ML20105C817
| ML20105C817 | |
| Person / Time | |
|---|---|
| Site: | LaSalle  |
| Issue date: | 08/31/1992 |
| From: | Susan Daniel, Dingman S, Payne A, Shaffer C, Sype T, Whitehead D SANDIA NATIONAL LABORATORIES |
| To: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| CON-FIN-A-1386 NUREG-CR-4832, NUREG-CR-4832-V03-P1, NUREG-CR-4832-V3-P1, SAND92-0537, SAND92-537, NUDOCS 9209220470 | |
| Download: ML20105C817 (161) | |
Text
{{#Wiki_filter:- N U REG /CR-IS32 S A N D92-0537 Vol. 3, Par I
=_ ~ -
_ =; ; Ana vsis o ~ 17e LaSa se U ni 2 Nuc ear Power P an~:: Risk Me:locs in:eora: b ion anc
'm . ,r 2Va Ua11on -)rografn @77Mgi2 v ,,I )
lillCIIMll [iVCillS }\CCillCll! SCtlllCllCC Ollaillil'ICilliOll Main Report
. = - - -_ _ .
_ .;.- :. w _ _ - , _ _ _ _ _ g _ _ :- = - =y _ 19 e p.u ni i n A.(' l u nc. it. 51 1).uoet i t W W h a c h ca..). I l Sy pt , S i Du , un ( ) . M .i' n Santtia National 1.at> oratories ()petated l9 SanJia ('oipot atnin Pr epared for l'.S. Nin 'ar llegulatory ('ottintiwion 9209220470 920831 PDR ADOCK 0D000374 g PDR
~~~a ~ .. ~ ~ ~ - , . - - . - - - - - - - ~ . - - . . - _
- s.
I i , I l AVAILABILITY NOTICE i AvaMMy of Refmence Malen&s Ctted in NRC N%cchons f Most cocumente cited h NRO pubhcations wi!! be ava!!able from one of the following sources:
- 1. The NHC PuMc Document Room, 2120 L Street. NW. , Lower Level, Wasnington, DC 20555
- 2. The Sapenntendent of Documents. U S Government Prhting Office. P C Box 37082. Washington.
l DC 20013 7082 l 3 The NationM T echruca) Information Servic e, Springfm!d VA 22161 AhhougS the bsting that to!!ows rop esents the majonty of documents crted in NRC pubHcations, it is not etenced to be exhaustive Referenced documents asahanie fx incpecuon and copying for a fee from the NRC Pubnc Docurrtnt Room eclude NRC correspondence and internat NRC memoranda. NRC bubettna cecutars, informaDon noutes, hwect#ori and irwestigation notices; hcensee event reports ; v&ndar r eports and correspondence Commm Sion papers; and apphcant and lcensee documents and corresf ondence The fMomg documents in thn NUREG scruis a e avadabie 'or purchase from the GPO Sa!os Program. formM NRC staff and contractor reports NRC-sponsored conference oroceodtngs. Internabonal agreement reports, grant pubacations. and NRC tacebeu and brochures /uso avadabic are regulatory guides, NRC regulatans sn tne Code et f ecers: Rega tan. ana Nuww Reguatcry con e asvan issmcu Leocuments aval:3bie from the Nauorsal Techneca! inf ormapon serv;ce include NUREG-senes reports and technica! reports prepared by other Feoerat agencies and reports prepved by tne Atomic Energy Comm:s-s,on forerunner agency to the Nuclear Ac;patory Commission. Documents avanablc Pom pubhc and speciat techo.cM btvu include an open hierature ttoms, such as r eger3! peg 3% no. re3. Fedrra! and Stato loga:ation, srd con. books purna: artic'es. and transa: tans. gr enanal reports can usua% be obtai ed from thete hbranes Dc:vments such as theses . graes ,a 2ns f orem reports ana transbuens ard non NAC confer 6 ,e pro-cend ngs ar e avManic f:e poi,9 awe Pcn; tu orge raten spensorir; the puMcat>on oted Scy o cep+s of NRC drah repwh aN awacie free. to the eMont of e.upp uOon written request 10 tre Of f,ce of Admin:stration Dww :n and MS Services 6: ton UJ Nxim Re;;um! cry Commasian, Washmgton, DC 20555 Cocnes et incuau y coces ed staurcs used in a substanum manner to the NRC rega!atory process aN mutaned at the NRC L6eary, N20 Nortc5 benue, Betr+sa. Marydnd. fu use by the pubG . Cocres and standards are usua3y coo >r@ tea and map t>e parchasea f*om the orge astng organizauon cr, if tht:y are Amentan N,mnx St ana cs _ from t% Amener hatiena! Standards inv t 1.no 100 Orcadway New You
- NY 10016 L _ . _ _
o l DISCLAIMER NOTICE r Tnis re;mrt wa gnowod a an acccant of waA sponsced by an apncy o' the Unitcd Sums Gownment l' Neither the Unsc Simos Government nor any ayr'cy ner eat or any of the r emp,oyem mens any warranty, wme mmowa or assows any aca: i,anaty or recgveoaty fo< any tmra pany's use or ine eaus of NCh UML Of any inWr*Mt Ort npsWD!ul prDdit Or pWX:E5 Ch5CIO5Dd in IM f jNXM. Or f tyMenM that in use by 5;K:n It"rd party wouV not tri nge priv3M!y Of wi!ight
~ - - . . ~_ -
~
NUREG/CR-4832 SAND 92-0537 Vol. 3, Part 1 RX Analysis of the .LaSalle Unit 2 Nuclear Power Plant: Risk Methods Integration and Evaluation Program (.R MIEP) i Internal Events Accident Sequence Quantification Main Report i Manuscript Completed: June 1992 Date Published; August 1992 l'repared by A. C. Payne, Jr., S. I Daniel,11 W, W; tchead, T. T. Sype, S. ii. Ihngman, C. J. Shaffer Sandia :ational laboratories Albuquerque, NM 87185 Prepared for Division of Safety Issue Resolution
- Oflice of Nuclear Regulatory Research U.S. Nuclear Regulatpg Commission
~
Washington, DC . 9m NRC FIN A1386
i i } ABSTRACT This volume presents the methodology and results of the internal event accident sequence analysis of the LaSalle linit 11 nuclear power plant performed as part of the Levei Ill Probabilistic Risk Assessment being performed by Sandia National Laboratories for the Nuclear br,ulatory Co unis si on. This report describes the new techniques developed to solve the very large and logically complicated fanit trees developed in the roodeling of
- the LaSalle systems, for evaluating the lar&c number of cut sets in the accident sequences, for the application of recovery actions to the o cut i sets, and f or the evaluat.lon of the ef fects of containment failure on the systems and the resolution of core vulnerabic accident sequences.
The 1DCA, transient, transient induced IDCAs, and anticipated accidents without scram accidents resulting frorn internal initiators are evaluated and the final dominant accident sequences are determined. Integrated ; results are obtained by merging all of the accident sequences' cut sets ! together and evaluating the resulting expression. Integrated risk reduction, risk _i nc re as e , and uncertainty importance mersures are obtained. Also, an overall ranking of the dominant cut sets is obtained. The total internal core damago f requency has a incan valve of 4.41E-05/R-yr. with a 5th percentile of 2.05E 6/R-yr., a median value of 1.64E 05/R. yr., and a 95th percentile of 1.39E 04/R yr. The dominant cut sets all involve loss of the emergency core c oling systems (ECCS) as a result of , common mode failure of the diesel generator cooling water pumps which > results ir, delayed failure of the ECCS injection systems and control -rod drive and either a complete losa of offsite power resulting in a short or long term station blackout accident (depending on the status of the reactor core isolation cooling system, RCIC) or a loss of train A AC or DC power resulting in a loss of feedwater control and closure of one set of the main steam isolation ives. The events most ir port . to risk reduction are: the frequency of loss of offsite power, the noi recovery of offsite power within one hour, the diesel cool! water pump common mode failure, and the ncn recoverable isolation of RCIC during station blackouts. The events most important to risk increase are: the failure of various AC power circuit breakers resulting in part' al loss of onsite AC power, the failure to scram, and the diesel genera ,r cooling water pump random failure rite (determines the magnitude of t% common mode contribution). The domintnt contributors to unc e r t t.i n ty are: the uncertainty in control circuit failure rates, tne unc e: t a '.nty in rt lay coil failure to energize, the uncertainty in enetgized relay coils failing dectiergized, the uncertainty in the-lost of- of fsit e power ircquency, and the uncertainty in diesel generator failure to start.
-lii/iv.
. ,ww...w- ~ ,w,,-w, ,, v v w n m,-.,w,,,--.,,,,,,-e-_,m-,,......, ~,
, _ - . . - . . - . . ~ . _ - . . - . - _ _ - . . . . - . = . - - - . - .. -- - -. - - - . . .
11 TABLE OF CONTENTS Section hgg ABSTRACT................ .. ......................... ............, iii LIST OF FIGURES..... . ..................... ....... . . . . . . . . . . . . . . . ix l LIST Oi' TABLES. ................. ................................ xi , FOREW0RD.............................................. ............ xiii l 1 l 1.0 Introduction... . .. ......................................... 1 1 1.1 Le ve l o f Model ing de t a i1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 2.0 Overview of Methodology......... . . . . . . . . . . ..................,2 1 l 2.1 Description of Steps Used to Determine Core Damage Frequency... .... ....<........... . . . ... . . . . . . . . . . . . . . .2 1 2.2 References................ . . . . . . . . . . . . .................. 2 2 3.0 Fault Tree Solution Methods................. ............. .. ,3-1 i 4 3.1 Development of Individual Sys tem Solutions . . . . . . . . . . . . . . . 3 1 3.2 Merging Fault Trees...................................... 3 1 3.3 Development of Independent Subtrees...................... 3 6 3.4 Solving for System Fault Tree Minimal Cut Sets........... 36 T 3.5 References..... ...... . . . ..... . . . . . . .................. 3 11 4.0 Computation of Sequences............... . . . . .................. 4 1 4.1 Common Term Remova1.......................... . . . . . . . . . . .4 1 4.2 Separation Into l' arts Based on Number if Literals........ 4-2 4.3 Separation Into Parts Based on Truncation by Probability. 4-2 4.4 Grouping., , ................................... . . . . . . . .4-3 4.5 Intermediato Inclusion of System Success States.......... 43
- v-i
.-4-- __ _ _ __ ___.___ .--.._....s# , _ _ , _ . _ . . ,,.%o.%..,,A-me, .,4,, ,,.,,.,, _ _ , .%m,me.m m .. ...,_,,,..y,, ,,. c.,- 3 p...g.,, .,._,,ww.-yy.~.w,,.,4
l l l TABl.E Or CONTENTS (Continued) Strtion Eage i 1 4.6 Solution of Sequences............... ........ ........... 4 4 4.6.1 1.0CA Sequences................. .............. ..... 4 4 4.6.2 Transient Induced LDCA Sequences . . . . . . . . .. ..... .... 4 7 4.6.3 Transient Sequences................... .... . ..... 4-11 4.6.9 Anticipated Transients Without Scram... ............ 4 14 4.7 References............................................... 4 17 5.0 Operator Recovery Actions..... ........ ......... ..... . . . . . . 5_- 1 : ; 5.1 Application of the Recovery Methodology. . . . ............. 5 2 5.1.1 Identification of Possible Recovery Actionis...... ..54 - 5.1.2 Application of Recovery Actions to Cut Sets..,...... 5-6 5.1.3 Obt ain Estirriate for Recovery Action. . . . . . . . . . . . .... 5 12 ' 5.1.3.1 Diagnosis Phase Estirnate.. ............ ...... 5-12 5.1.3.1.1 Identification of Group Which Best Describes Recovery Action. . . . . . . . . . . . . 5 12 5.1.3,1,2 Estima . ng Time Tn....................... 5 16 5.1.3.1.3 Determination of Ta... .................. 5-16
$.1.3.1.4 Estimate Time Available to Diagnose the Recovery Action. To.. ........... ...... 5 16 5.1.3.1.5 Es*Imate Failure Probability for ,
Diagnosis Phase P(ND) at 7o.......... .. 5-16 5.1.3.2 Estimate thri Failute Probability for tho Action Phase. P(NA)......................, .,5 21 5.1.3.3 Estimato the Total Talluro Probability for a I Recovery Action, P(NR).......... . ......... 5 21 e 5.2 Sampic Calculation................... ..... ..............$32 , 5.3 Recovery Actions for LaSalle..... ...... ....... ... .. 5-27 5.4 References.., ... . . . . ............................. ... 5-27 6.0 Resolution of Coro Vulnerable Accident Sequences....... ...... 6 1 6.1 Introductton. ........................................... 6 1
- 6.2 Description of Steps in Core Vulnerable Sequence Resolution..... ... , . ..... . . ... .. ... .... ,,.. ...62 6.2.1 Step 1
- Define Core Vulnerable Sequences., ...... ..,6-2 6.2.2 Step 2: Determine Containment Failure Modes.. ..... . 3 -
-vi-l
. , , _ - _ _ - _ . - ..~..-_.-_..__..am .,.,-~.-,_.--,.-.-__...a___.__--...----__,.,.____.__
- . ~ - . - . , ~ . - - . - - - - - . - - . . - - ~ . - - - - - . _ - . - - . - - . - . .
I a
)
i TAl,LE OF CONTENTS (Concluded) i Seetion Eggg, 6,2.3 Step 3: Evaluate the Reactor Building Envirotunents. . 6 4 6.2.3.1 Reactor Bui.1 ding Model Description. .......... 6 5 6.2.3.2 Results of Analysis............................( 7 6.2.3.3 Model Limitations............................. 6 16 6.2.3.4 Conclusions................................... 6-17 l 6.2.4 Step 4: Evaluate Equipment Failure Probabilities.... 6-18 6.2.5 Step 5: Construct Simplified System Models.......... 6 18 6.2.6 Step 6: Resolve Core Vulnerable Sequences........... 6 45 6.3 Conclusions..... . ..... ................................ 6 45 g 6.4 Interface With Level 11/III Analysis. ................... 6 46 i 6.5 References...............................................646 7.0 Rouults of the Internal Events Analysis....................... 7-1 7.1 Dominant Sequences., .................................... 7 1 7.2 Dominant Cut Sets for Integrated Evaluation.............. 7-7 ' f 7.3 Importance Analysis Results.... ......................... 7 10 7 3.1 Risk Reduction............... ...................... 7 10 7.3.2 Risk Increase.............,......................... . 7 13 7.3.3 Uncertainty Importance......... .................... 7-15 , 7.4 Insights and Conclusions.......... ...................... 7 19 7.5 References.. ......... ........................ ........ 7 20 1 AppenMx A Integrated and Individual Accident Sequence Results....A 1 Appent.ix B Description of Dominant Basic Events. . . .......... ....B-1 Appendix C Containment Failure Mode E11 citation...................C-1 1 0
-vii. - - - , - - -. - . .--a , - . -.-,-.- - . . , - . - - --
a LIST Of FIGURES 7 f1Clut lillt f1tEt 3.1 Exartpl e Fault Tree logic loop Resolution. . . . . .3-5 4.1 1.aSalle LOCA Event Tree. . . .. . . . . . . .. 4-5 4.2 LaSalle Transient Event' Tree . . . . ... . . .4-10 4.3 LaSalle ATWS Event Tree . . . .. .. . .4 15 5.1 Recovery Methodology Flow Chart. . .. . .. . . .5-3 5.2 IIRA Event Tree f or Exartple Application. . .. .. . . . 5-26 6.1 Sys tern Failure Resolution. . .. . .. .. 6 3 , 6.2 MEILOR Noda11 ration for Reactor Building Model.. . . .6-6 6.3 Reattor Ba11 ding Preesures for 4" Drywell Broak...... . .6 9 6.4 Reactor Building Temperatures for 4" Drywell Break.. ... 6 10 6.5 Reactor Building Pressures for 36" Drywell Break. .6-11 6.6 Reactor Building Temperatures for 36" Drywell fireak. .. 6-12 6.7 React or liullding Temperatures for Wetwell Venting. . .6 13
-tx-
. - . - . - _ - . ~ - - - - - . ~ - - . - _ . _ _ - - . - -
7-..----- _ a i i-i 1 4 LIST OF TABLES L Table hu i ! 3.1 Fault Tree Segments Developed for the LaSalle Analysis.. 3 2 l 3.2- Size of Mer6ed Front Line System Solut.lons.............. 3-10 - 4.1 Transformation Equations for Initiators and Flags in ' LOCA Sequence Evaluation............................... 4 8 4.2 Value Block Changes for LOCA Sequence Evaluation........ 4 9 4 4.3 Transformation Equations for Transient Induced IhCA i S e q u e n c e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 - 12 4.4 Value Block Changes for Transient Sequences............. 4 13 1 4.5 Value Block Changes for ATWS Sequences.................. 4 18' 5.1 Recovery Actions from Event Trees and Fault Trees....... 5 5 5.2 Sample VOT With Recoverable Basic Events Identified..... 5 7 5.3 Basic Events Which Were Categorized as RA-1 Type .ictions..i 8 5.4 Basic Events Which Were Categorized as RA 2 Type Actions.5 9 5.5 Basic Events Which Were Categorized as RA 8 Type Actions.5 10 5.6 Basic Events Which Were Categorized as RA-9 Type Actions.5 10 5.7 Basic Events Which Were Categorized as RA 15 Type , Actions. . . . . . . . . . ....... ...... . . . . . . . . . . . . . . . . . . . . . . . 5 10 5.8 Recovery Actions Identified After Examining the Cut Sets.5 11 5.9 Summary of Ten Croups of Crew Recovery Actions....... . . . 5 13 -f 5.10 Description of Recovery Actions Based Upon Examination of Croup' Descriptions in Table 5.9..................... 5 14 5.11 Estimates for Tn Resulting from Thermal Hydraulic Calculations........................................... 5 17 5.17 T4 for Various Classes of Actions....................... 5-19 5.13 Potential Diagnosis Times............................... 5 20-5.14 Croup 11. Parameter Estimates from Fit of Lognormal' Fu 1 c t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2 3 5.15 Recovery Actions In LaSalle PRA.................. ...... 5-28 6.1 Marginal Failure Probabilities.......................... 6 4 6.2 Base Cases' Temperatures (K)... . . . . . . . . . . . . . . . . . . . . . . . . , 6-14 6.3 Sensitivity cases' Temperatures (K)..................... 6 15 6.4 Sample Severe Environment Evaluation for CRD_ System..... 6 19 6.Sa Quantification for Leaks.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 20 6.5b Quantification for Ruptures,............... . . . . . . . . . . . . . 6 22 6.5c Quantificaticn for Venting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-24 6.6 Summary of Severe Environments.......... . . . . . . . . . . . .. . . . 6 26 6.7 Final Collapsed List of Severe Environments............. 6 27 6.8 -- System Models...... .. . .. . . . . . . . .. . . . . . . . . . . . . . . . . . . . . 6 29-6.9a Basic Event-Name of Survival Question for Containment Leak Sequences.... ....................................;6-37 s-i xi-
--%' 4m-ee ,,u.--sr-1 g., .--. 4-a,9eni--pe.-- .e een g - yyve w -- p grw-r1e,w-- --.9++p y ,w go w-ia,-yw,,g,.,.g,9,,.y-,,.pgmw-- -p.y 9 g --y-o,..y q g-. .y yw ,y-pm--prq+-%we,-'.gpgmy,,%p--my-ym-,y,ye-e
LIST OF TABLES (Concluded) 10ble . . . . .. .
. . . l'DLt 6.9b Basic Event Narr e of Survival Question f or Containment Venting Sequences. . . . . . . .. . .6-38 6.9c Basic Event Na tte of Survival Question for Containment Rupture Sequences. . . . . .6-39 6.9d Basic Event Name of Survival Question for Containment Failure in ATVS Sequences. . . . . .... . ... . .6 40 6.lua Failure Equations for Survival Events for 1.caks. ... 6-41 6.10b Failure Equations f or Survival Event *, for Ruptures, . .6-42 6.10c Failure Equations for Survival Events for Venting . .6 43 6.10d Failure Equations for Survival Events for ATWS.. . . . . 6 64 1.1 1._Salle Final Sequence Core Damage Statistics: Internal Events . . . .7-2 7.2 Internal Eventn Total Plant Run: Cut Sets. . .. .7 8 /.3 Internal Events Total Plant Run: Risk Reductlon by B a r. i c Event (Wit.h Associat ed Unce rt aint y Ir tervals) . . .7-11 7.4 Internal Events Total Plant Run: Risk Increase by Basic Event (With Associated Uncertainty Intervals). .7-14
- 1. ') Internal Events Total Plant Run: Uncert aint y import ance by Basic Event . . . . .7-16 9
v
/
-xii-
. ~ . - . - - - - . _ - - - - - _ - . . - _ - - - . . ,
!OREVORD LaSalle Unit 2 Level Ill Probabilistic Risk Assessinent 1
e In recent years, applications of Probabilistic Risk Assessment (PRA) to nuclear power plants have experienced increasing acceptance and use, particularly in addressing regulatory issues. Although progress on the TRA front has been impressive, the usage of PRA methods and insights to address increasingly broader regulatory issues has resulted in the need for continued improvement in and expansion of PRA methods to support the needs of the Nuclear Regulatory Commission (NRC), liefore any new PRA methods can be considered suitable for routine use in the regulatory arena, they need to be integrated into the overall framework 01 a PRA, appropriate interfaces defined, and the utility of the methods evaluated. The LaSalle Unit 2 Level 111 PRA, descril>cd in ' ti=1: :.,4 as soc iat ed repor t s , integrates new methodn and new applications cf previous methods into a PRA framework that provides for this Integration and evaluation. It helps lay the bases for both the routine use of the methods and the preparation of procedures that vill provide guidance for future PRAs used in addressing regulatory issues. These new methods, once integrated into the f ramework of a PRA and evaluat ed, Icad to a more complete PRA analysis, a better understanding of the uncertainties in PRA results, and broader insights into the importance of plant design and operational characteristics to public risk. . In order to satisfy the needs described above, the LaSalle Unit 2, Level 111 PRA addresses the following brand object.1ves:
- 1. To develop and apply methods to integrate internal, external, and dependent failure risk methods to achieve greater efficiency, consistency, and corrpleteness in the conduct of risk assessments; 4
- 2. To evaluate PRA technology developments and formulate improved PRA procedures;
- 3. To identify, evaluate, and effectively display the uncertainties in PRA risk predictions that stem from limitati0ns in plant modeling, PRA methods, data, or physical processes that occur during the evolution of a severe accident,;
- 4. To conduct a PRA on a B's 5 , Mark II nuclear power plant, ,
ascertain the plant's dominant accident sequences, evaluate the core and containment response to accidents, calculate the consequences of the accidents, and assess overall risk; and 4 finally
- 5. To formulate the results in such a manner as to allow the PRA to be easily updated and to allow testin;; of future improvements in methodology, data, and the treatment of phenomena.
-xiii-
<s___-____ . .
-.-, --.,~.m.....--...-~...._,.w4w,,y...~my., ,,,,,,,,.y,.,,n.w.,m, . , , _ ,,y , , , , . , , , , .- - , _ , , , . . ,
t The LaSalle Unit 2 Pita was performed for the NRC by Sandla National Laboratories (SNL) with subst antial help f rom Commonwealth Edison (CECO) and its contractors. Because of the size and scope of the PRA, various related programs were set up to conduct dif ferent aspects of the analysis. Additionally, existing programs had tasks added to perform some analyses for the LaSalle PRA. The responnihility for overall , , direction of the PRA was assigned to the Risk Met hods Integration and ) Evaluat ion Program (RMIEP). RMIEP was specifically responsible for all ~ aspects of the 1,e ve l 1 analysis (i.e , the core damage analysis)4
. The Phenomenology and Risk Unce rt a i nt y Evaluation Program (PRUEP) was responsible for the i.e ve l 11/111 analysis (i.e., accident progression, source term, consequence analyses, and risk integration). Other programs !
provided t.upport in various areau or perf ormed some of t he suhar.a l yse s . *
- These programs include the Sciamic Safety Margins Research Po gram (SSMRP) at Lawrence Livermore Nat ional Laborat ory (LLNh), which performed the seismic analysis; the Integrated Dependent Failure Analysis Piogram, which developed methods aiul analyzed data f or dependent failure modeling; the MELCOR Program, which modified the MELCOR code in response to the PRA'a modeling needs; the Fire Research Program, which performed the fire analysis; the PRA Methods Developrnent Program, which developed some of the new methods used in the PRA; and the Data Programs, which provided new and updated dat a f or BWR plant r. shnliar to LaSalle. CECO provided ,
plant design and operational information and reviewed many of the analynin results. The LaSalle PRA was begun before the NUREG-1150 analysis and the LaSalle program has supplled the NUREC I150 program with simpiifled location analysis met hods for integrated analysis of external events, insights on pon t hl e subtle interactions that come from the very detailed system mode 1 s -used in the LaSa11e PRA, core vulnerahle sequence resolution methods, methodu f or handling and propagat ing stat istical uncertainties in an integrated way through the ent ire analynic, and BWR thermat-hydraulic moal s which were adapted for the Peach Bottom and Grand Gulf analyses. 1 The Level 1 results of the 1,a S a l l e Unit ? PRA are present ed in:
" Analysis of the LaSalle Unit 2 Nuclear Pewer Plant: Risk Methodu
!ntegrat ion and Evaluat ion Program (RMIEP)," NUREC/CR 4832, SAND 92-0537, ten volumen. The reports ate organized au follows:
NUREG/CR 4832 Volume 1: Summary Report. NUREC/CR-4832 - Volume 2: Integrated Quantification and Uncertainty Analysts. NUREG/CR-4832 - Volume 3: Internal Events Accident Sequence Quant i ficat lon. NUREC/CR-4832 - Volume 4: Initiating Events and Accident Sequence Delinentlon. 3 xiv- _.~ . _ _ . - _ . _ . _ - _-_-.__ _, _ _ ._. _. __~ ., , -
[ i i I NUREC/CR-4832 - Volunc 5: Parameter Estimation Analysis and lluman ! Reliability Screening Analysis. j i NUREG/CPr4832 - Volume 6: System Descriptions and Fault 'Iree f De '. i n i t '.on . NUREG/CR 4 U2 Volume 7: External Event Scoping Quantification. NPREG/('R 4832 - Volwt e 8: Selt.ric Analystr. NUREG/CR-4832 Volume 9: Internal Fire Analysis, j NUREG/CR-4832 - Volume 10: Internal Flood Analysis. i The Level 11/111 tesults o 'he LaSalle Unit 2 PRA are presented in: .
" Integrated Risk Assessment For the LaSalle Unit 2 Nuclear Power Plant: ,
Phenomenology and Risk Uncertainty Evaluation Program (PRUEP)," NUREG/CR- !
$305, SAND 90-2765, 3 volumes. The reports are organfred as follows; i NUREG/CR 5305 - Volume 1: Main Report NUREG/CR-5305 Volume 2: Appendices A-C tiUREG/CR 5305 Volume 3: MELCOP Code Calculations Important associated reports havo been issued by the RMIEP Methods Development Program in: NUREG/CR-4834, Reconcry Actions in PRA for the Risk Methods Int egration and Evaluation Program (RMIEP); NUREG/CR 4335, Comparison and Application of Quantitative Human Reliability Analysis Methods for the Risk Methods Integration and Evaluation Program (RMIEP);
NUREG/CR 4836, Approaches to Uncertainty Analyr.12 in Probabilistic Risk Assessment; NEREG/CR 4838, Microcomputer Applications and Modifications " to the hndular Fault Trees; and NUREG/CR-4840, Procedures for the External Event Core Damage Frequency Analysis for NUREG-1150. Some of the computer codes, expert judgement clicitations, and other supporting informatton used in this analysis are documented in associated reports, including NUREG/CR 4586, User's Guide for a Personal-Computer-Based Nuclear Power Plant Fire Data Base; NUREC/CR-4598, A User's' Guide-for the Top Event Matrix At.alysis Code (TEMAC); NUREG/CR 5032, Modeling ' Time to Fecovery and Initiating Event Frequency for Loss of _ Off Site Power Incidents at Nuclear Power Plants; NUREC/CR-5088, Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including
- l. Previously Unaddressed Irsues; NUREC/GR 5174,-A_ Reference Manual for the
[ Event Progression Analysis Cute (EVNTRE); NUREG/CR-5253, PARTITION: A Program for Defining the Source Term / Consequence Analysis Interface in-the- NUREG-ll 50 Probabilistic Risk Assessments, User's Guide; NUREC/CH-5262, PRMIIS : Probabilistic Risk Assessment liodel Integration Sy' tem, User's Guide; NUREG/CR-5331, MELCOR Analysis for Accident Progression Issues; NUREG/CR-5346, Assessment of ths XSOR codes; and NUREG/CR-5380 A
-xv-i ; ,_. 4m.. -.- . . . - _ . -
. . . - _ , , , _ . . _ . .m.,___..-._.._---, _ . _ - - - . _ . _ - . 2 m._ _ _ . _ . . . _ . _ . . _ _ . , - - . _ ,
08er's Hanttal for the Poutprocessing Progema PSTl:VNT , I n add i t. uin the - render is directed to the NUR):G llSO technical support reports in NURI:G/CR 4550 and 4551. Atthur C. Payite , J r . i Principn1 Investigator Phenonienology atui Hisk Uncert ainty Evaluat ion Progrma and Risk Methods Integrat lon and Evaluation Program Diviolon 6412. Reactor Systems Safety Analysin ; Sandia National Laboratories i l Al buque rclue , New Mexico 8 71 H'i
-1 l
I e t 9 2
-xvi-n.. . . . - . . - . - , , . . . . . . - . - .......-._.-_-._:-..--.-..-__.---____.______-
. _ = ___ _ _ _
( ! l.0 1NTRODUCTION I i 1.1 Ley.e1. E .Eode11og Detall i 1 As part of the analysis of the core damage irequency from internal . initiators, the accident sequences defined for the pHA must be evaluated I and their irequencies calculated. This process can range from very easy to j extremely difficult depending on the level of detall of the analysis and the analysis tools available. For the haSalle Probabilistic Risk i Asseur, ment (PRA), the inclusion of external initiators on an equal footing ! with internal initiators required the expansion of the model to include i passive failures, diversion paths from spurious operation, additional
- components not usually modeled, and a greater level of detail in the fault tree modeling to accurately represent the effects of some of the external eVellt S ,
2 This additional level of detail required the use of the most powerful tools , 4 available and their exteesion by the development of new techniques to (1) { effectively include the additional level of detail in the system fault t trees, (2) include some information in the fault trees via transformation . equations, and (3) aid in the process of evaluating the accident sequences l in an efficient. and cour effect.ive manner. The description of the system modeling effort and of the development of the system fault t.r e e s is presented in Volume 6 of this report. The
- description of the techniques used to include location based information
, for the external event analyses in the fault tree model and the location i data bases and transformation equations are presented in Volumes 8, 9, and 10 of this report on the seismic, fire, and flood analyses respectively. i i This volume presents the method used to evaluate the very large fault trees '
, developed for the LaSalle pRA and the new solution techniques used in analyzing the accident sequences to obtain the core damage f requency from i 2
int ernal initiators. 1 l f e ) l L i 1-1 l r
...~.----~.n - _ . - - - , , _ . , - _ _ . , _ _ - - . , _ _ _ , , - . _ _.,_,____,_.-_.,__,,-n,--,._,.n,,.,vnr m. w ~.
l E
. _ -._ . - - - -~ . ~ ..- . - . - - .-- - - - - _ - - -.- - - - - -
~ . . _ . -
i i I 2.0 OVERVIEW Of METil0DOLOGY ! r 2.1 Description of Ei, ens Used t o Det erreine Core .Darste Precuency I The general process used to analyze the accident sequences and obtain the " core damage frequency for the internal initiating events can be broken down ' into a series of steps ,
- 1. Define the initiators to be analyzed. This analysis is described l in Volume 4 of this report.
- 2. Determine the accident sequences that can result frca these ,
ini.tiators and the systems necessary to mitigate the accidents. This analysis is described in Volume 4 of this report. ;
- 3. Develop fault tree models for the systems appearing in the event trees defining the accident sequences (front-line systems) and ;
their support systems. This analysis is described in Volume 6 of this report.
- 4. Develop a data base consisting of point estimate values to use in the screening analysis and continue te refine to get values for .
the final analysis with uncertainty distributions. Inis analysis is described in Volume 5 of this report.
- 5. Solve the fault trees of the front-line systems in terms of their l hasic failures and include their support systems and the interactions between front-line systems, between support systems, and between front line and support systems. This analysis is described in this volume.
- 6. Combine these system fault t.re es into accident sequences using ,
point estimate data to calculate screening estimates of the accident sequences. This analysis is described in this volume. 3
- 7. Analyze the sequence cut sets (i.e., combinations of basic failures that can result in the accident sequence) to determine if they make physical sense and evaluate the potential for operator recovery actions mitigating the accident. Define and classify the recovery actions. Add the failures (i.e., non-recovery . actions) to the cut sets, develop a method for quantifying the probability of operator failure, and quantify the actions and add to the data base. The definition, classification, addin6 to the cut sets, and quantifying the non recovery actions are reported in this volume.
The development of the method of evaluating human actions is presented in Reference 1.
- 8. Develop a method for resolving accident sequences which have uncertain end-states as a result of the inability to quantify the interaction between sequence phenomenology and system performance.
Apply this methodology to resolve the core vulnerable accident sequences. This analysis is described in this volume. 2-1
- . - .a.. . - - . - . - - - - . _ . - ~ - -
.-. . . - - - --..~-- . - . _ - ~. . _ - _ - - - - - . - . _ - . -
i 2 9. Using the uncertainty distributions developed for 'the data, quantify each individual accident sequence and the - combined accident sequences (i.e., the integrated results) to obtain the i individual sequence and integrated core damage frequencies for internal initiators. The implementation of the data base to quantify the basic events appearing in the fault trees with all of the final uncertainty distributions is presented in Volume 2 of this report in the appendix describing the Latin Ilypercube sample input. files. The evaluation of the sequence and integrated uncertainty distributions and the importance calculations are reported in this volume. ! 2.2 References 1
- 1. D. tJ . '.'h i t e he a d , Recovery Actions in PRA for t.he Risk Methods integration and Evaluation Program (RMIEP) Volume 2: Application of the Data Based Method." NUREC/CR 4834/2 of 2, SAND 87 0179, j Sandia Natfonal Laboratories, Albuquerque, NM, December 1987.
f I l 2 1 I 2-2 .
- m. -+.-r-m--r-. ew---w e.%- < - - . - , -,-,~,.,-ww-.e--m w,,',-%.*-,w me-.a-s-....rm--- y,,-<-uw_w -u r-e s - ---iry v n-v-o---,,-1*w w vyr -,-r *T-e t- **-
3.0 FAUhT TREE SOLUTION MET 110DS l 3.1 Develonent of Individual _ System Solutions j Modular fault tree methodology was used to construct the LaSalle system fault. trees for LaSalle The generic modules in Appendix 1 of NUREC/CR-32681 were revised and additional modules were developed for modeling l J control and actuation circuits based on relay as opposed to solid state logic. An IBM-pc program, MODEDIT, was developed to retrieve these files for modification into plant-specific modules. The program also checks each I module for any errors that may have been generated during modificat. ion. Another IBM-pC program, INDEX, was developed to identity developed events which do not have a corresponding top gate in another fault tree module A full description of these programs and the revised generic modules is discussed in " Microcomputer Application of and Modification to the Modular Fault Trees."* As the fault tree modules for each individual system were completed, they were transferred to the mainframe computer. Using the SETS code 2 procedurc Form New Fault Tr e e _, FRMNEWFT; the modules were merged into a system fault ' tree. The Generate Fault Tree Equation, GENFTEQN , procedure was-then used to compute the minimal cut sets of the system Ther,e cut sets were examined by the analyst for validity and any indications of modeling errors. If modeling changes were needed, appropriate changes were made and new cut sets were generated. This process was repeated until the analyst was satisfied with the model of the system. Some systems, such as the electrical actuation system, were developed in parts to help clarify the function being modeled by the analyst. These parts were then merged and checked for errors. Twenty-seven individual fault, tree segments were 4 developed during this phase of the analysis. Table 3.1 lists these fault trees. 3.2 Merging Fault Trees The fault tree segments for support and front-line systems were combined to form a completely merged fault tree for each system that appeared on the event trees (i.e., the front-line systems)4 The SETS code was used to perform the merging task. Two major problems we.e of concern in merging the RMIEP fault trees: (1) circular logic and (2) s i;:e . Circular logic often occurs in lault tree models since interdependencies exist among systems In the LaSalle fault-trees, these interdependencies existed between the power distribution system (PDIST) and its support systems (e.g., the heating, ventilation, and air-conditioning system, llVAC , r.rNP.A r a - ._M
- T, L Zimmerman, N. L. Graves, A. C, Payne Jr., and D. W. Whitehead,
" Microcomputer Applications of and Modifications to the Modular Fault Trees," NUREG/CR-4838, SAND 88-1887, Sandia National Laboratories,.
Albuquerque, NM, to be published. i 3-1
_ _ . . _ _ _ _..__-_.__.__...___-______._~.~_.___m._- Table 3.1 Faalt Tree Segments Developed for the 1.aSalle Analysis
- 1. PDIST Power Distribution - Includes AC and DC power buses ar.d circuit breakers and the diesel generat. ors.
- 2. EPAV1 Elcetrical Actuation - Part 1 - Includes the actuation circuit ry for the AC and DC power circuit breakers and diesel generators.
- 3. EPAV2 Electrical Actuation - Part 2 4 EPAV3 Electrical Actuation Part 3 !
- 5. IIVAC lleating, Ventilation, and Air-Conditioning Systems - '
Includes diesel-generator facilit.tes ventilation system and ECCS equipment areas cooling system. i
- 6. CSCS Core Standby Cooling System - Includes diesel generator ,
and FCCS room and ptuop cooling.
- 7. l.PCS los Pressure Core Spray System 1
- 8. LPCI low Prensure Coolant Injection System -- Mode of RilR.
9 CSS Containment Spray Systern Mode of RilR.
- 10. SCS Shutdown Coolleg Syst em . Mode of RilR.
- 11. SIC Suppression Pool Cooling Mode of RllR,
- 12. ADS Automatic Depressurization System
- 13. RCIC Reactor Core Isolation Cooling Systern
- 14. IIPCS liigh Pressure Core Spray System
- 15. PCS Power Conversion System - Includes main steam system and condenser.
