cut sets which involve a station blackout wi th minimal operator recovery potential.
4,6.3 Loss of off-Sito Power Frequency As described in Reference 2, a new method for calculating the loss of off-site poner initiating event frequency distribution and distributions for the probability of recovering ef fsite power by time t. was developed for the LaSalle PRA.
The mean f requency of LOSP at LaSalle calculated using this umt'and was 0,096/yr, the 5th 4 11e is 0.024/yt., the meilan is 0,085/yr and the 95th %-11e is 0.20/yr.
The method used assumes cuch plant has an i n d i v i du r.1 incidence rate for LOSP occurrence which belongs to a superpopulation of incinence rates.
A distribution for the superpopulation luidence rate is calculated from the historical dat a and then a Baysian-based procedure using piant specific data for plant-centered, grid, and weather-induced LOSPs is used to determine a plant specific incidence late and distribution.
At the time the calculation w as done, no 10SP had occurred in four operating years (if one includen both units 1 and 2).
4 3B
1.00-01 g
1.00-02 "I
Legend 1
x N'N PRA Curve u
\\
'x 0
EPRI Curve 3 1.00 03 g
\\u n.
s
\\
,,-,s 's E
j N.
N
~
O LLNL Curve
-,s a
\\
u s
x
' g ' s% g' x.s--_
u N
i.00-04 :
~x_. %
~~s s
. ~Nc _.,
s,~
1.00-05,
l q
x.
1.00 06
~
0 200 400 600 800 Acceleration (cm/ soc"2)
Figure 4.6-1 Comparison of LaSalle seismic lla: ard Curves 4-39
Coirnu n a al th Edison Company (CECO), the owner of the LaSalle plant, had contracted with General Electric to perform a PRA in parallel with the NRC sponsored effort described in this report.
The results of that analysis are reported in Reference 3.
In CE's report. a value of 2.4E-03/yr is used for the LOSP ialtiatie-event f requency based on Ceco analysisU of the unavailability of safety buses at the lasalle Station.
SNL analysts felt that this value was much too low based or, the historical data.
However, Ceco felt that they had corrected or designed away th, faults that had rer,ulted in prior LOSPs on other grids.
In ?989, a LOSP occurred at the LaSalle plant.
Ascuming one event in 8 operating years, this implies a rate of 0.13/yr.
However, since the PRA is trying to represent an v:cident occurring at any time in the lifetime of the plant, this particular value would not necessarily be the correct one to use.
As time goen on and no addit lonal IDSP occurs, the average value per year will decrease.
It is judged that the uncertainty distribution ased in this analysis will adequat.ely represent any year to year variation in the LOSP initiating event frequency.
This particular dif ference of opinion is symptomatic, however. of a much larger problem.
In the estimation of failure rates for various events, many analysts try to argue away all the failure data by saying that they either fixed the problem or designed a new device that does not have the problem.
The result is, in our opinion, a large underestimation of the fallu" probability.
While it is true that one hopes that design improve..%nts and fixes will improve system reliabilit y, we believe that it in clear irom experience that, in general, the reliability of new systems improves much alower than would be estimated.
This stems from two conside rat ions.
First, people do not make a large effort to estimate all the new failure modes they have introduced and all the old ones which have not occurred yet.
Second, these failure rates ara very small and what is being estimated is the occurrence rate of any unlikely event that could result in system failurc.
Just because one fixes a particular fault does not mean that one has significantly affected the underlying f ailure rate.
There are clearly dif ferent ways of incorporating the switchyard failures into the analysis.
.e vay done in this analysis is to use genetic statistical data on loss of offsite power then modify that data by taking into account switchyard type, grid, and weather and, finally, to update this information with the plant specific data.
An alternate method would a detailed fault tree model of the switchyard.
levolve constructing interfacing this with the in-plcnt models and the external events such as weather and grid effects, and gathering generic and plant-specific data to qunntify the model.