- 16. MFW Main Feedwater System
- 17. CDS Condensate System 18.-SWS Service Water System 7
19, TBCCW Turbine Building Closed Cooling Wat System 3-2
Table 1.1 Fault Tr(c Segttents Developed l'or the 14alle Analysis
- 20. lA Inst rument Air system
^1. DWN Drywell Pnetunat ic Syst un (Instrtueent ditrogen)
- 22. RPT Recirculation Pump Trip
- 23. S Bl.C Standby Liquid Control System 24 VENT Con t a i nroe tit Vent.ing System
- 25. RBCCW Reactor building Closed Cooling Water System
- 26. CRD Cont rol Rod Drive System (two pumps needed)
- 27. CRD1 Control Rod Drive System (one ptuop needed) 9 J
3-3
.m..m.________.__m_.. _ _ . - _ - _ _ . . _ - _ _ - - -m..__
h d t and the core st andby cooling syst em, CSC1, which provide room coollog and ; p(mp and seal cooling to the AC power Sencrating eeuipment and its support ' e q u i p tw n t ) and within the PDIST system itself (e.g., AC/DC power dependencies)
~
Figure 3.1 shows the logical connections that resulted in feedback el fect s in the LaSalle analysis and the solution used to renolve these dependencies. The solution was implemented in the follnwing fashion, i First, the l'D I ST , CSCS, and llVAC systems were duplicated with all of the gate namen chanc.ed to create different but logically equivalent systems (i.e., the primary event names remain the same). This was accomplished with ' tlm FRMNEWi~f procedure of SI:TS using the NAME option. Gate names were changed by appending a "1" to the end of each gate name. To insure no gate ! wuw exceeded sixteen characters in length (SETS will not accept names longen than 16 characters), the f t rs t. occurrence of a hyphen was removed , from each gate name in the loop-cut ting version of PDIST, PDIST LC; gates l
- onoo r t irg t o the ftont-line systems were removed using t he TR1H option with l the FRMNEWFT procedure of SETS so that PDIST-LC only fed into the PDIST ,
f aul t. tree and it n support systems, The logic loops all involved diesel genetatorr and batt< ries depending upon themselves tbrough their support systems The connections back into t.he r4upport systems were removed from the loop ^ut versions of the fault trees (i.e , when the loop cut version of
- the CSCS system, CSCS-LC, was merged with the loop cut version of the PDIST tree, PDIST-LC; the connection back to the CSCS-LC tree via the diesel i gene r at or was removed). Appropriate gates in the electrical actuation fault tree EpAVALL vere renamed to reflect. the appended "1" in the loop cut veretons of ;he other systems so the actuation logic would feed into the ;
PDIST-LC fault tree (no logic loops went through the actuation circuits no a duplicate actuatinn treo was not required). The three loop-cut systems ! Pb1ST-LC, CSCS - LC , and ilVAC LC were merged with PDIST and EPAVALL t o form a { uerged-powcr lault tree MERCED-PWR with all logic loops removed, This fault , tree was later merged with the front line system fault tree segments and the original support system fault- trees to create the completed systems. Although fault tree size is always a problem of concern, it's soldam of the magn.i t ude encountered in the 8aSalle analysis. For this reason, selected fault t rc n were merged in small groups and these groupn were later merged int o the one final, large, multi-topped fault tree This helped in a number of w,ys (1) duplicated logic was eliminated early 8 n t.he merging process, (2) ertors were more easily resolved, and (3) SETS runs were of a manageable ' si: e in terms of time and output. Frent-line system fault trees were eventually all mer;ed into one large group and the fault trees for the supporting pcwer systems into another group. The two groups still contained over 10,D00 gates which is more than the largest version of the SETS code could handle w;thout. code rewriting, To solve this problem, Form Two of the FPMNEWFT procedote of SETS was use;l ro coalerce and re:aove single input , g,tes from the fault tree grcup convaining the front-llue systems. _This reduced the number of gates enough_so that it could then be merged with the tupporting power system fault tree group to form one ver y large tuul t i- t opped l inult tree containing all the front. line systems complete with their supporting systema The SETS output was carefully reviewed at t his point t.o i l l 3-4 i
4 l t[ l
.- ~ ,,
AC \ l e v / y II AC NCsCs/*v
%-y Original Loop Logic 4
1 y IWAC Ns / 4
,' s CSCS N
' f/
AC
,- 4A IIVAC' E"'
4' AC After Loop Cutting Fipire 3.1 Exenople Fault Tree 1.ogic lesop Rtsolution 3-5 l n . - - e- e -,---o--w i . , , ~ m-e < - we s r- a- -<,y w a y-- -,y =-9
i insure (1) the coales,cing and single input gate recaval did- not sever any connertions between irunt 1ine aiul support systems (thiu sould occur if the connect inn gates were single input nstes and wete deleted from the tree),
- (2) no developed event s remained in the f inal merged tree and (3) each
! system appearing on an e vent tree that was r epresent ed by a lault tree was represent < d by a t.op gate on the merged f ault tree, 3.3 Dryrlentr en te Litrie p e intenLS uhttne n The LaSalle system fault trees are large and complex representing the int eractiotm of many suppot t systemn and primary events, Even with the use of the SETS comput e r code on a large mainframe, it is not possible or
- economical to ident i f y all the minimal cut set s of a syst em fault t ree. One achnique that teduces the fault tree size problem !s the identification nud n M ien of the largest independent subt ron . Form Three of the FHMNEWIT
] procedu.c parfoamn this function by restructuring and then s. epa rat ing a designated i c.u l t tree into its stem and a collection of independent subtrees. Independent s,ubt ces can be quantified and evaluated individuelly and replaced by developed events in the system f aul t. t.r ce s (i.e.. these po rt i onn of the fault trees are treated as single super events). This process van very beneficial when applied to the LaSalle fault treen. The I.aSalle trees cont ain 3651 primary event s. This SETS procedure ident i fled
- 80. exist ing independent subt revs and created an additional 283 subtrees.
4 These M 3 independent subitees isolated 2928 of the primary events The use of t he s.e subtices as " super events" resulted in a smaller tree and more -3 . efficient solving of the original trees. These events must be resubstituted at the end of the analysin to obtain results in terms of t he prituary events on t he original t ree A thorough and in depth discussion of t.he development ' ] of independent subtrees is found in NUllEG/CR-3547.3 34 EvlY.iELh!I FnLtnLEnnlLIree tunhtwLC9LEcDi Even wit h t he use of independent subtrees, the iront-line system inuit trees f ot LaSalle were .ery large obtaining an exact listing of minimal cut sets for such large ttees is difficult, expensive, and of t en - impossible. For these reanons, it was necessary to probabiliatically eliminate cut sets ! below a selected truncation value. A truncation value of IE 08 was selected since previous experience has r.hown that the dominant pRA-estimated core drunage sequenee i requenclen - bef ore the applicat-lon of recovery are in the 1E-04/R-yr. to 1 E-05/by r range and that a significant number of cut sets-will be retained using this truncation value to give good entimates of the dominant sequence frequeneies. Every primary event- in the iault tree murst have a probability value associated with it-in order to eliminate eut sets based on ptobability. Since independent sub vees are treated as s upe r events," t hey t oo must have a va)ue associnted wit h them, The Generate Fault Tree procedure, GENFTEQN, of SETS was used on the collection of independent subtrees to generate a l\oolean equat ion cont aining the minimal cut sets for each i ndepende nt subtree The Compute Tetm Value procedure, 9 % 3-6 i
. - - ._- ~~.-- -.-_------.-------
1 COMTRMVAL, was used to obtain the su1 of the probabilitles of the n.i nimal l cut secs for each independent subtree This approximation associated with each " super event" or independent subtree was then added to the list of point value probabilities for each of the primary events for use in i computing the minimal cut sets for each of the front line system equations. ' The screening or point estimate values associated with each primary a
- i for computation in this phase of the analysis should be the largest s .. j ever to be associated with the event. Events having smaller valuet -
certain sequences can be reduced later However, if it becomes necessary t increase the probability value f or any primary event after the system cut sets hav< been obtained. the sys*em cut sets should be resolved. Some cut sets may have been eliminated by the use of the smaller probabilit.y value. Itaving to repeat the process to obtain system cut sets can be very costly and is better avoided by careful review and use of the highest value. Even with the use of independent subtrees and truncation, obtaining the cut sets for the I.as al l e front-line systems was very difficult.. The SETS code gives the computer analyst tremendous ficxibility in solving fault trees. This f l e x i b i l i ty ,. that allows an analyst to solve very large complex structures, requires the computer analyst to exercise a considerabic amount-of responsibility in generating and executing the details of a SETS user program. The computer analyst should have a detailed knowledge of the fault tree structure and work very closely with the systems analyst during the , front-line system solution effort. Failure to recognize this responsibility can result in excess.ive coniputer costs and minimal results. I The size and complexity of the LaSalle system fault trees necessitated careful review of the front-line systema prior to attempting to solve for the syntam mialmal cut sets Computer output from the Print Block procedure. PRTBly, was reviewed f or each front line system. This computer output gives the analyst insight into Ae coalescing and restructuring that occurs during t.he merging of the !;.divioal system fault trees. Simple sketches showing the logic structure can be generated and can be used to determine modifications to the SETS user code to optimize the solution as described below. After reviewing the restructured f ront-line system fault trees, toe Generate Fault Tree Equation procedure was used to generate the SETS user code to solve a given front line system using the bottom-up method. The PUNCll option was included to prevent. the SETS code from attempting to execute the generated code. A " quasi" bottom-up method was used to solve the stem portion of the front 1ine sys ter: fault trees. The bottom-up met hod generates Boolean equations for selected Intermediate events starting from the bottom of the fault tree. tach equation is reduced as it is generated. Progression is made through -; successively higher levels of the fault tree until the top gate is reached. After reduction, the top-gate equation is a function of only primary events or primary events and independent subtrees (i.e. " super events") if only the stem portion of a fr..It tree is being solved. A detailed explanation of the bottom-up nethod of the Generate Fault Tree procedure of SETS is given in l l l 3-7
. , , . , __ _ ____ - , _ _ - . _ . , , _ _. . ~ , ._ _ . _ _ _-...-,.- _ , - - _ , ._
.-- ~. . -. . - _ . - - - . - - - - - _ . - _ . . -
t Referetice 2. A discussion of it s itse in accident *;cquence analynis is found itt Referetter 3. The approach takeri to obtain solutiots of the laiSalle fault tteen was a " quasi" bottoui-up method because 'he SETS control program produced with the Generate Fault Tree procedure was mmll f i ed considerably prior to executton of the uset code These modi f icat loin included: (1) i nc lus l ott of additional st opping poit tn (i.e nelected i nt e t ttted i a t e eventu j which are solved to ob t a l ti their Doolean equations), (?) teview and changes I to the user code for solution of " AND" ga t e n , (3) une of equation, to equate equivalent gaten, atul (4) temoval, insettion, ated c h a t y,e s to Denete Itlock ( Dl.Thlf ) and l'orm block (IRMDlK) s t a't einent h By Ieview of 1he SETN uuct code i t om dettet at e fault T1ee Equation and the PRTDtX out put , the computar analyst can piepute a list of ititermediate evento to be used au stop point s stop points determine a stage in the de Ye l o phie nt of 3n expt ebbion afid ac t ab a sort ol " temporary huper event," b Illt e Intelmediate eVetit N aie 110 t f lo l lft a l 1 Y ashigned ValueH, S t.op pol11t s are exeludcJ ftom computation by use of the Except Noncomplement, EXC EPTNONCf4 P , opt ion in the Truncate on Terin Value statement cotresponding to the SuhntItute Equatlon haviog ihe STOP option The stop points are either "AND" gater. or i nt e r mediat e eventn used multiple
~
times in the tault tIce lhe use of st op point n allows the analyst. to solve the cut het equation for an i nt e r iin gate in piecemeal inshion. Allowilig only one or two of the equations for the inputs of a gate to ent er the
- equation for the gate at one time will gl ent ly reduce the fiuinbe r of terms
- that will be generated by expansion. After simpltlication, additionni inputn can he r e 'l e a s e d .
, The use of stop point n is particularly effeetIve f or mult iple input "AND" , gaten In this case, the order in which stop points are t eleaned can he impor t ant . If an "AND" gate, Q, has inputs A, B, C and D, and A and B are known to have events in c on:mo n , the analyst should release inputa A and it while stopping on C and D. This will result in a smaller number of-terms to he combined when the stop points C and D are nequentially released. Another item the coicputer analyst must monitor is that selected intermediate stop points have tiot already been solved in a previous computer run. This iesults in the stop point having no ef f ect Vhen individual syntems are merged to tos m front line syntem fault. trees, the SETS code output contains a list of any occurrences of equivalent gates found in the merged fault tree, Equivalent. gates are gates of the same type (i.e both "AND" or "DR" gates) and having the n ante inputs. Often this Inf ormat.lon can he useful in simplifying the solution of an intermediate gnte If an "AND" gate, 1, has loputu L, P, G and H, and E and F are equ i. val e nt gates, then equat long can he used to reduce the number of inputs to-gate 1 from four to three For example, if E and F are "AND" gates both having inputs K and L then the following equations can be used to set the equivalent gates equal: 1 L i l l l 3-8 l
- w-=-www,.m ==--2-a.w-e-4-n--*-- ww w - wem..,-w=- -e,- -,+r = m --e =- re e-e+~ .w-r--u--w.w.--e.cm-e-,-m.rw-w---r.--r-n-wr-we -e,w---p-*wwa--e-w-r-=w s---w=se- +=e w-r w
- . . . - _ - - - - - - . - . - . - - - - - . - . . - . - . - . - ~ . - - -
I f i , PROGRAM $ LAS ALL5' * 'I .
+
4 4 j E - TEMP. " F - TEMP. TEMP - K
- L. r SUBINEQN (TEMP, T12iP) .
i The computer analysis then precedes as if gate I had inputs G 11 and TEMP. The Delete Block and form Block procedure staternents were of ten removed f rom the user code at. the lower gate levels to speed up computer run time. The name 1;iven to a block being formed was changed from the previously used block name to prevent a loss of information if a computer tline limit was encountered during a Delete Block or Form Block procedure. Additional form Block statements were -added to the code tt the upper gate levels. This saved the computed information more often in case a computer restart was needed. Since the SETS block file is a sequential file, it is more economical to keep only essential information on the file so previous interim blocks were deleted once a new one was successfully formed. Admittedly, for small problems the computer cost involved in th e id e procedures would probably be nominal but a significant savings is realir.ed - when dealing with extremely large system fault trees. Proper use of the Form Block procedure may save the computer analyst from " losing" a 30 minute computer run. The computer code for solving a front-line system was generally broken into parts for submission to the computer. This allowed the computer analyst to , iview the output and make appropriate changes to t.he next section of code to be submitted if needed. This helped to control the computer cost and often prevented the submitting of a costly run that_ could not be successfully completed.
~
An equation was used to set-the event ilIGil DWPRESSURE to OMEGA . (i . e . the event is assumed to always occur) while obtaining the system minimal cut sets for all of the front-line systems except PCS. The event 111 011 DWPRESSURE was set to / OMEGA (i.e., pill, t.he event was assumed never to
- necur) during the computation of the minimal cut sets for PCS. The event il1Gil-DWPRESJURE is a flag that indicates the presence or absence of high pressure in the drywell. For all accident sequences where PCS was not avail _ble or success ful , high drywell pressure (i .e . , . drywell pressure
- greater than 1.69 psig setpoint used in the emergency system's actuation logic) was assumed to occur.
The fifteen iront-line systems and their number of minimal cut sets are shown in Table 3.2. The number of cut sets shown is prior to substitution for independent subtrees. Substitution for independent subtrees was not ,. made until af ter the formation of sequences. 3-9 _ _ _ . _ . _ _ _ _ . . . _ _ _ _ _ _ _ _ _ . _ . _ . _ _ _ _ _ _ .. ,.. ~ , _ _ _ - - _ -.
P F Tabic 3.2 Site of Merged Front Litm System Solutions Abbreviation Front I.ine Sys t ere *Ntuober of Cut Sets - RPT Recirculatton Pump Trip 200 Sn!.C Standby 1.iquid Control System 7$ RCIC Renet or Cot e Isolation Cooling System 317 IIPCS liigh Pressure Core Spcay Systcia 128 1.PC S low Preunute Core Spray System 1$7 CDS Condennate System 459 CSS Cont alruimnt Spray Syst em 7920 SPC Sup;>ression Pool Cool tug system 8014 SCS Shutdown Cooling System 4361 l.PC I low Pressure Coolant Inject ton Syst em 5696 ADS Automatic Depressuttratton System 7280 PCS Power Converblon System $09 J ! HIV Main Feedwater System 610 ) CilD Conttol Rod Drive System 186 VENT Cont a i nme nt: Venting System ?89
- Noinber of cut sets prior to subutitution for independent subtrees.
a 3-10
- -. . . . . - . - _ - . _ . . _ . . . . _ _., _ .- . . _ . _ _ . . _ _ _ _ - _ _ . _ .;,_._._u._._._,,. . _ . . _ . . . , . . , , - . . . - . - -
.._4._.. m _______._ _ . _ _ _ _ _ _ _ . _ _ _ _ _ _ . . . _ _ _ . - . _ _ _ _
1 Once system solutions are obtained for all the front line systems appearin6 on the accident sequence event trees, the accident sequences can bc , evaluated. The evaluation of the LaSalle ac~id nt sequences is described in i chapter 4 of this report. 3.5 References
- 1. G. B. Varnado, V. 11 . llo r t on , and P. R. Lobner, " Modular Fault Tree Analysis Procedures Guide," NUREC/CR-3268, SAND 83 0963, Sandia-National Laboratories, Albuquerque, NM, August 1983. i
- 2. R. B. Worrell, " SETS Reference Manual," NUREC/CR-4213, SAND 83 2675, Sandia National Laboratories, Albuquerque, NM, May 1985.
- 3. D. W. Stack, "A SETS User's Manual for Accident Sequence Analysis," ;
NURCC/CR-3547, SAND 83-2238, Sandia N a t. i o n a l Laboratories, Albuquerque, NM, January 1984. Y l 3-11 __.______.._.__._____..2.. . _ . _ , _ . . _ _ , _ , _ _ _ _ . . _ . _ _ _ _ _ ~ _ . _ . _ _ . _ . - . _ , , . - _ . , _ . , _ .
..m_ _ . _ _ _ _ _____.. _ _ _ _ _ _ . _ _ _ . _ . - _ . _ . - -
t s 4.0 COMPUTATION OF SEQUENCES Most of the LaSalle sequences were evaluated with a tiuncation value of IE-
- 08. This led to some difficulty in generat ing the sequence solutions as comb i n i ty', f a l lut e states often generated millions of intermediate cut 9ts.
Obtaining a cross product of two or reore system failures is expensive and sometimes impossible without employing techniques other than simply "ANDING" (i.e. the Boolean operation of conjunction) the syn t ests together. A teethodology for performing the sccident sequence analysis portion of a ' l'RA using SETS is discuss ~' in detail in NUREG/CR-3547.1 Additional techniques employed to obtain the LaSalle sequences included: (1) connon term removal, (7) separation into parts based on number of literals, (3) separation into parts based on probability, (4) grouping, and (5) i nt e r medi at e removal of success states. I l 4.1 CominqLIe rm I!cmoval If sufficient i n f o rma t f o r. is known about- two systems to indicate that they have a nturbe r o f cut sets in common, the combined system failure can be calculated without generating all of their intermediate cross pro /octs. For example, several of the LaSalle sequences required combining the system failure states of containment spray system (CSS) and suppression pool cooling (SI'C) system. As shown in Table 3.2, even in terms of independent subtrees (ISTs) or " super events" these systems contained 7920 and 8014 cut. sets, respectively. Since these two systems vero known to contain a sizable number of cut sets in conaan, their cross product was obtained as follows The Delete Term, DLTRM, procedure was used to obtain the terms of CSS not in conunon wit h SPC. Using DLTRM again, this result was then used to separate out the terms of CSS that were also in SPC. A third appj ication of DLTPJi was made to obtain the terms of SPC not in common with CSS. The resulting three terms represented: (1) terms in CSS but not in SPC, (2) terms . In both CSS and SPC, and (3) t e rats in SPC but not in CSS. The terms of CSS not. In connon with SPC were then "ANDED" With the terms of SPC not in common with CSS. This result was then "ORED" (i.e. the Boolean - operatlon of disjunction) with tarms common to both CSS and spC to obtain their complete cross product. Sample St;TS code to execute this process is shown below: PROGRAMS LSL-SEQ. COMMENTS COMBINE SYSTEM CUTS SETS FOR CSS AND SPC $ l DLTRM (CSS. SPC X1). --- DLTRM (SPC, CSS, X?). DLTFJi (CSS , XI , Y) . i CSS-SPC - XI w X2 + Y. SUBINEQN (CSS-SPC, CSS-SPC). 4-1
-Some computer costs _are heavily- w 'ghted to I/O operations. Since DLTRM makes heavy use of.I/0, in some cases- it may be more efficient to remove the second DLTRM statement f rom the above code and change the equation to CSS-SPC - X1
- SPC + Y. This would require that the Substitute in Equation procedure, SUBINEQN, be followed by . either the Reduce Equation procedure, REDUCEQN, or Truncate on Term Value procedure,-TRNTRMVAL, since the result of the SUPINEQN would not be minimal. If the product of two or more failures is-common to more than one sequence, it is important to save this result using the Form Block, FRMBLK, procedure so that it is not necessary to compute the product n;re than once. ,
4.2 Separation Into Parts Based on Number of Literals Some LaSalle sequences were extremely- dif ficult and capensive t'o obtain. These sequences were developed in stages. "'h e cut sets for two or more system failures in a - sequence would be combined and the computer output examined before combining this segment of the sequence with other system failures to continue computation of the sequence. If the computer output indicated a segment could not be combined with another system without generating too many intermediate terms for the capacity - of the computer code, the sequence segment was sometimes broken into parts. This was accomplished by using the option in the REDUC 1N procedure to truncate the sequence segment.on number of literals, j. Using the sequence segnent and-the j-truncated sequence segment as arguments .for the DLTRM procedure, the sequence segment containing greater than j literals was obtained. These two parts, the less than or equal to j literals part of the sequence segment and the greater than j literals part were each "ANDED" with the next system failure state to be included in the sequence and then the results are "0 RED" to obtain the next stage, If necessary the process can be applied more than once, but since the computations to obtain the parts can be fairly expensive they should be kept to a minimum. The computer output from each stage in the development of a sequence is used to determine the value of j and whether or not this process is applicable. 4.3 Separation Into Parts Based on Truncation by Probability Sometimes a large sequence segment would not lend-itself to separation into parts based on number of literals (i.e. too many terms containing the same number of literals). In tiase cases, computer output was reviewed for the possibility of separation i n t o. parts based on truncation at some-probability level, This process is similar-to separation into parts based on number of literals except the TRNTRMVAL. procedure is used to obtain a part_of the sequence segment truncated at a higher prcbability value, k ,-
- than the value being used for the ana tysis. To determine the k probability.
value to be used as the break point requires the analyst to have;some knowledge of the magnitude of the cut sets being generated and/or computer output from a COMTRMVAL procedure for - the sequence segment or systems composing the sequence segment. The DLTRM procedure is applied to obtain 4-2
~ , , . _
. . - _.m_____... . . _ _ _ _ _ .._ _ , _ - . _ _ _ _ . _ _ _ _ _ _ _ . _ _ . _
J the pc ,lon of the sequence segment having probability less than k. -As above, the two parts of the sequence segment are combined with the next system or systems of the sequence and then the results are *0 RED" to obtain the next stage. 4.4 Crouping Two types of grouping were used in computing the LaSalle sequences. The first type involved combining and saving combinations of systems that were used in more than one sequence. Combining many of the systems generated 3-large number cT intermediate cut sets which resulted in high computer charges. Because of these computer costs, combinations of systems found in two or inore sequences were often formed and the results saved using the Form Block procedure, IW1BLK. These system combinations could then be recalled as needed during a sequence computation. The second type of grouping used in computing the LaSalle sequences selected systems to be combined based on known commonalities. When combining several systems that create a large number of interiin cut sets, the order in which the systems are ' combined can become very irnportant. Combining two or more systems known to have many cut sets in coimnon prior to combining these systems with another system which does not have cut sets in common with the previous systams generates fewer intermediate terms which have to be eliminated in the Reduce Equation procedure. Obviously, these " groupings" are very judgemental and requiza the analyst to have or obtain considerable information about the interactions of the physical systems being modeled. Occasionally, the two types of " grouping" are in conflict with each other. The first type discussed generally helps in reducing the cost of obtaining a solution while the second type of grouping may control whether or not the solution can even be obtained. Unless costs become a maj or concern, grouping to reduce the number of terms is generally the maj or deciding factor in dealing with very large problems. 4.5 Intermediate Inclucion of System Success States The Delete Term procedure, DLTRM, can be used to include the success states of a system in an accident sequence without determining a compicment equation for the system. For example, suppose we have the failure , equations for two systems, p and q, in disjunctive normal form (i .e. , sum I of products (cut sets) as opposed, for exnmple, to a factored forin) . The saquence we wish to evaluate is given by the equation s - p*/q where system p.has failed and system q has succeeded. Instead of deterinining explicitly the complement of q , /q , (which can have a very large number of success cut sets and .is usually not done); we delete terms in the equation for p that subsume terms in the equation for q from the equation for p to form a new equation, r. This _ means that cut sets in the failed system that are 4-3
physically' it. compatible with the fact that the' other system succeeded are removed from the failed system's equation. . The sequence can then be approximated as s - r. In general, the probability of success is usually close to 1.0 probability and the improvement in the estimation of the sequence frequency by elimination of cut sets physically incompatible with the sequence definition more - then compensates for the error introduced by not including the probability of success. If the probability of success-is-
- small, then a more explicit representation may be needed. The number of terms in equation r will be smaller than the number of terms in equation p i unless the systems involved are independent of each other. A more precise discussion of this process is found in NUREG/CR-4213.
Because the inclusion of a system success in this manner has the effect of reducing the number of cut sets in a sequence segment, it is of ten i beneficial to include system successes at intermediate stages of a sequence ' comput ation. It results in fewer cut sets in a sequence s e gr..eu t that must ' st'11 be combined with other system failures. It is important to remember that when a success state for a system is included in a sequence segment prior to combining the last failure system to the sequence segment, it will be necessary to combine the success state again. This is to insure that terms of the success state system have been removed from all of the failure systems occurring in the sequence Analysts' judgement and familiarity with the modeled systems must be used to determine when including success st.ates at intermediate stages will be useful. Alse, when using a particular combination in several dif ferent sequences, one must be careful to use only success states that appear in both sequences or evaluate the combination twice.'once for each sequence. 4.6 Solution of Sc.quences The evaluation of the LaSalle sequences required the use of all of the techniques discussed above.. Some types of sequences, such as the transient and transient-LOCA sequences, were extremely difficult to conipute. In some i cases, it was not feasible to obtain all of these sequences at the probability truncation value of IE-08. 4.6.1 LOCA Sequences The event trees, discussed in Chapter 2 of Volume 4 of this report determined the sequences to be evaluated for Loss of- Coolant Accidents, LOCAs. The LOCA event tree is reproduced here as Figure 4.1. Because the severe environment and containment failure expert elicitations had not been performed by the time the screening was to be done, the events SRUp and SUR were not evalented at this time (see Chapter 6 for a discussion of'these events). Since the LOCA tree was evaluated simultaneously for all LOCA sines (small, medium, and large), any syst em specific effects due to the dif ferent LOCA 44
.~ - . . - . , . ..- _ _ - - ---. ._ -
1 i i l lE l f# l YlTlY Y l f [ , i .= C l h. n
'= ;
a
- s. De I - ., ..
r -c :: % (4) 'c n.
- c
. - ,.. . .c.
= n (3) n i = ::
(2) I 4
= E
= :' n
= :: n
, = ; :".
(1)
= "
n
, = : ::
= '
J (5) C n
, = :, n
= :: !'
1 ,
= n I = :; n
= :: n
, = :. n
= :: ;;
, = : :
= :: :
- n 1 = :: ::
, = n
-(4) =
n E
- 8 CD
= ; a (6) , n .
I - m ' s n (4) '
=
o. i " V to
= ::
, . n" .
I = :: n
, = "
= ; a (4) , = ; .g
= .; p.
". E (1) TRANSTER TROM TRANS!ENT SEQUENCE f 103.
(2) TRANSFER MOM UtANSIENT SEQUENCE f 103. (S) RCic success POssmLE FOR SMALI,1DCA ONLY. (4) GD SUCCESS POSSIBLE FOR SMAL.L LOCA OR STEAM BREAK ONLY, (6) JUR VERY LONG TERM SEQUENCES WIDI A LARGE LDCA WlERE DE COIE IS AT 2\S TAT MAY GET SUBCOOLING AND MElf UE TOP OF DIE CORE IF ONLY ONE LPCI PUMP IS OPERATING. (6) TRANSFERS TO (2), DOWNCOMER, VACUUM DREAKER, OR SRV DISCHARGE llNE FAILURE, S AME SYSTEM SUCCESS CRTIEIA, SEQUENCE OCCURES IN SHORTER TIME. (7) TRANS)E TU ATWS DEE. Figure 4,1 LaSalle LOCA Event Tree 4-5
sizes had to;be included directly In the system fault trees. For example, the reactor core isolation cooling (RCIC) system fails due to its-inability to supply enough_ water to make up for the coolant being lost and due to the reactor vessel depressurization that occurs after a medium or large 1DCA. Two events representing a medium and large IACA are - placed in the RCIC system fault tree such that , if a medium or large IDCA occurs ,- the- RCIC - system fai;3. For other events such as electrical bus failures only partial system failure may result. Each sequence was multiplied by an initiating event equation - to insure every cut set included an appropriate IDCA initiator as indicated by the event trees. Af ter the systeme are solved and combined together to form the celected accident sequence, two types of cut sets will be present: 1) cut sets with no initiators coming from the fault trees (i.e., cut -- se ts composed only of random failures of equipment from the failed systems) or
- 2) cut sets with one or more initiators and possibly some random failures.
In order to ecmplete the sequence definition, each Y it set must have - an ini tiating event. Those cut sets which already have an initiating event , coming from the fault tree ' solution are complete. Cut sets with multiple luitiators _ are not physically realizable since by definition only one ini.tiating event occurs at a time. The fault trees already contain random events representing the occurrence of an initiator as a random failure given the occurrence of some other initiator. The - thod used to eliminate these double initiator cut sets will be discuned ier. Cut sets with no initiators are -independent of the specific initiator type and need to be combined with each initiator to create new cut sets, one for each initiator (i.e., given a cut set X*Y and the three initiators LLOCA, MLOCA, andc SLOCA; three cut sets can be created LLOCA*X*Y, MLOCA*X*Y, and SLOCA*X*Y by "ANDING" the cut set with the equation LLOCA + MLOCA + SLOCA) . For sequences one through sixty , the initiating event equation included a small, medium, and large LOCA initiator. Sequences sixty-one through ninety-eight each contained two parts; the first part received a small and medium initiator while the second part received only a large LOCA initiator. This was because, for a- large LOCA, the automatic
-depressurization system (ADS) is not necessary to depressurize the reactor vessel in time for the low pressure inj ec tion systems to - prevent <- core damage. Since the initiator does not fall the ADS system but merely renders it unnecessary, the sequences were first evaluated without including ADS success or failure. These cut sets were "ANDED" with the i large LOCA initiator to ' form the large LOCA cut sets. The original cut sets were then combined with ADS success or failure, as appropriate, and the resulting cut sets were "ANDED" with the small and medium LOCA initiators. The two parts of each sequence were then "0 RED" together to form the complete sequence. Equations were used to set the transient initiators to / OMEGA (i.e. OMEGA means . the event always occurs, PHI -
/0MEGA means that the event never occurs) for the LOCA sequence evaluation.
This was necessary to remove transient initiators appearing in the cut sets as a result of their inclusion in _ the fault trees. For some events, the probability of occurrence is - dif ferent . for different sequences. During screening, a single value, the maximum value that can occur in any 4-6
- - .-, , , . - _. -,, - ,.er_...-.-.m, ,
. .._ -- - - - - .. - - . - - . . . _ ~ -- . - _ - - _ .-... . - . - - - _ _ -
r sequence, is used so that one value can be~used and no cut set will' be truncated unnecessarily, in the final evaluation of specific sequences, the data used to quantify the events is assigned it's appropriate value. Equation and value block changes used for the LOCA sequence computations are listed in Tables 4.1 and Table 4.2, respectively. Complement events were not used in the construction of the LaSalle fault trees. This occasionally led to the same primary event being modeled in a different state In various systems and being given a different event name, For example, a valve might be modeled as failed open in one system while the same valve is modeled as failed closed in another system, Combining the system cut sets for these two systems in a sequence could result in a cut set that would not be logically valid since the same valve can not fail both open and closed in the same sequence, Events modeled in more than one failure condition were " flagged" during modeling. An equation containing the products of these " flagged" events was used with the DLTRM procedure to remove the logically invalid or " double-flagged" cut sets from the sequence Cut sets containing double . initiating events were also considered unnecessary to the analysis. These cut sets were removed in the same manner as the " double-flag" cut sets. After the " double-flags" and " double-initiators" were removed, substitution was made for the ISTs to obtain LOCA sequence cut sets containing only primary events . Only sequences L4, L6, L8, L12, L14, Ll6, L18, L20, L24, L26, L28, and L97 had cut sets remaining after this substitution and i truncation at lE-8. 4.6.2 Transtent-Induced LOCA Sequences The event trees, discussed in Chapter 2 of Volume 4 of this report, determined the sequences to he evaluated for transient-induced Loss of Coolant Accidents. The LOCA ev t tree, Figure 4.1, was used to evaluate the transient-induced LOCA sequences. These sequences start out on the transient event tree shown in l'igure 4.2 with successful scram and safety relief valve (SRV) opening. The SRVs do not reclose and, depending upon the number of SRVs which fail open, are equivalent to a small , meditun, or large LOCA in their effects on system operation and RPV inventory. Because the severe environment and containment failure expert clicitations had not been perf ormed by the time the screening wa- to be done, the events SRUP and SUR were not evaluated at this time (see Chapter 6 for a discussion of these events). In a similar fashion as for the 1.0CA sequences,- each sequence was multiplied by a transient ini.tiating event equation to insure an initiator was included in each cut set. llowe ve r , the event SRV C on the transient event tree which represents ' the translent induced LOCA was not developed into a full fault tree. A Boolean equation SRV C - Qt + Q2 + Q3 was used to represent this event where Q1 represents the probability of one of the SRVs demanded open failing to reclose, Q2 represents the probability of i 4-7 l l
Table 4'.1 Transformation Equations for Initiat. ors and Flags in IDCA [ Sequence-Evaluation. ~ BIDCK$ lhCA Pill-0MEGA. lilGil-DWPRESSURE - OMEGA. N0lilGil-DWPRESS - /0MEGA. T1-1E - /0MEGA. T2 1E - /0MEGA, T3-IE - /0MEGA. T4-1E - /0MEGA. T5-IE - /0MEGA. T6-1E - /0MEGA. T7-IE - /0MEGA. LOSP-1E - /0MEGA, T9A-IE - /0MEGA. , T9B-IE - /0MEGA, T101-IE - /0MEGA. T102-IE - /0MEGA. T11-1E - /0MEGA. T12-IE - /0MEGA. T13-IE - /0MEGA.- T14-IE - /0MEGA, TlSA-IE - /0MEGA. TISB-IE - /0MEGA. l 1 l I 4-8
. . . . . . , . . . - - _ . = , . - . - . - . - . . . . - . - . _ . - - - - . . . - . . . ~ . . - .
Table-4.2.
-Valuo Bloc'k Changen for 11)CA Sequence Evaluation COMMENT $ CHANCES FOR ALL VALUE BLOCKS $
3.4E-3 $ RHR301AX-STR.$ 3.4E-3 $ RHR301BX STR $
-3;4E-3 $ RHR301CX STR-$
3.4E-3 $ LCSD302X-STR $ 1 2E-3 $ RCID00lX STR $. 1.2E-3 $ HCSD001X STR $ COMMENT $ CHANGES FOR LOCAS AND TRANS-LOCAS $
.1 $ TDRFP-T 0E $
.1- $ MFS RESET-0E $
.1 $ ADSMINIT-QOO-0E $
.01 $ OPERR-INITCSS $
.1 $ OPFAILS-REOPEN $
0.0 $ OPTURNSOFF-TURB $ 0.0
$ TRN-A-SCSMODE $
0.0 $ TRN-B SCSMODE-$ 0.0 $ TRN-AORB-SCSMODE $ l i 4-9
_ . . . _ _ . . . - . . _ . . _ . .m . _ _ __-. - _ _ __. _ ._.. . . . . . _ _ . - ._. , _ . _ ._
' l E l'"l'c"l"l"lT*l "l*!N "l N *! N .
N N !YI " I
. .g , . .
I 4
]' e . .
I, , -
- .o.
n . - .
. - a.
- . o i .s.i O.s.
, 1 .. .
H - o
. - .. .3 M . .,4 E
. = L 0-6 -c ::
a-I. .e, . o. l pe tu
-i
-= '
i' i , = 0 0
= :: -
=
,. - .un. -
I i
= ::
'n n o
-c _
ll ;;
. n
, = :' O I
1
= *;
=
Oa n
= :,
- 0 . 13
- _ m o.
I N N CO I i
= :.
.a n
_ - - ' e (11 m h tri
.&. u
.. w
.E D8
- i. __ . .
H i __4 - w I - . I h 80 G i a
= 9
. n M
9
. D.o E
lI
.C.D.
1 I - g
- e.a c>
1 - a.o - I - N O
- .)
f I
- Os, n
i . n m
= :*
.# l3 T r~ .
Y
. 5. .
L' - en I. - . .to
%-sanew W E G.
..' w n
= : .T: 0; u
e,.. .w (1) USED M RESOLVE CDRE D AMAGE RKLVERY,IDW IEESSURE SYSTELfS FAIL ON ADS CIDSURE AT ADOUT 85 PSIG. BOILOFT AND COPE DAMAGE OCCUR BDDRE CCNTAINMENT FAILURE (MEAN VALUE. 196151G). (2) TRANSTER TO IDCA 'IREE (1 SRV PIC = SMALL LOCA. 2 SEV PIC = LEDIUM LOCA. AND
>= 3 SRV PIU s LARGE IDCA)
(3) 'IRANSTER "ID LOCA TREE ( OVERPRESSUKF CREATES IDCA. IHOB. OF 18 SRV PID NEGLIABLE). (4) TRAN5M2 TO ATW3 TE Figure 4.2 LaSalle Transient. Event Tree 4-10
- - - - - . ~ - - - . ~ _ . - - _ . - - -----. - - - ._ . - -
exactly two of the SRVs demanded _open failing to reclose, and-Q3 represents the probability of three - or- more of- the SRVs demanded open failing to reclose. These Qs are ' equivalent to a small, medium, and large LOCAs-res;3ec tively. The LOCA initiators appearing in-the fault tree were changed to the appropriate Q using transformation equations to - represent the ~ effects of the stuck open SRVs on the responding systems. These equations 1 and their. associated probability values for each event are shown in Table 4.3. Other events having changes for probability values for transient-induced LOCA sequence evaluation were the same as those shown in Table 4.2-for the LOCA sequence evaluation. As described in Section 4.5.1, sequence cut sets containing " double-flags" were removed. Cut sets containing two transient initiators were also eliminated from the sequence cut sets. However, cut sets containing the transient initiator T7 which represents a stuck open SRV as an initiating event had to be treated di fferently since T7 and Qt are equivalent. Cut sets with T7*Q3 were transformed . to cut sets with only T7 while cut sets with T7*(Q2 + Q3) were deleted. The sequences one through sixty and sixty-one through ninety-eight were then evaluated in the same fashion as for the LOCA sequences. The transient-induced LOCA sequences were evaluated using a probability truncation value of IE.08. After the " double-flags" and " double-initiators" were removed, substitution was made for the ISTs to obtain the transient-induced LOCA sequence cut sets containing only primary events. Only sequences TL4, TL6, TL8, TLl2, TLl4, TL16, TL18, TL20, TL24, TL26, TL28, TL30, TL32, TL34, TL36, TL38, TL59, and TL97 had cut sets remaining after this substitution and truncation at IE-08. Although not all sequences had a large number of cut sets in their solution, most of the transient-induced LOCA sequences were difficult to compute and required considerable use of the techniques described in Sections 4.1 to 4.4. 4.6.3 Transient Sequences
.The event trees, discussed in Chapter 2 of Volume 4 of this report, determined the sequences to be evcluated for transients. The transient event tree, Figure 4.2, was used to evaluate the transient sequences.