This second method does have the appeal of being consistent with current modeline metbods and we would recommend going this direction in the future It is not cicar; however, that significantly different final results would be obrained since the underlying ds~a should be consistent and the final answers should be approximately the s a.ae.
l 4 40
4.6.4 Containtr+nt. Vent ing As described in Seccion 4.1, the current procedure for venting the con t aitunent contains s.ome positive and negative aspects.
Current ly, the operator is directed to vent f i r s t. from the wetwell through the standby gas treatment system.
The piping from the containment is connected to the SBGTu by a rubber boot..
When the 24" valves are opened, the boot is almost certain to fail.
Also, the SBGTS filter box, which is not designed to withstand such pressurea, will likely fail.
This will occur in both reactor buildings, since the t' nit I and Unit 11 SBGTS are connected.
The resulting severe env i r otuts n t s have a substantial probability of causing equipment belonging to possible mitigating systems which are locat.ed in the reactor building
'o fail.
The result. would be the l o s t.
of injection and t.ubs e que nt core damage.
1 that appear in the dominant sequences:
Let. us examine the possible cases 1.
Loss of RilR and high pressure inj ec t ion works.
The con t ai tune nt pressurizes until the vent threshold is reached at which time the operator vent.s t.he containment.
In the dominant sequencen, !!PCS and CRD are the two pot.sible high pressure injection r.ystems that could he working.
Both of these <ystem are located in the southwest corner cubicle which is open at the ground floor to the rest of the reactor building.
The results of the expert w
c11 citation on equipment failure indicated a nican probability of f
0.97 and 0.99, respectively for failure of the systems in the severe environments created in the reactor building if venting occurs at this time.
What if the operator did nothing and the c,ntainment continued to pressurize until structural failure occurred?
The most likely containment failure mode (about 0.67) is by the drywell head lif ting and the release will be o the refueling floor.
In this case, no severe environments will be produced in the reactor building and the high pressur-injection systems should continue to work.
The sequence is a success, in the case of failure to the reactor building, the probability of r.ystem failure is similat to the venting case Therefore, if the operator vents, core damage is almost certain to occur; while, if the operator doer nothing, one-third of the time core damage is likely.
2.
Loss of RilR and only low pressure inj ection vorking (LPCI, LPCS, CDS, DFW).
The containment pressurines until the venting threshold is reached at which time the operator vents the containment.
If CDS or DFW is working, then core damage is not likely since these systems have no components in the reactor building whose failure would result in system failure.
However in the dominant sequences ei ther LPC1 or LFCe is working.
These systems have many components located in the rn. tor building.
The failure probability f rom severe environments is about 0.66 hecause 4.
1 L_-___
m_.._. _ _ _ _ _.
_______m
____-.____.__________-_-.___-__-_m.
___.__i___.
l t.ost components are located in closed corner cubicles (northwest and sc atheast).
11 the operator does nothing, then the containment will pressurize to the SRV reclosure pressure.
When the SRVs rret'ose, the vessel will repressurize and low prescure injection will be lost (for LOCA or transient induced LOCA;, the vessel will remain depressurized; but, these are not dominant sequences).
Core damage will result frorn loss of injection before tLe c on t ai nme at pressure reaches the structurel failure point.
The result of the probabilistic (nalysis of the two scenarios can he stunmarized as:
It is not benifical to vent if high pressure injection is wallable and it is benifical to vent if only low pressure inj se t i on is available in either case, however, venting vill result in some posalbility of core damage.
A possible change in the venting procedure would eliminate this possibility.
A hard pipe vent path exists which goes di.ectly to the steam tunnel.
Releasing the steam into the steam tunnel will result in the blowout panel on the roof opening and directing most of the steam to the outside.
Some steam would go under the main turbine and could leak up into the turbine hullding.
However, the flow resistance 'n high and not much steam is expected to go by that path and not many cr;rical components of the safety systems are located where this would affect. ' he r.