1 Because the severe environment and containment failure expert clicitations had not been performed by the time the screening was to be done, the events SRUP and SUR were not evaluated at this time (see Chapter 6- for a discussion of these events) . Like the LOCA and transient-induced LOCA sequences. the transient sequences were multiplied by a transient initiator equation. Values for the LOCA initiators were set to ::ero. Probability value changes were made for the events listed in Table 4.4. Cut sets containing " double-flags" and "d.ouble - initia to rs " were eliminated in the same manner as for the LOCA and transient-induced LOCA sequences. Computation of the transient sequences was extremely dif ficult. Even with the use of all the techniques described in Sections 4.1 to 4.4, the 4-11
. , _ . _ _ . . . - . - . _ . . . . . _ . _- - . . . _ _-_. _. _-. .. ~ , _ . . _ . _ . . . _ . _ _ _ . . . _ _
-Tabic 4,3-Transfortpation Equations for Translent.-Induced IDCA Sequences SLOCA-IE - Ql-MIBCA-lE - Q2 L1hCA IE - Q3 Q - Q1 + Q2 4 Q3 PROBABILITY VALUE CllANCES FOR TRANSIENT LOCA
, Q1 - .2 Q2 - 4.SE-3 Q3 - 1.2E-4 (ALSO ALL EVENTS LISTED IN TABLE 4.2) t-l 4-12
- .= - _ . . . - - _ . . . - - .
Table 4.'4 Value Block Changes for Transient Sequences COMMENT $ CHANGES.. FOR ALL VALUE BIECKS . $ -
.3.4E-3 $ EHR301AX-STRi$ "
3.4E-3 $ RHR301RX-STR $ 3,4E-3 $ RHR301CX-STR $ 3.4E 3 $ LCSD302X-STR $ 1.2E 3 $ RCID001X-STR $ 1.2E-3 $ HCSD001X-STR $ COHMENT$ CHANGES FOR TRANSIENT SEQUENCES $ ,
.01 $ TDRFP-T-05 $
.01 $ MFS-RESET-0E $
.01 $ ADSMINIT-QOO-0E h
.01 $ OPERR-INITCS9 $
.1 $ OPFAILS-REOPEN $
0.0 $ OPTURNSOGC-TURB $ 1,0 $ TRN A-SCSMODE $ 1.0 $ TRN B-SCSMODE $ 1.0 $ TRN-AORB-SCSMODE$ 01 $ FCSS2-Q 0E-0 $
.01 $ C34R601A-Q-0E $
^
.01 $ C34R6018-Q-OE
,01 $ 1ECOEX-QCO-0E .,
.01 $ 2HSFWO32-Q-0E-O $
COMMENT $ SET VALUES FOR Q1,Q2. AND Q3 $ 0.0 $ SLOCA-IE, Q1 $ 0.0 $ MLOCA-IE, Q2 $ 0.0 $ LLOCA-IE, Q3 $ l l 4-13
truncation value had to be-relaxed in order to obtain the cut sets for the transient sequences. . Sequences twenty-five - through one hundred and one were truncated at SE-08. Sequences one through twenty-four were truncated at SE 07. All core damage sequences survived the truncation process before the inclusion of the severe environment failures and the application of recovery. 4,6.4 Anticipated Transients Without Scram The event trees, discussed in Chapter _2 of Volume 4 of this report, determined the sequences to be evaluated for anticipated transients without l scram (ATWS) events. The ATWS event tree, Figure 4.3,_was used to evaluate the ATWS sequences. Because the severe environment- and 'contaitunent failure - expert e11 citations had not been performed by the time the screening was to. be done, the events SRUP and SUR were not evaluated at this time ' (see Chapter 6 for a discussion of these events). The event lEDC2DEP-FROP-4 which represents DC battery depletion was set to
/0MEGA (i.e. PiiI) to c11rninate the ef fect of battery depletion for the two systems RPT and SBLC. These systems must perform their functions within the first few minutes of the accident and battery depletion will hot occur for several hours; therefore, battery failure can not be a failure mechanism for these systems. Events for which probability changes were made are listed in Table 4.5. Two point estimates were used in the ;
computation of the ATUS sequences. They included: (1) FWL which is represented by the event OPFAILSMFW-8M and is failure of the operator to control feedwater level in an ATWS scenario to a level consistent with , condenser makeup limitations within eight minutes, and (2) RPS/ARI, reactor protection and alternate rod insertion systems fail. The screening values used for these point estimates are also listed in Table 4.5. The ATWS sequences were multiplied by an initiator equation to insure every cut set contained an initiating event. Cut sets containing - " double-flags" and " double-initiators" wert eliminated in the same manner as for the LOCA, transient-induced _LOCA, and transient sequences. Because of the magnitude (1.0E-05) of the point estimate for RPS in the ATWS sequences, system cut sets were truncated at 1.0E-04 prior - to forming the NEWS sequences. The truncation of system cut sets at 1.0E-04 made the sequences easier to compute since fever terms were generated ' while combining systems. The overall truncation level was equivalent to 1.0E-09 except for initiators with frequencies greater than 1.0/R-yr, lioweve r , the largest of those was 4.5/R-yr. so in all cases the truncation level _was at-least 1.0E-08/R-yr. L After substitution for the ISTs, the following sequences survived the truncation _ process: A14, A15, A17, Ald, A22, A48, A49, A51, A52, AS4, ASS, A57, A58, A60, A61, A76, A77, A93, A119, Al20, A122, A123, A125, A126, A128, A129, A131, A132, A147, and A148. 1. l, 1 4-14 l
s ~~.., . ..-. m.m - . m.... - . .. m. m_ .._m ._ , . - - . < ..m.a . _ _ . ~ _ _ , m . _ _ . . . . . . _ . , , . . _ . _ . __ .. 4 T . RM WFW UT3l LPCI l SPC j CBS l VENT l CRD1 SRUP SUN ULT 3D SEQ f STAR?5 go ltTl l K3] l f*WL l 5814} (N 1 }I l#T1 ll ADS 1 t I f ' P) ('M 40Yales 1' 04 (N I 7 DE 3 Os i e on S CD 4 Da [M 3 7 CD 1 a- 9- CO ' to Da il CD 12 CD (6 t 13 Ou - lM 1 to CO ep 16 CD in c,s 17 C3 48 CO W I *e. er eq we Da CW
] F1, W Ou Pr t1 - CD F3 ee Os m i F* ra CD i 75 en os is 99 ' CO I P F.1r Du es we on
] ' Fu tm Os -
(45 3C. 90* CD 31 te ne tM i - P. CD CD - 33, t08 Os [ t I se tcm to m HE. CD 36 top ce l 3 *, 5W On 1
- 25. 1 31 04 3u. s to CD e;;. st t -
On (F) E 41. 117 CD [ [ . 4J 113 et I
%- =A114 CD e4 i es CD 4S 114 CO 44.117 CD e v. t is ow ed. Ilt CD (C 46.120 CD
$0.174 On St. tre - CD (7) W 1F1 CD 51 IFe Du
$4.1 r% CO M, t 78 CO B4 477 On (T/ r t s. tFS CD
$4.129 CD H tw De
@ i e0 135 CD abiP CD
$P.1.11 Os W 43 43s CD na IM CO M' TE.136 De 1
1 us. i39 00-
- 6 7. 1.18 CD pg M 13e Os R 149 CQ 1 '
L.p ,) % 54: CD ri 147 CD y# FF.141 Os P1 144 CB De 145 CO - 76 14f Os (M i - we 847 ' CD 77.i43 CD - (M it 149 04 i PB '60 .CD 80 it' CD I St. TSP 04 N r af.153 _ ' CD - S1, tse CD DG e4. tan ce 1 1 e4. 9w - CD - 1 {t t) 00.567 CO
# 8 'M - CD as tse co .
M,.',90 - CD n
< er m Figure 4.3 LaSalle ATWS Event Tree 4-15
. . . - - _ . - . - _ - - - . _ . - - - - - - - . . - = - - -. - - _ - . .- -
Figure 4;3 LaSalle ATWS Event Tree (Continued)
- 1. If MFV -(main feedwater) succeeds, RPT ' (recirculation pump _ trip) f ailure will be negligible since it depends _ upon the same power sources _as MFV . If power fails MFV, then it will _ also fail the RCPs (recirculation pumps) . If RPT does fail, either PCS - (power--
conversion system) will have succeeded in which case we have an ok sequence or, if PCS fails, MFV will behave as in note (3) and the-RCPs will fail on low suction pressure (the peak pressures will be below level D stress limits)
- 2. If MFV fills, RPT is not relevant since RPV (reactor pressure vessel) level can not be maintained and the resulting low level -
will result in RCP failure on low suction pressure. Sequences transfer to (4).
- 3. MIN can not continue to run for more than about 8 minutes without
-depleting the main condenser unless the operator controls level.
- 4. Transfer sequences from (?).
- 5. Operators are instructed by E0Ps (cmergency operating procedures) not to use inhibit switch for ADS (automatic depressurization-system) but to reset timer,
- 6. For cases where no choice is given, ADS success or failure will not affect sequence timing or end result significantly, If the operator opens the SRVs (safety relief valves) to bring. pressure -
doun or auto ADS occurs due to low level, power wil'1 increas- from-about 12% to about 18%. LTAS code calculations, described in Volume 4 of this- report, - show that ADS and subsequent ilPCS (high-pressure core spray),- LPCS (low pressure core spray), or LPCI (low pressure coolant inj ec tion) injection _ will not produce excessive power spikes. Level will remain at about :2/3 -TAF, the-low pressure injection systems will inject enough to raise pressure above'their< i shutoff heads, and, if 11PCS is working, th y will remain shutoff since the pressure will not decrease back below their shutoff heads. If IIPCS is not working then oscillatory behavior results (mild pressure variations).
- 7. Containment pressure increases until containment failure occurs.
1 l: L o 4-16
> - . - . -~~--w.--= - .-:,.-., .~.s.. ..~~..u , - - . , . ~ . . .~. ., .~ ,-- ~. . - - - . . . . .
t - Rf5 WW R7 M3 I NL j $9LO l HPr$ l ADS l UCBl UCI ESC l CSS VEhT CRDI IRUP - SEQ # STAT.JS my l- f l f<) { StlRl ULT 5D 1 l I tt?' 1 0 31 netatws i on
@} I r or
-3 Os 1 4 os 4- CD 6 De rm i 7 to e a De 9 CD 10 08 u CD Ei 12 CD 13 Os W ,, i 14 is CD to is os tr to te to (0 . SE R,: On i me on 1 F1 W 04 FF 33 CD 71 to Os Et! 1 P4 m CD -
l M th D4 FB 97 CD F1. UR De I FIL W De a tz @ I 3L ILD CD (4) I 31 SW On (7) I a. 3r 101 CO l 1 33 10e Om I $8 '@ CD 36 im CD M.10' Or j 37. ith 04
] 3a. is os na tic CD 4a ut Os iD I 41.152 CD 1 1 42. H3 Os g 41 194 CD 44 l '8 CD 45 114 CD 46 11 F LD A7. Ha . 04 1
4a. De CD Ib, 45.123 CD Sc. 'Tt Da St 1Ft CD-( P) te 1F3 CD Si tre ca 84 1M CD 95 9 M CD SA iPF De W u
$9. tra CD So,179 CD
! se.130 . DW (91 x 30. t U CD 6' 137 CD
$7.133 Ou (M S3.134 CD ea tia CD
- a tas De b) i BA 13F CD 87.1'M CO.
(10) 0" 88 t'"op 09 CD I I pq ' 7tl tal CD
- 71. 142 CD g .. . PP.143 Ow
^
n sse CD
- 74. 146 - CD
- M 146 OW '
N r 75 147 CD PT. tes CD
- 78.149 On E i 75 150 CD 40 1S' CD
-01 167 Oe M i a2.143 CD s3 ine co .
Se 196 04 IlOI 99 tsa CD
=
i l' ') es nu co es. ins co 88 'Se CD 98 190 CD ist (i) t GP Q) l Figure 4.3 LaSalle ATWS Event Tree 4-15
F Figure 4,3 LaSalle ATWS Event Tree (Continued)
- 1. If MFV (main feedwater) succeeds, RPT (recirculation pump t rip) failure will be negligible since i t. depends upon the same powor-sourcen as M FV . If power fails MIN , then it will also fail the RCPs (recirculation pumps) . I f RPT does fail, either PCS -(power conversion system) will have succeeded in which case we have.an ok sequence or, if PCS fails, MIN will behave-as in note (3) and the RCPs will fall on low suction pressure (the peak pressures will be below level D stress limits).
- 2. ~f f MFV f a l l r. . RPT is not relevant since RPV ( r e.* c t o r pressure vessel) Icvel can not be maintained and the resul t ing low icvel will result in RCP failure on low suction pressure, Sequences transfer to (4).
- 3. MFV can not continue to run for more than about 8 rinutes viihout depleting the main condenser unless the operator controls level.
4 Transfer sequences from (2), S. Operators are insc ructed by EOPs (emergency operating procedures) not to use inhibit switch for ADS (automatic depressurization system) but to reset timer
- 6. For cases where no choice is given, ADS success or failure'wlil not affect sequence timing or end result signifteantly. If the operator opens the SRVs (safety relief valves) to bring pressure down or auto ADS occurs due-to low level, power vill increase from about 121- to about 184 LTAS code c al et.la t ions , described in Volume 4 of this report, show that ADS and suhnquent ilPCS (high pressure core spray), LP4 S (low pressure cora spray), or LPC1 (low pressure coolant injection) Inj ec t i on will not produce excessive power spikes. Level will remain at about 2/3 TAF, the low pressure injection systems will i nj ec t enoagh~to raise pressure above'their shutoff heads, and,_lf HPCS is working, they will remain shutoff since the pressure will not decrease back below their . shutof f heads. If IIPCS is not working then oscillatory behavior results ;
(mild pressure variations).
- 7. Contalnment pressure increases until containment failure occurs.
4-16
- __ ,,. . _ . . . , . - _ a_. _ - ._u.__. __ _ _
Rii W F"4f Rl9 l ST3 f F '. $W.E l ifT1 A:X4 I lJ' S l (JV1 $1C Il (35 lI VENT! l CRDil $RUP ULTSD l SL'R SFQ g STAn:s 1 PL, f 1 1 I I i (*: l 1 t I (' P) fW hCTe'W%
<- 6 og F g-I F 04 4
3 m 1 4 o.
& CD 4 Og
!" ! F C')
1 8 On 9 CD 10 Os It CO 17 CD (f ! $3 og rp 14 Cp n 56 t. n it Du 18 C ') 18 CD p' "- 19 EL' Os I pc 3 Ou I Ps W Os F# 5') CD F1 ed Oe
- I P4 SN CD 1 h EB 04 M 98 CD F'* Da I FB 6 De I Mw Os 741 3L 10' CD 31 1W Du n (D I 3/ 10 CD l 1 31 904 tis y
la 9Ch CD 2h 93 L L' W 10 7 Da l 17. hp 04 1 E la Os N. t ic CD aC t t ' on Ih 1 et M2 CQ l 1 42 D 3 05 4 5 S t4 CD l 44 ?16 cc eb HS Ca et.
- i F CD 4 P. 518 Os I
et '
- 5 t0
{p^ 49 57') CD ha 1t* On r $1 ' FF CD IU ' W 'f1 CD S.1 iPe De r ga, ip gg M 'N 00 g SF 17 ' 04 E S!, tN CD be. in CD
,, . De 13C Ou
' b- M 43' (D l' .11' CD B7 ill 04 E3 114 1
' to ea tu Ca g IIh t ie' De -
r y tjp to
$r N CD (ig er 139 (=
i M I4C CJ l (e i, % 24$ C3
- 71. i4e CO (9) PP 541 De r F3. ' 44 CD l ~ 7e.148 C7 M 14 De L' E, -
=,,.9 CD 1
.. c2
,p' FG 1*e 04 s r 4 ibe CD ec *)* Cp O' tV On 9' r 82 553 CD S't iM CD
(, g' 84 'M Om i F5 W CD 4 3 g,.3' L en. 'n t i Cn
'j 8 *. ' M CD M 559 CD H .'.9C C,: ,O w m Figure 4.3 LaSalle ATWS Event Tree 4-15
, _ _. m . - - . .._ _._ . - . _ _ _ . - . - _. ~.. . - . ._ _.m. .
1. Figure 4,3 LaSalle ATVS Eventi Tree (Continued)
- 1. If MFW (main feedwater) succeeds, RPT (recirculatiort pump trip) failure will be negligible since It depends upon' the n ame. - power sources as MFW.
If power fails MFW, then it will ' al f.o full the RCPs (recirculation pumps) . If RPT does fail', either PCS (power ; conversion systca) will have succeeded in which case we have an ok sequence or if PCS fails, MFW will behave as i n not e (3) and the-- RCPs will fail on low suction' pressure (the peak pdssures will be - below leve' D stress limits), 4
- 2. If MPW fails, RPT is not- relevant since RPV (reN. tor pressure i vessel) level can not be maintained and the resultlag low level l will result in RCP failure on low. suction pressure. Sequences -]
transfer to (4).
- 3. MfV can not continue to run for more than about 8 minutes without depleting the main condenser unless the operator controls level.
- 4. Transfer sequen- o from (2).
- 5. Operators are instructed by EOPs (emergency operating procedures) not to use inhibit switch f or ADS (automatic depressurization system) but t.o reset timer,
- 6. For cases where no choice is given, ADS ccess or failure will not af feet sequence timing or end result significantly. If the-I- operator opens the SRVs (sa fe ty relief valves) to bring pressure down or auto ADS occurs due to low level, power will increase from about 12% to about 18%. LTAS code calculations, described in-Volume 4 of this report ,. show that ADS and subsequent llPCS (high pressure core spray), LPCS (low pressure core spray), or LPCI (low pressure coolant inj ec t ion) injection will not produce excessive power spikes. Level will remain at about 2/3 TAF, the low pressure injection systems will inj ect enough to raise pressure above~their-shutoff heads, and, if IIPCS is working, they will remain shutoff ~ .
j since the pressure will not decrease back - below their shutoff I heads. If HPCS is not working then oscillatory behavior results J (mild pressure variations).
- 7. Containment pressure increases unt il contaitunent failure occurs.
d 4-16
& n . , - - . , _ , - ._-%g,, .y-., , , , . ,y -
...yy
Figure 4.3 LaSallo ATWG Event Tree (Concluded)
- 8. RHR (residual heat remc h ) and Venting success -
Containment pressure remains - N210w ADS reclosure pressure (90 psit, 321 F), Oscillatory behavior results from RPV pressure - exceeding low - pressure system shutoff heads, inj e c tion valves cycle (16 times /hr.).
- 9. RilR OK and Venting failure - Contaitunent pressure increases to ADS.
reclosure pressure-then oscillatory behavior results (100-psia, 321 F) from RPV pressure exceeding low pressure system shutoff heads, inj ection valves cycle - (11 times /hr. ) .
- 10. RHR falls and Venting OK - Containment pressure remains below ADS reclosure pressure (90 psia, 321 F). Oscillatory behavior-results from RPV pressure exceeding low pressure - system shutoff - heads, injection valves cycle (16 times /hr.).
- 11. RilR and Venting fail - ADS valves reclose at about 85 psig, RPV repressurizes above LPCS and.LPCI shutoff heads, boiloff and core damage occurs long before containment failure.
- 12. 'Upon containment leak or rupture to the reactor building, sovere environments may result in equipment failure.
- 13. Ultimate Shutdown -
Requires alternate rod insertion or Boron injection by some alternate means, 4-17
- . . . . ._ . . - - - - ~ . . . _ . . . - . ~ . . - . - . . - ._ . - - , . . . .
/ Table-4.5_ ' Value Block Changes for ATWS Sequences ; COMMENTS 3-24 87 $ COMMENTS TliiS VALUE BIDCK HAS CHANGES FO's ATWS SEQUENCES INCOPPORATED$ ' COMMENTS FOR FOLLOWJNG PATA' --$ 0.5 . $ OPFAILSCDS 0E $ 0.1 $ SLC0000X-QOO-0E $
.01 -$ OPERR-INITSPC $
0.1 $ OPERR-INITCSS $ 3.0E-02-$ S14CA-IE $ 3.0E-03 $ MLOCA IE- $ 3.0E-04 $ LLOCA-IE '$ COMMENTS OPPAILSCDS-0E WAS 5.0E-01 $ COMMENTS SLC0000X-QOO 0E WAS 5.0E-01 $ < COMMENTS OPERR-INITSPC WAS 1.0E-02 $ COMMENTS OPERR INITCSS WAS 1.0E-01 .$ COMMENT $ SLOCA-IE.WAS'1.0E-01 $ COMMENT $ MLOCA-IE_WAS-3.0E-03 $ COMMENT $ 1.LOCA IE WAS 3.0E-04 $ . COMMENTS END OF ATWS 3-24 87 CHANGES $
. SCREENING VALUES FOR POINT ESTIMATES FOR ATUS SEQUENCES
- Point Estimate Screening Value FWL - OPFAILSMFV-8M 0.5 RPS 1.0E-05/yr.
F i 4-18
= _ _ = _ _ _ .. _ , _ - - -_. - _ _.. __
t i 4. V ! 4.7 References
- i. . .
D. W. Stack, "A SETS User's Manual for Accident Sequence Analysis,"
~
- 1. ,
NUREC/CR 3547, - S AND83-2238, Sandia National Laboratories,._
= Albuquerque, NM- January 1984, i
I
- 2 .- R. B;-Worrell, " SETS Reference Manual," NUREC/CR-4213, SAND 83-2675, F Sandia National Laboratories, Albuquerque, NM, May 1985, l
.- ~ l 1 i l l' l l I 4 i r l P 4 9 4-19 ,,em. .<.,,4--- - , - . . - - . - - - .---...,....---,-.-----..,.-m, ee- . = _ , , - . --.--..,--...e -,-.-...---.,,,--w-m- z-wse,eir e = m - + e-eww.--,v
- - _ ~ -- - ~ . . - - . - - - .
l 4 l
-i
-5.0 OPERATOR RECOVERY ACTIONS At this point in the LaSalle PRA, we have identified a set of potential ;
core damage accident sequences. These accident sequences consist of equipment failures (e.g., pump fails to start and run, valve falls closed, etc.) and human errors (e.g., maintenance, testr etc.) and their estimated probabilities of occurrence. ?f we stopped at this point, the PRA would not accura
- ly reficct the possibility of potential core damage due
- an accident sec;uence . To accurately reflect this possibility, we must include events in the cut sets which represent the ability of the plant operators and other support personnel to prevent or mitigate core damage during the -
accident situation. These events are called recovery actions. A methodology fer including recovery actions in the LaSalle PRA was developed and reported in Volume 1 of NUREG/CR-48341 and is explained in detail in Volume 2 of NUREG/CR-4834.2 A summary of the methodology and its development follows. In the methodology, a recovery action is de fined as an action which must be accomplished by the operators (or others) to prevent or mitigate core , damage during an accident. It consists of two distinct phases:
- 1. a diagnosis phase - recognizing that a problem exists with one of the critical paramer- -nd deciding what to do about it, and
- 2. an action phase - physically accomplishing the action (s) decided upon in the diagnosis phase.
A new data-based model for estimating the contribution from the diagnosis phase for certain-type recovery actions was developed after (1) examination of existing models Indicated a heavy reliance upon judgement data and (2) results from statistical testing of observed operator bebavior indicated a lack of correlation to the corresponding judgement data. This new data-based model for the diagnosis phase was developed using information obtained from simulator drills. These simulator drills were based cn preliminary results from the LaSalle PRA. - These _ preliminary results were used to define realistic plant-specific accident scenarios which - could potentially lead to core damage. The drills were used to=obtain time data on the operator team's ability to respond to the accident scenario. This time data, along with the grouping of operator actions based upon the under lying operational similarity of the actions, provides the basis for j the model of the diagnosis phase of the recovery action. It was concluded that existing models for the action phase of the recovery action could be used, i The recovery methodology can be summar ced as follows: 1
- 1. Appropriate recovery actions are identified. This includes both recovery actions which are to be placed directly on the event 5-1
trees - or - f au' t trees- and recovery actions which result from _ examination of the information contained in the cut sets.
- 2. For:the recovery actions which are not included in the event trees or fault trees, a unique event representing the recovery action or et of recovery actions is defined and then added to the
-ppropriate cut' sets.
- 3. The recovery actions are modeled as consisting of a diagnosis phase and an action phase.
- 4. Estimates of the failure probabilities for each phase are provided using separate models (i.e., the diagnosis phase uses the . data-based models deseloped from the simulator data and the action phase uses existing models).
- 5. Estimates for each phase are combined to produce a single non-recovery probability.
- 6. The effect is that the original cut sets' failure probabilities are multiplied by_ the non-recovery probability of the recovery action (s) to give new cut set failure probabilities. The new cut set failure probabilities now reflect the operators' contribution in reducing or mitigating core damage.
5.1 Annlication of the Recovery Methodology As stated above, the recovery methodology used in the LaSalle PRA was developed in NUREG/CR-4834.1 Figure 5.1, Figure 2.1-1 of Reference 2, provides a flow chart for the application of the recovery methodology. The following sections describe how - the recovery methodology was implemented for the lasalle accident sequences. Before the sequence can be analyzed to determine whether the operator can intersene to restore failed equipment, the assumptions regarding types of operatot recovery actions must be defined. We have included the-following recovery considerations in the LaSalle Unit 2 analysis.
- 1. Failure Mechanism: The fault trees were developed to a level of detail that allows us to_ identify recoverable _and non-recoverable faults. For example, " local faults" of a valve generally included.
a mechanical failure of the valve that precluded any operator recovery, either remote or local. " Control circuit faults", however, have recovery potential by the operator actions - of identifying the problem and possible manual opening or closing of the valve. In general, extraordinary actions'were not considered unless they were clearly indicated as being needed and sufficient time was available to perform them, 5-2
s t er 1 Identaf y appropeaete Retevery Actioe Etet 2 1' Apply tetevery actaon to Cut Set 3 tot 3 1' Cttsin totiaste f or pocovery Actaon jles e ttet 10 1' Dasanosis Phase action Phase Battmate a s t ke.a t e
~
S t et 5 1' stor e P 8staaste 7tme Tg Identif y Crowy which Ta is the haJe ssur Time Be s t Describes avsalatie to Cosglete secovery Action both Phases of the Recover Artier ste 1 Y Deterv.ine ta. Ta is the Time lequired to Peytisa ly Accomplash the Ac tion Phase Iter 8 1' Estamate Time Avellable to Diagnose Recovery action (Tcl by; To e Tg - Tg Stet 9 Stet Il l' Obtain Retimate of Istimate the Failure Pollure Probability Probability for the I 4 f or tre Dissnosie action Phase P(EA) Using Pthase P(ED) et the handbook er Time To Other appropriate Sowrte fler 12 Settmate the Total railure Probability
; f or the pecovery ;
&ction P(53) by f P(E3) e P(ND) e P(RA) l - Pft")P(EA1 1
1 1 1' Stet 13 Regwantify the Cut Set by A ltiplying the Original Cut Set trprese hen by P(53) Figure 5.1 Recovery Methodology Flow Chart 5-3
. . - - ~. . -~ . -- --- .- - - - . - - . - -
- 2. Failure timing: This can be subdivided into two categories:
-4. .The time of the failure with respbet_to the accident scenario (i.e., the time to the onset of core ~ damage), determined, in part, the state of the operator and his ability to cope with the failure. To pick two extreme examples, much less-~ credit would -be given to a recovery action that had to occur within '
the first two minutes of an accident sequence than to the same type of action that must occur within the first eight hours of an accident sequence,
- b. The time to the " Point of No Return" for equipment damage is-also a factor. Some failures- are not immediately catastrophic. Many support system failures will ' cause a front line system failure only af ter a period of hours has gone by. Thus, if the _ operator receives warning of a problem developing, he may have sufficient time to diagnose and correct the situation.
- 3. Failed Equipment Location: For operations outside of the cor. trol room, the. operator must have definite indications of a problem with the system of interest and sufficient time to take corrective action, For most locations at LaSalle, an additional ten minutes over the control room time is sufficient for the operator to reach the location.
- 4. Number of Recovery Actions: Credit was not given ~ for multiple recovery actions unless the actions were performed by a different set of indivr ls or were distinct enough or separated by a large enough time interval to be regarded as independent, -An example of the first case is the recovery ' of offsite - power which was considered as being performed independently of other onsite recovery actions. An example of the second case is _ recovery of injection in the initial phase of the accident-and then recovery of containment heat removal in the many hours ' available until -
containment failure. 5.1.1 Idcntification of Possible Recovery Actions-It is recognized that some recovery actions were included -in . the event trees and the fault' trees. The recovery actions included in the event trees were operator actions that were necessary to model certain_ accident sequences. The recovery actions; included in the fault trees were generally high-level procedural actions. The recovery actions included in the event trees or fault trees are listed in Table 5.1. -The remainder of this section deals with the recovery actions which were "ANDED" to the sequence' cut sets resulting from various SETS _ runs. 5-4
Table 5.1 Recovery Actions froin Event Trees and Fault Trees 1EDC2DEP-FROP-4 ADSMINIT-QOO-0E CRD- REALIGN-0E CRD1-REALIGN-0E MFS-RESET-0E MODESWTCH-C-0E-0 OPERFAIL-VENT-0E OPFAILSCDS-OE OPFAILS-REOPEN TDRFP T-0E-0 - ADS-INH 1 BIT-0E SLC0000X-QOO-0E SLcC001B-QOO-0E OPERR-INITCSS PERR-INITSPC 0PFAILSMW-0E 5-5
- - . . . . _-..- _ - - - ~ - - ~ - . - - . - - - . - - - - - . - -
One of the - Lirst tasks which must, b'c accomplished to take credit for-tecovery actions is t o' identify the potential recovery -act ions. For 1.aSalle this was done by:
- 1. Identifying the basic event failures which were recoverable and 2 Examining the cut sets to determine if any other potential recovery actions existed.
Using the Variablo Occurrence Table (VOT) from the SETS run for . each sequence, the basic events were examined to determine if they were potentially recoverable. 11 a basic event was found to be potentially recoverabic, it was identified as recoverabic and was init ially grouped depending upon what type of action was necessary to accomplish the recovery actlon. This .lucluded identifying whether the action could take place in the control room, locally within the plant, or some place else. Table 5.2 is a sample of a VOT from a SETS run with the basic events ident ified as either recoverable or non-recoverable, and if recoverable then recoverable from the cont rol room, locally, or some place else. i l The basic events which were identified as recoverabic were grouped into cat egories depending on whether t hey were recoverable from the control room (RA-1 type actions), locally (RA-2 type actions), or some place else (e.g. , l RA 8 type actions). Ta'les 5.3 through $,7 list the basic events which were grouped into a specific recovery action type (e.g., RA-1 type actions are listed in Table 5.3). In addition to the recovery actions resulting from oxamination of the VOT, other recovery actions were identi fied af ter l ' examining t he cut sets Table 5.8 lists these recovery actions. l j .i 1.? Appl!catton of Recovery Actions to Cut Sets i After the basic events were identified as recoverable or non- recove rable , they were prioriel: ed to faellitate the applicat ion of t ho recovery nctions l to the cut sets. The order of priority was roughly in order cf their ! probabilit y wit h the easiest actions being taken credit for first (i.e., the lowest non-recovery probability act ion- that- is, the highest recovery probability act'on was taken credit for firnt). If two nctions were-possible and they could be considered independent of each other, then credit wculd be given for both, it should be noted that if restoring offsito power (i.e., RA-8) was a potential recovery action, then taking credit f or at least one more recovery action in the same cut set was.always possible (see section 5.1). After- priorittring the basic events, a global search through the computerized list of cut sets for each accident sequence was conducted to identify each occurrence of a basic event , If the cut set containing the basic event did not have a recovery action, then the recovery . act im associated with that basic event wu "ANbMD" to the cut set If the cut set already conta.ned a recovery len that had been identifled . by this b6 I
- - - - - . ~ - - . , - - - - - - . - ~ - - , - . - - . . .~...,,---,n -, - --
Table 5.2 Saxtple VOT with Recoverable Basic Events Identified FVI NT th i ME IDENTIFIFR LOCATION LCSC002A-P-UUM NR 1AR10RCA-R00-LFO RA 1 CR LOSP-1E RA-8 OTnER
- T101 IE NR CODGolF PLC-LF NR CODC0lP-PMS LP NR CODG0lP-PMS-CC NR CODGOlF S UUM NK CODC01P.P-UUM NR EE-CODG01F-PLG NR CCBODG1P BCO LF NR RLOSP RA 8 OTilER 1EB235XA BCO-LF NR 1EB235A-BCO-LF NR AP037X3 ROO-LFO RA 1 CR DOVB101X-BCo LF NR llACTR3 ROO-LFO RA-1 CR CSCD300 PIE-LF NR APO40X3-R00-LFO RA-1 CR 1AK9ARCA-ROO-LFO PA 1 CR 1AKlBARA-R00 LFO RA-1 CR 1AR9BRCB-R00-LTO RA-1 CR IAK18BRB-ROO-LFO RA-1 CR LAK3BRCB RCO-LFO RA-1 CR llCFF004C-VCC LP NR llCSF004C-VCC CS RA-2 LOCAL HF004CB-BCO-LF RA-2 .'OCAL llACTC PF) - FUS - LF RA 1 .R liACTC PF2 - FUS - L/ RA 1 CR HACTK9-ROO LFO RA-1 CR DCO-GEN-LF RA-9 LOCAL DGO-CEN-CC RA 9 LOCAL DG2A-CEN-LF RA-9 LOCst DG2A-GEN-CC RA LOCAL 5-7
Table S,3 3 luisic Events Which Were CatcKoilzed
- m. RA 1 Type Act tons
. _ . . . _ . _ . . _ _ _ _ . _ _ _ _ . _ . _ _ _ _ _ _ . _ . ~ _ _ _ . - . . _ . - _ _ _ _ . . _ _ _ . _ . . _ _ .
I l'.4 3 6 ? S 1 - 1100 1.I'O I AK1OkCA 1100-1.10 1 f.4 % 7 S ? - 1100 - 1.10 1 AK10 AC P9 - 1.F00 l l:4 3 ? / SX - R00 1.10 1AKl 8 ARC-It00 lfo 1f.437/SY ROO Li'O l AK 1 B AllA - ROO Li'O lEBlYlX hCO 1AKl8111tB R00 lJO 1Eb2Y4X BCO lAK18ACPI ISOO
?l3CB16 BCO l AKl 8BC PI - LF00 Al'04 0X 3 - It00- !JO 1AK21bRB-R00 LEO A P03 / X 3 -it00 - 110 IAK21 ARC R00 l#0 AP03/X3CP7-IJ00 I AK7 3 bP C- R00-ISO Al'040X 3 G P 7 1100 lAK?$CBR-itOO !JO AP03/X4 CPI 1.1CO 1AK78ACXCP4 LI CO APO40/,4 cpl 1.FC0 1AK28hCXCP4 LPCO ADARK9h 1100 l#0 1AK /0 ARA ROO-110 ADARK1OB 1 00 1JO lAK70BRB-ROO'IJO ADARKl?B It00 IXO 1AK105Ch-R00-ISO ADARKMB ROO-LEO 1AS44AX-QCO llO ADARK 3815 -It00 - lJO 1AS44BX-QCO ISO ADARK39B ROO IJO LCSKlARC RCO LFO ADSACT ItOM-16 LCSKl?AR R00-if0 ADSACT-IllH 18 ISSK14 Alt 1100 LFO ADSACT-lh Tl?001 IIACTK3-R00 Li'O ADSACT-1B TI:007 llACTK9-ROO LFO ADSACT RE001 B llACTK3CP9 LF00 ADSACT ItE00? B llACTK9CP7 1100 1 AK?ARCA-RCO 110 ilACTCPF; FUS-LF IAK2BRCB-RCO-LFO llACTC P F7 - l'US - 11 2 IAK3ARCA-RCO-ISO llF001CCB BCO lAK3BRCll RCO-1.F0 llc 01 K 14 -ROO- LFO IAK3ARCXCPl-ISCO RACTK3-R00-IJ0 I AK 3 BRCXC PI - LFCO RACTK5 R00-LFO IAK9AltCA R00 LFO RACTK17-R00-lfo IAK9BRCB-R00 LFO lAK9ACP3-lE00 1 AK9 BC P 3 - LF00 5-8
___ . . _ _ . .._. _ _ _ _ _ __ ._-__ _ _ __.__.-. _ _ ____.~._._m__ .____.._.m.___ Table 5.4 Basic Event s k'hich k'ere Categorized as RA-2 Type Actions 1 1 CSCr068A VCC CC PJIRF47AA RUM 1 CSCF0688 VCC CC RilRF47BB RUM 1 CCBF068A ICO LF RilRP48AA V00 CC CSCB068X BCO*LP RHRP48BB V00 CC llACTK13 CPS- LFC0 Rilid101AX RUM 1 HACTK13CP3-LFC0 RilR1101BX RUM-1 IICSF004C VCC Cf. RHRF55AX RUM 1 IICSF015C VCC CS kHRF55BX RUM 1 IlCSF023C VCO CS RilRF51AA RUM 1 IIF004CB-BCO LP RilRF51BB RUM 1 , ~ llc 015CB.11CO LF RllRF60AA RUM 1 llF04CSC-QOC LF Ri!RF60BB RUM 1 LAK14 ARC.RCO LFO RllRF65AA RUM 1 i IAK14BRC RCO Li'0 RllRF65BB RUM 1 i 1AK93 ARC.ROO-LFO RilRF64AA RUM-1 1AK93BRC ROO LFO RllRF74AA RUM 1 1AK93ACP3 LFC0 RilRF74BB RUM 1 1AK93BCP3 LFC0- RllRF87AA RUM 1 IAK105AA R00 LF0 Ri!RF87BB RUM 1 l 1AK105BB ROO LFO RilRF88AX RUM-1 LF5K8AR-R00 LFO SCSF06AA. RUM 1 IAK10BB ROO LFO SCSF06BB RUM 1 LCSC002A-RUh 1 RilRB03AX BCO LF RHRC003B RUM 1 RHRB03BX BCO LF ' RllRF64BB RUM 1 I t 5-9
- . .- . . :_..._-.-.- ~ . - - - _ _ _ _ .. .., , ,_ _ . _ - - , ,-- - - ,, c . . . -
Table 5,5 Basic l: vents Vbich Wero Categorir.ed au RA 8 Type Actions II)SI'-1F. RIOSP 1 r l f Table 5.6 Baule P.ventu Which Were Categorir.ed au ItA 9 Type Actlons DGO GI-;N LF DGO GEN CC DG?A-GF.N LP DG2A-Gl'.N CC DG2It Gl:N 1.P DG21b CEN- CC ( l I. Table $.7 Banic 1: vents Which Were Categorized as l<A-15 Type Actions DG-CM 5-10
- m. .._ ___ __
Table 5.8 i Recovery Actions Identified Af ter Examining the Cut Sets I 1 Action
- Description I pA 1 Manual operation of a sys t ers or component from the control room.
RA-2 Local operation of component s. RA-3 Open RCIC isolation valve (s) after RCIC room isolation. RA-4 1solate recirculation pump seal LOCA 6@ rutore PCS. Rh SV Vent through alternate vent path, i RA-6 If one electric power train has failed, one half of the i time the recirculatlon pump LOCA will occur on the ; recirculation pump vitich can be isolated. Isolat.c recirculation pump seal LOCA AliD restore pCS. RA-7 Open a manu.1 valve that is closed due to unscheduled maintenance. RA-8 Recover off-site power. RA 9 Recover DC - af ter loss of off-vite power and failure of DG. RA 10 Replace a fuse in the control room. RA-11 Manually close SBLC valves after the occurrence of an ATWP, given failure to close the valves following a previous test on the SBLC system. RA 12 locally close RWCU valve after the occurrence of an ATWS, RA 15 Repair of DG common mode failure. RA-16 Manual start of a DG from the control room and then manual start of an SBLC pump af ter the occurrence of an ATWS. I RA-CDS Use condensate system. RA DDFp Use diesel driven firevater pump.
- RA-13 and RA 14 not used.
5 11 _ _ _ _ . _ _ _ - _ - . _ _ . _ . _ ~ .
p r oc c a. s , t he n no additional recovery action was added unless the actions could be considered independent. This process was continued until all the t ecovet able basic event s were examined. 5.1.3 Obt ain 1:st imat e for Recovery Action After the recovery action identifier was applied to the cut sets, we obtained estimates for the failure probabilit ies of the recovery act ions. Since the recovery actioon were modeled as consisting of two phases (i.e., diagnouis phase - and action phase), each phase was estimated usiny, appropriate models. The following sect ions discusa how est.imates f or each plunie were obt nined.
*) . i.3.1 Diagnosis phase Latimate Two tasks had to be accomplished before the diagnosis phase failure probabi11ty of a recovery action could be estimated. First, where possible, we identified the group which best described the recovery action of interent by searching Table S.9 (Table 2.1.5-1 in Reference 2). Second, we est imat ed the tinic available for the operators to diagnose the tecovery action, These tanks are described below.
5.1.3.1.1 Identillention of Group Which best Describes Recovery Actit.n To ident i f y t he group that bent described the recovery action, we examined ' j the actionn in each group in Table 5.9 and chone the group that. contained actions that were most similar to t ht- recovery action of interest or for which the group desc ript ion was judged to be the best. ina t c h . If the ; recovery action could not be described by one of the groups in Table 5.9 or L if specific data existed for the recovery action, then other models were uned t o pr ovide est imates for the recovery actlon. For example, basic e v e n t: ApO40X3 ROO 1.FO f rotn Table 5.2 represents a failure in the automatic operation of diesel generator "2A". Searching Table S.9 for the actions which are most similar or the deneription which best describes the recovery action, we found that tho action was best ' described by Group 3: Manual operation of systems or component s which tailed to automat ically actuat e (operate). This process was repeated for each basic event in Tablen 5.3 and 5.4. In addition, the recovery actions i listed in Tables 5.1 and $.8 were examined to determine if they could be ; i described by the groups in Table 5.9. Table 5.10 list the recovery actions identified by this process. 5-12
Table 5.9 Sww.ary of Ten Groups of Crew liecovery Act ions' Stew *4tsultilta st.tutten &e tiont I seen.al e,erstion of erstem *r eens = ent 1. Drill 1 - Inittete exa af ter arvs. to control e cr6tteel par.neter trier t. Dett! # & Is -- Inittete se eseling aftee er tent. to the automalle na tuetten (if it has 3. Drill 3 - Initlete DCIC af ter stetten blacW1. auteestle estuattee) of the pretse or 4. brill 4 - Inittete EP teoling ef ter (cla leads. eeeyonent. 5. Drill 4 -- Close W38te af ter 8evel 9 alars.
- 6. Drill 6 -- Clees PV enlee la after Lasel ? ale.re.
- 1. Drill 6 -- Init tete SP emoling af ter 83 trip.
- 4. Det11 4 Inittete t? emeling after Et trip.
3 Dee of new pesemurs erstees Wien high 1. Dellt 4 - t*pressuriae af ter Sc!C f ailurs, pressure erstmo are unavailable. 2. Drill 4 -- lajec t LJ siter DClc f atture. 3 thenud operet tem of erstene or 1. te til 3 - Ber 4 6-enn te open roll af ter p013 f ailues. e osrponent s whle h f ailed t o 1. Drill 4 - Booet Klc teoletten af ter DC la leads. automat te e tly es tuste (operstel . 3. Drill 4 - Eequest DCic investigetlen af ter SCIC f ailure. a testerstion of saf ety-selsted 1. Dr6113 - tequest tc 0 repelr af ter etetten blackout. And suso eteettleal tunes er egly 3. t rllt 3 - Request tc le espelr af ter stetten blackown. 6,wi pees.t . 3. Drill 3 -- Bequest IC la repair af ter stetten bleaWL.
- 4. Drill 4 .. Betweet Ic 10 evpelr after SAT failure.
- 5. Drill 4 - Decover tc la ef ter Ic 14 trouble.
- 6. Drt116 Sequest EC & Levestigation af ter IC & f ailure.
5 bestorat ion of of f-ette.oupplied 1. Dr!!! 3 -- toquest 8-tle efter stetten blac h t. sumeafety-related electrical neees 3. Drill 3 -- toquest LAT repent af ter stetten blackout, or supply ogwipner.L. 3. Drill 4 .. Request SAT reystr efter SAT failurs.
- 4. Drill 4 -- togwest 3-41e after &&T failure.
S. Drill 4 - Seeters tus lit leestly after 82 trip. 6 aLanual kne buy o f an aut ene t te 1. All Dritto - mode owlteh af ter DJ trip. ohut deun f unc t ies . 3. All Drille -- Manuel stree after 32 trip. 8 marnual override of a systeus that 1. Drill 1 - Jueror VP af ter drywell leelellen. out eest le nt l y f unc t ione n 3. Drill 4 -- 8estere vp af ter drywell toelettom. aut oest le ope re t t en of t he s y s t em 3. Dr!!! 6 . Sentere VP af ter tc A f ailure. would shelterse e erntleal parameter. 4. Drill 6 -- testers vp af ter arywell tentation. 10 tequest to use last inne of (cAs&ACS)ese 1, pyggg 4 .- leptweeutleatlen ef ter stallen blacht. erstems f or level teatrol. 3. Dell! 4 -- tequest diesel fire rump af ter eletten blackout. 11 f.oca.1 eperetten of enanually eentrslied I. DrLil 3 & 28 - send t-man to sleee SDv valves eseconente persally operated f ree the ef ter screa reset et t empt. eentrst room when control-esee 3. Drill 6 -- toqueen str restorstion after eerette operettam f alle, mir pressure new stars. Il enanual overe nde of a f atte esetrol 1. Drill 4 - Request bypass of eclC leeletten af ter scit signal W n se direct indleotten toeletten because of rete overhoting. emnets that the comtrol signal le f alse or erreneews.
*The Llose listed to thle table e,of er to the terrwet dietneste of the requirwd setten, essee terreprending table (Tables 3.1.9 1 through 2.1.5-10) for informatten to be used in settmating. *** gat &AC8 erstems are those systeme which are used only an e test resort to prevent sere danego. These systems leject *dlety* (nontsteter grado) erster into the vessel one are used only if me other emanne of injeetle6
- ster into the vessel are evallable.
1 5-13
a Table 5.10 Description of Rocovery Actions Based Upon FAamination of Group Descriptions in Table 5.9 t i Arlipn* Crnup DettqJiption Identifier 4 HA 1 1 Hanual operation of a system or compo. RA 1 1 ! nent from the control room that has no automatic actuation or prior to its automatic operation if it has automatic actuation. RA-1 3 Stanual operation of a system or component RA 1-3 ! , from the control room which failed to autountically actuate, i RA 2 11 local operation of manually controlled RA 2 11 cotrponents normally operated from the _ , control room when control-room operation fails.
! RA 2 3 local operatien of a system or component RA-2 3 which failed to automatically actuate.
RA 3 12 Open RCIC 1. solation valve (s) given RA 3-12 occurrence of RCiG room isolation. RA 5V 1 Vent t.hrough alt ernat e vent,. path. RA SV 1 RA-7 1 hocally open a manual valve closed due RA 7 1 ,, to unscheduled maintmance of a pump, Restores heat removal, RA 7 3 Locally open a manuai valve closed due RA-7 3 1 to unscheduled maintenance - o f a pump. Restores injection. , RA-10 1 Replace a-fuse in the control room in a RA-10-1. system or component that has no automatic operation or prior to'its automatic
- operation if it has automatic operation, RA-ATWS 11 11 Local operation of manually controlled SBLC RA-ATWS-11-11 valves normally operated _from the control room when control-room operation fails.
RA-ATWS-16 3,1 Manual start of a DG from the cont ol room RA ATWS-16 31 and then manual start, of SBLC pump. 5 14
-_ .- =.___-.---.--._,.-a.-.-...-...-._,, . - . .-.- .-.-
l l l Tatd e 5.10 (concluded) Description of Recovery Actions Based Upon n atuination of Group Descriptions in Table 5.9
/tttin n' qtopn .Hererirtion Id tn1JJ.ler RA-ATWS-1 3 Manual operation of a syst eta or coroponent RA A1VS - 1 3 f rotu the control rootu which failed to automatically actuate after the occurrence of an ATWS.
RA NIWS-? 3 Local operation of a system or component RA-ATWS-? 3 which f ailed t o automatically actuate after the occurrence of an A"VS. RA-ATWS-12 3 Locally close the RWCU valve after the PJ\ NIVS 3 occurrence of an A1VS, RA-CDS 2 lujectlon of water into the vessel via RA-CDS the condensate system. RA-DDlV 10 Inj ec t ion of wat er int o the vessel via RA-DDIV the diesel driven firewater pturp.
- RA-4, RA-6, RA-8, RA-9, and RA-15 are data based and have no r,roup assoclatlon, i
5 15
5.1. L 1. 7 Eut imat ing Time Tn in order f or as t o be able to estimate the amount of t ime available for the , di agnos t- phat,e of the recovery r.ction, the ma x innun time available to the operators must he estimated. This max imtun t ime , Tn, is the time during -; which both phases of the recovery action (i.e., diagnosis phase and action phase) must he completed to eru ut e the ptevention or mitigation of the l undesirable outcome. Tn was estimated using thermal-hydraulic computer j codes to provide information on core or c on t a i ntpent parameters (e.g., pr essus e, temperatute, water !cvel, etc.). Table 5.11 list the estimates l j of Tn that resulted from the thermal-hydraulic calculations. In Volume 4 i of this report, the renults of the calculations are discussed in more i detail. i S I.3.1.3 Determination of T 3 ! i After ost Imat es of Tn were obtatoed, the amount: of time required to physically accomplish the action (sp decided upon during tho diagnosis phise van de le t mi neel . Thin time, T 3, was est imat ed as t he maximum amount of time r quited by the opeintor(s) to reach the area where the action takes place j plus the time required to accomplish the action (s). The t iene required to l accomplish different classes of actlons is presented in Table 5.12. 1 i l 5 .1.1.1. 4 Est imat e Time Available to Diagnose the itecovery Actlon, To The following expression was used to estimate the time available to diagnose the recovety actlon: Tn - Tn - T ,4 whe re
'I n ' ' t he maximwn t ime in which bot h phases of the. recovery action must i be compl e t e: to prevent or mitigate an undesirable outcome during the l accident, and l T4 fu the time iequired to physically accomplish the actlon(s) decided upon in t he diagnonis phase i I
l l Table 5.13 list the possible diagnosis t. i me s f or the 1.aSalle sequences. 5,1.3.1.5 Est imat e failure Probabilit y for Diagnosis Phase P(ND)_at To Given that the group which best descrlhes a recovery actlon has been identified (Section 5.1.3.1.1) and the amount of time available to diagnose the recovery action han been es t iinat ed (Section S.I.3.1.4), the failuro probability for the diagnosis phase of the recovery action was determined by: i
t Tabic 5.11 l Estimates for Tg Resulting From l Ther'aal Hydraulic Calculations ; i Scouence ,Ir_ Notes T12 27 hours 1, 6 2 hours 2, 6 : T24 27 hours 1, 6 6 hours 2, 6 T30 27 hours 1, 6 6 hours 2, 6 T40 27 hours 1, 6 6 hours 2, 6 TSO 23 hours 1, 6
-2 hours 2, 6 T59 8 hours 3,7,8 10 hours 4, 7, 8 T64 27 hours 1, 6 6 hours 2, 6 T76 27 hours 1, 6 i 6 hours 2, 6 T88 23 hours 1, 6 ;
2 hour; 2, 6
- T97 1 hour 5, 9 i T98 80 minutes 5, 9 TL16 27 hours 1, 6 ,
2 hours 2, 6 TL30 27 hours 1, 6 6 hours 2, 6 TL36 27 hours 1, 6 6 hours 2, 6 TLA 5 - 27 hours 1, 6 6 hours 2, 6 TL54 23 hours 1, 6 2 hours 2, 6 TL62 8-hours 3,7,8 10 hours 4,7,8 TL68 27 hours 1, 6 6 hours 2, 6 TL80 27 hours - 1, 6 l 6 hours 2, 6 TL92 23 hours 1, 6-6 hours 2, 6 TL100 48 minutes 5, 9, 10 TL101 54 minutes 5, 9, 10-L16 15 hours 1, 11 4 hours 2, 11 5 _ _ _ _ _ _,. _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ . , . . , _ _ . _ . _ _ . . , , . , - . - - - _ . -
l Table $,11 (concluded) l'.st innat en f or Ts llenut t ing l~ rom ; Thermal-ltydraulle Calculat iotu. 1 l EtquenCA L lhicii l
- 1,30 la bours 1, 11 !
4 hourn ?, 11 l l l NOTES: 1 - A$ount of t ime to r est ore cont altunent heat ! reinoval or begin itijectiots of water itito the vessel, :I 2 - Amount of t.ime to begin vent itig the cotitaltunotit. 3 - Actiount. of t iltic to begin inject ion of water into the vennel when no AC power la available. 4 . Amount of time to begin injection of' water into the vennel when AC power is initially available, S - Amoutit of t.itne t o rest ore injection of water 11:t0 the vessel. 6- 1.TAS calculation (long- t e rar loun of CllR , high pressure inject ion available) 7 - 1.TAS calculation (long-terin loss of CllR, itCIC only) l 8 LTAS calculation (long-term loss of Cllh , low prenuure itiject ion only) 4 - itEIAP calculation. 10 1.TAS calculation (small break, s t e nin) 11 - 1.TAS calculation (small break, liquid) l l l l S-18
Table 5.12 T3 for Various Classes of Actions T3 Destription of Action 2 minutes Start or stop a systern or component from the control room. 2 minutes change the state of an operated valve from the control room, l$ ruinutes* Locally (i.e , away from the control room) start or stop a system or component. 15 m i nut e s *- locally change the state of an operated valve -- given that control room operation of the valve is impossible. 15 minutes
- Locally change the state of a manual valve 15 mit.utes Use the condensate system.
I hout Use the diesel driven firewater pump.
- The 15 in i tm t e s includes (1) 10 minutes of travel time and (2) 5 minutes to physically accomplish whatever action is required. The 10 minute travel time is based on a plant walk through by people who were not familiar with the plant layout and as such is considered to be a c o tis e rva t ive estimate of the amount of t irne the operators tieed to travel from point to point within LaSalle 3-19
Table 5,13 l'ot.ential Diar,nosis Timon Tn .TA I(* 27 hrs 2 inin 26 hrs 58 inin 15 min 26 hrs 45 min 23 hrs 2 rnin 22 hrs 58 rain 15 min 22 hrs 45 min 15 hrs
- min 14 hrs 58 inin 15 min 14 hrs 4'> inin 10 hrs 2 inin 9 hrs 58 inin 15 iniu 9 hrs 45 inin 8 hrs 2 inin 7 hrs $11 min 15 min 7 bra 45 inin
(, hrn- 2 min 5 hrs 58 min 15 rain 5 bra 45 rnin 4 hrs 2 min 3 bra 58 inin 15 inin 3 hrs 58 min 2 hrn 2 min I hr $8 inin 15 min 1 hr 45 inin 1 hr 1 hr 80 inin 2 inin 78 min 15 inin 65 min
'I hr 2 min 58 inin 15 min 45 min 54 rain 2 min 52 min 15 min 39 min 4tl min 2 inin 46 inin 15 min 33 rain I
l l l l f' 5-20
- _ _ - - , . . _ . . . . . . _ . . - _ . _ . . . _..__.__..._._m.-_.. _ . . , , , . . . . , . , _ . . _ _ . . . . , , _ _ _ . _ , , . . - , , _ . . . . . . , . . _ - . . . _ _
l (1) identifying the table from Tables 2.1.9-1 through 2.1.9 10 of Reference 2 that corresponds to the group identified in Section 5.1.3.1.1, and (2) by following the p r oc e dure:. recommended by Reference 2 for using the inioimation cont ained within the table to obt ain an est imate of t. h e diagnosis failure probability for a particular recovery a c t. i o n . The procedures from Reference 2 are summarined as follows: (1) In the probabi11ty of fallure column of the table identifled above, select the median value of the failure probability ( P ( ND)-n.n) that corresponds to the amount of time available to diagnose the recovery action. If the amount of time available to diagnose the recovery action is greater than the last time specified in the table, then use the probability of failure value that corresponds to the last tiine in the table (2) Calculate the error factor (EP) associated with the probability of fallta; value identified in step (1). This is accomplished by dividing the corresponding value of the upper 95% confidence limit by the probability of failure value If this calculated error factor is greater than 10.0, a value of 10.0 is assumed for the error factor. (3) Ca l e t.l a t e the mean value for the diagnosis fallute probability (P(ND) ,,n) at time Tn using the EP from step (2) and the median ' 5 value from (1) by the following formula which assumes that the distribution at a certain time is log normal: .e P ( N D ),,,,n - (P(ND),y,n)(exp( [ ln EP/1. 645 )2/2 )) 5.1.3.2 Estimate the Failure Probability for the Action Phase, P(NA) Estimates for the failure probability for the action phase P(NA), can be computed from any number of dif f erent sources For application to RMIEl', the models and information summarined in Chapters 5 and 20 of Reference 3 (also referred to as the llandbook) were used. 5.1.3.3 Estimate the Total Failure Probability for a Recovery Action, P(NR) J s After eatimates for the diagnosis phase failure probability (P(ND)) and the action phase failure probability (P(NA)) were obtained, we calculated the totai fatture probability for the recovery action, P(UR). The failure probability for the recovery action is calculated as the probability of 5-21
i [ L either falling to diagnose the appropriate action or falling to perform the recovery action. P(NR) is calculated using the following expression: I P(NR) - P(ND) i P(NA) P(ND)P(NA) , where P(NR) is _ the failure pr >bability for the recovery act ion, P(ND) in the failure probability for diagnosing the required action within time Tp, and , P(NA) lu the failure probability for physically accomplishing the i action within the time T 4. 5.2 Lutple Citlntiat ion As an example of how an estlaate of the failure probability for a recovery action was made, consider the basic event 1AK93 ARC H00-LF0, The event represents the failure of a norrnally open motor operated valve to close and , to remain closed given that it is deiaanded closed. The valvo in question is normally controlled manually from the control room. The failure prohnbility la cutimated as follows:
- 1. Table S.9 is searched for the group which best describes the recovery action, in this case group 11,
- 2. From thermal hydraulle calculations, it has been dotormined, for the acquence of interest, that the maximum amount of t i ene available to the operators is 27 hours i.e., Tg- 27 hours,
- 3. From considering the physical actions required to accomplish the '
recovery act. ion, it is estimated that 15 minutou will be required to accomplish the action i.e , Tx - 15 mir.utes. This IS minutes includes 10 minutes of travel time and $ minut es of time to . physically close the valve.
- 4. Given the i ni o rma t. i on in (2) and (3), To - 26 hours and 45 minutes i
') . Tabic 2.1.9-9 from kefereace 2 (reproduced herc as Tab 1 <i 5.14) corresponds to group 11 as identified in (1).
- 6. Since To is larger than the last. occurring value of time in Table S.14, the last value in the probability of failure column is used.
Thus, P(ND),,mn - 0.00060.
- 7. The EP associated with this value of: P ( N D )n.. <n sn is 10.0 since dividing the corresponding upper 9% confidence limit by the median failure probability results in a value greater than 10.0.
5 22 _ . _ . - ._. . ~ _ . . . _ - _ . - . _ _ _ - . . _ - _ . _ ,, _ ._._ ,. _ ,,,,_ _ -. _ ._
I Table 5.14 Croup 11. Parameter Estiraates from Fit of Lognorrnal Function (N - 15. Mean .85. Standard Deviation .50) Standard Upper 95% Lower 95% , Time Deviation Probability Confidence Confidence (min.) of_ Point of Failure Limit Limit 1 .039 .96 .99 .78 ; i .072 .87 .96 .66 3 .000 .77 .90 .56 4 .096 .69 .85 .48 2 5 .10 .62 .79 .41 6 .10 .56 .74 .36 7 .10 .51 .70 .31 8 .11 .46 .66 .27 9 .11 .42 .63 .24 10 .10 .39 .60 .21 11 .10 .35 .57 .18 12 .10 .33 .55- .16 13 .10 .30 .53 .14 14 .10 .28 .51 .13 15 .098 .26 .49 .11 16 .096 .24 .47 .10 17 .094 .23 .46 .092 18 .092 .21 .44 .003 19 .090 .20 .43 .075 20 .088 .19 .42 .068 21 .086 .18 .41 .062 22 .004 .16 .40 .056 23 .082 .16 .39 .051 24- .080 .15 .38 .047-25 .079 .14 .37 .043 26 .077 .13 .36 .039 27 .075 .12 .35 .036 28 .073 .12 .35 .033 29* .071 .11 .34 .030 30 .069 .11 .33 .028 31 .068 .10 .33 .026 32 .066 .097 .32 .024 33 .064 .092 .31 .022 34 .063 .088 .31 .020 35 .061 .084 .30 .019 36 .060 .081 .30 -.018 37 .058 .077 .29 .016 38 .057 .074 .29 .015 39 .056 .071 .29 .014 40 .054 .068 .28 .013 41 .053 .065 .20 .012
- Extrapolated beyond time = 28.9 min.
5-23 _ _ _ , . . _ - . . _ . . . . _ _ . _ . _ . . . ~ . _ _ . . . _ _ _ _ . .. _ -._ . _ _ . _ - - _ . . . . -
Table 5.14 (Concluded) Gtoup 11, l'ar ame t e r l'.r.t lina t e s itom l'i t of 1.ogtmtmal l'unc t i on (N - 15, Mean - ,85, St andat d Devint loti .$0) 6 Standard llPPer 951 lower 95% Time Deviation P r o ba bi.1 i t y Contidence Con lence of l'elnt, of F a l.l M n ._ l d m i_t _ 1,imit ImiAJ 42 .052 .062 .27 .012 43 .051 .060 .27 .011 44 .049 .058 .27 .010 45 .04B . 0 '; 5 .26 .0096 46 .047 .053 .26 .0090 _ 47 .046 .051 .26 .0084 48 .045 .049 .25 .0079 49 .044 .048 .25 .0074 50 .043 .046 .25 .0070 51 .042 .044 .24 .0066 52 .041 .043 .24 .0062 833 .040 .041 .24 .0059 54 .039 .040 .24 .0055 55 ,038 .038 .23 .0052 56 .038 .037 .23 .0049 57 .037 .036 .23 .0047 58 .036 .035 .23 ,0044 59 .035 .034 .22 .0042 60 .034 .033 .22 .0040 61 .034 ,032 .22 .0038 62 .033 .031 .22 .0036 63 .032 .030 .22 .0034 64 .032 .029 .21 .0032 65 .031 .028 .21 .0030 _ 66 .030 .027 .21 .0029 67 .030 .026 .21 .0028 68 .029 .025 .21 .0026 69 .028 .025 .20 .0025 70 .028 .024 .20 .0024 80 .023 .018 .19 .0015 90 .019 .014 .17 .00096 100 .016 .011 .16 .00064 110 .014 .0089 .15 . 00044 120 .012 .0072 .15 .00031 180 .0051 .0026 .11 .00005 240 .0026 .0012 .093 .00001 300* .0015 .00060 .079 ,00000
*For times greater than 300 min.. une last line of table.
5-24
l 1 l -f (8) The mean value for the diagnosis failure probability is then . calculated. This-result.s in: P ( N D ),,,,, - (P(ND)%,,)(exp((in EF/1.645): .
/2)) ;
- (0.00060)exp((In 10.0/1.645)2/2)) .
- 1.6E-3
- 9) The action phase of the recovery action is a series of physical actions carried ont by the personnel at the plant. For this example, the control room operators would direct someone (e.g., a B man) to manually close the valve and would monitor control room I lustrumentation for indications as to the success of the requested actlon. To estimate the action phase failure probability, a HRA .
2 ovent tree is constructed (see Chapter 5 of Reference 3). The llRA I event tree constructed for this example is shown in Figure 5.2. This HRA event tree, in conjunction with the human error probabilities (HEPs) given in Chnpter 20 of Reference 3 provide a means of estimating the action phase of the recovery action. From the llRA event trce, the probability of failing to accomplish the action phase is found by: i P(NA) ~ F3+ 2F 4 F3 4 F 4 Fg - 0 F2- (0.001)(1.25)*(0.003)(1.25)* - 4.69E-6 F3- (0.001)(1.25)*(0.003)(1.25)* - 4.69E 6 - F. - (0.001)(1.25)*(0.003)(1.25)* - 4.69E 6 (NOTE: *1.25 is the multiplier used to convert a median value with EF-3 to a mean value assuming a log normal distribution.) P(NA) = 0 + 4.69E-6 + 4.69E 6 4 4.69E.6
- l'. 4 E - 5 (10) With both P(ND) and P(NA) having been detormined, the total failure probability for the recovery action is found by:
P(NR) - P(ND) + P(NA) - P(ND)P(NA) ,
- (1.6E-3) 4 (1.4E-5) -
(1.6E-3)(1.4E 5) (1. 614 E- 3 ) - ( 2 .- 24 E - 8 ) 5-25 . ._. _ - . - _ . _ . _ _ . _._ __ u _ ._ _ _ .-.,-_ _ _.a _ _. , _ .- _ _.,,,--.-_ ._. _ - _ ~ , . _
_ . _ _ _ _ _ _ . . . . . . , _ _ _ ._.. = j e i a i I l b i t . A ! , /\
- a
/ %. ;b l I
,s
/ N A
, es % -
/ N,
( '/
/
/ 'N \ ,
i i / if N l' !
/,/
t /
/ \sN ,
m, . . ....*
,/ $)
/ \,
/ % >
\ !
ef N 1 m i /
,/
y-
,e ( N -- 1 8
/
/
qj \[,
.I
\
x,s
./ ....../- .-,
- 7 x,' l
/ ='
f s I / Of M. l f N s' - --- .-- \p I
' 11gLl!lf lunt h ht_l % 1 L E Lillf. EWMt ,
5 A Ho<.hu.iit al et physic al f at ture g ruhtbits opet ator a fr4=u getting mensage tu B-man A Er t na lii nesesse f ace opet ates .001 (ff = 3)_ Table 20 6 Item (la) i l H Opstatet- f ails t o nonttor feedt,ac k (fotovery settun) .003 (FJ
- 3) Page 20 13 i
i C B man misun.ter st an=to menn e6* .001 (IT
- 3) Taite 70-6 It en (le) i D O l 'et at os f alls to tuont tot feedback (recoveiy at tlun) .003 (if
- 3) Page 70-13 i I: it nian selec t s inrottert valve ,001 (IT '3 ) Table 20'13 It em ($)
. (1 Operet.o f alls ta monitor f ee:1beth (a nover y action) . 00 3 ( t r = ft ) Case 70-13 l
*All. value6 ar e f ita the llau,1t.od , on ept the valun tot A. The value tot A.le 1ated on engineetIng ,)udgment, i
8 Figure 5.2 l llRA Event Tree for Exaniple Applicat lon I i i l x S 26 .. _ _ ~ , , , _ _ , . ,. ~_n,-.,_,-,-_....--,,n.-,.n
i
- 1.614E 3
- 1.6E 3 5.3 Entne ry Actions for M p.l.ln Following the procedures described above, failure probabilities for the recovery actfons in Tables 5.1 and 5.10 were calculated. To determine the f Inal values for use in the PRA, one last factor needed to be considered.
In determining the final value for recovery ac ti ms , one needs to consider the ramiom failure probability of the equipment to be used in the recovery pr ocess. While control circuit tailure on a valve can be bypassed by locally manually opening the valve, there is some probability that the l valve itself may be locally failed. This fact puts a lower limit. on the i effectiveness of the operator. The non cccovery failure probability used I , in the PRA to quantliy the cut sets can tiot have a failure probability less 4 than the corresponding failure probability of the equi prnent . For purpose:.: , of this PRA, the non-recovery pro'aability was not allowed to be below 1.0E-03 which is roughly the failure probability of the types of equipment modeled in the PRA and used f or t he recovery actions. It was assessed that a more exact model which evaluated a separate random failure for each type of equipment and recovery action was unwarranted. The results of these calculations are presented in Table 5.15. 5.4 References a
- 1. L. M. Weston, D. W, Whitehead, and N. L. Graver., " Recovery Act. ions in PRA for t.h e Ri sk Me t. hods Integration and Evaluation Program (RMIEP), Volume 1: Data Based Method," NUREC/CR-4834/1 of 2 SAND 87-0179, Sandia National Laboratories, Albuquerque, NM, June 1987.
- 2. D. W. Whitehead, " Recovery Actions in PRA for the Risk Methods Integration and Evaluation Prograt (RMIEP), Volume 2: Application of t.b e Dat a Based Method," NUREC/CR-4834/2 of 2, SAND 87-0179, Sandia National laboratories, Albuquerque, NM, D(cember 1987.
- 3. A. D. Swain and 11 . E. Guttmann, "llandbook of Iluman Ro l i.ab i l i t y -
Analysis with Emphasis on Nuclear Power Plant Applications, Final Report," NUREG/CR-1278, SAND 80-0200, Sandia National Laboratories, Albuquerque, NM, August 1983. 5-27 ____ . - _ _ _ . - . _ _ ~ . _ _ . . _ - . . ~ . . _ . . _ . - . _ _ . . . _ _ _ . . . . _ _ _ . _ , _ . _ _ . _ . _ .
..._ _ _ m _ - . _ _ _ _ _ - - ~ . _ _ _ . _ _ . _ _ _ _ . _ _ _ _ _ _ .
Tabic 5.15 llecovery Actions in LaSalle PRA e i __.,1y<,;nLJbge __ Dnhnj Linn Value Sourn IEDC2DEP FROP 4 Failure to restore offsite power 1.0 1 in 4 hours. IEDC2DEP- FRP l'>ll Failure to restoto olisite power 2.0E 2 1 ; i n l ') hours. ' IEDC2DEP-11tP ? 711 Tallure to restore offsite power 2.0E-2 1 in 27 hours. ADS ttullblT 12M operat ors inhibit ADS in 12 minutes. 2.0E 1 2 l , ADS SEl 0E 54M During a setsinic induced accident 2.2E 3 2 operators inil to ADS in 54 minutes. ADS-SE1 0E 80M During a scismic induced accident 2.2E 3 2 , opernt. ors f ail to ADS in 80 minutes. CRD-REALIGN 0E Operators iall to realign the CRD 2.lE-3 2 - system (two puinps available) in 8 hours. CRDl -It EAl .l CN - 0E Operators fail to realign the CHD 2.lE-3 2 system (one pump available) in " 12 hours. MFS-RESET-25M Operators fall to reset main feed- 4.4E 3 2 , l water t. rip in 25 minutes. M t'S - R ES ET - 69M Operators f ail t o reset innin f eed- 2.lE-3 2 l water trip in 69 minuten. MFS-RESET 9FM Operators tall to reset main feed- 2.lE 3 2 water trip in 95 minutes. MFS RESET-DE 27tl Operators inil to reset main feed- 2.1E-3 2 wrter trip in 27 hours. , MODESWTCil-0E-69M Opet at ors fall to change mode swit.ch 1.2E-3 2 from run to shutdown in 69 minutes.
!10DESVTCil-0E- 9 5M Operators fall to change mode switch 1.2E-3 2 from run t.o shut down in 95 minut es.
OP- P- IN I TCSS - 2 5M Operators fail to initInte contain- 4.4E-3 2 l ment spray system in 25 minutes. l OP-F-INiTCSS-30M Operators fall to initiato contain- 2.7E 3 2 ) ment spray syst em in 30 minutes. l l OP-F-INITCSS-56M Operators fail to initiate contain- 2.lE 3 2 1 l ment spray system in 56 minutes. l OP-F-]NITCSS-59M Operators fail to initiate contain- 2.lE-3 2 ment spray system in 59 minutes. OP F INiTCSS 8SM Operators fail to init, late contain- 2.1E 3 2 ment spray system in 85 minutes. OP-P-]NITSPC 65M Operators fall to initiato suppres- 2.lE 3 2 sion pool cooling in 85 minutes.
- OP-F-REOPN-FTR Operators fall to reopen RCIC F063 4.3E 1 2 valve.
5-28 a_.._ ..-._.,..-_...._.-___.__u_.-._ ._m,.
i Table 5.15 (Continued) Recovery Actions in LaSalle PP.A Event N mr'e Del 11Li t t on Value Source OPFAIL-ADS 54M Operators tail to use automatic 2.2E-3 2 depressurization system in 54 minutes. OPFAI L ADS - 80M Operators fall to use automatic 2.2E 3 2 depressurl:ation system in 80 minutes. OPIAIL REOPN 10ll Operators f all to reopen RCIC 1063 2.5E-3 2 valve in 10 hours. OPFAll-REOPN-lH Operators fail to reopen RCIC F063 2.50-3 2 valve in 1 hour. OPFAIL-REOPN-20M Operators fail to reopen RClc F063 3.5E-1 2 _ valve in 20 minutes. OPFAIL-SLCOX-30M Operators fall to start Standby 2.7E-3 2 Liquid Control System in 30 minutes. OPFAIL-SLCOX-56M Operators fail to start Standby 2.1E-3 2 Liquid Control System in 56 minutes. OPFAIL-SLCOX-54M Operatorr. fail to start Standby 2.lE-3 2 Liquid Control System in 59 minutes. O P FAI L- S LCOX- 8 5M Operators fail to start Standby 2.1E-3 2 Liquid Control System in 85 minutes. O P FAI L- S LC1 B - 30M Operators fail to start second 3.0E-3 2 standby liquid contr ol pump in 30 minutes given that the first pump failed to start. OPFAIL SLClB-56M Operators fail to start second 2.1E-3 2 standby liquid control pump in 56 minutes given that the first pump failed to start. OPFAIL-SLC1B-59M Operators fail to start second 2.1E-3 2 s tandby liquid cont rol plur.p in - 59 minutes given that the first pump failed to start. OPFAIL-SLClB-85M Operators fail to start second 2.lE-3 2 st andby liquid cont rol pump in 85 minutes given that the first punp failed to start. OPFAIL-VENT-Oll Operators fail to vent in zero hours. 1.0 2 OPFAIL-VENT-20M Operators fall to vent in 20 minutes. 1.0 2 OP FAI L- V ENT- 211 Operators fail to vent in 2 hours. 2.1E-3 2 OPFAIL-VENT-411 Operators fail to vent in 4 hours. 2.1E 3 2 OPFAIL-VENT-6H Operators fall to vent in 6 hours. 2.lE-3 2 OPFAILS-REOPEN Operators full to reopen RCIC F063 1.0 2 valve OPFAILSCDS-OE-BM Operators f. 1 to control condensate 3.4E-1 2 system in 8 minutes. 5-29
Table 5.1$ (Continued) Recovery Act iotu. In laSalle PRA 1-f.Yrilldelitt _l'tllll1110H. VAhle SollItt OPI'All.SMI'W BM Operators fall to control main feed- $.0E-1 ? ; wat er Nyst elo in 8 IntnuteN. ops-r VENT-611 Operators fall to vent in 6 hourn 1.0 2 RA 1 1011 Hanual operatton within 10 hours ?.lE-3 2 of a nystem or component f rorn the control room that han no automatic actuation or priot to its automatic operation if' it: han automatic , ac t unt len. RA. l - 1 l $11 Hanual opernt lon wlIhin l$ hours 2.1E 3 2 of a nyutem or component from t.he I cofit i ol I oorb that has no automatie acttiat 10n or prior to 11 8 autonialit i operation 11_It hau automatic actuntlon. RA-1-1-731l Manual operat ion within 73 hours 2,1E 3 ? of a syntem or component i roin the control room that han no automatle actuation or prior to i t s aut ostin t ic operatinn if 1t han nutomatic actuntlon. RA 1-1 2/ll Manual operation within 27 hours 2,1E-3 ? of a nystoie or component itom the cont rol room t hat hait tio aut omat ic actuation or prior t o it s aut.omat ic operation if it har automatic ac t ua t:1on . RA-1-1-8tl Manual-operation within 8 hours 2.lE-3 ? i of a syntem or component frotn the control room that has no automatic actuntion or prior to its automatic opernt.lon !! it has automatic actuatlon. RA 1-3 10ll Mariual operat ion wit hiti 10 hours 2.6E 3 ? of a nystem or component from the control room which falled to aut oniat.ical ly act uat e . R A 3 1311 Manual operation within 13 hours 2.6E 3 2 of a system or component from the cont rol room-which f ailed t o automatically actuate. RA-1 3 lli Manual operation within 1 hour 3.2E 3 2 of a system or component f rom the control room which failed to automatically actunte.
- - - _ - . - . - - - . - - - . - . - . - - - - ~ . - .-
$-30
Table $ 15 (Gontinued) Recovery Aerions in LaSalle PRA f.YrnL.14ame Delinig. inn. Value SQuin RA- 1 3 - 1511 Hanual operation within 15 hours 2,6E*3 2 of a systern or component from the control room which failed to automatically actuatc, RA-1-3-2311 Hanual operat ion within 23 hours 2.6E-3 2 of a system or component irom the contr ol t oom which f ailed to aut omat ically actuate. RA - 1 3 - 2 711 Manual open at ion within 27 hours 2.6E 3 2 , of a synt em or component from the ; control room which failed to automatically actuate. RA-1-3-48M Manual operation within 48 minuten 6,4E 3 2 of a system or cornpore at f roin the _, cont rol roam which f ailed t o automatically actuate. RA-1 3-54H Manual operation within $4 minuten 4.5E 3 2 of a synt em or component irom the cont rol room which failed t o automatically actuate. RA-1-3-80M Manual operation within 80 rninutes 2.6E 3 2 of a system or component from the control room which talled to automatically actunte. RA-1-3 811 Manual operatton within 8 hours 2.6E 3 2 , of a system or component Irom the - control room which failed to automatically actuate. RA-15-10ll- Repair of DG common modo failure 3.8E 1 3 within 10 hours. RA 15 ill Repair of DG connon mode failure 9.lE-1 3 ; within I hour. RA-15-2311 Repair of DG common mode failure .l.2E 1 3 within 23 hours. RA 1S-2711 Repair of DC cominon mode failure 1. 0 E- l ' 3 wit.hin 27 hours, RA-15 48M Repair of DG common mode failuru 9.5E-1 3 within 48 minates. . RA 811 Repair of DG common mode failurn 4.SE 1 3 within 8 hours. RA-2-11-1511 local operation v!Lhin 15 hours 1.6E 3 2 of manually cout rolled component n normally operated from the control room when control-room operation fai1n.