In this case, whether one han high or low pressure i nj e c t i on, ventini will not result in syi.t om failure.
This type of venting would be similar to th t to which the Peach Bottom plant changed as a result of the NUREG 1150 analysis.6J peach Bottom has a 6-incb pipe through which thny can veat directly to the outside, thereby, not creating severe envirotunents in the reactor building.
One note of caution, however, if core damage has alteady occurred then venting into the reactor building, which would tend to retain more fission products, could lead to smaller radioactive releases.
This would be important in the Level 11/111 annlysis.
4.6.5 RCIC Isolation As part. of the pRA, simulator tests were run for various postulated accident sequence scenarios on the LaSalle plant simulator.
These tests weto run to determine the human error probabilities.
During these tests, it was found that the RCIC system was isolating every time a loss of off-site power occurred.
This was traced to a contact timing problem in the isolation circuitry.
On IDSp, part of the isolation circuitry is deenergized. This results in a contact in the DC powered portion of the steam leak detection circuit high room temperature signal resulting in closing.
This would simulate a closure of the AC powered in-board steam isolation valve except that the 4-42
valve power is also lost and it can not close In addition, the loss of power relays in the AC powered portion of the isolation circuit deenergine resulting in their cont act s in the DC powered portion of the isolation circuit opening.
Wen on-site AC power is started, AC power to the valvc is restored and the less of power contacts in the DC portion close before the relay in the AC powered port lon, which controls the remaining contact in the DC portlon, closes.
The ro ult is that the DC portion of the circuit is morrent arily closed.
This directs the valve to close due to hign room temperature The contact locking in the in-boar-1 AC powered MOV close circuit is energized before the loss of power contact in the DC portion reopens nad the in-board steam isolation velve closes.
11 onaite AC power entinued to work and no other AC powered systems were available, the operator would have about 80 minutes before core damage would begin and there would be plenty of time to reopen the valve However, in the case of a station blackout resulting from the failure of
~
diesel geaerator cooling water, the DGs would start and load; but, they would ti,e n fall due to the loss of cooling.
This del ayed failure would result in the valve closing before the diesels would be likely to fail.
After the diescis failed, the valve would not be abic to he reopened.
All core cooling would be lost and core damage would result unless AC power could be restored in time.
A similar effect happens when one train of AC power falls immediately and the other has a delayed fcilute.
The RCIC steam line has two AC pow ed isolation valves powered from
'ferent AC trains.
One valve is in-board and the other out-board.
In
.s particular case, RCIC either will not isolate on starting of t he AC train or AC will continue to be available to recpen whichever valvo closes.
llowever, if even one train of AC power is available, RCIC will isolate in about 20 minutes on high room t erne ra ture.
As long as that train continues to work, the isolation can be
,erridden; but, ff some other system is available for injection, it may not be.
If the train subsequently falls and the operator has not reopened the isolation valve, he may not be abic to depending on which valve closed 2
(l.c.,
if the out-board valve was the one that had power, then it can be manually opened locally).
Two events were introduced into the fault trees to account for theso effects.
They are OPF*1LS-RE0 PEN and RCICRMCOOL-FLAG, respectively.
Fault trees are not very good at modeling time dependent effects and, in order to model these offects correctly, the curve for the probabi!ity of failure of the operating DC with time would have to be convolved with the curve for the probability of the operator recovering the valve within a certain time.
In, dttian, eacil cut set could have slightly different timing depending on chat was causing the DC failure.
As a result, it was decided to conservatively model these events as not being recoverable.
The utility has instituted a design change to correct this problem.
4-43
-m
_.--._-_--_.----~___-___.__m
'll
l 4.6.6 RPS railute Probability Because of the complexity of ne reactor protection system, a separate detailed fault tree was not :onst ructed for this system in this analysis.
Au IMCA was perf ormed on t he RPS system and all interfaces to other systems were identified.
For any other system that relied on RPS logic, that portion of the logic was incorporated into the system's fault tree in detail.
The RPS system failure was treated as an undeveloped event and a single number was used to represent failure to scram in the quantification of the ATWS sequences.
This number was 3E-05 of which 2E-05 as considered to be due to electrien faults und recoverable.
Since 1.aSalle has an alternate rod insertion system which operatea on a diverse principle and since nio s t electrical faults can be bypassed by doenergizing the RPS clectrical huses, electrical taults were considered to be negligible compared to the mechanical faults and not included in the
~
quantification.
The final mean value used was, therefore, IE-05/D for the conditional probability of failur( on demand and van non recoverable.
This approach is nimilar to that used in NUREG-1150 to quantify the RPS failure probability (see the Peech Bottom analysis as an example ).
6 4.6.7 Use of Quailtative Fire Infor.tiation In Plant Operations The location based information that can be obtained from the type of analysis done for this project can be used in many dif ferent ways.
An example of the use of this informttica would be to prioritize the areas for increased inspection for the fire watch to reduce the risk from fires.
L' hen trains of various systems are taken out for maintenanto, repair, or testing; the results of the fire anelysis can be transformed to allow the identification of the areas where because of the reduced redundancy, fires can have the most potenttal for leading to core damage.
Table 4.6-1 shows for the dominant fire areas resulting from the LaSalle analysis, those i
systeos which must fail randomly in addition to those failed oy the fire before core damage can occur.
By inverting this table, see Table 4.6 2, one can construct a list of the fire areas one should be-concerned about if cert ain systems are made unavailable for various reasons.
By increasing the fire inspections for these areas or by making other adjustments to the treatment of these locations -hich could reduce the possibilities of fires in those areas, the risk from fires can be reduced.
4.6 8 Quality Assurance 4
The RMIEP program had a very extensive QA plan consisting of both in-house revie' of the results of each task by someone who had no': performed the pork, and by an external QA team censisting of many of the leading practitioners in the PRA community, the NRC project raa na ge r, and the utility and their architect engineer, Sargent and Lundy.
k//44
-.. ~.,... _
)
Table 4.6 1
'Jominant Fire Areas and Associated Random Failures j
D re Area
- 11andow. Failures G
None, Control Room E(S2) llPCS E(53)
Venting ti RilR-A P
RHR B T
Venting and RilR-B S(AA)
DG-A and Rilk A
{
S(W)-
RiiR-A W1 RaiR A W2 RHR-A Y1 RilR il
-Y2 RilR li Z
RiiR B AA-DG-A and RilR A TAC RllR-B See Volume 9 of this report for a detailed description of the fire areas and their significance, Table 4.6-2 a
. Iniportant Fire Areas Given Una"allability of System-t SVDtts-Important Fire Areas Venting:
E-S3, T R!lR-A _
N; S-W, S-AA,.Wl, W2, AA RilR-B P, T, S-AA, Y1,- Y2, Zi AC
- DGJA S-AA, AA
- IIPCS E S2
!. 4 t
a 4-4$
e-v*
w d.w
, w e..
+r
-r-w-+,w w
w.--x.<....
e-..
-,____i,____i_-__u
.m
.i
This plan worked very well until the inception of NUREG 1150.
The NUREG-1150 project had t.
substantiel impact on the resources available for the LaSalle l'FA and resulted in a substantial lengthening of the schedule, In fact, the LaSalle Level 1 PRA was not fully completed unt il af ter the Level II/III analysis of the Peach boctom NUEEG 1150 analysis was completed, since uany of the people working on the Peach Bot. tom analysis were the ones responsible f or completing the LaSalle analysis.
The result was that the inittal phases of the analysis were reviewed by the whole team; but, the final results of each onalysis, i.e.,
the final seismic, fire, flood, and interroi event accident sequence cut sets, were revleued only by tha in-house independent review, the NEC, and the ut111ty.