- - . ~ _ ~ - . . . _ . . . . - -. .-... .. - -.-. --
5-31
r r Table 5.15 (Continued) Recovery Actions in LaSalle pRA i Event Name Definition Value Source RA 2 3 10ll Local operation within 10 hours 2.6E 3 2 . of a systern or component which ! failed to automatically actuate. RA 2-11-1311 local operation within 23 hours 1.6E 3 2 of manually controlled coitponents nortnally operated frorn the control room when control-room operation fails. RA-2 11 /II local operation within 27 hours 1.6E 3 2 , of manually controlled cornponents normally operated from the control room when control-room operation fails, R A 2 111 Local operation within-1 hour 6.9E 3 -2 of a system or component which f ailed to autornatically actuate. RA 2 3 2711 Imal operation within 27 hours 2.6E 3 2 of a system or component which , failed to automatically actuate. RA-2-3 48M Local operation within 48 ininutes 1.6E 2 2 of a system or component which failed to automatically actuate. RA 2-3-54M Local operation within $4 minutes 1.0E 2 2 of a systern or component which failed to automatically actuate. RA 2 811 Local operation within 8 hours 2.6E-3 2 of a system or component which failed to automatically actuate. RA-2-3-10ll Local operation within 10 hours 2.6E-3 2 of a system or component which failed to automt.tically actuate. RA 3-12 211 Open RCIC isolution valve (s) 2.4E-3 2 within 2 hours given RCIC room isolation. RA 3-12-68M Open RCIC isolation valve (s) 1.8E 2- 2 within 68 minutes given RCIC room isolation. RA 3 12 80M Open RCIC isolation valve (s) 3.SE-3 2-within 80 minutes given RCIC room isolation. RA-3 12-10ll Open RCIC isolation valve (s) 2.4E-3 2 within 10 hours given RCIC room isolation. RA-4-411 Isolate recirculation pump seal 1.0E 3 4 LOCA AND restore PCS-. . S-32 i
--,. ,-m.v.- ,. ,.-n- , , , - , - - , . -
i Tabic 5.15 (Continued) t Recovery Actions in LaSalle pRA
- Event Name Definition Value Source RA 5V 211 Operators vent within 2 hours 2.1E 3 2 through alternate vent path.
RA SV 611 Operators vent within 6 hours 2.1E 3 2 threu6h alternate vent path. RA 6 411 If one electric power train has 5.0E 1 5 failed, one-half of the time the recirculation pump LOCA will occur ' on the recirculation pump which can be isolated. Operators isolate recirculation pump seal LOCA and restore pCS. i RA 7 1511 Locally open within 15 hours 2.1E 3 2 [ a manual valve clored due to . unscheduled maintenance on RilR pump C003B. Res' ores heat removal. RA 7 1-2711 Locally open within 27 hours 24 1E-3 2 a manual valve closed dt- to unscheduled maintenare' n RilR pump C003B. Restore ' retnoval . I RA 7-3-811 Locally open within 8 . ars 2.1E-3 2 a manual valve closed du to unscheduled maintenance on R11R pu:np C003B. Restores injection. . RA 7-3 10ll Locally open within 10 hours 2.1E-3 2 a manual valve closed due to unscheduled maintenance on RilR pump C003B. Rest . res injection. RA-8 10ll Restoration within 10 hours of 1.7E-2 1 offsite power. RA-8-1511 Restoration within 15 hours of 6.9E-3 1 offsito power, RA- 8 111 Restoration within I hour of 1.7E-1 1 offsite power. RA-B 2311 Restoration within 23 hours of 2.5E 3 1 offsite power. RA 2 711 - Restoration within 27 hours of 1.9E 3 1 offsite power. RA-8 48M Restoration within 48 minutes of 2.2E 1 1 offsite power. RA-8-80M Restoration within 80 minutes of 1.1E-1 -1 offsite power. RA- 8811 Restoration within 8 hours of 2.0E-2 'l offsite power. S-33
I Table ,15 (Cont inued) i Recovery Actions in LaSalle PRA EnnLRotte D.tLinillen Vahte sourcs RA-8 SEl-L1-lli Restoration within 1 bour of 1.0 6 offsito power given that a level L1 seisanic event bac occurred. RA- 8 SI:1 - L1 -4 8M Rest orat inn vi t bin 48 ininut es of 1.0 6 ; offsite power given that a level Ll seismic event has occurred. ItA-8 SEl L1 8tl Restoration within 8 hours of 1.0 6 of fsite power given that a level Ll s.etsmic event has occurred. RA S El - 1.2 - l li Restoration within I hour of 1.0 6 offsite power given t hat a level L2 seismic event. has occurred, R A- 8 SEl- L2-48M Restoration within 48 minutes of 1.0 6 offsite power given that a level L2 selranie event has occurred. RA 8-SEl-L2 811 Rostoration within 8 hours of 1.0 6 olisite power gl.ven that a level 4 L2 seli.mie event has occurred. HA 8 SEl-L3 lli Restoration within 1 bour of 1.0 6 of f site power given that a level L3 selraute event has occurred. RA-8 SEl-L3 48M Rest orat ion wit hin 48 minut es of 1.0 6 off site power given that a level L3 salianic event has occurred. RA S El L3 811 itestoration withiri 8 hours of 1.0 6 offsite power given that a 1cvel L3 seismic event has occurred. RA S El - 1/e - 111 Rentoration within 1 hour of 1.0 6 offsite power given that a level L4 seismic event han occurred. RA-8-SF.1-L4-48M Restoration within 48 minut es of 1.0 6 olisite power given that a level 1/e seismic event han occurred. . RA- B SEl 1/e - 811 Rentoration within 8 hours of 1.0 6 offuite power given that. a level 1/e seismic event han occurred. RA-8 SEl- LS-Ill Restoration within 1 hour of 1.0 6 ofinite power given that a Icvel L5 seismic event has occurred. RA-8-SE1-L5 48M Restoration within.48 minuten of 1.0 6 of fsit e power given t hat a level L5 ocismic event has occurred. RA S El - LS - Bil Restoration within 8 hours of 1.0 6 offsite power given that a level L5 seismic event has occurred. 5 34 _ - - - - . _ . . . . _ _ ., . - _ , _ . _ . _ . _ _ . _ - . _ , . . _ . . . _ _ , - . , _ . _ , _ . - . ~ _ . - _ - . _ . - . _ _ . . , , - - . . .. ,. . .._
__ . . _ . _ . - - . _ __ ._ _~_ _ _ _ _ _ . - - - _ _ . _ _. _ _ _ _ _ . _ _ . - _ _ . - _ . , _ _
-l l
Table 5.15 (Continued)~ Recovery Actions in LaSalle PRA Event Name Definition Value Source RA- 8 S EI - L6 - 111 Restoration within 1 hour of 1.0 6 offsit; power given that a . vel-L6 seismic event has occut 1. RA-8-SEI-L6-48M -Restoratic1 within 48 minutes of 1.0- 6 offsite power given that a level L6 mismic event has occurred. RA-8+SEI-L6 811 Res aration within 8 hours of 1.0 6 offsite power given tt 'evel L6 seismic event has os d. RA-8 SEI-LL1-1H Restoration within 1 bu of 1.0 6 offsite po"er given thac a level LL? seismis event has occurred. RA-8-SEI-LL1-48M Restoration within 48 minutes of - 1. 0 6
- offsite power given that a level LL1 seismic event has occurred.
RA 8 - S EI - LL1 - 811 Restoration within 8 hours of 1.0 6 offsite power given that a level LL1 seismic event has occurred. RA 8-SEI-LL2-lli Restoration within 1 hour of 1. 0 6 offsite power given that a level LL2 seismic event has occurred. RA-8-SEI-LL2 48H Restoration within 48 minutes of 1.0 6 i offsite power given_that a level LL2 seismic event has occurred. RA S EI - LL2 - 811 Restoration within 8 hours of 1.0 6 offsite powcr given that a level . LL2 seismic (vent has occurred. RA 9-21I Repair of DG failure within 2 hours. 8.7E-1 3 RA-9-10ll Repair of DG failure within 10 hours. 5.5E 3 d,A- 9 1511 Repair of DG failure within 15 hours. 4.7E-1 3 RA 4 14 Repair of DC failure within 1 hour. 9.3E-1 3 RA G e Repair of DG failurc within 23 hours. 4,1E-1 '3 RA - - Repair of DG failure within 27 hours. 4.CE 3 RA-9-wo Repair of DG railure within 48 9.6f-l 3 minuter. RA 9-811 Repair of DG failure within 8 hoars. 6.0E-1 3 RA-9-SEI-lH Repair of "" failure within I hour 1.0 7-given that a seismic event has occurred. RA 9-SEI-48d Repair of DG failure within 48 1.0 7 min- w given that a seismic event bac curred. R A S El 811 Repair of DG failure within 8 hours 6.4E-1 7 . given that a seismic event has occurred. i 5-35 '
Table 5.15 (Continued) Recovery Actions in LaSalle PRA Value Source d ygnt_Name iltll11LLintL_ RA-10-1-2711 Replace a tuse within 27 hours in a 2.lE-3 2 nyst ein or component that has no automatic operation or prior to its automatic operation if it has auto-matic actuntlon. Cluse S15LC F01(> or F017 valve 1.0 2 RA-ATW 11-11-30M within 30 minutet after the occurtence of an ATWS, r,1ven the failure to close the valves followtar, - a previous test on t he SitLC syst em. RA-ATu,1(,-31-30M Manual statt of a DG f rom t he 1.0 2 coutrol room MID then manual at nrt of the appropriate SBLC pump within 30 minutes after the occurrence of an ATVS. Manual st at t of a DG irom the 10 2 RA - ATW - l f> 59 M control room 6N.D then manual start of t.he appropriate SBl.C pump within S9 minutes alter the occurrence of an ATWS, % Manual operation within 25 minutes 3.0E-2 2 T ~ " ' RA-ATWS 1-3-25M of a system or component from the ,; ; control room which failed to auto-
" mat ically actuat e after the 0- occurrence of an ATWS.
Manual operat ion within $9 minut es 3.2E 3 2 RA-ATWS-1-3-59M of a system or component from the - cont rol room which failed to auto-matically actuate after the occurrence o' an ATVS. hocally close RWCU valve F004 1.0 2 RA-ATWS-12-1-10M wit hin 10 minutes af ter the o c e s. r r e nc e of an ATWS. RA-ATWS-2-3 25M 1.ocal operation within 25 minu'en 1.lE-1 2 of a system or component which latted to automatically actuate after the occurrence of an ATWS. 1.ocal operat ton within 59 minut es 7.4E-3 2 RA ATWS-2-3-59M of a system or component which talied to automatically actuate after the occurrence of an ATVS. Restoration within 25 minutes of 4.0E-1 1 RA-ATWS-H-25M offuite power after an ATWS has occurred. I
Table 5.15 (Continued). Recovery Actions.in LaSalle PRA Event Name Definition Value Soureg RA-ATWS-8-59M Restoration within 59 minutes of 1.7E 1 1 offsite power after an ATWS has occurred. RA ATWS-8-85M Restoration within 85 minutes of 1.1E-1 1-offsite power after an ATVS has occurred. RA-ATWS-9-59M Repair of DG failure within 59 9.3E-1 3' tainutes after the occurrence of an ATWS. RA ATWS-9-85M Repcir of DC failure within 85 9.0E-1 3
..inutes af ter the occurrence of an ATWS.
RA-CDS-2}i operators une condensate system 2.2E-3 2 within 2 hours. RA-DDFP-2H Operators use diesel driven fire- 1.0E-1 2 water pump within 2 hours. RA-DELETE Used to delete invalid cut sete. 0.0 RA NONE No recovery action identified. 1.0 PCICRMCOOL-DELET Used to delete not applicable 0.0 cut sets TDRFP-T-0E-15H Ope a ars fail to trip turbine 2.6E-3 2 driven reactor feedwater pumps within 15 hours. Prohibits motor driven feedwater pump from auto starting. TDRFP-T-0E 25M Operators fail to trip turbine 3.0E-2 2 driven reactor feedwater pumps within 25 minutes, Prohibits motor driven feedwater pump from auto starting. TDRFP-T 0E-27H Operators fail to trip turbine 2.6E-3 2-driven reactor feedwater pumps within 27 hours. Prohibits motor driven feedwater pump from auto sta ting. TDRFP-T-0E-48M Operators fail to trip turbine 6.4E-3 2 driven reactor feedwater pumps within 48 minutes. Prohibits motor driven feedvater pump from auto scarting. TDRFP-T-0E-69M Operators fail to trip turbine 2.6E-3 -2 driven reactor feedwater pumps within 69 minutes. Prohibits motor driven feedwater pump from auto starting. 5-37
. . - . ~ . . . . . . .. ~ . _ . ~ . --- -.-
P' Table S'.15 (ConEluded) ' Recovery Actions in 1.nSalle PRA LienLHttme. Drii.u11191L Value Source TDRFP T 0E-95M Operators fall to-trip _tuibine 2.6E 3 - 2 driven reactor feedwater pumps within 95 minutes. Prohibits motor driven. feedwater pump iroin auto
- s t a r t i ny,, =
NOTES: 1 lindeline. T1pe t o Ik,covery of Loss of Off-Site Power l'10nta, NUREC/GR 5032', 2 ikE2XtL.Ac11nn11_in:PRA for1the 1Lak_lic1heda_intternlinn andlyaluat ion Pr2Etum f RM1EPF Volume 2: App 11gglign itf _Lltc Dala_lluited litlh211, NUREG/CR-4834/2 of 2 3 St at t on Blackout _ Accident.AnalXf.g (Part of NRC Tash Actlon; Plan A-44),-NUREG/CR-3?26 and analysis of Core Dn111atc_firgututy From _1uternaLEy. cats,1 Pentli Bottom 11 nil _2,- NUREC/CR 4550/Volumu 4, 4 ARA.4a S "RA 6" 6 - seismie LOSP , 7 - 3 pluu time requirement i
-1 I
1 d 5 - 3 11
.. - -- . . ~ , . - . - , . _ . , _ . _ , _ -. _ _ . . . _ . _ . _ . ;_ - . . . _
6.0 RESOLUTION OF CORE VULNERABLE ACC1 DENT SEQUI2!CES 6.1 jntrodoct10D in this section, we are concerned with the resolution of an issue that appears at the interface between the Level I and Level 11/111 analyses and again in the accident progression analysis in the Level 11 analysis. In the 1.e v e l I analysis, certain of the end-ctates of the accident sequences may be initially undefined (e.g , whether or not core damage occurs is unknown) This uncertainty involves the interaction between the containment and the systems that must respond to the accident as described below and this interaction must. be evaluated in order to resolve the wquence .. t a t u s In the Level 11 analysis, the status of systems after centainment failure may not be known. This issue also involves the interaction between the containment response and the systems and must bo __ evaluated in order to evaluate the characterictics of the radioactive release The Level 11 aspect of this issue is described in the 1,cVel 11/111 report.* For the ievel 1 analysit, in the past, engineering judgement with little or no upport ing calculat ions was used to resolve the end-state. (Usually to simply say that it was core damage since almost no information was available and it was conservative to assume so.) For the LaSalle PRA, it was decided to use a more realistic approach in which t.be rmal - hyd raul ic analyses were to be coupled with expert judgement to determine the
<urvivability of the systems The accident sequence end-states which were initially undefined in the I.aS a l l e analysis involved s e que nc e s in which core cooling was initially available, but containment heat removal was not sufficient to prevent containment pressurination. For these cas , containment failure or venting is guaranteed, and the re s ul t a n t. steam blowdown to the reactor build;ng could fail critical components of the cooling systems, leading to core damage The following procedure was used to resolve these end-states: -
- 1. Identify those accident progressions with uncertain end-states.
? Evaluate the containment failure location, size, and failure pressure
- 3. Perform approprince the: mal-hydraulic analyses to evaluate possible reactor building environments for the cases identified in step 2.
6 Evaluate equipment surviv.bility in these environments.
- T. D. Brown, A. C. Payne Jr, L. A. Miller, J. D. Johnson, D. 1.
Chanin, A. W. Shiver, S. J. Higgins, and T. T. Sype, " Integrated Risk Assessment for the 1. .lle Unit 2 Nuclear Power Plant: Phenomenology and Risk Uncertainty and Evaluation Program ( I'RU E P ) , Volume 1 Main Report," NUREG/CR-5305, SAND 90-2765, Sandia National Laboratories, Albuquerque NM, to be published 6-1
_ _ . . _ _ _ . _ . _ _ . _ - . _ _ _ _ ~ _ _ _ . - - _ _ . _ _s
- 5. Develop system ' models in order to quantify sy s t ein failure-probabilities for use in quantification. >
- 6. Use thin -information to resolve the question of whether or not the core cooling systems would fall after containment venting or failure, ,
Th'ese steps will be discussed in detail in the remainder of this sect ion. , 6.2 ilcEU.inintLnfJitps .iLLC ordtlnttnhin Enquente Res01ution 6.2.1 Step 1: Define Core Vulnerable Sequences For the 1.aSalle PRA certain sequences in the Level I analysis were not initially resolved (l.c., whether or not the sequence proceeded to core damage was not known), These sequences are the so entled ' core vulnerable' sequences in which the coro is initially coolable but in which core damage may occur later in the sequence if cooling systems fall in the severe environment. created by the accident, In the LaSalle analysis , ' t hese sequences arise either from accident, sequences in which core. cooling is available and c ont a i tune nt heat removal has failed (TV) or in anticipated transients without scram (ATWS) where the heat load is beyond the capability of t he containment heat removal systems, In either case, the containment heats up and pressurizes. The reactor core isolation cooling (RCIC) system will fail due to back pressure at around .277 Mpa (40 psia),. and the low pressure systems will fail their function when the automatic depressurization system (ADS) valves reclose at about .689 Mpa (100 psia), If other high pressure sys t en.s are working, t hey will continue - to operate unless they also fail due to the severe envi rorucent s after containment venting or failure. For these types of sequences (TW and ATWS), the emergency procedures direct-the operators to vent the cont a inment through S .1 cm (2") lines in the i wetwell and drywell if and when the containment pressure exceeds 0.517 MPa - (60 psig). These two S.1 cm lines can not removo sufficient energy to p re ve nt. lurther pressurization and the operator will be directed to vent using the_0,66 m (?6") wetwell and/or drywell lines, The two 0,66 m lines connecti via a common 0.46 m (18") line to the stundhy gas treatment system (SGTS) which limite the relief size. The 0,46 m line connects to the SGTS supply fans -which have a short section of ductwork and a rubber boot, both of which are virtually certain to fall if-a 0.66 m line is opened. This will re'l e a s e the vented steam int 6 the react.or building instead of to the environment. If venting did not or cannot occur, then the containment is assessed by the experts to most likely fall when the pressure reaches the 1.41 Mpa (190 psig) range, Depending on the containment failure mode and location, steam may he released into the reactor building or to the . refueling floor, If the release is to the refueling floor, no severe environments will he 6-2
generated in the reactor building because the refueling floor walla will fail, thus directing the steam to the outside lf the steam is released directly into the reactor building, steam will fill the reactor building, creating e n v i r o tune n t s of varying severity depending upon the building design and st eena blowdown rate. In order to incorporate these considerations directly into the analysis, additional events were added to the accident sequence event trees as described in Volume 4 of this report first, a venting question was added, and if venting succeeded, then a system survival question was asked. If vent ing f ailed, then a containment failure modo question was added followed by a system survival question (see Figure 6.1). Figure 6.1 System Failure Resolution p VENT CONT SURVIVAL LEAK
-___ og
__ . _ _ _ _ _ yes Yes - - - Core Damage No _ _ _ _ _ _ _ _ og _ . . . _ yes 1.e a k - - - - Core Damage
- _ _ _ go No OR Yet Rupture - Core Damage No 6,2.2 Step 2- Determine Containment Failure Modes .
The S t r u c t u r a. Expert Elicitation Panel for the NUREG-llSC expert elicitatlon1 was asked to evaluate the structural design information and construct a probability distribution for the containment failure pressure. The experts each received structural design information and previous calculations on the LaSalle and similar containments. They received the results of experiments on containments and equipment hatchs, and performed some simplified calculations of their own. Using this information, they were asked to evaluate, at each pressure , the probabilit y of containment failure and t. hen the conditional probability of the containment failing in one of the following eight modes:
- 1) Wetwell Leak above the water line (' ".' Law )
- 2) Wetwell Leak below the water line (WWLbW)
- 3) Wetwell Rupture above the water line (WWRaW)
- 4) Wetwell Rupture below the water line (WWRbW)
') ) Drywe11 Leak (DWL) 6-3
- -. -..- -- . - . - - . ~ . - . . - . - - . ~ . ~ . . . - . . , - - ~ . . ~ , . -
- 6) Drywel1 Rupture ( DWR')
- 7) Drywell llend Leak (DWitL)
- 8) Drywell llend Rupture (DWHR)
These inodes were selected, firstly, because we needed to differentiate between leaks and ruptures in order t o_ know if the cont aitunent pressure would drop to the point.were los pressure systems.could be used before core damage occurred. Secondly, we had to differentiate based upon the location in order to know if the failure would create a severe environment in the reactor building or if the failure would be to the refueling floor which would bypsss the reactor building and not affect the systems _ environment.s. Finally, we had to different iate ef fects on the source term of suppression pool and secondary containment decontamination. The overall issuo and results of this process for the NUREC-1150 plents are described in Reference 1. For the LaSal le - analysi s , the results are i presented in Appendix C. The mean failure pressure was 191 psig. The marginal failure probabilities for the individual modes (these are the i weighted average over all pressures, i.e., the sum of the conditional probabilities at each pressure interval times the probability density of f a ilure in t hat i nt e rval) , calculated from the results in Appendix C, are. Table 6.1 flarginal Failure Probabilities WLaW - 0.1094 WRaW - 0.1111 WLbW - 0.0156 WWRbW - 0.0105 DWL - 0.0746 DWR - 0.0858 DWill - 0.5487 DWliR - 0.0442 We use the marginals for the point estimate since the pressure will continue to rise until contaltunent falls for these sequences. As a result of grouping the failure modes, we can calculate various conditional ptobabilities:
- 1. The conditional probability of a leak is 0. 7483 and a rupture is 0.2516.
- 2. Given a leak, the conditional probability that it is to the-refueling floor is 0.7333 and to the reactor building is 0.2667.
- 3. Given a rupture, the c ond i t-l ona l probability that it is to - the refueling floor is 0 1757 and to the reactor building is 0.8243.
6.2.3 Step 3: Evaluate the Reactor Building Environments The tiELCOR2 code was used to perform the thermal-hydraulic analysis of the-effects of containment failure and blowdown f rom high pressure into the 6-4 l
. - -, - -.-. . - .~ - . -- . . _- -
reactor' building.3 A detailed MELCOR model was constructed for the reactor building using information from the plant drawings, the Final Safety Analysis Report, and two volumetric and heat transfer models developed by the architect / engineer for LaSalle -- (Sargent - and Lundy) to perform steam line break calculations. The reactor building was divided into 27' volumes as shown in Figure 6.2. Since the main concern is equipment survival in- I the lower levels of the _ reactor building, more detailed noding was used in these regions. Single volumes were used to model the steam tunnels, refueling floor, and the unit I reactor building. 1 MELCOR was chosen to perform most of the thermal-hydraulic analyses for the j PRA because (1) it can be used to perform an integrated analysis - that -l considers reactor vessel, primary containment, and reactor building response simultaneously; (2) _it is fast running; (3) it has flexible control function capability for modeling flow paths; and, (4) it_ includes the capability to address uncertainties in modeling parameters and-correlations. This detailed dock will also be used for special analyses of-reactor building response to hydrogen and carbon monoxido burns _and for j fission product transport in the Ixvel II/III analysis. The dock has also l been simplified and incorporated into another deck being used for integrated calculations for the Level II/III analysis. 6.2.3.1 Reactor Building Model Description A detailed MELCOR model was constructed for the reactor building using information from the plant _ drawings , the Final Safety Analysis Report (FSAR),' and two computer models developed by the architect / engineer (AE) for LaSalle, Sargent and Lundy, for use in design calculations. One of the Sargent and Lundy models was used to calculate gas flow between rooms and , had detailed calculations of flow path areas and resistances. The other model was used for room environment calculations af ter high energy line breaks and had detailed calculations of room volumes and surface areas. Neither model had estimates of equipment masses or surface areas, so these were estimated based on the Level I location analysis that had identified all the equipment in euch room of the reactor but.1 ding, , It is important to have sufficient nadalization to model the building j characteristics that determine the flow patterns for areas-where important equipment is located. Also, adequate representation of doors and blowout panels is necessary because the flow patterns can be greatly affected if normally closed flow paths are opened during the severe transients. Slight differences in opening pressure differentials can determine the exact configuration of flow paths for the various scenarios analyzed, The reactor building was therefore divided into 27 volumes as shown in Figure 6.2. Since the main concern is equipment survival in the lower levels (floors) of the reactor building, more detailed nodalization is used in these regions. The annulus (outside the primary containment on the lower two levels), high pressure core spray (llPCS) -and low pressure core 6-5
. _ , . . . . . - . . - . .. -- - . . _ . - . . . _ . ~ . . . .~ . . ..~~ . . _ . . .
u.- TURBDG _d to ,/ CAVrW Nl g g - 30 NC .
-.f.- STEAM 3 y g n' TUNNELy *30 l NCI CRD NC NC
_,..jD g 1%A __[_ a ,__4_ M + k_, _ 0
- ANNULUS / .b3 11 A<
NC1 '
)
3 3 _9] L__,,__,,,____,_, f .]?_ p. j 3 - *l* , 694' # 710' UCI B 673' ucs ' (ground nevel) UCI C HCIC g g'M .% Q r qt... ._ 60 4 q., 50. . _ 15 - 12 23 20 NC4 g ,{. .-- 40 40
- -h - h-NC '* ~ '
g4 13 ; NC 4 - 33 , 17 22 21
- r-+ 4,rj -
[]n '
.i. ] r
.;g m. ,,
1JtAK md HUPTURE SOUrtCE NC NC 4 a 60 T
.'%M .T a _1- ...
- n. 30 _ r.__a a, 60 c _
g],, : NC*. .. 26 J
. . NC 7
ei ,- , 22 *g? NC * - g 4 f
- 21 . 2( *W*
- 25] .
l 877' SG'P3 s' / g4y OT3: VENT SOURCE IDCATION Y u 3* *N t E Figure 6.2 MELCOR .Nodalization for Reactor Building Model 6-6
. . . ~ . - - . - . - - . . - - ~ . - - - - - - - - . . - - . . - . - . . - . - -.
spray (LPCS) rooms are each divided into two volumes to represent the upper and lower levels. The low pressure coolant ~ inj ection (LPCI) rooms are modeled with single volumes because the heating, ventilation, and air conditioning system (llVAC) circulates between the upper and lower' levels, resulting in well-mixed regions. Levels 710',-740', 761', and 786.5' are each- divided into four quadrants to allow the main circulation paths to be-calculated. The East portions of levels 807' and 820' are each divided into two volumes and the more dead-ended regions at the West end of the-two levels are lumped into a single. volume. Single volumes are used to model the steam tunnel (including turbine cavity), refueling floor, and the unit i reactor building. The flow paths in the model are also shown in Figure 6.2. Normally, the corner rooms in the basement of~the reactor building are fairly isolated j- from the other regions, but circulation is increased if doors are blown open during a severe transient. Unlike the basement where the levels are subdivided into rooms that restrict flow, at levels 710' and above , the floors are essentially wide open. Also, there are reasonably largL flow areas between the upper 1cvels through stairways and an equipment hatch. Initially, the reactor building is isolated from the refueling floor, but paths can be opened if a door is blown open or concrete slabs are lifto from over the equipment hatch. The walls of the refueling floor level are assumed to fail at 14 kPa (2 psig), opening a 7 m (23 ft) diameter hole to the environment. The reactor building can also vent to the unit I reactor building if pressure increases suf ficiently to blow open the doors between the two units. In addition, the reactor building can vent from the upper level of the annulus into the steam tunnel and into the turbine cavity if a very small pressure differential is exceeded. A blowout panel in the reactor building return air riser at the top of the steam tunnel is included in the model. All leakage / infiltration paths between the reactor building and environment are lumped into flow paths at the 710 level. Heat structures are included in all reactor building volumes to model heat transfer to walls, ceilings, floors, and equipment. Heat removal by the room coolers in the basement corner rooms is also rodeled. Flow of gases through the standby gas treatment system was included in all runs; failure
-because of the severe environment was not considered.
A simplified nodalization for the primary containment- and reactor pressure ve s =,e l (RPV) is used to provide blowdown sources to this detailed-reactor building model. The RPV is modeled by a single volume. and 3 volumeo are
-used for primary containment. The containment gases are exhausted to the reactor building-- at -level- 820' (volume 324) for cases examining venting, and to level 740' (volume 313) for cases exami. lng containment failure.
6.2.3.2 Results of Analysis Calculations were performed for venting the - primary containment through an 18" diameter (.46m) line from the wetwell to the top of the reactor 6-7 i
-. , . - , , - - . , - , , , . , , , - . - _ -._-7m.,,
i building and--for-2 sizes of drywell breaks: 4" diameter (,10m) and 36" diameter (.91m). To examine modeling sensitivities. 4 variations of the venting calculation were-run;
- 1) Five times the equipment mass
- 2) Twice the rated heat removal rate for the room coolers
- 3) Vent area reduced in half (6.4" diameter)
- 4) Blowout panel on the refueling floor to the outsido environment The reactor building pressure for the 4" drywell break is shown in Figure 6,3, The early pressurizat ion opened one of the doors to unit I and t.he door to the refueling floor , but the blowdown was not large enough to open
. paths to the environment by either ialling the walls of the refurling floor or opening the blowout panel at the top of the steam tunnel. The pressurization was relieved through leakage paths, the SGTS, and condensation on structures Since the flow was not being forced-through the steam tunnel, little steam was drawn down into the emergency core cooling-systems (ECCS) rooms in the basement. The reactor building heatup was relatively gradual as shown by the temperatures plotted in Figure 6.4 and listed in Table 6.2. The pressurization w a s, higher for the 36" diameter drywell break (equivalent to 7 sq ft), as shown in Figure 6.5. All doors and blowout panels were forced open except for three of the doors between the annulus and corner rooms in the basement. With the refueling floor walls failed, most of the blowdown was carried upward through the reactor building rather than being pushed down through the basement and out, through the steam tunnel, lloweve r , there was sufficient flow down into the basement rooms to cause considerable heatup (i.e., final _ t emperatures > 400K) as shown in Figure 6.6 and Table 6.2. For the 18" wetwell vent case, the steam entered near the top of the reactor building rather than near the bottom, The pressurization.from the blowdown opened 3 of the upper doors to unit 1, the door to the refueling floor, and the steam tunnel upper blowout panel, but the - walls of the refueling floor were not predicted to fail. Thus, for this case, the majority of the steam was drawn down through the basement, then into the steam tunnel and turbine cavity before exhausting to the environment. lAs a - result, relatively high temperatures (i.e. ~370 -400K) were predicted in the basement rooms as shown in Figure 6.7 and Table 6.2.. The variation of the 18" vent case with increased steel area was virtually identical to the base case. Pressures and temperatures-vere only reduced slightly, Using twice the rated heat removal for the room coolers also had negligible effect on the pressures and on the temperatures in all rooms except those directly connected to the room coolers. As seen in Table 6.3, the peak and average temperatures in those rooms were reduced on the ordar , of 5 - 10 K. For the case using half the blowdown rate, the peak pressure was reduced by about _ 5 kPa (3/4 psig) at the top of the reactor building and decreased-back to atmospheric pressure at about twice the rate of the 6-8 i !_ . , . . . _ . - - -- . - - . - - - , , . , - . - - . ~ . >-, , - - - ,- c.
j 1 1ljji' E $ tt1r J-}$ Wa:u. 4 3 2 I 0 9 8 7, 6 5 5 1 1 4 1 5 5 SI 1 1 1 3 1 1 3 1 5 j{
- ~ f ~
_ ~ _ ~ - 1
'0 1 5
k
' _ '3 a e
r B l
' 0 l T 3 e w
' y r
D 1
~
i s. s 4" v ~ 2
- r 0 3 o
~
1 I
.f s 6 s E
e e 10 M r
' 2 I T
r u g s u i s
' e s l r
\
P s r5 1 g s
' n i
\
d
\ l
' i I 0 u g
i 1 B
\
\
r o t
, c f
0 a I
* . ' , ' i g i50 2 R
e
.I.) ( i. l
( 8
.b I'
)
t'f I ')
. r l R WL 1 l .! 1 , I ;. 1 i : t
! 1 j i
_ EE EV _ 0 RE
-!l!
I - - 1 -
\
0 RL 0 5 0 5 0 5 0 5 0 5 0 5 0 5 7 r 6 5 5 1 1 3 3 z 2 1 1 0 01 I( 0 0 01 0 01 0 1 0 1 nI 0 1 0 1 01 0 1 l 1 1 1 c ~ x _. r< S
. 3 q, t r,b<Lra o3r.
m.e il lll l l1 il l l il l i l jlli (l(l l = '
4- h 4 e +-*-F.* 8.-M-J3 *4 44."J. 3b 4A4 ,4em v4*du MM@ 6 4 AL W 4 EMi- 8 M-h3 --+--e a +uOa to rh AA- 4#-M dS W,.a e. J ab,,A.aAJ6AA... a J ,e.. A. ,A , i i UI 3srd883dW'J1 o -o 9 e 9 9 9
- o. 9 9-C % C C S 0 8 H ev k u k, - .
in
-~
7~.* % .,I a. .p j
. 7 qm_.qd. --
q L. _H, i. y i p s
- O, w g
/,+ f 1 tts 1 @
l \ .u I m
' \ ,,, -
I , s v -
\
> \ '
?
I
, \ ~
C. i \ a t - j
- o. 5 g
\ "e 4 I N
, , y s
O 1 W
\ -
_ 4 i \ s e e - = ( @@ i -d u
\ n
/
L
, s -s E ?. 3 i
'r s s
\
s
=
ii f. u e c r I l s
' \
, ~, .Lu h4 CL a
' g. @
\ F9 l \
- i l
' \ m
.- . I:
~ 8
. e w
{ i
/
"w s ,
j .,
) M m-hl r s D gq
~p - m,c,=.e-s s Cl 0 3
\ ~ M $.I u C
\ , ,
c=:2 l ' .. s A e
? : ui - ,i m
/ '% I
- L)
% ' % ' f e C.COC
.-i.% .,_ 7 ._ % s.- ,rr. m - - - %
,f Q. v- N
' _ * ~ ~y ,
b N (g)
""~'-+-%..-,..,_ __ , ., . _ _ . _ . _,, , _ , _ r a u 3 L*.
uuu C > > :n - 9 C U LJ U
-7 . , ,_ , , - .y.._, __1_7- , r , - ,
o sJJt
- o. - o. o. o. o. o. o o. D. o. o. o. o. - c. . o.
o ' , ,,
- S. ---R. R. .
8-8
- g P
- g 5 0
m R m 3 2 8 rt
- i.
01 38nlUM3dW31 6-10
telse) 3815536d R. 8, 0 8 R. F. C. 8 K. ! I
- - - - =-
e.
-- j ]
l o
~
l o - I p
-{ s i
8 W O. W E9 A F i 4 s i l s i I g O l I I d v f a I a o @ l - M
~
o < 1 eC u l y -W c- r o
; I -- m I
"he & WW W W b
t 3 U r to m o wm
/ ig AW kw u
! E A I s0 1 c. .G.e
- 9 D A s _.
> ,. .e4 D
i
' O m
s
/
- C. w 7 W
, n O W
~- , O C c;
- " . --+wA-
. - - - ~ v._ _ w O r; y
...w... ... _ , , , , , , , , , , , _ , _ __ g i
. . 3 p c
! l' f a UC C>
1 L._ X: C-C C, C. C. C. C. C. C. C. - i C
. _ _ _ - _ C.. - ,
e roix tyd! 3B1^53bd : i L L _ _ _.- 6-11
J,- 4 m.& A. _d # 5Awuu._M& a 2 J.l.f -#~Mi. Am'e 4.A+l4J4 u44--.A.w SeJ--J] Imv- ma nreOe 4- 4 a w 4u--4-n - e ._.SM
- e M 4. 3 m -M >'ih*J<
.. e-UI JenJUE3dW31 1 o e o o e o e o o ,
R r. 6 o n - a o 1 4 ', i T i i i i 5 P
, '/
- (
9 o -i
. ;l 1 -
e N' xn I W
)' o u i 5 #
Y 1 4 g i e - e-4 4
.~ k lJ k 9
S 'W k
, e o E
1 O Y
' N
! d 1 I$ u 4.
\ O k' -
i 9
- p . \ -p -
- m w.
s J .e o u p
,.I \ U Og e
, o* *- e
- n-g g[ '
, .( g F. La, a.
g Is % 4
' h-
/
s
'ep
, y'
- 3 I
t i .M -4 O w4
-t( / + q.
4 m. 0
/ / i n
/ .
s u-O I~
/ \
g ~O MUUU W d O'ZZZ U e 1
/ \ ,
'n e I Ui i i o l
/\ \ , O .W i s % + -
C000 1
<- --,w. - % ,,
_,O_----~_.r.==._- o Cr - e tN l
--- -. . a, ,w _g es s o O J J.J o UUU c.>>>
CUUU f-- -aaa C! o c, o o q o q q q e, o e o o
~
? R_ R. .
8 8 8 m R m g- S
?
-m R
m R m - $ . ,
' I i
i -i t>) 38n1983dW31 6 ,
, - .-- .---- - - . - . - - - _ _ __-- - - - - - - - . - - . , , --n-- - , , -- , - - - - - - .
c 4 pg s ..w.,.<.-4 A- aE ad 6 ' A d46p---.s,-.".--.ha- JD &-J %_eJ~-4d4.J-a ,WC-e49- 4 14b-2--a., 4.A,--@bMM-4eJ1++-*J4==m-d- M.M+ _ 6 46_a.i.ea Ad M &44.& ,.4 w;A _ .a. m o o o o e o o o
.o 5- R -K 9 K R F 8
~ a N R.
. - G.
i i , i i N 4+
. , , , , . g I.:
'8a
.: no n- ca 1'
~C~
,- -{ .
p kl . M
~
a ja> . . -
- y, u
,j ,
- J e Dt
!I u :-
0
'l n %
h - U h (A tj
~Q ?
jI - G -B u. 9 I, . 8. u - E O I
- r. w ,i E O.
I'"* I I. e C
- C. w
+ f W_ D Ii, -
M 1 3 I6 t-~ M
. h4 g'a . ' .C >= L.) LJ U .O
' u CZZ2 .()
- 2 e
- l W1 4 i G-j
' C %
c ri) f1 XOOO
- 3: -- e r4 l
sj. . .O kkD f %y
- L.
. -- . , OJJ)
. ." -de_r ,: . ~ ~. - . ~ ~ -- -
... O wyu-C. > > >
..j._ gy'
- c,
_ . ~ _ , .T .~ m a - _ oyyy r
----~.-__~_._______m,_., i 6 i i i 2 C;
o sJ ]J , O. C. C. C. O. C. C. C. C. O. C. C. ' C. C. R g ', S E. 8 F 5: E 9 -9 2 -R R E 8
,- , . n m A N n n n n n 3
l
- l IM JI:fr,Wd3dW31 6-13 , . - - - - - - . . - - . . - . .---.-- - - - . . , - . - .- - ,----, ~ + ,- .-- -
._ m_ __ . _ . _ _ _ .. _ _. - . . _ _ _ _ . . . _ _ . _ _ . _ . . . _ _ _ . . _ . . . - . . _ _ _ ,
e Table 6.2 Base Cases' Temperatures (K) 4" Leak -18" Vent '36" Rupture Volume Peak Average Peak Average Peak Average 301 309 309 310 305 320 305 302 309 305 390 390 415 415 303 320 315 375 380 355 345 304 330 325 395 390 380 375 305 309 309 315 308 325 308 306 313 310 390 390 420 420 307 305 297 400 390 373 373 306 365 365 415 390 430 415 309 405 400 420 390 430 415 310 365 365 395 390 430 415 311 395 390 390 390 430 4l5 313 435 420 410 395 435 410 317 420 415 410 395 435 410 321 400 390 410 395 410 410 324 345 340 415 395 410 410 325 390 390 420 395 400 400 331 305 299 390 390 420 420
\
6-14
Table 6.3 ' '
)
Sensitivity cases' Temperatures (K)- 5* 2
- Rated Fan
.5
- Vent. Refuel Floor Steel Mass Cooler Q Area Llowout
. ime Peak Avg Peak Avg Peak Avg Peak = Avg 301 310 305 310 305 310 305 310 305 302 390 390 390 390 385 385 385 385 303 375 375 370 370 355 355 370 -370 304 395 395 380 380 375 375 390- 390 305 310 310 310 300 310 310 310 310 306 385 385 380 380 380 380 360 360 307 400 395 390 385 310 300 310 300 308 420 390 415 395 350 350- 395 395 309 420 390 420 395 390 390 410 395 l 310 390 -390 395 395 380 380 375 375 311 385 385 385 385 380 380 365 365 313 415 395 415 400 400 400 405 400 317 410 395 410 400 415 400 400 400 321 410 395 410 400 415 400 400 400 324 420 395 -415 400 415 400 415 400 325 425 395 420 400 425 400 420 400 ,
331 385 385 385 385 310 300 310 300 6-15
- . - . - . - - . - . . - ~ ~ . _ . _ _ - - . _ . . ~ . - . - - _ _ - . . - ~ . - - , _ , -
' base case. The smaller blowdown caused a much slower heatup of most-of the reactor building, but by the end of the run, the temperatures _ were - approaching the same level as in the base case. The LPCI room response varied more from the base case than the other rooms had because the doors did . not blow open, giving a more restricted path -into the room, and therefore, the temperatures remained naminal. In the final sensitivity case, the assumed blowout panel from the refueling floor to the environment , opened almost immediately. This additional opening relieved the pressure more quickly than in the base case, resulting in about a 5 kPa (3/4 psig) reduction in peak pressure and a more rapid return to atmospheric pressure. About 2/3 of the steam went out through the refueling floor level, reducing the amount- of steam being drawn down to lower levels and out the steam - tunnel. Therefore, the response in the lower portions of the building resembled the response for the case with reduced vent flow area. However, the venting of steam through the refueling floor opening resulted in a change in the flow patterns such that flow was mainly directed down through the hatch with less circulation around each level. This can be observed by examining the room temperatures in Table 6.3. b.2.3.3 Model Limitations Since this is one of many analyses being performed as part of the PRA and due to limited resources, complete sensitivity calculations covering all. possible variat.lons in physical parameter estimates, code thermal-hydraulic models, initial conditions, and reactor building models cannot be evaluated explicitly. For the PRA, the impact of these uncertainties must be estimated so the uncertainty can be represented in the final result, Somo of the dominant modeling uncertainties are discussed below.
- 1. We did not model the leakage path from the steam tunnel to the turbine building via the turbine cavity underneath the main ,
turbine. Initially, this volume was believed to be isolated, but later information showed that there were various paths by which steam could reach the turbine building. All of these paths have fairly large flow resistances and we judge that the total flow will be small if any other path is open. However, for leaks, some portion of the flow would be drawn down into the annulus and out the steam tunnel. The information to model this is not available and would be very difficult to either calculate or estimate. Sensitivity rt is or engineering judgement could be used to assess the impact on uncertainties. The steam tunnel volume was doubled to account for the cavity volume but this was later found to be too low. The turbine cavity is actually about 35,000 m. 3 For leaks, this will draw hot steam down into the lower regions of the reactor building but should not result in significant additional heatup of the corner rooms. For venting and ruptures, the dominant flow paths will not change and, therefore, the environments in the reactor building should not be substantially affected. 6-16
S i l
- 2. At the time. these calculations were performed, the drywell was predicted to_ fall:at 12,9 bar-(160 psig). More recent analyses by the NUREG 1150 expert review group, as - described in - Appendix C, predicted primary contair. ment failure-to occur in the wetwell_and at a pressure of 1.41 MPa (190 prig) . This - difference will not significantly affect expected flow . patterns in the reactor building and the resultant threat to equipment.
3, If the doors-between the Unit 2 and Unit I reactor buildings blow out in more than 1. location, a flow path can form where steam-flows from one location in Unit 2, through Unit 1, and back-into a-second location in Unit 2. Unit: 1 is only modeled as . o single volume, so any flow - entering it is instantaneously mixed with the
- entire Unit 1 volume, rather than just mixing in a local region.
This simplification affects the results, but it is probably less influential than other uncertainties in the problem.
- 4. The results are probably most sensitive to the setpoints of blowout pancis and doors. As was discussed in the Results-section, the status of these paths greatly affects temperatures-within the various regions of t% reector building. The actual load the doors could withstand is unknown; we estimated values that seemed reasonable.
6.2.3.4 Conclusions Because of the level of detail of the model, we were able to examine details uf reactor building flow patterns that have not previously been examined, This level of detail reduced the uncertainty in a number of variables included in the model that could affect the results of the calculations (e.g. volunu s , surface areas, flow path characteristics, and the effects of room cooling) and, the re fore , the assessment'of equipment survivability. The reduction in the number of uncertain parameters'and the experience gaired by varying se;ne of them enables us to better use our-engineering judgement to estimate the effects of the rcmaining parameters, For all of the cases examined, the upper regions of the reactor building-were relatively well mixed. For the 4" drywell leak case, the blowout - panel in the steam tunnel-did not open, so the. basement rooms were buffered from the blowdown and remained relatively cool,. For the 18" veat case,-the steam tunnel blowout panel opened, but the walls-of the. refueling _ floor did not - f ail . - As - a result ,- steam was drawn down 'into - t.he basement rooms, giving higher temperatures, For the_36" rupture case, the steam tunnel _ blowout' panel vas opened and the walls of the refueling floor failed. Although this allowed some of the steam to flow up through the reactor building, a substantial amount wa t, still drawn down into the basement . rooms, resulting in relatively high temperatures. Sensitivity calculations for the 18" vent case showed that heat transfer uncertainties were much less significant than uncertainties regarding possible flow path configurations. 6 17
6.7.4 Step 4; Evaluate Equipment Failure probabilities. The Expert Elicitation panel for the NUREG-11SO Level 1 issues was supplied ' with the results of the abeve severe environment calculations for LaSalle and with a list of the types of equipment that appeared in the reactor buildinr, and their qualification characteristics. The experts were asked to assess the failure probability of the different categories of equipment in t he various enviroiunents. The experts based their evaluation upon their knowledge of test and qualification procedures and results. The results of their analysis are reported in Reference $. The actual distributions used in the Latin liype rcube6 sample are reported in the LHS input file in Appendix D of Volunm 2 of t.h.i s report. Ilowe ve r , we note here that fne conditional failure probabilities were in the 0.1 to 1,0 range with wide distributions. As an example, we use the control rod drive (CRD) system and its support systems in the case of a leak from the containment to the reactor building. From the expert clicitation, the values for the failure probabilitien in severe environments for the CRD and reactor building closed cooling watar (RBCCW) pumps and cont rol circuits, the heating. ventilation, and air-conditioning (l!VAC) system fan and its control cl . ..uit for the CRD room, spurious operation of a motor operated valve in the service water system (SW), and a 480 VAC motoc cont rol cent er are given in Table 6.4. Table 6.5 contains the list of equipment evaluated, rough estimates of environmental quallfleation, their locations, the expert case used, and the median probability of failure to give a sample estimate for containment leaks, ruptures, and venting. Table 6.6 contains a summary of all the differentr cases, evaluated for each component examined in Table 6.5 and Table 6.7 gives a summary list of the environments examined. In all the tables the tollowing abbreviations occur: So - spurious operation, Sit - short to ground, FTR - fall to run, QT - qualification temperature, 1 and 10 - 1 or 10 hour exposure 6.2.5 Step 5: Construct Simplified System Mc.dels, For each system, the original fault tree models were examined and all-e <1u i pme n t in the reactor 1.ailding was identified. For each train, the components which had the highest failure probabilities in the envi rotunents to which they were subj ec t were selected to represent train failure. The full system models could have been quantified since sufficient information was available, but, insufficient resources were available - for full q u a n t. i f I c a t i o n , the probabilities were high and exact probability calculations would need to be done to get accurate answers, and the current. level quality of the environmental, thermal-hydraulic, and expert judgement on containment failure and environmental failure analyses does not really justify that level of effort. Therefore, simple Boolean models were then constructed for the systems Failure probabilitirs for the components were selected from the expert judgement results, and the system failure i l i 6-18
"?rw " 9- e- w,.w.4,ene-,us---m..-mas-seea ny.- ,--w.see- -p-w-enggo- e e ,--mSu- g3ym.>wyp- -.ye-.g.- er patr ,JW 9lp+'-' e' 2*-' -
S' t'8" *-me-t-NM"r TWTze dr-
Table 6.4 Sample Severe Environment Evaluation for CRD System Event Value Location Description (median) (VOL) CRDPltIR-SUR-F.? - 0 305 CRD pump CRDPICC-SUR E? - 0 305 CRD pump control cir. 2WRP1PTR-SUR-E7 - 0.2510 321 RBCCW pump 2WRPICC-SUR-E? - 0.7976 321 RBCCW pump control cir. SWVYO2CC-SUR-E? - 0.5517 305,306 IIVAC fan control cir. SWVYO2LF-SUR-E - 0 305 llVAC fan PSW175CC-SUR-E? - 0.7442*(1-0.4'00) 309,313 SW MOV spurious op. g-
- 0.4168 2WRMCCl-SUR-E? - 0.7015 321 RBCCW MCC The conditional probability of a leak to the reactor building given containment failure is:
LEAKTRB - 0.2667 (median) 6-19
- . . - - . . . . - . . .- - -- - .- . . - - - - . _ . . . . . - . . . - ~ . - ~ .. ... .~.
4 Table--6.Sa Quantification for Leaks: Types of components and environments:
- 1) CRD. pumps FTR 10 hr, qual - 310 F?,'envir nominal temp ( 312 ) _;
- 2) RBCCW pumps FTR 10 hr, qual 310 F7, envir - 250 P' ( 3D ) )
- 3) Fan motors FTR 10 hr, qual - 355 P 1006 hum, envir - nominal temp (
312-) 4 MOV motors FTR 10 hr, qual - 310 F7, envir - 260 F (- 3G 1 ) -> prob 300 F if Icak in wetwell, nominal temp ( 3111 or 311 ), 280-F ( 3E-),
- 5) CRD pump CC FTO 10 hr, qual - 185 F?, envir - nomina 1 temp-( 312.)
- 6) RBCCW pump CC FTO 10 hr, qual - 185 F?, envir - 250 F ( 3D )
- 7) Fan CC FTO 10 hr. qual - 185 F 954 hum, envir :( 312,3112 ) nominal temp for leaks on 3F 1 from drywell but would be more severe in 3112 for leaks from the wetwell only one floor above (_ 200-300 F depending on location of leak, use 240 F ), Average the two with'a
.58/.42 split from expert. modo probabilities.,
- 8) Valve CC SO 10 hr, qual - 185 F?, envir - 300 F ( 3G-1 and 3F-1 ),
nominal temp ( 311, 3111 ), 280 F (3E ), see n7 above use 240 F * ,42
+ 100 F * . 58 ( 3112 ) ,
- 9) MCC SH 10 hr, qual - 340 F 1hr then 320 F lhr then 160 F 100 days 951 hum, envir 250 F ( 3D ), 300 F ( 3G-1 ),
- 10) ADS valves FTO 10 hr, qual - 350 F, envic - 60 psig, 308' F (3J),
ll) ADS valves FTO 10 hr, qual - 350 F, envir - 195 psig, 386 F (3J). l?) IIPCS pump FTR 10 hr, qual - 310 F, nominal temp (312). -l h 6-20 l'.
~ . _ - . . . . - . - . , - . - - . - . . . . . - - - .. . - ..._- . . - - .. -..- - . . - - . .. - . r i Table 6.Sa (Concluded) Quantification for Leaks: From the expert clicitation, median values are: Event -Value Location Quan Ref CRDP1F1R-SUR E? - O 3I2 FTRIO, nominal CRDPICC-SUR-E? -0 312 FT010, nominal PSW175CC SUR-E7 .7442*(1- 3F-1,3C-1 S010, QT+115 * /FTRIO 4400) .4168 QT15 SWVYO2CC SUR-E7 ,5517 312,3H2 FT010, 58
- QT-75 +
.42 *- QT+50 .58 *
.3736 + .42 * .7976 SWVYO2LF-SUR-E -0 3I2 FTR10, nominal 2WRP1FTR-SUR-E7 .2510 3D FTRIO, QT-60 2WRPICC-SUR-E? .7976 3D FT010, QT480 2WRMCCl-SUR-E? ,7015 3D SH10, QT+100 HPCSPPTR-SUR-E7 -0 312 FTR10, nominal IIPCS01SP-SUR-E? -0 3Il S010, nominal HPCS23SP-SUR-E7 -0 3H1 S010, nominal HPCSO4SP-SUR-E7 .6950*(1- 3E S010, QT+100 * /FTR10
.3035) .4841 QT-35 HPCS15SP SUR-E? .2260 3H1,3H2,3Il S010, (.58
- QT-75
+ .42
- QT+50) * /
FTR10QT-210 - ( 0 *
.58 + .42 * .5381 )
- 1 .22.60 MC1E35Y2A-SUR-E? .7015 3C-1 SH10,- QT+150 ADS 18 VAL-SUR-E? .0171 3J FT010, QT+50**18 LEAKTRB .2667 Therefore:
CRD1 - 0 + 0 + .4168 + .5517 + 0 + .2510 + .7976 + .7016
.9882 IIPCS - .5517 + 0 + 0 + 0 + 0 + .4841 + .2260
.8210 ADS .0171 LPCI .7015 LPCS .7015 LPCI
- LPCS .7015 HPCS
- CRD1 .5517 t 0 + ( 0 + 0 + 0 + .4841 + .2260 ) * ( 0 + 0 + .4168 4 .2'10; + .7978 + .7015 )
.8139 where sums were combined using P(A + B) P(A) + P(B) - P(AB).
6-21
. ~ . ~ . ..
Tabic 6.5b-Quantilicatton for Ruptures:
. Types.or components and environments;
- 1) CRD pumps-1Ik 10 hr, qual - 310 F7, envir - nominal temp ( 312 )
- 2) RitCCW pumps ITR 10 hr, qual 310 F?, envir - 280 F ( 3D )
nominal temp (-
- 3) Fan motors FTR 10 hr, qual -
355 F 100% hum envir 312 ) 4 MOV motors FTR 10 br, qual - 310 F7, envir - 230 F ( 3G-1 ) -> prob 280 F if rupture in wetwell, 290 F ( 3111 ), nr .alnal ( 311_), 280 F (- 3E ).
- 5) CRD pump CC FTO 10 hr, qual - 185 F7, envir - nominal temp ( 312 )
- 6) RBCCW pump CC 17010 hr, qual - 185 F?, envir 280 F ( 3D )
i- . l 7) Fan CC 170 10 h r , qual - 185 F 95% hum, ent'r - nominal ( 312 ), 300 i- F( 3112 ) for rupture on 3F-1 from drywell vould be the same in 3112 for ruptures from the wetwell only one -floor above,
- 8) Valve CC SO 10 br, qual - 185 F7, envir - 285 F ( 3G-1 and 3F-l'),
nominal temp ( 311 ), 290 F ( 3111 ), 280 F (3E ), 300 F ( 3112).
- 9) MCC Sil 10 hr, qual - 340 F 1hr then 320 F lhr thee 160 F 100 dayr, 95% hum, envir - 280 F ( 3D ), 280 F ( 3G-1 ).
I 10) ADS valves FTO 10 hr, qual - 350 F, envir - 60 psig, 308 F (3J) .
- 11) ADS valves FTO 10 hr, qual - 50 F, envir - 195 psig, 386-F (3J).
)2) lipCS pump FTR 10 hr, qual - 310 F, nominal temp (312) .
l -. l 6-22 l
- , _ _ . .. _ _ _ _ _ _ _ . . _ _ _ _ _ - . _ . . . . _ . . _ _ , . , ~_ , _ . _ , _ . . . . _ _ . _ . . _ . . ._. -- - , .a .,
... -, . . - . ~ _ ~ . - . - - . - . - . - .. --..-- - - . - - . . _ . . . . - . . _-
-Table 6.5b (Concluded)
Quantification for Ruptures: From the expert elicitation, median values are: Event Value Location Quan Ref CRDP1FTR-SUR-E? - 0 312 ITR1, nominal CRDPICC-SUR-E7 -0 312 FT01, nominal PSWl75CC-SUR-E? .5659*(1 3F-1,3C-1 S01, QT+100 *
.2619) .4177 /FTR1QT+35 SWYO/CC SUR-E7 .6898 31 2 , 3112 FT01, QT+115 SWYO2 LF- SUR- E -0 312 FTR1, nominal 2WRP1FTR-SUR-E7 .2619 3D FTR1, QT-35 2WRPICC SUR-E7 .6898 3D FT01, QT+100 2WRMCCl-SUR-E7 6220 3D Sill, QT4125 llPCSPFN-SUR-E7 -0 3I2 FTR1, nominal llPCS'J18P-SUR E7 -0 311 Sol, nominal llPCS23SP-SUR-E? 5659*(1- 3111 Sol, QT+100 *
.3001) .3961 /fTR1QT-10 llPCS04SP-SUR-E? .5659*(1- 3E Sol, QT+100 *
.3001) .3961 /FTR1QT 10-IIPCSISSP-SUR-E? .5659*(1- 3ll1 , 3112 , 3 1 1 Sol, QT+100 *
.3001) 3961 /FTR1QT MCIE35Y2A-SUR-E7 .6220 3C-1 Sill, QT+150 ADS 18 VAL-SDR E7 .00125 3J FT01, QT+50**18 RUPTURETRB ,8243 Therefore:
CRD1 - 0 + 0 + .4177 + .6898 + 0 + .2619 + .6898 4 .6220
.9844 ilPCS .6898 + 0 + 0 + 0 + .3961 + .3961 + .3961
.9317 FIPCS
- CRD1 .6898 + 0 + ( 0 + 0 + .4177 + .2619 + .6898 +
6220 ) * ( 0 + 0 + .3961 + .3961 + ,3961 )
.8774 LPCI .6220 LPCS .6220 LPCI
- LPCS .6220 ADS .00125 where sums were ccmbined using P(A + B) - P(A) + P(B) - P(AB).
6-23
. ..m ..,. . _ _ _ . . _ _ _ _ _ . . _ _ . . _ . . . . _ . _ _ . - _ _ _ . . _ . . _ . _ . . . . . _ . . _
Table 6,5c Quantification for Venting; Types of components anel environments:
- 1) . CRD pumps FTR 10 hr, qual - 310 F?, envir nominal temp ( 3I2 )
- 2) RBCCW pumps FTR 10 hr, qual - 310 F?, envir - 250 F ( 3D )
- 3) Fan motors FTR 10 - hr, qual --355 F 100% hum, envir - nominal-temp (.
3I2 ) 4 MOV motors FTR 10 hr, qual - 31. F7, envir - 240 F ( 3G 1 ),. nominal temp ( 311 ),-240 F ( 311 ), 250 F ( 3E ).
- 5) CRD pump CC FTO 10 hr, qual - 185 F?, envir nominal temp ( 3I2 ))
- 6) RBCCW pump CC FTO 10 hr, qual - 185 F7, envir - 250 F ( 3D )~
- 7) Fan CC FTO 10 hr, qual - 185=F 95% hum, envir - nominal ( 312-), 240 F ( 3112 ) .
l- 8) Valve CC SO 10 hr,. qual - 185 F?. envir - 250 F ( 3G-1 and 3F-1.), l nomi.nal temp ( 311), 240 F ( 3111 ), 250 F-(3E ), 240 F ( 3112) . I
- 9) MCC Sil 10 hr, qual - 340 F 1hr then 320 F 1hr then 160 F 100 days 95% hum, envir - 250 F ( 3D ), 240 F ( 3G-1 ).
- 10) ADS valves FTO 10 hr, qual - 350 F, envir - 60 psig, 308 F (3J) .
l
- 11) ADS valves FTO 10 hr, qual - 350 F, envir - 195 psig, 386 F (3J),
i.
- 12) itPCS pump FTR 10 hr, qual - 310 F, nominal temp (312).
l l 6 _ _ . . - - . . . . _ .._ . _ __ _ __ . . _ _ _ _ _ _ _ . - __ .. _ , _ . _ . .- _ . _
Table 6.5c (Concluded) Quantificat ion f or Venting: Fr oin the e r.pe r t elicitation, stedian values are-f:ve n : Value 1,ocatIon Quan P ~ CRDP1FTR-SUR-E7 - 0 N 312 iTR10, norninal C R Dl'l CC - SUR - E ? -0 312 17010, norninal PSW175Cs SUR-E? - .6168*(1- 3F-1,3G 1 S010. QT+75 *
.2510) .4620 /fTR10QT- 60 SVVYO2CC SUR E? - .7976 3 1 2 , 3112 17010, QI+ 50 SWVYO?LF SUR-E -0 312 ITR10, norninal 2WRPl FTR SUR- E7 . 2 510 3D ITR10. QT-60 2WRPICC-SUR-E7 .7976 3D 17010, QT 6 80
. RMCCl-SUR-E7 -
.7015 3D Sil10, QT+ 100 liPCSI'FTR SUR 07 -0 312 ITR10, norninal llPCSolSP-SUR-E7 -0 311 Solo, nominal
"CS ? lS P SUR- E7 . 5 3 81 * (1 - 3111 5010, QTtSO *
.2510) .4030 /ITR10QT- 60 llPCSO4SP SUR-E7 .6168*(1- IE S010, QT+75 *
.2510) .4620 /fTR10QT 60 iiPCS15SP SUR-E7 .5381 3111 , 3112 , 3 1 1 S010, QT+50
- 1.0 MCl E P;Y2 A- SUR - E 7 . 616 8 3G-1 Sil10, QT+ 75 ADSl8VA1.-SUR E7 -0 3J 17010, QT-50**18 Theretore CRD1 - 0 4 04 .4620 4 .io76 +0+ .2510 4 .7976 + .7015
.9951 ilPCS - .7976 4 0+0+04 .4030 +.4620 4 .5381
- 9100 CRD1 + llPCS - .7976 + 6 + (0+ + 4620 4 .2510 + .7976 + .7015
~
.)
) * (04 04 403) 4 .4620 )
.9316 1.PCI - .6168 1.PCS - .6163 1.PCS + 1.PCI .6168 ADS - 0 where sums were conihined using P:A 4 B) - P(A) + P(B) - P(AB).
6-25
Table 6.6 Stamnary of Severe Eiwirotnent s: Ct!trentni Et.Y11t Iny1LentttnLE falcSlnL12nal_Enntulu l'SW175CC-SUll E? - 5010. QT+ 11$ * /ITRIO, QT415 - E6* (1 ElB) SWVYO2CC-SUR-E7 - 17010, .58*QT-754.42*QT+50 - .58*E22 4 42*E23 2WRI'llTit SUK- E? - ITR10, QT 60 - E16 2WRPICC-SUR-E7 -- 17010. QT e 80 - E24 2WRMCCl-SUR+E7 - 51110 QT6100 - E10 " llPCSO4SP-SUR E7 - S010, QT4100 * /ITRIO, QT- 35 - E5*(1-E17) llPCS15SP-SUR 07 - Solo, .58*QT-7;+.42*QT+50)*
/ITR10,QT 210 - (.58*E2+.42*E3)*(1-14CIL;5Y2A-SUR.E7- Sil10, QT+ 150 - Ell )
ADS 18 VAL-SUR 1:7 - 17010, QT+ 50*
- 18 - E23**18 Quant i f lent ion f or Rupt ur es PSW175CC-SUR Sol QT+100 * /ITR1,QT+ 35 - E1 * ( 1 014 )
SWVYO2CC SUR-E7 - 1701, QT 6115 - E21 2WRP1ITR- SUR E7 - ITR1, QT- 35 - E12 2WRPICC-SUR E7 - 1T01, QT+100 - E20 2WlMCCl SUR-E7 - Sill , QT412 5 - E7 lil'CS2 3SP-SUR E7 - Sol , QT 4100 * /tTR1,QT- 10 - E1*(1 E13) ilPCSO4SI' SUR E? - Sol, QT+100 A /FTR1,QT 10 - El*(1-E13) IIPCS15SI' SUR E? - Sol , QT4100 * /ITR1,QT- 10 - El* (1 E13) , MCIE35Y2A SUR E?- Sill , QT + 150 - EB ADS 18 val.-SUReE? - 1701, QT+50**18 - E19d*18 Quantiflention ior Ventiny, PSW17 5CC- SUR E? - S010, QTi ? 5 * /ITR10,QT-60 - E4*(1-E16) SWVYO2CC- SUR+ E? - 17010, QTt 50 - E23 2WRPllTR SUR-E7 - ITRIO, QT-60 - E16 2 WR l'1 CC - SUR- E? - 17010, QT+80 - E24 2WRMCCl SUR-E7 - Fil10, QT e 100 - E10 4 IIPCS23SP SUR S010, QT450 * /FTR10,QT 60 - E3*(1-E16) llPCSO4SP-SUR-E? - S010, QT675 * /FTR10,QT-60 - E4*(1-E16) llPCS15SP-SUR E7 - S010, QT+50 - E3 MClE35Y2A-SUR-E7- Sil10. QT*75 - E9
__ _ _ _ _ _ _ _ ~ _ _ [ l Table 6,7
-Final Collapsed List of Severe Environments: ,
Hop 2 Description Where Found E1 - Sol, QT+100 NEW STUFF Sol #5 E2 - Solo, QT 75 NA IDENTICALLY ZERO E3 - S010, QT+50 NEW STUFF S010 #1 E4 - 5010 QT+75 NEW STUFF S010 #4 E$ - S010, QT+100 NEW STUFF S010 #5
- E6 - S010, QT+115 NEW STUFF S010 #6 (+125)
E7 - Sill, QT4125 NEW STUFF Sill'#6 . E8 - Sill, QT4150 NEW STUFF Sill #7 E9 - 51110, QT+75 NEW STUFF SH10 #4 E10 - Sil10, QT4100 NEW STUFF Sil10 #5 E11 - Sil10, QT4150 NEW STUFF Sil10 #7 E12 - FTR1, QT-35 NEW STUFF F7R1 #4 . E13 - FTR1, QT-10 NEW STUFF FTR1 #5 E14 - F7R1, QT+35 NEW STUFF FTR1 #7 (440)- E15 - FTRIO, QT 210 NA IDENTICALLY ZERO i' 6 - FTRIO, QT 60 NEW STUFF F7R10 #3 E17 - FTR10, QT-35 NEW STUFF FTRIO #4 ' E18 - FTRIO, QT+15 NEW STUFF FTRIO #6 E19 - F701, QT450 NEW STUFF FT01 #9 E20 - FT01, QT4100 NEW STUFF FT01 w9 (+50) E21 - FTol. QT+115 NEW STUFF FT01 #9 (450) E22 - FT010, QT 75 NEW STUFF 17010 #4 ; E23 - FT010, QT+50 NEW STUFF FT010 #9 E24 - FT010, QT480 NEW STUFF FT010 #9 (450)
?
6-27
j pr obabilit y was calculat ed. Since the failure probabilities were rnostly above 0.1, the small value approximation could not be used and exact results were calculated. For example, for the CRD system with one train 4 operating (CRD1) and contalnment leak, the Boolean equation is: CRD1 - ( CRDP11TR SUR-E? 4 CRDPlCC-SUR-E? 4 PSV175CC-SUR-E7
+ SWYO2CC SUR E7 + SWYO21.P-SUR E 6 2VR PllTR- SUR - E 7 6 2WRPICC-SUR-E7
- 2VRMCCl-SUR-E7 ).
Subst it uting in t he above equat ion the failure probabili ten for each event. from step 4: CRD1 - 0.0 + 0.0 + 0.4168 4 0.5$17 4 0.0 4 0.2510 #0.7976 + 0.7016
- 988? ._
where sums were conbined using P(A 4 B) - P(A) 1 P(B) - P(AB). For this part icular system and case, the severe e nvi r onment failure probability is almost 1.0 and not much van gained; however, for other systems and cases, the values ranged from no additional failure probability to 1.0 depending upon the type and location of the equipment, the environment, atid the system design. Table 6.8 contains a description of the simplified equation used f or each sys t < m. Be c ain,e the nystemn that are available to respond to the survival question re po' / tit ially dif ielent for each cut set (i.e., combina' ion of component i llurer that can renuit in a part icular accident sequence), a Boolean egaation was constructed for each possible combination baned upon an examinatton of the cut sets of the nequences Each unique combination is defined to be a di flo rent survival event. If we wnsider a cut set for which only CRD can operate then: SUR-001-L - CRDI
- LEARTRB - .988? * .2667 - 7636 where SUR-001 L is the probability of no. ..< !ng able to use CRD if c ont a i nment failed in a leak mode and the resulting severe environment falled CRD, since one needs a leak to the reactor building in order to get any severe env i rotunent inilure. We see that, for this example, the conditional probability of a leak to the reactor nullding instead of the reit eling floor is very important in determining the final amount of recovery credit t hat can be given.
The definitton of each survival event used in the analysis is given in Table 6.9 in terms of system succerses In Table 6.10, the failure equat ton and an est.imat e of the probability using the median values for the severe envirotwent failures and the c on ta t iune n t failure is given. The system equations were substituted into the survival event definitions and the Boolean expressions were siirplifted and then converted to probability equations Because sotte of t.be probabilities are large (i.e., greater than 0.1), exact expressions were cloped to calculate the probabilities (the 6 28
i I i i i Table 6.8 l System Models j s ADS System The ADS systern has only its main valves and their solenoid valves in the , l prirtary containroent. All other components which are necessary for manual operation are in the auxiliary building and not subject to harsh i environments. There is a nitrogen bottle sta.lon also in the auxiliary building to indefinite operation can be sustained. The followirt simplified equation is therefore adequate to represent ADS failure in harsh environments: ADS-SUR - ADS 18 VAL-SUlt-E7. That is; all 18 SRVs must fail in order to fail ADS. This tuust be evaluated for venting at 60 psig or containment failure at about 195 psig. L. I i i 6-29
i l a d i a i Table 6.8 (Continued) i System Models i ; CL byatem The compo:wnt s In the condensat e r4ys t ern ar e located throughout. the turbine buildlng Even 11 the s t e nin gets int o the t urbitm building, for thlN , system to be operating the building )(VAC will likely be wo king since all l powet will be avullable. The expec t ed environment s for the lower levels into which out side air is being forced, nhould be mild. Therefore, otily random failure in expected, llowever, nince PCS has f ailed, makeup f rom the , ! CST 16 needed for continued operatlon, Tlw limiting random inilute in fallute of IA a.upply to the snakeup valves, 11y examinitig the system cut l' nets this i n t v' '-l lute in 6.9E 7. Failure of any comprensor will tesult. in sul f icient fa n t ' ens on to close the valve, 4 liecause of the long , time before < s n- %o %. , the spare can be cantly started, This I me to ut that th t< 1 e 3 , ;:n e llty in dominated by operator fallute to maint ain cont isnm _ ; n 4 ou Yoe r e are several single random .intlures in the low 'tE-3 range t h o mor e in the LE 5 range, Therefore, CDS failure can be t cat ed nu t aiutom und we wi11 une operntor iatlure to be the dom i natit. tailure l I CDS l'All - OPERFCDSTW - 7,IE-03, l.og normal, Elbl0, Group 2 netlon. I f 1 e 1
+
l l l l 6-30
. - . . . - . - . . - - . . - . . . . . .., . - - . -. - - - .--.- . -. - - - --- . _ _-.- - --.,---.,~ - ~ - -....-..- , -
_ - .. . ~ . _ . _ _ ~ - - - _ . - - t Table 6.8 (Continued) System Models j CRD System 1
- If the CRD syst em is already running then the following equation represents t he dorninant. systern f ailures
i CRD2R-SUR - ( CRDPil'IR SUR-E7 4 CRDPICC SUR E7 ) * ( l CRDP21TS-SUR-E7 4 CRDP2iTR- SUR-E7 4 CRDP2CC SUR E7 ) t PSW175CC SUR-E7 * /PSW175LF SUR E7 4 SWVYO2CC SUR E7 4 SWVYO2LF-SUR E7 + ( 2WRPlfTR SUR E7 I 4 2WRPlCC SUR E7 6 2WRPICB SUR E7 4 IE34XBMCC-SUR E7 4 IET34XBTR-SUR E7 4 IEB234BBK SUR-07 ) * (
- IE233TXTR SUR E7 4 lEB233ABK SUR E7 + 2WRP21TS-SUR-E7 6 2WRP21TR-SUR E7 + 2WRP2CC-SUR-E7 ).
The equation we used to approximate the systern probabili ty f or all cut set s where at least. one train of CRD is working was: l For Lenks: CRDlR SUR - ( CRDPlFTR-SUR-E7 + CRDPICC-SUR-E7 i PSW17bCC-SUR E7 i SWVYO2CC SUR E7 4 SWVYO2LF-SUR E i ?WRP1FTR SUR E7 4 2WRPICC-SUR-E7 + 2WRMCCl SUR E7 )
- IAARTRB.
For Ruptures: CRDIR-SUR - ( CRDPlFTR*SUR E7 4 CRDPICC SUR E7 4 PSW175CC SUR-E7 4 SWVYO2CC SUR E7 4 SWVYO2LF-SUR-E 4 2WRP1FTR-SUR E7 4 2WRPICC-SUR-E7 4 2WRMCCl-SUR E7 ) *-RUPTURETRB. For Venting: CRDIR-SUR - CRDPlFTR SUR-E7 4 CRDPlCC-SUR E7 + PSW175CC-SUR E7 '
+ SWVYO2CC-SUR-E7 1 ."WVYO2LF SUR E + 2WRPilTR+SUR E7 4 2WRP]CC-SUR-E7 4 2WRMCCl-SUR 07.
The only components in the reactor building needed to operate-in this' mode (one pump minimum flow at > x hrs) are the pumps and their control circuits, the service water supply MOV which could spuriously close, the room cooling fan control eircuit, the RBCCW pumps and their control' circuits, and the electrical power support through an MCC, trans former, and circuit-breaker ( the transformer and circuit breaker are in the MCC :). All other components are: (1) in the auxiliary or DC building and not subject to harsh environments, (2) in the main turbine building area where some mild environmental changes are expected, or (3) in the 11PCS room ( $D2 ) which is isolated from -eny harsh environment, The CRD pumps are in 312, the CRD control circuits are in' 312, the fan control circuits are in 3111 and 3112, the service water valve is in 3C-1.with CC in 3C-1 and 3F 1,_the RBCCW pumps and MCC electrical support are in 3D. 6 31 _-_-._______________m..-,,_,,._,-w..-- .m-o w -..wr ~.- - y -.m-. ..mw_m .,-..w-w,e,.W._
l
! Tabic 6.8 (Continued)
System Models J firewater System t This system is in the turbine building and will be dominat ed by operator failure to st art . Success is unlikely unleus started before containment I failure since some st. cam will be in t,he turbine building af ter contaitument failure. There are no active valven or other support systems needed; so , failure is dominated by operator in11ure to allgn. The following equation can be used to quantify DDIV: DDIV- Fall.S - OPERFDDIV - 0.12, log-normal, EP-7.8, Group 10 action, t
--..~%
l l 1 I I i l l 6-32
Table 6.8 (Continued) System Models llPCS System Nince the llPCS system is a s i n g,l e train nystem, it can be t epresent ed by the f ollowliy; equat ion: For 1eaks llPCS SUR - ( SWVYO215- SUR - E 7 + SVVYO?CC-SUR E7 + llPCSPPTR SUR-E7 e llPCSOISP SUR-E7 e 1;PCS2 3SP-SUR E7 4 ilPCSO4SP-SUR-E7
-+ llPCSISSP-SUR E7 )
- 1.EAETRB.
Ior Rupturev., llPCS SUR - ( SVVYO21S-SUR-E7 4 SWV'!O 2 CC - S UR - 07 + llPCSPl7R-SUR- E7 e llPCS0l S P - SUR - E7 + llPCS 2 3S P - SUR - E7 + IIPCSOSSP-SUR E7
+ llPCS15SP-SUR-E7 ) A RUPTURETRB.
Foi Vent t ry; itPCS -SUR - SVVYO?if SUR 1:74 SWVYO2Cc SUR- E7 + llPCSPl'TR SUR-E7 e llPCS0lSP-SUR-E7 + llPCS 2 3 S P- SUR- E7 + llPCSO4SP-SUR-E7
+ llPCS 15S P SUK - P.7.
The fan is in its own bouning and sees the environment. In the liPCS room 312 atui 1112 (Thi s is the same inn as for CRD), valve 2 3 and cont rol circuit- are in 3111, valve 1 azul cont rol circuit. are in 311, the pump is in 312, valve 4 and cont rol circuit are in 3E, and valve 15 18 in 311 with its cont rol
~
circuit in 311, lill, and 31!2 6-33 - _ _ _ _ _ _ _ _ - _ _ _ _ - - _ _ _ _ _ _ - _ - _ _ _ _ - _ _ - - - _ _ - _ s
I I i Table 6.8 (Cont.inued) Systein Models
!.PCI System The LPCI syst em 1s a three t rain syst em in which two t rains are in the same :
roor 51oce the rooms are normally isalated except in the rupture case, l the no s. t susceptible components are the room HVAC power supplies on the l 710' level of the reactor building (even in the case of a rupture, these ; are still the inost limiting). The system failure can therefore be represented by the following equation: j l LPCI-SUR - MCCIE35Y2A-SUR-E7
- MCCIE36Y1B SUR E7. j The two MCOs are identical and can be said to be 'ompletely correlated. I The environment they see will also be the same. As a result, we !
approximated the system failure by using only.one of the MCCs and said that l For most of the doirinant cases this the second failed if the first failed. was also reasonable since only one of the trains was operating due to partlal loss of AC power or random failure of the other train. The MCC used is the same MCC that powers LPCS. For Leaks: LPCI SDR - MCCIE35Y2A-SUR-E7
- LEAETRB.