4.7 Peferences 1.
R. J.
Budnitz, 11. E Lambert, and E.
E Hill, " Relay chatter and Operator Response After a Large Earthquake An Improved PRA Methodology With Case Studies," NUREC/CR-4910, Future Resources A sociates, loc., Berkeley, CA, nugust 1987.
2.
R.
Iman and S.
C.
llo ra, "Modelfng Time to Recovery and Initiating Event Frequency For Loss of Off-Site Pcwer Incidents at thiclear Power Plants," NUR2G/CR-50?2, SAFD87 2428, Sandia National Laboratories, Albuquerque, NM, Janua ry 19 '8.
3.
A.
J.
Call. L G Frederick, P.
D.
Krie ch t,
C.
11. Stoll, and S.
Viswenwaran, "LaSalle County Station Probabilistic Safety Analysis," NEDI-31085, Nuclear Energy Business Operations, General Electric Company, San Jose, CA, November L985.
4.
" Predicting Transitission Outages for System Relicbility Evaluations, "EPRI EL 3880, Commonwealth Research Corporation, Chicago, ILL, May 1985.
S.
" Unavailability and Unreliability of Preferred Supply to Essential Service Buses at LaSalle Station," memo to J, S.
Abel from A.
11.
Getty, September 13, 1985.
6.
A. M. Eolaczkowski, W.
R. Cramond, T. T.
Sype, K J. Maloney, and S.
L.
Daniel, " Analysis of Core Damage Frequency' Peach Bottom, Unit 2 Internal Events," NUREC/CR 4550, SAND 86-2084, Volume 4,
Revision 1, Part 1, Sattdia National Laboratories, Albuquerque, NM, August 1989.
7 A.
C.
Payne Jr.,
R.
J.
Breeding, it.. N. Jow, J.
C.
lle l t o n,
L.
N.
9mith, and A.
W.
Shiver, " Evaluation of Severe Accident Risks:
Peach Bottom Unit II,"
NUREC/CR-4551, BAND 86-1309, Volume 4 Revision 1, Part 1, Sandia National Laboratories, Atbuquerque, NM, December 1990.
4-46
Distribution Jan;es Abel Cunono..senith Edison Co.
35 1st. National West Ch i e r. go, IL 60690 Kiyoharu Abe Car'rtment of Reactor Sately a,e a r c h NL. lear Safety Research Cettter Tokai Research Establir.hment JAERI Toka1 inura, llaga gun Ibaraf1 ken, JAPAN Bharat B. Agrawal 4
USNRC RES/PRAh 11 5 : NLS-372 J. Alman Commonwenith Edison Co.
LaSalle County Station RR1, Box 22 2601 North st Rd.
Marsielles, lu 61341 w
George Apontolakis UCIA Bonitor llall, Room 5S32 1.os Angeles, CA 90024 Vladimar Asmolov llead, Nuclear Safety Department 1, V, Kurchatov Institute of Atomic Enegry Mosec,a, 123182 U.S.S.R.
Patrick V.
Baranowsky USNRC AEOD/TPAB MS:
9112 Robert A. lia rl Brookhaven N *t ional 1,aborat orles Building 130 Upton, NY 11973 Richard J.
Barrett CSNRC-NRR/i'D3 2 a
hS:
13 D1 b
P Dist 1
Willi.am D. Beckner USNRC-NRR/PRAB MS:
10 E4 Dennis Bicy Pickard, lowe 6 Garrick 2260 University Drive Newport Beach, CA 92660 Gary Boyd Safety 6 Reliability Optimization Services 9724 r:Ingston Pike, Suite 102 Knoxville, TN 37922 Robert J. Budnit s-Future Resources Associates 734 Alameda Berkeley, CA 94707 Gary R. Burdick USNRC-RES/RPSIB MS: NLS 314 Arthur J. Buslik USNRC RES/PRAB MS: N1.S-372 Annick Carnit,a Electricite de France 32 Rue de Mc.); eau 8FJ1E Paris, F5008 FRANCE S. Chakraborty Radiation Protection Section Div. De La Securite Des Inst. Nuc.