For Ruptures: LPC1 SUR - MCCIE35Y2A SUR E7
- RUPTURETRB.
For benting: l LPCI SUR - MCC1r.35Y2A-SUR E7, for failure due to valve cycling only: LPCI-SUR - LPC1C 6-34
I Table 6,8 (Continued) System Models I LPCS System Since the LPCS system is a singic train system, it can be represented by : the following equation: 4 LPCS-SUR - NEllVACF-SUR-E7 + NEllVACPCC-SUR-E? + NEHVACBR-SUR-E7 + LPCS01SP SUR-E7 + LPCS12SP-SUR E7 + LPCSPPTR-SUR-E7 + ; LPCSPCC-SUR-E7 + LPCS05170-dUR-E7 + CSCS35SP SUR E7 4 MCCIE35Y2A SUR E? + CSCSBR-SUR E7 + LPCSN413 SUR-E?. llove ve r , the LPCI and LPCS systerns limiting components are the MCCs on the f 710' level in the reactor building and these systerns can be approximated by only one term (we used the common MCC for LPCS and train A of LPCI, see discussion under LPCI): For Leaks: LPCS-SUR - McClE35Y2A-SUR-E?
- LEARTRB, For Ruptures: ,
LPCS SUR - MCCIE35Y2A-SUR E7
- RUPTURETRB, For Venting; LPCS-SUR - MCCIE35Y2A-SUR-E?,
6 35
.~ - . . . , . - , . . - . , - , . . , , - , = . . . - .. ..- .. . . - - . _ - . - - - - _ . . . . - . - . . . - . .
Table 6.8 (concluded) System Models M' sys t em As with the CDS system, the main feedwater system does not have irnpo r t ant conponente in the reactor building The main components are in the turbine building where the environment s are expected to be fairly mild and not result i na si gni fic ant increase over the random failure rates. For this analysis, main feedwater failure was conservatively estimated as IE-02 and was only used in ATWS sequences since, for non-ATUS transients, if fcedwater is working no core damage results.
.% g.,%-i-m-3a->+--n-m- m --+-w-eme.w-e-ees=--.www.-u-w 6 36
l Table 6.9a liasic 1: vent Name of Survival Question for Contaitutent Leak Sequences hasic 1:vn1LFame I:quipment Available SUR-001-L CRD1 SUR 002-L llPCS SUR-003-L llPCS + CRD1 SUR-004-L CDS SUR-005-L llPCS 4 CRD1 + CDS SUR-006-L llPCS + CDS 6-37
Table 6.9b , Basic Event Name of Survival Quer'lon for Containment Venting Sequen -s ; i' P,asic Event Nanie Equipment Available SUR 001-V CRD1 + ADS * (DDIV + CDS) I
-SUR-002-V CitD1 + ADS *_ (DDIN + CDS + LPCI) '
SUR-003 V CRD1 + ADS * (DD}V + CDS + LPCS) SUR-004 V CRD1 + ADS * (DDIN 4 CDS i LPCI + LPCS) SUR-005-V lil'CS 4 ADS * (DDIN
- CDS)
SUR 006 V lil'CS 4 ADS
- DDIN SUR 007-V llPCS 4 DDIN SUR 008-V lil'CS 4 DDIV 1 CDS l
6 38
..-,, - . . , _ . - - . _ . - , - - _ - . ~ . . .
Table 6.9c Basic Event Name of Survival Question for Containment Rupture Sequences Basic Event Name Equipment Available SUR-001-R CRD1 4 LPCS + DDW SUR 002 R LPCS 4 DDW SUR-003-R CRD1 + LPCI + DDW SUR 004-R CRD1 + LPCI 4 LPCS 4 DDFV SUR 005-R LPCI 4 DDW I SUR-006 R LPCI + LPCS 4 DDW SUR-007 R CRD1 4 CDS + LPCI 4 DDW SUR-008-R CRD1 4 CDS + LPCS 4 DDW SUR 009-R CRD1 + CDS 4 LPCS 4 LPCS 4 DDW SUR 010 R CDS + DDW SUR-Oll R CDS 4 LPCI i DDW SUR 012 R CDS + LPCS 4 DDW SUR 013 R CDS 4 LPC1 + LPCS + DD W SUR-014 R CRD1 4 ADS * (DDW + CDS) SUR-015-R CRD1 4 ADS * (DDW + CDS + LPCI) SUR 016-R CRD1 + ADS * (DDW + CDS + LPCS)
- SUR 017-R CRD1 + ADS * (DDW + CDS 4 LPCI y LPCS)
SUR-018 R CRDI 4 ADS * (DDW + LPCI 4 LPCS) SUR-019-R CRD1 4 ADS * (DDW 4 LPCI) SUR-020 R CRD1 4 ADS * (DDW 4 LPCS) SUR-021 R llPCS 4 CRD1'4 ADS * (DDW 4 C D S ,' SUR-022 R llPCS 4 CRD1 '4 ADS
- DDW SUR-023 R llPCS + ADS * (DDW 4 CDS)-
SUR-024-R llPCS + ADS
- DDW SUR-025-R llPCS 4 CRD1 + DDW SUR-026.R llPCS + CRD1 4 CDS + DDW SUR-027-R llPCS 4 DDW SUR 028 R llPCS 4 DDW 4 CDS i SUR-029 R CRD1 4 CDS i DDW r
1 6-39 a
Table 6.9d Battic Event Narne cf Survival Question for contairunent Pa11ure in ATVS Sequences hnElt._ErnitL_line ._ET11ptre n t Ayall able SUR-001 A-L fi}V 4 11PCS SUR-002-A-L llPCS SUR.001 A R llPCS + ADS * (LPCS
- LPC1)
SUR-001-A V HPCS 4 ADS * (LPCS
- LPCI)
SUR-002 A V ADS * (1.PCS 4 1.PC I ) SUR 001-A C LPCIC 6 6-40
Table 6.10a Failure Equations for Survival Events for leaks I SUR-001-L - CRD1 .9882 * .2667 . 2636 SUR-002-L - ItPCS .8210 * .2667 .2190 SUR 003-L - IIPCS
- CRD1 .8139 *- .2667 .2171 SUR-004 L - CDS - 2.1E 3 * .2667 - 5.6E 4 SUR 005-L - IIPCS
- CRD1
- CDS .2171
- 2,1E 4.$$9E 4 SUR 006-L - liPCS
- CD3 .2190
- 2.1E 3 - 4. 599E-4 1
i l 1 I 2 i i L h P P 6-41
. . . . _ . _ __. - = ._ -
t a Table 6.10h Failure Equations for Survival Events for Ituptures SUR-001-R - CRD1
- Ll'CS
- DDIN - .9844 * .8243 d.6220 * .12
- .0651 4
SUR-003-R - CRD1
- 1.I'Cl
- DDIV .06S1 SUR-004-R - CRD1
- 1.PCI
- LPCS
- DDIN - 06S1 4 SUR 001-R - CRDI
- CDS
- 1.PCI
- DDiv .9844 * .6??0 * .8743
- 2.lt 3 - 1.054E 3 S U R - 00.': - R - CitD1
- CDS
- LPCI
- DDFV - 1.054E 3 SUR.009-R - CRD1
- CDS
- 1.PCI
- LPCS
- DDiv - 1.054E 3 '
SUR-010-R - CDS
- DDiv - 2.10-3 A 8243 - 1.718E.3
, SUR 014-R - CRDI * ( ADS e CDS
- DDiv ) .9844 * .8243 *
- ( .00125 + ?.lE 3 ) - ?.733E-3 f SUR 015 R -
CRD1 * ( ADS 6 CDS
- DDIV
- LPCI -) .9844 *.8243
* ( .00125 4 7.10 3 a .6??O ) - 2.147E 3 SUR-016 R -
CitD1 + ( ADS 6 CDS
- DDIV
- LPCS ) - ?.14 /E 3 SUR-017 R - CRD1 * ( .* M 4 CDS
- DDIV
- LPCS
- LPCI )
- 2.147E-3 SUR-OlH-H -
CRD1 * ( ADS 4 DDIV
- LPCI
- LPCS ) - 9844 *.8243
* ( .00125 + .12 * .6??O ) - 6,2460 2 SUR-019-R -
CRD1 * ( ADS
- DDIV
- 1.PCl ) - 6.246E ?
SUR+070-H - CRD1 * ( ADS e DDIN
- LPCS ) - 6.246E 2 SUR-021-R -
IlPCS
- Cl(D1 * ( ADS 4 DDIN
- CDS ) . 6774 *.8243 '
* ( .00175 4 ?.lE-3 ) - ?.34?E-3 !
! SUR 027-R - IIPCS
- CRDI * ( nos 6 DDIV ) .8774 * .8743 * (
.00125 i .l? ) - 8.784E.7 SUR 0?3-it -
IIPCS * ( ADS t DDIN
- CDS ) .9317 * .8243 * (
! .00l?S 6 2.lE-3 ) - $.8560 3 SUR-024*H - IIPCS * ( ADS 4 DDtV ) - 9317 * .8243 * ( 00125 i .12 ) - 9.369E-2 SUR-0?5-R - lil'CS
- CRD1
- DDIN .9317 * .9844 * .8243 * .12 '
- 8.979E-?
, SUR 076 R - IIPCS
- CRD1
- DDIV
- CDS - .9317
- 9844 *.8243 *
?.lE 3 - 1.581E-4 SUR 0? /-R - IIPCS
- DD7 .9317 * .8243 * .12 - 9.174E 2 SUR-028 R -
11PCS
- DDIN
- CDS .9317 * .8243 * ?.1E.3
- 1.670E 4 SUR 029-R - CRD1
- CDS
- DDiv .9844 * .8243
- 2.lE-3
- 1.698E-4 1
6 42
~ , . . - . , . . . - _ . . . . . . . _ . - _ . - , . _ . - , , . - . -
Table 6.10c l'a ll u t e Equations foi Survival 1: vents for Venting St'R-001-V - CRD1
- f ADS 4 DDIV
- CDS )- 9951 * ( 04 2.1E-3)
- 2.11;-3 SUP-007-V - CRD1 * ( ADS 4 DDIV
- CDS
- Ll'C1 ) - .99S1 * ( 0 4 2.10-3 * .6168 ) - 1.3E 3 SUR-003-V - CRD1 * ( ADS 4 DDiv
- CDS
- 1.I'C1 ) - 1.3E-3 SUR 004-V -
CRD1 * ( ADS
- DDIN
- CDS
- Li'Cl
- 1.I'CS ) - 1. 3E 3 SUR-005 V -
lil'C S * ( ADS +- DDIN
- CDS ) -
.9700 * ( 0 4 2.lE-3 ) - ?.0E-3 SUR-006-V -
lil'CS * ( ADS
- DD}V ) - .9700 * ( 0+ .12 )
- 1.?E-1 SUli- OU / - V -- lil'C5
- DDiv . 9 700 A-
.12 - 1.2E 1 SUR 008 Y - lil'CS
- DDFV
- CDS - .9700
- 7.lE 2.00-3 6-43
1 Table 6.10d Pallure Equations for Survival Events for NINS SUR 001 A-L - MIN
- llPCS - .01 * .8210 * .2667 - 2.2E-03 SUR-002 A-L - IIPCS .8210 * .2667 - .2190 SUR-001 A-R - IIPCS * (ADS i LPCS
- LPCI) .9317 * (1.2SE-03 4 .6220)
* .8243 .4787 SUR 001-A V - IIPC4 * (ADS + LPCS
- LPCl) - .9700 * ( 0 4 .6168) - .S983 SUR 002. A-V - ADS 4 1.PCS
- 1.PCI - 0 4 .6168 .6168 SUR-001 - A-C - LPCir -
6-44
equat ions used to calculate the probabilities can be found in Appendix D of i Volun1e 2 of this report in the LHS ext ender code listing). 6 2.6 t 6: Resolve Core 'ulnerable Sequences. The venting system fault tree was evaluated and its success and failure were "andt i" to each televant sequence This tesulted in two sequences, one in which venting was a success and the other in which venting had fatled. For the sequence in which venting had failed, two events representing c on t a i tutent failure by leak and rupture ere added and two sequences were created. In one, the c ont a i retent failed by leak and, in the other, the c ont a iturent failed by rupture For each of the three sequences thus created (as defined in the step 1 discussion above), t.he individual cut sets were examined and the appropriate survival event from Table 6.9, representing the systems which were available to respond, was chosen and added to the cut set. The sequence was then quantified. The use of the above nethod 7t ves a point estimate of the Level I core damage frequency. To get an e"aluation of the uncertainty, a Latin Hypercebe s a:rp l e (i.e , a stratifled Monte Carlo sample) must. be formed using the distributions not only for the c ortpo ne n t failure data consonly used but also for the c o n t a i t ut e n t failure locations and modes, the equipment failure probabilitles in severe environments, and, if there was a large uncert aint y in the environments, the ranges of the environments. The sequences with the added venting, containment failure, and survival events were then evaluated nultiple times using this Latin Hypercube sample and the TEMAC7 code 'I b e result is an uncertainty distribution for each sequence and/or the total core damage frequency that incorporates tne uncertainty not only of the random failure distributions for the basic component failures, but also of the uncertaint y in phenomena and equipment response to these phenomena, see Chapter 7 of this report and the integrated results presented in Volture 2 of this report. 6.3 Eng l u s i on The use of expert judgement based upon various supporting calculations nilowed us to resolve oore vulne.ahle sequences in a much more realistic and less conservative way than by simply assuming failure by application of a systematic pre edure, the underlying parameters or processes contributing to the u u rtainty in the issue were delineated much nio r e explicit.ly than has been done in t he past . The unde rlying assumptions and expert judgement that were used to quantify the issue for the PRA are delineated such that people wanting t o review the PRA or use it can clearly understand the limitations and areas of applicability. The uncertainty in the current state-o .nowledge in both PRA modeling and thermal hydraulic analyses was explicitly incorporated into the PRA, and its importance to the final results calculated. 6-45
l A simplifled version of this methodology was used in the NUREC-1150 analysis of the Peach Bot t om plant . 6.4 Inttr.1are W11bJrvnlll/lLL Atb1 Lysis Because the Level 11/111 analysis evaluates the possibility of containment fallute and uses the location, size, and tin,e of failure to calculate the iadioactive release to the envitonment; the same cont ainment failure modes tru s t be used in order to calculate the containment and system failure piobabilities in the I.e ve l I analtsis and pass these values in a consistent f m.bl on to t .e Level 11/111 analysis. In order to maintain consistency, for each 1.e ve l 1 sample, we will sample the containment failure pressure (even thouEh thit i s. ce r t ain for the Level 1 t.e que nc e s of interent, the actual failure pressure will impact the mode of containment failure and - will also be used in the level 11 analysis for sequences which had core dana,, in the Level 1 analysis but do not have containment failure until later). The same user function (FORTRAN subroutine used in the accidenc progression event tree, APET, in the Level 11 analysis to calculate the containment failure mode) used in the APET was used in the Level I analysis for the i .e v e l 1 aeilysis only slow pressurization cases are impot t ant (for the Level 11 analysis, explosive or very rapid pressure increases are also possible). The result is that, for each sample, t.he same c on t a i tune n t failure pressure, location, and size and the same envl ronment al fai1ure probability Ior the system components and survival events is used in both the Level 1 and Level 11 analyses 6.5 Reh r e nc e ,
- 1. R. J. Bteeding, 1. T. lia r pe r , T. D. Brown, J. J. Gregory, A. C.
Payne Jr , E D. Corham, W. Murfin, and C. N. Amos, " Evaluation of Severe Accident Risks Quantification of Major input Parameters: - Expert's Determination of St ruc t ural Response issues," NUREG/CR-4551, Vol ?, Rev.1, Part 3, SAND 38 3313, Sandia National 1.aboratories, Albuquerque, NM, March 1992.
? R. M, Summers, R. K Cole, Jr., E. A. Boucheron, M. K Carmel, S.
E. Dingman, and J, E Kelly, "MELCOR 1 8.0: A Computer Code for Nuclear Reactor Severe Accident Source Term and Risk Assessment Analyses," NUREC/CR-5531, SAND 90-0364, Sandia National Laboratories, Albuquerque, NM, January 1991.
- 3. S. E. Dingman, C.J. Shatfer, A, C. Payne Jr., and M. K. Carmel, -
"MELCOR At:alysis for Accident Progression Issues," NUREC/CR-5331, SAND 89 0072, Sandia National Laboratorles, Albuquerque, NM, Jar y 1991.
- 4. "LaSalle Count y Station: Final Safety Analysis Report," through Amendment 63, Commonwealth Edison Company, Chicago, 11.
6-46
- 5. T. A. When)*r, S. C. Hora, W. R. Cramond, and S. _
D. Unwin,
" Analysis of Core Damage Frequency: Expert Judgment Elicitation on Internal Event Issues; Part 1 - Expert Panel, and Part 2 Project Staff," NUREG/CR 4550, Revision 1, Volume 2, SAND 86 2084, Sandia National Laboratories, Albuquerque, NM, December 1988.
- 6. R. L. Irnan and M. J. Shortencarier, "A FORTRAN 77 Program and User's Guide for the Generation of Latin liyper cube and Randora Samples for Use With Computer Models,"_ NUREG/CR 3624, SAND 83-2365, Sandia National Laboratories, Albuquerque, NH, March 1984
- 7. R. L. Iman and M. J. Shortencarier, "A User's Guide for the- Top Event Matrix Analysis Code (TEMAC)," NUREG/CR 4598, SAND 86 0960, .
Sandia National Laboratories, Albuquerque, NM, August 1986= t L b 1 l 6-47 1 1 l
- -. _ . - , . . . . . , _ , , . _ ~ . , . . ~ . . . . . . . . . , , . . . - -
i l {
/O LE5l'LTS OF 'IllE INTERNAL EVENTS ANALYSIS i.I Df;TitMllL irT" moos Fiftv-fout sequences sutvived the initial screening process described in thapter! 3 and 4. For each of these sequences, the cut sets were individually examined and the appropriate recovery and survival e- nts were determined and added to the cut sets as described in Chapters 5 and 6. The ha:. i c event data was reviewed and modifled as described in Volume $ of this repott and the sequences were requantified. No sequences or cut sets that survived the inittal screening process were truncated for this final quantification. If some cut sets were determined to be unphysical, an e ve nt RA-DEhETE was added to them so t h a t. the cut set frequency would be zero-- The cut set remained in the cut set file so that the final dit. position of all cut sett could he traced.
l ab i t .1 l I:.t ! all of the sequences that survived the screening process. The ,equences are oldered from most dominant to least dominant. as determined hv the mean value from the TDtACI calculation Also shown are t h< 'th percentile, median, 95th percentile, the point estimate, the fractional cont ribut ion to the total internal core damage frequency, and
- he cumulative contribut!an to the total internal core damage frequency.
The last two rows show the algebrale stun of each column and the results of the i nt egrat ed evaluat ion. The mean core datta ge frequency for internal events is 4.41E-05/R-yr. for the LaSalle plant The lower 5th percentile - 2.05E-06/R-yr,, the median - 1.n4E-05/R-yr , and the 95th percentile - 1.59E-04/R-yr. The mean core damage frequency is low considering that this is the first time a PRA has been performed on the plant. Typical core damage frequencies obtained in the past for first time PRAs have been in the low 1.0E-4/R-yr. range This is usually due to the identification of some design and construction errors that result in a loss of redundancy and some core damage sequences with high frequet es of occurrence The LaSalle plant, heing a modern BWR design, has highly redundant and independent systems which tends to a rre l i o r a c e these types of problems. While s orte design faults were found in the anal nis , none were of sufficient severity to result in sequences with high core d a.na ge f quencies The dominant sequence is T100 which cont ribut es 64.1% of the core damage frequenev from internal events In this sequence, we have a transient initiator followed by successful scram and SRV operation All high and low ptersure injection systems fail and core damage ensues The cut sets fall int o two groupr (1) an early core damage scenario where all AC is lost initially and reactor core isolation cooling (RCIC) fails and (2) a late core damage scenario where AG works for a while and then fails. For the late scenario we have about 10 hours for recovery actions to be con ple t ed. For the early scenario we have about 80 minutes. 7-1
i l t -4 enee4 e 4 e4 e4 H e4 e4 e4 e4 ed e-4 en.e4 e4 e-4 ed c4 e4 e-4 e=-4 & e4 e4 & e4 ed e4 04 ed ed s-4 ed e4 & ed e4 e4 e=4 e 4 ed a) e: O00000000000000000000O.000,0,00000000,00000000 e i . < a i e H N N 14 W W W W W Ld W id W W td W Ld W Ld Ld L 1 W 14 W id W id W W h1 W LO W Ld W W W Ld Ld La L4 W Ld 4 & ew r 4 O a th 3 en N te o @ N 4 N in @ @ m @ N N rn rn en N rq O @ ** nn (.o O N n rw to to & & & F -1 M & n O N N ro O ro rn rn H m M 4 @ t s cc in & rn @ ch H en in W N N to to to ch ch ch ch cr. & th ch &
-3 H rsm rs en N m rn w rN en N Ch O N rn 4 A @ r t 4 to to @ Ch (b Ch & th & ch th Ch th Ch Ch & Ch Ch Ch Ch th U 4 to es N e @ @ t, f - to to m to e & & & ch & & ch tw a ch e ci & & ch ch ch & ch cr. & & ch & ch ch & Ch
@ r - m & ch & 0 ch ci & & & Ch & & & & Os ch 0. & ch ch ch ch Ch & & & ch ch th & & & & & ch ch & Ch ch 41 G e-4 e4 H r J rN M M rn t) M rn M rn M fn M M M rn44-1-74-1414 W @ in O A A O nn in in @ @ @ @
H O O. O. O. O. O. O. O O O Oe iO O. O. O. O. O. O. O. O. OeOe O O O. O, O O. O. O. O. O. O. O.e Oe O e i 4 e O O.eOeOeOe O w Ed W hl Id W W W Ld 10 W Ld L4 W 14 W (d 14 LO W 14 W W Ld td La LaJ W 14 W id W Ld LM W Ld W W id 14 L4 W id
-1 4 en us & nn to a o & N H in 4 @ & to en en O N @ M N O N H H @ M N in en ed 4 en 4 H O N A M 0
7 - f & in O N -1 N e-4 fn A N to M 03 Q) N 4 @ @ N 4 M ,-e O N 4 N fn N rn ed @ ed & 4 N O M W 4 N 4 4> U M in H @ 4 , 4 in (.h M M Ch GJ in H to N O O in 4 m M N O 0) N rn to en @ W nn @ N kn N ed N @ v'* H G rd 1 H to in r'- nn O @ rn O Ch r - @ M rN N & e4 ea ua in in in O Ch ch H @ Co & Co e4 M fn N O nn O 4 fn H 1 La . . . b 1 @ e4 H N N & in in 4 - 1 en c4 e4 H H H H H e4 5 rn M rn N N H H ew @ in 4 M en N N N N H #9 rn en N hl
,-4 s e,@ @ N N N N rs es N 03 to to en r.o to m & ch to cc O to m ch & c) ch ch ch ct O O O O O O O O O e-* H k sJ C e Oi O e O O. O O O. O. O. O. O. O. O. O.
i i O e eO i Oi O O O. O.e4 . C. O. O O L Orii . O O,eeH e e e**4e4e-4e4 4 e e e e e eHie4 i R e4 L N W W W h1ld W W td L4 td W W (d Ld N Ld W W id td td td N W W W La td W La M h) 14 W W La L4 Ld W W W W D 000C00000000000000000000000D0000000000COOO v kJ 00000000000000000C00000000000000000000000Q C G 4 r ~ H .4 5 ea @ 4 H rN M N 4 H ch en N O m O W @ tn ts- ua u) eH N H s T in N en th in N N to W n LA 4 __ e4 tw t
- to O CO ts O e4 M M in N to e-4 e4 4 u] O in O ro M in m & N O e-4 O ew 4 f s 4 in 4 @ N to @ O N H -4 G
he N 4cy 4 m 1rN H N H J m 4 N m ed H A @ e4 H to c4 H ew m & M M ew N ro @ H m H rn H H H N 4 v; o in in a W @ @ @ @ t- N w r, r s 5 + m aa to to N to th to to co u) to & CO ch & Ch & O ch O Ch O O O O O 0000000000000 O C O O O O. O. O. O. O. O O. O. O. O. O. O. O iOe Oe4 O H H H H r4 e e O e H, e e
+4 O e e i i e
- i e i i i . e e i e v e W W 10 id td 8414 td La hl W N W (d td Ld W Ld W L4 N L4 W W td W 10 L4 Ld Ld La td W W W La L4 W L4 L4 L4 Ld we sn C00000000000000000000000000000000O00000000 O Ch C0000O00000000000000000000000O000000000000 M -1 M & rn & (n H e4 4 r 4 H m @ ch N N O en a to tn O & 4 4 & rn N N 4 s & N en N H en N -1 ch M &
ts 4 O O & ts C N @ @ 4 4 N N N in H 03 N ew rn N rs N ry & rN ch to H in in @ rn W e-4 N in N in o @ 4) to .
& N N 'o en c4 H H N A n.1 N H eH H M & H ed H N N in 4 N in en N H to Ch 4 @ P s N rs 4 e-4 @ @ ed N tm t o.
g e in @ @ @ @ ts N rs N N r- m to co ro to u) 03 to to to 03 u) o) ch ch ch & rk & ch ch ch ch & Ch O O O O O H _ c fi C, 0 0 0 0 0 0, 0, 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0e Ce
- i e e i e a e O O O O H e-8 H H H H i i e e e i e i yO C 41 14 Ld td L4 (d N id W L4 Ld b) W LO Ld W W W W N N Ld L4 Ld td td L4 td 14 W id 14 Ld N N W L4 td 14 td 14 W W OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO g
W e 4 OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO 5 rn & ro a @ co @ O 4 nn a cc rN O 4 to n n O N cb to in to to O rs ch e4 N rn e-4 @ cf a 4 rs O in C @ E o en in o N & rn 1 N H & en ch ch 4 & r 4 th ch N N in n M ch to @ O ch @ N N 4 O O C s O rs @ in tn 4 U N W 4 H H 4 N N N H H co N tw in in A 4 4 rn H H H ew to to to in N N N H H H H r > @e-*H H m U C @ @ O O O N cc e m O to cc ch & O ch O C O O O ch Ch O O ch O O H O ed O O O O O O H H O O w O O O O O O O O O O O O O O O O O O O O O O O O O O O O O H O r4 O O O O O O c4 H O O n C i ++ + i i + i i + e e i + i +++++ie ++ e + + e 4 i + + + + + + . e + + t" d 14 W L4 td W W td W W W LJ N W td tu W LO W id W W td La Ld W La W W L4 L4 Ld Ld L4 W Ld La L4 N (4 LO 14 W W H 000000000000000000000000000000000000000000 to O OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO 4 N ch O O O N e o eH H O * & 4 4 O W O O O O O @ 4 O O ro o O H O in O O O O O O r* C C O M E O rn O O O 4 4 O m O O M C N N O N O O O O O N M C O N O O rn C Ch O O O O O O s cc O O. . . . . . . . . . . . . cc . . . . . . . . . . . C Ch N O C C e-4 W O rn 4 O eH H 4 Ch O ed O O O O O H rn O O N O O to O N O O O O O O N e-d o O 14
@ ts O O O to & O th & O O O O O C N O O O O O H O O O O O O rn o en O O O O O O rn en O O L
c- 4 C. Oe O++O+O O. Oe O + Oe i O +OiHiene H i e4
+ iO+H+ O+ O +O+ O e i O ++e-4.H+ O+ O, e-4 + + C+ o+ rm + +O +H+OeOe O+ O $ O O H e-4 0 0 H W (d W Ld id W Ld W LJ W (d W LO Ld Ld 14 L4 W (d W W Ld W id W W id W 10 W LO L4 W W W td W 1414 (d W L4 4 M 00000000000000000000000000000000000O000000 Lo in OOOOOOOOOOOOOOOOC 0000000000000000000000000 y O to O O O e en O m W O to @ N 4 O M O O O O O n in O O M O O e-+ o en O O O O O O N O O O rA r< H O O.O tn e4 C en tw O &.N N
, . . . . to O W O D O O O 4 M O O H O O (n o rn O O O O C' O to @ O O H M C O O M 4 O N N O M in H N O & O O O O O H H O O H O O & C 5 O O O O O O @ 4 O O 4
O C 0
.5 O H NN 3 CS M @ to 4 @ Ch O t" O N 01 O N @ O 4 c-- ,m&D J A O A NaiNmNit 4r<@= Ch eH @ N M ew H N N rn to 03 N 4 H 4 N N 'o N cd in sn s.1 ew pH N d d N O @ e4 4 (n to d M H e"8 d d
@ H @ e--4 eN N *-4 e- e N d d M ? H A i e,.
to Hidr-*I* H H H H H H H # % !" H ' a H H H < W 6 4 H H J < H H H < < < at H H H H H d < H H 7-2
OOCOCOOOOOOO 4> 00000000000O C 4 4 + + + + * * + + + + e4 hJ id 10 id hi Ld W Ld (d W Ld La O00000000000 <C eC P OOOOOOOOOOOO 1 ' L*. d O000C0000000 U C00000O00000 e4 H e4 e4 a e4e4 A em H e-4v4 AJ fl @@NNNNP% % O')CO tO O O H O, O O e O e eOeOe O O O O. O. C 4 4 i eH + k4 bd Ed W hd (d Ld t.d W td N td LA) Q N O= c @ & O N w in N csDs <O os N rn N m m m @ cy 4 m in ;.O U O>COOCON 4OmsnOrO @ C O m C N m 4 @ H @ rs O N W 4 m O 4J La Y N4 e *I e*'A WJ @ & O V-k & O V4 H & H _ _ Q l* W e4e4 H N H N H r4 m 4 N e sn in a H e4 & e-
- e-o H e4 e4 e 4 . 4 e4 e4 OO
& m i e e e e e a e e e . . e e f** Ld Ed DJ (d Ld td (d td Ld N 10 Lu L4 bJ LG C: 0000C0000000 0C
% U OOOOOOOOOOOO rn O
@ G @ tD O N N @ @ O 4 0 to d 44 k.i sd & D e 4 & Q rs th ('4 & & & Q e4 e4 C O
>< % D D a @ N D e4 @ 4 tc e4 m en en V O O H H O e4e-4H Ntn N 4 44 U H e4 H e-d em e4 H e-er4 H e4 e4 OO
.e 4 e e 9 4 6 0 5 6 4 , t e e e m44 ss- W Lu id 14 Ld (d Ld (d LW W W Ld 141d
< m D 000000000000 HO q' *-* Os OOOOOOOOOOOO NO e-e os
.,f u
.: e e4 N co r ,to NNHin@NOOOO & N O .-4 @ rn o e &
em p s 3, tn g N N rn en e-4 e-4 4 e-4 c4 n rei e4 e-4 em C c; k U1 r e-4 H e-i H He4 H HHH ed H He-8 H HN e- N M rn in. CA
,-e r.4 OO C ri e e e e e e i e e e i i i g d C 14 td L4 td td td W Ld Ld W id td WW
,C to O00000000000 mO n W W OOOO3O000000 40 Y rn H @ a. 4 rn sn e4 0 co c to ts e4
% O N N c, N @ N es ts e-4 sn o 34
,4 0 - -
,, U r.c @ rn N N H e-4 N H N @ CO 44 H
m m U O N o en O O rn O O O 4 N sn in G O H O sm O O r4 O O O H e4 OO c C + e + a + + i + + + e e i e
;* c L4 W La td LW W td td td La la td 14 td C" -4 000000C00000 08 0 si 'U O C O O O O ',s O O O O O tc O M 06 O e- O O O O s.' O O O s7 in is 4 4, O T C N O C 3*iO O O N N v4 @
e4 . . . M O N Oen O Oto O O O 4 N e-4 H C
.a
- h. O r%O D C O O O O O D O @@
O 00 4 4 e 4+Q .v4+C+O+O+O cC C, .- N . e4 W ' ? W W W LM W W W W La td td W e-4 6' OOOOOOOOOOOC NO (t C OOOOOOOOOOOC 40 Ln O t% C sn O O O O O O ,4 8" 4 in F C000000000@O 40 J' O H ci N O O O O O O m ~ HN O id 0 H U C N 4 O O @ co CC N LA r7 sA CO O O C N rn en (O O 4 en H
& I.L." sirne4ts J.J - N H H {p ;*.
to < < H H < H H H e J .4 < < to H 7-3
! The secotut most dominant scytu nce is 162 which cont ribut es 14 . M of the core damage frequency 1 tom internal event s in this sequence, we have a transient initiator followed by successful sc r atu atut safety relief valve (SRV) operation. All high pressure injection except RCIC fails atul cont ai nment and primary system heat removal fall The automatic depressutination (ADS) system works but the low pr essure s y s t e tu s are failed. The overall time available to the operators to perform their recovety actions is cpptoximately 2 hours. In some cases (e.g., re s t o r i tif, offsite poweI when a diesel generatot (DC) has run for some perlod of time) more time is available The amount of time available depends on the fallutes that c onst i tut e the cut set and what recovery action is being connideted. The t hi r d most dominant sequence is TlB which contributes 11.1% of the core damage frequency ftom internal events in this sequence, we have a t r ans ient initiator followed by successful scram atul SRV operation. The main fredwater (MIN) system fails but high pressure core spray (llPCS) and one train of the control tod drive (CRD) system woth providing high pi c' su re injection. The normal cont a inment atu! primary heat removal systems fall, and ve nt i ty; fallt Containment pressure increases until a leak develops Depending upon its location, this leak will produce an e nv i ronment which could cause injection systems that are operating or that may be able to operate to fail The overall time available to the operatori to periofm their iecovery actions is approximately 27 .ours. In som< cases (e.g , vent ing) less time is available The amount of time available d(pends on the failures that constitute the cut set and what terovery action is being considered. 1hc f ourt h mon t dominant sequence it T?O which cont ribut es 2.94 of the core damage frequency irom internal events in this sequence, we have a transient initiator followed by successful scram and SRV operation. The main feedwater system falls but ilPCS and one train of the CRD system wor k providing high pressurc i nj ec t ion. The normal cont aitunent and primary heat temoval systems fail, and vent ing tallt Cont a itutent pressure increases unt il rupture occurs Depending upon its location, this rupture will produce an environment which could cause injectirn systems that are operating or that inay be able to o p e r a t .. to fail The overall time available to the operators to perform their recovery actions is approximately ?/ hours in some cases (e.g , venting) less t. i tu e is available The amount of time available depends on the failures that constitute the cut set and what recovery action is being considered. The f i t t h most dominant sequence is T?? which contributes ?.M of the core damage frequency from internal events. In this sequence, we have a t ratu. lent init lat or followed by successful scram and SRV operation. The main feedwater system and the CRD system fall but the itPCS system works providing high pressure injection. The normal containment and primary heat removal systems fail, and venting fails Cont aitunent pressure increases until a leak develops Depending upon it s location, this leak will produce an envlionment which could cause in *lon systems that are operattng or 14
that may be able to operate to fail. The overall t i tue available to the operators to perform their recovery actions is approximately 27 hours. In son e cases (e.g , venting) less time is available The autoun t of time available <hpendn on the failurer that constitute the cut set and what iicovery actton is being considered. The sixt h most dominant sequence is T16 which contributes 0.97% of the core damage frequency from internal events In this sequence, we have a trausieut initiator followed by successful se r:un and SRV operation. The main feedwater system falls but llPCS works providing high pressure injection. The noimal cont ainne nt and prin ry heat removal systems fall, but the operators are able to vent Successful venting produces an envi ronme nt which may cause injection systems that are operating or that may be able to operate to fail. The ove c41 t . m.. available to the operators to perform their recovery actions is approximately 27 hours. in some cases (e.g. periotming venting) less time is available The amount of tlue available depends on the failures that constitute the cut set and what recovery actlon is being considered. The sevent h mos t dominant sequence is T101 which contributes 0. 5 51e of the core damage frequency from internal events In this sequence, we have a transient initiator followed by successful scram and SRV operation. All high pressure injection fails and ADS fails so low pressure systems are not available Core damage begins in about 80 minutes. The eighth most dominant sequence is r24 which contributes 0.50% of the core damage frequency from internal event s In this sequence, we have a transient initiator followed by successful .s c r am and SRV operation. The main feedwater system and the CRD system fail but the llPCS system works providing high pressure injectlon. The normal containment and primary heat removal systems fai1, and venting fails. Con t a l t une n t pressure increases until a rupture occurs Dr. sending upon its location, this rupture will produce an environment which could cause injection systems that are operating or that may he able to operate to fail. The overall time available to the operators to perform their recovery actions is approximately 27 hours. In some cases (e.g., venting) less time is available The amount of time available depends on the failures that constitute the cut set and wha. recovery action is being considered, The nin a most dominant sequence is T1.12 which contributes 0.47% of the core damage frequency from internal events. In this sequence, we have a transie a initiator followed by a successful scram. The SRVs open but. one o r ca n 10 reclose when required (i.e , they stick open), resulting in a t tex-induced LOCA. The malu feedwater system fails but lipCS works pro. ing high pressure injection. The normal containment and primary heat r e m o v a '. systems fall, but the operators are able to vent. Successful venting produces an e nv i ronnee n t which may cause inject. ion systems that are operating or that may be able to operate to fail. The overall time available to the operators to perform their recovery acticus is approximately 27 hours. In some cases (e.g , performing venting) less time 7-5
is available. The amount of time available depends on the failures that constitute the cut set and what recovery action is being considereo. The tenth most dominant sequence is Ti.9 7 which contributes 0.30% of the core damage Irequency from internal events. In this sequence, we have a transient initiator followco by a successful scram. The SRVs open but one or more fail to reclose when required (i.e., they stick open), resulting in a t ransient -induced LOC /, All high and low pressure injectior systems fail and core damage ensu , The cut sets fall into two groups. 1) an early core damage scenario wlere all AC is lost initially and RCIC fails and 2) a late core damage scenario where AC works for a while and then fails. For the late scenario we have about 10 hours for recovery actions to completed. For the early scenario we have about 48 minutes. The highest anticipated transient without scram (ATWS) sequence is A49 at . 8.94E-08/R-yr, and is the twelfth most dominant sequence contributing only I 0.2% of the core damage frequency from internal events. In this sequence, we have a transient initiator followed by initially successful main feedwater. The power conversion (pCS) system fails which leads to the fallure of the feedsater turbine-driven pumps from loss of steam or inadaquate level in the condenser. The operator then falls to control the motor-driven feedwater pump inj ec tion rate to less than the condensate storage tank (CST) nakeup rate of 1800 gpm (the corresponding reactor pressure vessul. -
;' vel is 2/3 top of active fuel, TAF) resulting in pump trip and loss u all feedwater. The liPCS system works; but the standby liquid control (SBLC) system fails and the reactor continues to operate at about 91 pc we r . The containment heats up until pressure reaches 6 psig when the operator vents the containment. The re st.l t ing severe environments in the eactor building fail llPCS i' any other available injection systems and core damage results with a ' :d containment.