5303 Vurenlingen SWITZERIAND Michael Corradini University of Wisconsin 1500 Johnson Drive Madison, WI 53706 George Crane 1570 E. Ilobble Creek Dr.
Springville, Utah 84663 Mark A. Cunningham USNRC-RES/PRAB PS:
NLS - 37 2 Dist-2
G. Diederick Commonwealth Edison Co.
LaSalle County Station RR1, Box 220 2601 11 orth 21st Rd.
Marstelles, IL 61341 Mary T. Drouin Science Applications International Corporation 2109 Air Park Road S.E.
Albuquerque, 11M 87106 Adel A. El Bassioni USNRC-NRR/PRAB MS:
10 E4 Robert Elliott USNRC-NRR/PD3-2 MS: 13 D1 Farouk Eltawila UStiRC RES/AEB MS: N!JJ-344 John 11. Flack USNRC-RES/SAIB MS: NLS-324 Rarl Fleming Pickard, Lowe & Garrick 2260 University Drive Newport Beach, CA 92660 James C. Glynn USNRC-RES/PRAB MS: NLS-372 T. llammerich Commonwenith Edison Co.
LaSalle County Station RR1, Box 220 2601 North 21st Rd.
Maralelles, IL 61341 Robert A. Itasse USNRC RGN-III MS:
Rill i
Dist-3
Sharif lieger UNM Chemical and Nuclear Engineering Department Farris Engineering Room 209 Albuquerque, NM 87131 P. M. lierttrich Federal Ministry for t.he Environment, Preservation of Nature and Reactor Safety llusarenstrasse 30 Postfach 120629 D-5300 Bonn 1 FEDERAL. REPUBLIC OF CERMANY S. liir chberg Department of Nucicar Energy Division of Nuclear Safety International Atomic Energy Agency Wagramerstrasse 5, P.O.
Box 100 A 1400 Vienna AUSTRIA M. Dean llouston USNRC-ACRS MS: P-315 Alejandro lluerta-Bahena National Commisnion on Nuclear Safety and Safeguards (CNSNS)
Insurgentes Sur N.
1776 C. P. 04230 Mexico, D.
F.
MEXTCO Peter !!umphreys US Atomic Energy Autt -ity Wigshaw Lane, Culcheth Warrington, Cher. hire UNITED KINCDOM, VA3 4NE W. lluntington I
Commonwealth Edison Co.
LaSalle County Station RR1, Box 220 2601 N( rth 21st Rd.
Marstelles, 11 61341 Dist-4
Brian Ives UNC Nucicar Industries P. O. Box 490 Richland, WA 99352 Williarn Kastenberg UCiA Boeiter llall, Room 5532 Los Anne.cs, CA 90024 Centge Klopp (10)
Conunonwealth Edison Corapany P.O. Box 767, Room 35W Chicago, IL 60690 Alan Kolaczkowski Science Applications Int. Corp.
2109 Air Park Rd. SE Albuquerque, MM 87106 Jim Kolanowski Commonwealth Edison Co.
35 1st National West Chicago, IL 60690 S.
Kondo Department of Nuclear Engi sering Pacility of Engineering University of Tokyo 3-1,liongo 7, Bunkyo-ku Tokyo JAPAN Jose A. IAntaron Cosejo de Suguridad Nuclear Sub. Analisis y Evaluaciones Justo Dorado, 11 28040 Madrid SPAIN Josette larchier-Boulanger Electricte de France Direction des Etudes Et Recherches 30, Rue de Condo 65006 Paris 111ANCE Dist-5 s
Librarian NUMARC/USCTA 1776 1 Street NW. Suite 400 Washington, DC 80006 Bo Liwnang 1AEA A 1400 Swedish Nuclear Power Inspectorate P.O. Box 27106 S-102 52 Stockholm SWEDEM Peter Lohnberg Expresswork International, Inc.
1740 Techno1cgy Dri e San Jose, CA 95110
~
Steven M. Long USNRC-NRR/PRAB MS: 10 E4 lierbert Massin Commonwealth Edison Co.
35 1st National West Chicago, IL 60690 Andrew S. McClytnont IT Delian Corporation 1340 Sarat oga-Sunnyvale Rd, suite 206 St.n Jose, CA 95129 Jor,e I, Calvo Molins 11ead, Division of P.S. A. and lluman Factors Consejo De Seguridad Nucicar Justo Dorado, 11 28040 Madrid SPAIN Joseph A. Murphy USNRC-RES/DSR MS:
NLS 007 Kenneth G. Murphy, Jr.
US Department of Energy 19901 Corinantowa Rd, Germantown, MD 20545 Dict-6
Robert L. Palla, Jr.
USNRC-NRR/PRAB MS: 10 E4 Gareth Parry NUS Corporation 910 Clopper Rd.
Gaithersburg, MD 20878 G.
Petrangeli ENEA Nuclear Energy ALT Disp Via V. Brancati, 48 00144 Rome ITALY Ing. Jose Antonio Becerra Pere:
Comision Nacional De Se6uridad Nuclear Y Salvaguardias Insurgentes Sur 1806 01030 Mexico, D. F.
MEXICO a
Villiam T. Pratt Brookhaven National Laboratory Building 130 Upton, NY 11973 William Raisin NUr1 ARC 1726 M. St. NW Suite 904 Washington, DC 20036 D. M. Rasmuson USNRC RES/SAIB MS:
NLS-372 John N. Ridgely USNRC RES/SAIB MS:
NLS-324 Richard C. Robinson Jr.
USNRC-RES/PRAB MS: NLS - 372 Denwood F. Ross USNRC AEOD MS: 3701 4
Dist-7
Christopher P, Ryder [10]
USNRC+RES/PRAS MS: NLS 372 Takashi Sato Deputy Manager Nucicar Safety Engineering Section Reactor Design Engineering Dept.
Nuclear Energy Group Toshiba Corporation Isogo Engineering Center
- 8. Shinsugita-cho, f r.ogo-ku,
Yokohama 235, JAPi.N Martin Sattison Idaho Nationni Engineering Lah.
P O. Box 1625 Idaho Falls, ID B3415 Louis M. Shotkin USNRC-RES/RPSB MS: Nill-353 Desmond Stack Los Alamos National Laborat ory Group 0 6, liail Stop K556 Los Alamos, NM 87543 T. G. Theofanous University of California, S. B.
Department of Chemical and Nuclear Engl.neering Santa Barbara, CA 93106 Itarold VanderMolen USNRC-RES/PRAB MS:
NLS-372 Magiel F. Versteeg Ministry of Social Affairs and Employment P.O.
Box 90804 2509 IN Den llaag Tile NETilERIANDS Edward Varman g
Stone & Vebster Engineerlag Corp.
P.O. Box 2325 Boston, MA 02107 Dist 8
Volfgang Werner Gesellschaft Fur Reaktorsicherheit Forschung,gelande D 8046 Cs:ching FEDERAL nEPUBLIC OF GERMANY 3141 S. A. Landenberger [5]
3151 G. L. Esch 6321 T. A. Wheeler 6400 N. R. Ortiz 6410 D. A. Dahlgren 6411 D. D. Carlson 6411 D. M, Kunsman 6411 R. J. Breeding 6411 K. J. Haloney 6412 A. L. Camp 6412 S.
L. Daniel 6412 S. E. Dingman 6412 B. D. Staple 6412 G. D. Vyss 6412 A. C. Payne, Jr. [25) 6412 D. W. Whitehead 6413 F. T. liarper 6413 T. D. Brown 6419 M. P. Bohn j
6419 J. A. Lambright 8524 J. A. Vackerly p
O D i r. t - 9
U $. NUCit A RI gut A10H v COMYil$10N 1 H Mik 7,ivv t t 64 NRC C49 Db L%ba
- LOY.',,,^0,*Th.',*r" '"
muu BlDLIOGRAPHIC DATA SHEET NUREG/CR-4832
<su,w :,ww r e,.. w,,1 SAND'?-0537 r nitt eou suun at yg), 3 Analysis of the LaSalle Unit 2 Nuclear Power Plant:
3 D ^" ""m NM-m Risk Methods Integration and Evaluation Program (RMIEP) j
, w..
Summary
_ July 1992 4 hN OH GRANI NWPt A A1386 E AUT HOH($l p p q pppgegp1 Technical A. C. Payne,Jr.
i et nuo cuw t a t p % -, e,.,
""".l,'%*,",2,t,""""~'"'"'"**"'"'""~"*"'""~'"'""*'*"'"""""##~'~"'"*"'""
Sandia National Laboratories Albuquerque, NM 87185
~
i svOuson ma ora Ana A,,os - u Aut Auv nor>n n t,s n< ~ec.,o, m-....e.v.,
,,, n-..
,c v v.
s e c v.,.v-vvv. - e.,, v s n., n., 8.wv, e.~
,w.-
,,,-,.ao m i Divinion of Safety Issue Resolution office of Nuclear Regulatory Research US Nuclear Regulatory Conunission Washington. DC 20555 10 $UPPLE VE NT ARY NOf tS T L A B'i1 R AC T IM wo,,9 u, mar This volume p re i.e nt s an overview of the methodolor,y and results of the integrated accident sequence analysis (Level I) of the LaSalle Unit 2.
nuclear power plant performed as part of the Level III PRA performed by Sandia National Laboratories for the Nuclear Regulatory Commission.
The 1.evel II/III results are presented in associated reports described in the Foreword.
This voltune contains a summary description of the LaSalle plant, describes the contents of the other nine volumes of this report and their relationships to each other, the relationship of the LaSalle program to step-by-step summary description of the methodology and other programs, a new techniques used to perform the analysis, and presents the integrated renuits obtained by merging all of the roccident sequence cut sets from the LOCA, transient, transient induced 14CAs, and anticipated accidents without j
scram accident sequences resulting f rom internal initiators with the cut-sets from the fire, flood, and seismic analyses acci, nt sequences.
o., m %u n s u. w, i a n v wu s v3 0 t sr.w m o s m, ~.,,,, -...
m.,
.,..u-,mm..o w,,,....,,,,oy,
Unlimited Probabilistic Risk Assessment (PRA)
Risk Methods integration and Evaluation Prorgam (RMIEP)
" " " ' ~ '
LaSalle Unit 2 Nuclear Power Plant Unclassified ___
Le el i
- w.. -
Uaclaselfled Y5 NUYHi.e OF OAGE S i t' EkiLL
%c %. us u,,
THIS DOCUMENT WAS PRINTED USING RECYCLED PAPER
i UNITED STATES s <ciat rounrw ctasa nATe l
POSTAGE ANO FFES PAID l
NUCLEAR REGULATORY COMMISSION "C
WASHINGTON. D.C. 20555-0001 PERWT NO G 67 Of F:CIAL BUS; NESS PEN A.LTY F CR PR4 VAT E USE. 5300 I.' O 5 t;f 1 5 a r,,
vg
,7 :
" ! *J rk'? 5Y' i
lar,,.
~
Yp
_ _I-v p
g,,
- ~*'?
['~2],
,zcy"LlC'TI'=
- 3 N r ; y,,,
T '/ r g Y,&
R 1
l 1
i l
l l
i l
l l
l
,