The highest LOCA sequence is Ll4 at 1.72E-08/R-yr. and is the twenty-first most dominant sequence contributing only 0.04% of the core damage frequency irom internal events, In this sequence, we have a LOCA initiator followed . by successful scram ai d vapor suppression operation. The main feedwater system fails but llPCS ind one train of the CRD system work providing high pressure inj ec tion . The normal containment and primary heat removal systems fail, and venting fails. Containment pressure increases until a leak develops. Depencing upon its location, this leak will produce an environment which could cause injection systems that are operating or that may be able to <perate to fail. The overall time availa' le to the operotars en perferm th ir recovery actions is approximately 15 nours. In snme cases (e g., venting) less time is available. The amount of time available depends on the failures that constitute the cut set and what recovery action is being considered. The TEMAC code output listing the core damage frequency statistics, risk reduction results, risk increase results, uncertainty importance results, ind cut sets for all the sequences is presented in Appendix A. 7-6
1 l 7.2 pominant Cut Sets for Jntegrated Evaluation in order to obtain an integrated result -or internal events, all of the cut sets from all of the sequences were merged together to form one large expression representing the total internal core damage possibilities. A point estimate TEMAC run was made and the cut cats were truncated at 99% for the uncertainty calculations- Origina11- re were 11,452 cut sets and after truncation 3589 cut ;ts remaine. e full results of the unce rtainty calculation are included in Appet, , only selected results are desc ribed in this and f ollowing sec tioin Table 7.2 lists the top fourty-six cut sets from the integrated enlculation. These cut sets account for 72.% of the total core damage frequency fiom internal initinters The two dominant cut sets are short-term station blackouts resulting from a loss of offsite power followed by a common mode failure of the core standby cooling (CSCS) system cooling water pumps which fails the diesel generators and emergeacy core cooling systems' (ECCS) room cooling. In the dominant cut set, responsille for 21.2% of the core damage frequency, the RCIC ' inhoard isolation valve closes due to a sneak circuit that occurs when offsite pcwer is lost and the emergency DGs are started. The operator fails to reopen the valve in the short time between the DCs starting and then falling soon after due to the loss of cooling and, since the isolation valve is AC powered, it emn not be reopened. Offsite power is not restored within 1 hour and core damage results after primary coolant boiloff in ahor- 80 minutes. In the second cut set, also responsible for 21.3% of the core damage frequency, the valve isolation occurs because RCIC room cooling has failed and the room heats up to the isolation temperature In an event where all AC power has falled immediately, this high temperature isolation is byparsed and RCIC would continue to work However, in this case, AC power RCIC works for some period of time until the DCs fail on loss of cooling. is on train /t and, if the train A diesel fails before the train B diesel, then the RCIC room temprature will rise on loss of room cooling and RCIC will isolate since train B AC power is available When train B AC power is then lost, the valve can not be reopened. This event was conservatively modeled as always resulting in isolation. This clearly is not the case, since (1) some of the time the train B DC will fail before the train A DC, (2) the operator may reopen the valve before the train B DC fails, (3) the time interval between the train A and train B DC failures may not he sufficient for the room to reach the isolation temperature, or (4) the RCIC system could be isolated from the sneak circuit described above The third cut set, responsible for 2.3% of the core damage frequency, is similar to the first two except that RCIC continues to work RClc fails at about 6 hours when either the battery depletes or the containment pressure results in isolation of the steam discharge line. Core damage occurs about 2 hours af ter the loss of all injection at about 8 hours The top three
;.]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - _ . _ _ _ _ _ _ _ _ _ . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - _ _ _ _ _ _ _ _ _ _ a
- .:i ;}: )f! 1(j tL;* r[ 1 h Lf' } ,; ii [tI y ,f[ ;j>sLil)[l[ll! * ( i}P w
* * + * * * * * * * * * * * * * * * * *
- P 8
N - E E - F C O - ! P I S 0 F D 8
- g
- C 5 - t S 5 3S 1 1 1 8 2 F P F 0 E F F F ?
L 1 8 L A 0 A 0 0 A - 1 S S S 6 N S S S S I - - I 9 1 9 1 1 B 5 - O C O - O O O O O p A E B A T T T T ! T 1 3 L L L- 8 M L L L L T -
- F - - - - - - - - - - - - - - - -
I A AF E E E E E E A A E E I AA E' I I E C R RO I I I I I I R R I I I RR I I I I
* * * * * * * * * * * * * + * * * + * *
* + * + * + * +
R- R- R A R R- S SGS G C E S C S E T T TAT FLT . T S S I S' T SA TL B C A B A-C- - - F - T F F TF
- - - - F F - F - - * ^
W S A S W S S L L F J' E FL S A S A A - - - L- I ' - -1 LO F I I F I I N N - - O F F F1 - - - - -
- P E3E EE? NHN3NHNC S
S O L I S O. 1 I S 0 O1 LT EE P C t E C D M E X MC I P f I C C t E C t I S O L E 5 T E G1 59B NNL G 2 - 2I 2 - i - GAGCGAIE G1S
- - O1 99L7 E1 E1 E1 E' G - G - G - GR.
9 C O - O - O - GI GAGAGAGC w
- I I I I E E E E I E I I DRDRDRII DRDRDRDR I .
S * * * * * * * * * * * * + * * * * * * * * + * * * * * * *
- T
.C O O O O S T" S. S J F F J N
'I mm Mt P CL 2 m2 2 M C
M C-I F N m I 'T
- C -
T F 1 O L O L O I O SS S S S S S S M SRF F F D O O
?K1 R . O 5
R S T
)
F
- M I
! P M
E M F M F MM M F C MEL FF - L L
- DA - -
R R-.R - N N -
- - - - - - - - N - 0 N E N 3 N H T J. 3 2H252H2B v E LL i 1 L L5SG-E1G -E1 G -E1 - - F1 09 -0 0 X1 - 9 X1X1 X1 L L
- AI O. s.
- 2. S
- CO DO C
O O O C O 0s G- C OD 9 - B! - 3 B 4 B3S 4 B hG m u. 7 F eL l A b" aL 5 T E S C t S t _ I v. CC GG CD D C D C G D C G D W_ O. i 3 X G D CCO G5 D'
- O - O - !
GAGAGAANSARARARAR IRI RDRE RD - O O - OP APAP APA. TT 0
- D * + * +** + * + * + * + * + * * * + * + * * * * * * * * . * * * * * * * * * *
- a E I BO O D O 1 3 GO O' O FF J T F
- m. 1 E A AFNF JN FLLNI NLNL 3
L I F I 7 LEL F - F - 1 E
- F L - -
- X0F OFOFO'E - E - E -
I F A A AA A A A A A A A A - CCO OO OT0OOOOOO
! T !..TT T T T T T
- T TLfE O OE CERIRERER L E ! E7 XEE E E I E E E E ECRRR RRAB - - R - R - R -
A Y H E ET BB B P B E E E E EO - - - - - T - XX - X - Y - Y SC T E - I - E - E - E - E - H - C X2 S X1XLEE17 2 2- 29IS- E L7 S I A N S N S.75SNB 2 C - E 5 . TN L1 n LN NLMiSLN r. N L N S *- L L7 1 F I SEE ESC R O C - C8 J P C w O M N uO N O N wC CO u!CCOI ONFBDC4 CM0D0 A4 6 3 AT2H3 A3 A3A3B 3 02I2I2I 2 - T O C - - - - C - C - - - CIOFO - 0FTER4 F4 F4 F4 - N 1 F I C e A Xs. AGA N O N- uAG AGAG CPFP APFAEEEPEFEFEAO1O1R
;s.
TI UFCF.P S GA DR hRuhRNRhRiRDRiRDRDRDRAOARACEIR1CI A A E wDTN E M wN e AE V U N SE - 2 TE EIP E N 5 3 0 7 37 6 6 7 2 7 8 7 4 7 0 6 6 5 2 2 8 1 8 9 7 7 7 7 4 4 9 03 7 5 . 7 5' . 954 1 SCC . I 2 4 7 2 7 1 5 1 5
, 3 0 1 . 0 9 9 7 64 1 2
2 2
. 3 NT L 1 2 4 6 7 9 0 2 5 5 7 7 ? 9 0 1 3 4 U2 T
E 2
- a. 4 4 4 4 5 5 5 5 5 5 5 5 5
- t. 6 . 6 6. ' 6. ' 50 C 7 *3 E!
H T 0 0 0C C 0 0 0 C 0 0 0 0 0 0 00 s0 0 0 RW S SF 7 7 7 7 ' .7 7 7 R I 6 6 7 7 7 7 7 7 7 7 7 7 7 7 0' 00 0 . 0 0 ET 0 0 . 00 0 0 0 0 0 . 0 0 0 0 0 0 E S - - - - - - - - - - - - - - CS O R E E 0 E 0 EE 3 9 E . E 4 4 E 4 E 4 E 4 E 4 E 0 E 9 E G E 9 E 9 EI E 1 E-3
. E 3
E 3
.E 3
T 6 5 1 f, 5 5
- 5 5 5 5 8 7, 7 7 7 4 2, 2 2 2 TU .
EC E M N E S 7 4 4 4 4 4 . 4 4 3 2 2 2 2 22 . 2' 2 2 2 3 TE F 5 5 4 5 5 5 $ 5 5 5 5 6 7 7 7 4 6 7 7 7 7 UZL C CI A LT S
? 9 6 8 7 '2 5 3 4 6 7 3 6 1 9 S, A t O 3 4 t 2 1 5 0 1
- i 1 1 1 ' 1 1 1 1 1 2 1 2 1 R F.
- L O
ECT eNNE 2 C T
- r. E VVE S 1 23 4 567 6 9 1 234 5678 9 01 I R 23 4 55 7 8 90123 4 5 b7 690 2222222222" 33 3 33 3533 4 4 TTP I 111 1 1 1 l 11 1 E L O F S "J T E E
TER U CCF O I ( Ny
~ '
l!lli;.ll 4 [ i i!l' } , .j .;" <;I , 5 !)!l! 4
n r 8 6 2 E. m m "5 rI w ri w b A m m m m m AA m m MM6 - edF c e a. 8 ba En c E "i l an- - -9e- - as- c9 c9 ea se.. ?? nn-nn9a e e a c
- a. c
- - m -
e n-au --a ---- e . ... . . . .. . . . . . ............... . . . .
, gg .,
2..
,4 mi mt e n, n,,.4 r, t t. u zr y bsa b mmnn
. m , a 6, 3 L L3 9' 1 b d d i 4 k h h d f
E' % {a 6 65650
" g o
5 ".i no e b l'i - - - - a L- - ~ - > - $' 5 0 ui
- - - - 5 5' y8"s - 8f fo traa. ,
p; ese e e v v e n nenen..nenegBe. q e a> a men e 8 = m 8 ausssaswasssa t, esa ni sasun i M
....4- .
.+...+.+.+.+.+.................+.+.+.+..
4 t. 5# o O o Y.
- , . b. b. n.
mm H
= E:
8 nm " L, "1 L M,W5 L*i b( b. t 3M d d ii95 < E y r aad='sn6ns.E 6 666 6 n666e6e6me E6535a5ala5asaEab 2,
$6646. $ z'nfeVes:h p'5a u u n e s u u v ,a ouununu2: -
u-o td42,W
" y. f E m in e m d O ad8M8u8p h g n [>SdF b p d8d r8 &' s q$' s 5o s- e'o s & og -* t ws M a 8, -k.
M8mbgg"aa gu e usM o
~~
N a,p: .......+........................................ J. n. C.1 a.r. 2 w- maw h a w o = R o w=mm o 8 9 m I; gg
, ,i w
om 6 kl
%7b ag i a e anai mi w 8.
a e
- am e
a e a* t N R a.
*f R.i a asaw e t 6 *N y qr)
- a. a.
4 1 e W E6Empaga
=2= set.se nenDnen>.636g6g6e66ssness66.<636-636q n amam asumusemusucaWsen baheBeEm 6 n nen 5 $$$NsSObEG55$U$$$$$ SUSS650bS$6ES$$$$bMN$$$5$N5N
~
e - e . . -.N ~ e N O - . - ~ N . -O , N - N dn t N @ m N 4 O O . u, ~ s . . . o , e m ,,, O O O O - - N N O. O O O O O. O O O O O O O O. O O O O O O O
..-N. O O O. O b N N N h A 8% e. N O as @ m m) 80 eD sp e 80 a) M eD e CD to e , t e e a N "i M M M M M ~M N N M N a O M d 0 0 MMN W M 0 E
* " * ~ 0 < *
- 9 ~. . 9 ~.m ~. ~. ~. ~. ~. ~. ~. ~. ': . ~. ~.
N N - -
- - - - a m o e io o e e oee. e .
o n .n N N O O O N @ W W O W W h h 5 N A 5 4 4 @ @ (D .* C N O 4 O O N O fB o - m N -e O O N m a) O - N 4 m O W N N N N N N N N en M M en 4"') m - t") M M 4 4 4 8 ad 4 <e N- -e V1 4D 6 40 fB O e4 NM 4 O #D N M mO e4 N f*) 4 en 4D 6 ED mO - N e) 4 W6 ON @ 0) O ed NM 4 O (D h e th 4 4 4 4 4 4 4 4 OO W) OO O OO O W) OO O W WO W WWOb b 5 S N b N N N N O@ O O @ O W W O O 7-9 m
- . - -- - . . - ~ . ~ - - . - - - - - - - - . _ - --
cut sets, while correct in themselves, double count some of the frequency contribution because they not not completely _ independent. Due to the complexi ty of the interactions between the sneak circuit and the system isolation on room temperature for various AC power states, it was not possible to easily model this process exactly in the fault trees. The sneak circuit will always occur if the appropriate DG restarts af ter _ the loss of offsite power; but, only if the operator reopens the valve can the room temperature isolation come in to play. If the operator reopens the valve in both cases, then RCIC can continue to work. The next set of seven cut sets, responsible for 10.3% of the core damage frequency, consists of train A AC or DC power failure and common mode failure of the CSCS cooling water pumps. The cooling water failure results in the failure of all ECCS systems including RCIC (since train B AC is working, RCIC will isolate on high room temperature), the train A DG (train B may start and fail but train B AC is still available from offsite), and the CRD system whose pumps are in the HPCS room. Maia feedwater falls when the main steam isolation valves (MSIVs) drift closed on loss of instrument air and the motor-driven pump injection sa Ne fails closed or a turbine pump locks up on loss of DC power resulting in high RPV level, MSIV , isolation, and main feedwater high level trip. 7.3 Importance Analysi<: pesults 7.3.1 Risk Reduction The risk reduction measure calculates the decrease in the core damage frequency when a single basic event's probability is set to zero. The implication is that the component or event represented by this basic event can not fail or occur. This measure tells you how much risk reduction you could gain by making a component perfect versus leaving it at its current reliability, Risk reduction measures are calculated both for basic event and for initiating events. Risk reductions for each individual sequence and the integrated result are presented in the TEMAC outputs shown in Appendix A. In this section, we will discuss only the _ integrated results which are shown in Table 7.3. One important item to note is that since some complement events appear in the LaSalle fault trees and, therefore, in the accident sequence cut sets; some events can havc neSative risk reductions. That is, decreasing . a certain events failure probability can actually result in an increase in rfsk not a decrease. These events appear at the bottom of the risk reduction list, so you must not look just at the top events in the list. The importance of this is much more obvious if one looks at individual sequences then for the integrated results. In some sequences only an event or its complement shows up, for example, sequences T18. and T22. Sequence T18 - has the event CONT-LEAK while sequence T22 har. the event / CONT-LEAK. Reducing the probability of containment failure by leakage increases the 7-10
Table 7.3 ' INTERNAL EVENTS TOTAL FLANT RUN: RISK REDL.MLH BY BASE EVENT (WITH ASSOCIATED UNCERTAINTY INTERVALS) RISK i BASE EVENT OCCUR PROB (RANE) )' W nCTI T '.idNK) LOWER 51 UFFER 51
-)
, RA-8-1E 508 '2.50E-01 ( 42.0) 1.89E-05 ( 1.0) > 9.15E-07 8.96E-05 DGCOOL-EETA 27 1.10E-01 ('49.5) 1. 7 7E-0 5 ( 2.5) 2.58E-07 7.4 8E-0 5 DGCOOL-FMS-CH 27 2.50E-03 (161.5) 1.77E-05 ( 2.5) 2.58E-07 7.48E-05 RCICRMCOOL-FLAG 1023 1.00E+00 ( 9.51 1.09E-05 ( 4.0) OFFAILS-REOFEN 129 1.00E+00 ( 9.5) i 8.87E-06 ( 5.0) ! RA-NONE 306 1.00E+00 ( 9.5) 6.19E-06 ( 6.0) RA-9-15 468 9.30E-01 ( 21.0) 3.1EE-06 ( 7.0) 8.70E-08 2.95E-05 .! DGO-GEN-LF-FTS 807 2.50E-02 ( 67.0) 5.14E-06 ( 8.0) 1.13E-07 3.53E-05' [ AF040X2-ROO-LFO 604 2.00E-02 ( 84.0) 3.75E-06 ( 9.0) 2.39E-08 2.43E-05 DG2B-GEN-LF-FTS 561 2.50E-02 ( 67.0) ; 2.74E-06 ( 10.0) 7.93E-08 1.69E-05 SUR-003-L 326 1.60E-01 ( 46.0) 2.70E-06 ( 11.0) 0.00E+00 2.09E-05 i IEB236B-BCO-LF 176 7.20E-05 (363.5) 2.08E-06 ( 12.0) 1.58E-11 1.73E-05 , i RA-8-103 1179 2.00E-02 ( 84.0) 1.74E-06 ( 13.0) 9.65E-09 8.44E-OS RA-9-2H 1152 8.70E-01 ( 23.0) 1.71E-06 ( 14.0) 9.51E-09 8.17E-06
%J RA-8-8B 468 2.7CE-02 ( 64.0) '!
1.71E-06 ( 15.0) 7.05E-08 7.83E-06 h ed 1E4327NY-R00-LFO 360 2.00E-02 ( 84.0) 1.66E-06 ( 16.0) 8.22E-09 1.21E-05 IE4327NX-ROO-LFO'358 2.00E-02 ( 84.0) 1.63E-06 ( 17.0) 8.10E-09 1.21E-05 [' CONT-LEAK 932 7.50E-01 ( 24.0) 1,62E-06 ( 18.0) 0.00E+00 2.73E-05 AF039X2-R00-LFO 342 2.00E-02 ( 84.0) 1.56E-06 ( 19.0) 8.34E-09 1.21E-05 ; EE-MDP-PSW-BC-R 78 3.30E-01 ( 39.0) 1.01E-06 ( 20.0) l i EE-MDC-1AS-CB-R 26 3.30E-01 ( 39.0) 9.24E-07 ( 21.5)
- - EE-MDC-IAS-AB-R; l 26'.3.30E-01 ( 39.0) 9.24E-07 ( 21.5)
DGO-GEN-LF-FTR' 546 1.90E-02 (100.0) 9.10E-07 ( 23.0) 2.51E-09 5.81E-06 ' DG2A-GEN-LF-TTR 445 1.90E-02. (100.0) 6.51E-07 ( 24.0) 2,66E-09 3.74E-06
' RA-9-8H 394 6.00E-01 ( 26.0) 5.76E-07 ( 25.0) 6.34E-09 4.07E-06 DG-FTS-BETA [
- 14' 1.20E-02 (103.0) 5.75E-07 ( 26 } 1.71E-08 1.99E-06 '
- - DGX-GEN-Of-FTS 14 2.5CE-02 ( 67.0) 5.75E-07 ( 26.5) 1.71E-08 1.99E-06 RERH01AX-STX-LFB 59 6.20E-03 (105.5) 5.64E-07 ( 28.0) 1.82E-09 4.34E-06
' DG2B-GEN-LF-FTR '361 1.90E-02 (100.0) 5.40E-07 ( 29.0) 1.75E-09, 3.CSE-06 DGO-G-UUM 114 6.00E-03 (108.5) 5.15E-07 ( 30.0) 1.12E-08 2.82E-06 DG2A-GEN-LF-FTS 307 2.50E-02 ( 67.0) 4,84E-07 ( 31.0) 9.82E-09 3.61E-06' ! SUR-002-L 315 1.60E-01 ( 46.0) ' 4.84E-07 ( 32.0)'O.00E+00 3.46E-06 OFFAILSCDS-OE-8M 11 3.40E-01 ( 37.0) 4.75E-07 ( 33.0) 6.15E-09 1.88E-06
'T5CDSSCPERCENT 3 5.00E-01 ( 30.0) 4.68E-07 ( . 34.0) <
SUR-021-R 154 8.50E-02 ( 55.5) 4.49E-07 '( 31.0) 0.00E+00 7.76E-06 ' SUR-005-V 68 2.10E-03 (186.0) 3.91E-07 ( 36.0) 4.18E-09 1.59E-06 RA-15-88 7 4.50E-01 (.33.0)- 3.'58E-07 ( 37.0). 8.63E-09 1.42E ; Q1 111 8.20E-03 (104.0) 3.47E-07 ( 38.0).6.34E-09 1.24E-06 : DGO-GEN-CC-FTS _114 3.70E-03 (114.0)- 3.27E-07 ( 39.0) 1.43E-09 1.79E-06 RA-1-1-27H 201 2.10E-03 (186.0) 3.14E-07 ( 40.0) 6.58E-11 1.90E-06 '- 59 6.00E-03 (108.5) DG2B-G-UUM 3.10E-07 ( 41.0) 8.84E-09 '1.26E-06 0FFAIL-VENT-25' '118 2.10E-03 (186.0)' 4.80E-08 (130.0) -2.59E-09 3.16E-07 RA-5V-1-28 48 2.10E-03 (186.0) 1.28E-09 (299.0) -5.34E-10 5.11E-09' i
, , , ~ . v . =
t ?k, (f' :! l.>r i. jt .*;* {>; i; Ii!1
;{ 6 i Ie # > ) i eI f :t!; _i i . ti ! ,
n a
)
S L A* u. i m 1 T N - I A x r_. N: b UD RE T 2 4 55 6 5 665 7 7 8 8
) TA 5 0 C0 C 0 0 0 0 0 00 0 deAC SI R EEEEEEE2EEEE d FS LO I 27 eE 0 0 19 0 E 4 0 u F 1 04 2623061 27 1 S T
- 1A U 1 11 633128E5 1 nA e E s
CCIW ( T 2 5 6 S 0 5 8190 0 00 1 0 C 1 0 0 1011 1 31
- - - - - - - - - - + -
S( R EEEEEEEEEEEE E 7* f E 93 3 3 5 2 0 0 3. 7! C T W 1 15 4 1 4 9 0,5 504 EN O l EVE E7 L 1 4 9 6231 7 3 20 1 b E aLAG ) ) ) ) ) ) ) ) ) ) ) ) ) +
! NN I
N 00 000 000,000,0 RI A 1 23 4 5S7 B 901 2 E! R 1 1 1 TA ( ( ( ( ( ( ( ( ( ( ( ( ( NI I ! 5
! 0 566677 7 7 7 9 9 9 N 1 0 0 0 C 0 0 0 c0 00 0 I K7 - - - - - - - - - - - -
SC EEIEEEEEEEEE Y I U 131 3 1 C 0 4 5 4 0 E B RL It 3 5 8 6 0. C. 7 418 42 E I 221 1 9 4 221 87 3 C - I T C U O ) K
) ) 1 ) ) ) ) ) ) ) ) '
I R 05, 0 5,0 5,5 0000 D. 5 A 70 1 . 0 130 021 1a5S 5 K R S ( . I i( ( ( ( ( ( ( ( ( { ( - R Q 23 0 3 1 3 31 1 1 21 I 000 0 000 0 C00 0 R - - + - - - - - - - - - F EEEEEEEEEEEE 0 0 C 0 O 0 0 0 0 0 0 0 5 0 5 0. C. 0 0 1 210 4 95 4 565555 4 3 1 R J 5 20 9 4 5 0 4 3 1 5 4 9 55 5 0 1 4 7 1 3 1 C 6 21 1 1 C 2 C T N
. E -
A V P1 .2 C E S0 A 0B O O1 1 9S1S32 4 L7 T LTT7TTT!7!E7 I - - - - - - - - - - - - N EEEEIEEEEEEE I I I IIIII II III
%e N I2+ ,i !' i ,1 '
- 2? k!' i,I' hifis if.= ! i < <' i!i '
l l containment failure probability by rupture. In the integrated result these ' effects are balanced out somewhat. However, one can see by looking at. Table 7.3 that two events even in the integrated analysis have negative risk reduction measures. These two events, OFFAIL-VENT-2H and RA SV-1-2H, represent successful operator venting of the containment, Venting using the current procedures creates severe envirotunents in the reactor building that can fail injection systems leading to core damage sequences. If ver: ting falls and then the containment fails by overpressure, the failure is often to the refueling floor which bypasses the reactor building and no severe environments are created. For the dominant long-term contaitument heat removal failure sequences which appear in this analysis, HPCS is the system supplying inj ection. Since HPCS is a high pressure system and does not fail from high containment pressures, the conditional probability of , core _ damage is actually higher if venting occurs than if containment failure occurs. This is because venting always results in severe environments while containnwnt failure only results in severe environments if the failure is in the reactor building. The most important event for risk reduction is the loss of offsite power initiating event with a risk reduction measure of 2.31E-05/R-yr, The second most important event is the non recovery of offsite power within one hour with a risk reduction measure of 1.89E-05/R-yr. The third and fourth most important events are concerned with the CSCS cooling water pump common mode failure and are the pump random failure probability and the common mode beta factor which links the pumps together, each with a risk reduction of 1. 77E-05/R-yr. The fifth and sixth most important events are related to the RCIC isolation problem either the isolation on room high temperature or the sneak circuit with risk reductions of 1,09E-5/R-yr. and 8 87E-06/R-yr. respectively. 7.3.2 Risk Increase The risk increase measure calculates the increase in the core -damage frequency obtained by setting each basic events failure probt.bility to one. The implication is that the component or event represented by this basic event always fails or occurs. This measures tells you how much increase in risk you would obtain if a componnnt was allowed to. degrade to the point of failure versus maintaining it at its current reliability level. Risk increase measures are calculated only for basic events. Since iniriating events are frequencies and can have values greater than 1.0, this calculation is not applicable to them. Risk increases for each individual sequence and the integrated result are presented ' in the TEMAC outputs shown in Appendix A. In this - section, we will discuss only the integrated results which are shown in Table 7.4. As with the risk decrease measure, certain events can have negative risk increase implying that the risk decreases as their probability is increased. In fact, the same two events that have negative risk decreases have negative risk increases. For example, as the probability of the operator falling to vent increases the core damage frequency goes down 7-13
lIfl)
) I S
L A V R E i F I Y T N I A T NG U R U 1 1 223 23 3 3 3 3 3 3 33 3 3 3 3 3 4 4 3 3 4 3 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 6 4 4 T D 5 0 0 0- 0 C - - 0 0 -C C 0 0 -C -C 0 C C C C 0 0 C- 0C - 00- C N E A T R 5E EEEEEEEEEEEE1E EEEEEIEE EEEEEEEEEE EEEEEEEEE 1 E 0 5 4 1 5 = 3 3 3 3 2E 2 1 E 1 5 7 0 223 8 6 E 4 4 3 B 7 0 3 E 3 22 1 7 BA B L IA E F C F F 4 7 0 4 4 4 9 5 5 5 5 5 5 2 6 6 7 1 1 38 20 6 27 3 2. c 9 2 4 287 1 0.C. 5 8 5 6 6 4, A LO 3 2529 1 97 6 6E6 S525 51 1 1 57 1 1 61 4 6 9937 3 67 57 7 6 3 6555 S 7 T S 7 3 3 4 07 0 SES557 5 67 56E 55 57 6 550 67 555 07 8 6665 6556 O e T A 1 5 0 0 0 0 0 0 0 C C C 0 0 00 000 0 C 0 0 0 0 C 0 0 0 000 0 0 0 0 0 0 0 0 0 00C 0 H - - - - + - * - - - - - - - - - - - - - - - - - - - + - - - - - + - - - - - - - - - - i t S ! R E EEEEEEE EEEEEEEEEEE EEEEEEEEEEEEEEEEEEEEEEEEE 3 t e0 O F 0 E 4 E 4 6 5 e 4 5 4 B 4 7 E 95 1 3 9 C 4 8 9 9 5 C 4 4 5 7 1 3 e 4 ? E aC!W T' W 5 0 2 4 C. 9 0 4 6.E.6 6 9.C. 6 91 6 7 4 e. 1 20 8 6 0, 0 65 2 2.C. 3 4 5 5 6 2. C. 6 0 0 E( O V L 9 1 1 1 0 5 0 322 2259 25 28 4 21 E 1 4 5 1 0 256 3 1 02 4 1 1 21 1 21 1 E T N ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) L E A V
)
E
)
000)
) )
0 00) 0) 0 5
) ) ) ) )
5 55 ) 00) 0) 0 0 0 C. 00, 0 00 C. 0) 0 )000 0 0 0 0 00000 00 00 N. E S 1 23 4 56 7 8 01 01 10 10 1 31 41 15 11 671 822222222223 90 1 23 33 4 56 7 8 9 0 1 2 3 4 5 57 8 9 0 1 3 3 D E / F 3 3 33 333 4 4 4 4 T ( S ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( INA E ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( E 22 3 3 33 4 4 4 4 4 4 4 s A 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 555 555 55 5 553 Y S 0 0 0 0 C C 0 0 0 0 C C O C 0 C 0 C 0 0 0 0 0 C 0 C C 0000 0 0 0 0 00 0 0 0 0C KA E SE EEEEEEE EEEE1EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE 995 7 E 3 7 1 ? 5 S 6 4 6 2 9 0 0 S E 4 3 9 3 C 5 54 4 7 21 6 e3853 4 4 E 4 21 0 0 r E IR S RC N 81 01 41 91 8 2 5 87 5 4 2 4,08, 8 8. E. 4 4 42221 0 0 2 0 0.e. 8 8 8 7 7 A I 21 7 21 1 98 7 7 7 77 7 7 7 22 1 1 1 1 1 1 1 1 1 1 111 999 9996 8S 838 E R C N I
) ) ) ) ) ) ) ! ) ) 3 ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )
K E 505 5 5 5 55 ) 55 5) 55 05 5 5. C.5 0 0 0 0 5 00 55505 0 5505 5 000000 0 N 1 3 9 1 3 93 9 3 3 3 3 3 3 9 5 5 57 3 6 4 4 6 9 0 0 9 3 3 7 5 4 9 9 3 55 00 0 4 1 1 R A R 5 7 6 5 3 E 3 E 56 6 5 5 6 4 4 9668626 4 0 1 3 6 6 E 22 31 123 91 0 21 0 0 1 5 5 1 1 1 2221 22 ( 33 1 3( 3 3( 3 3( 3(( 3 ( ( ( ( ( ( (3( 3( (3 ( 23 3 1 ( ( 3 1 ( ( ( ( ( ( ( 21 22( 3( (3(3( ( ( ( ( ( ( ( ( ( ( ( ( ( 2 553 5 4 5 4 5 5 5 555 4 5 5 325 324 3 13 4 4 5 523 4 4 3 3 33 4 333 4 4 O 0 0 0 0 0 0 0 0 0 0 C 0 0 0 0 0 C 0 C 0 0 0 00 0 0 0 0 0 00 C 00 0 0C0 00 00 0 R - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - F EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE 0 O 0 0 C 0 0 0 0 0 0 C C 0 0 0 0 0 E C 00 C 0 00 C 0 0 C 0 C C 0 0 C O C C C 00 0
- 2. C. 5 202 0 2 2 2,2 2264 4 2, 5 21 06 1 1 1 2 C. 225 08 026 2. C,2 1 1 7 0 0 7 1 27 1 7 1 7 7 7 7 7 7 38 6 1 27 225 21 1 7 1 7 7 23 5 1 3 1 63 7 1 1 3 55 R 6 6 7 4 7 8 3 97 7 7 7 E 1 5 4 427 696 40 50 1 12tE7 1 o7 9 761 76 16 44 193 66 9 3 3 93 4 8 B 5 4 5 521 1
" 7 5 25 23 2 0 5 1 C 1 6 6 2 3 C
O B FFF F F O FFS F F FF F F F LLLF LSL FF FG LMGFLSLL L ML LM - - - L - T - LL LL L- L- T F "M FLM - ULL -- T - - XUF SFOC
- C - M- UDDO - OO OOGFO - - - F MOO - U - U HT - - SM - OC O - CUOUCCCOCO CCL - C CG AS - UCOF - GU HFFMF CBV C C SCUC - S BB CSB SBFFB OL5T MF UBBLFL - 7 2 - - 1 F - C - -
S MB - BB - - - B - - P - - - L - vRF7 E F1 - - - - - FB E' - F - V - - XXY - XXO21 A - A - - 0 V AXN A - X A0 - A - A A V E 5 6
- B -
LYB5 6 1 A5Y Y2 1X22F220 Y 322T1 E5 1 0 X10 NX527 1 L1 D -A5- YG0 FG 1 - 5Y 21 ZE2F LZ A7 1 AAGF ANAe 1 2E1 6 3 O6 Y33 1 5 1 E Y Y - E 53 G3 0 0 0 - O0 2 Y3 5 - 0 0 3 - - O 000 O G0 0 E S 2 O3 3SCS4 B3353 33ETB22 22 2 3 2 3 2 1 TI 1 CC FR0 C -GOEEEEGC2E O - 2 - CD - 4 BB2 SD34 G1 OGC1 23 3CG282HCCGC
- - RR - 0RORC - BF A
E EPGEEEEEEEEEE
) RO1 I 1 1 I I 1AEESGEUFC 1 I I SI 3 ACD1 S ACRDCE 'A IAEEE2EGES 1 DLC1 RRRRECRDRC 4 d4 a5 ll! flI lll j
because, for the dominant sequences, there is less = probability of severe environments if the containment fails than if its vented as described above , I l' The most-important event for risk increase is the failure of the circuit breaker from 4160 V AC emergency bus 242Y -train B) to 480 V AC buses 236X and 236Y with a risk increase of 2.89E-02/R-yr. This fails all of train B emargency AC power. The second most important event is rcactor scram failure with a risk increase of 1.19E-02/R-yr. Even though ATWS sequences l' at LaSalle are very low and do not dominant the core damage frequency, if the failure to scram probability increased, they would become very important. The third most important event is the CSCS cooling water pump I random failure probability which determines the level of the cooling water common mode event. This-event has a risk increase of 7.05E-03/R-yr. The next ten events are electric power circuit breaker failures or unavailability due to maintenance which result in degraded AC and DC power states. .; l 7.3.3 Uncertainty importance The uncertainty importance is calculated for groups of basic events all of which have the same underlying distribution (i.e., all basic events ' represented by the same UlS2 variable). In the Latin flype rcube (UIS) ; sampic, a certain distributinn might have been selected for motor-operated valve failure to open. Every basic event appearing in the model that -) represents a motor operated valve failing to open is correlated, is represented by the same Uls variable, and has the same value for a particular UIS sample member. The uncertainty importance calculation is performed by performing a polynomial regression on the expected value of the log of the top event conditional on the sampled values of the selected LilS variabic. The uncertainty importance is calculated as: (the unconditional variance in the log of the top event - the expectation of the variance of the log of the top event conditional on the selected UlS variable)/(the unconditional variance 'of the log-of the top event). This : calculation is performed both for basic event and initiating events. For the LaSalle analysis, the result of this calculation for each accident sequence and for the integrated result are presented in Appendix A. Only the integrated results will be discussed in this section. The integrated results are presented in Table 7.5. The dominant class of events, responsible - for a 28.4% reduction in - the uncertainty of the log risk, is uncertainty in the probability of control circuit failure. This class includes valve, circuit breaker, pump, and fan control circuit failures. The second and third most dominant classes are deenergized relays failure to energize, responsible for a 16.5% and 16.3% reduction (two class were modeled with different exposure times which decoupled the UlS distributions in the UlS sample; they were correlated, however). The fourth and fifth most dominant classes are failure of 7-15
f Table 7.5 , " i INTEiiNAL EVENTS TOTAL" PLANT R*JN: 'L
. tlMCERTAINTY DL'ORTA.4 ~E BY EASE EVENT >f
! l
% REDUCTION IN {
TEE UNCERTAINTY ! BASE EVENT. OCCUR PROS (R.a5K) OF LOG RISK (RANK) Y.05/TE 05* Y.95/TE.95* LPCI-MOV-CM2' 4 2.50E-03 (161,5) 28.4 ( 17.5) 2.81 0.94 RER501BB-POO-CC 8 2.50E-03 (161.5) 28.4 ( 17.5) 2,81 0.94 , 1EB4223-BCC-CC- 11 2.50E-03 (161.5) 28.4 t 17.5) 2.81 0.94 C2DG01P-lHS-CC '33. 2.50E-03 (161.5) 28.4' ( 17.5) 2 81 0.94 + i DAV-t00-CW-CC 19 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 CODG01P-I*1S-CC 36 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94
- 1EB4253-BCC-CC 30 2.50E-03 (161.5) 25.4 ( 17.5) 2.81 0.94 ;
P"<F004X-VOO-CC 6 2.50E-03 (161.5) 28 4 ( 17.5) 2.81 0.94 DC2V03CB-FMS-CC 30 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 CSCC002-IHS-CC 21 2.50E-03 (161.5) 28.4 ( 17.5) 2.61 0.94 DGCOOL-FMS-CM 27 -2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.54 I 1 SEVYO3CB-FMS-CC 35' 2.5CE-03 (161.5) 28.4' 't 17.5) 2.81 0.94 1EE4238-B00-CC 11 2.50E-03 (151.5) 29.4 ( 17.5) 2.81 0.94 , N SWVYO2CC-FMS-CC 26 2.50E-03 t161.5) 28.4 't 17.5) 2.81 0.94 RERF46BB-v00-CC 28.4 ( 17.5) 2.81 0.94 h 3 2.50E-03 (161.5) . 28.4 ( 17.5) ! RHRF48AA-VOO-CC 2 2.50E-03-(161.5) 2.81 0.94 RER301AA-B00-CC 22 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 l DGHVDICC-FMS-(%: 16 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 , . 1EB4320-BCC-CC 16. 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 t l BCSC001C-etS-CS 16 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 9 , NWVYOICA-FMS-CC - 22 2.50E-03 (161.5) 28.4 ('17.5) 2.81 0 94 l t 1EB412A-BCC-CC 28 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 1EB413A-B00-CC .28 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 DGoV01CA-FMS-CC 27 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 1EB433C-DOO-CC ~ 16' 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 LPCI-FMS-CM 8 2.50E-03 (1=1.5) 28.4 ( 17.5) 2 81 0.94 , CSCF068A-VCC-CC 2 2.50E-03 (161.5) 26.4 ( 17.5) 2.81 0.94 5 SY-REGP-RCIC001X 6 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 DEV-t0D-COM-CC 16 2.50E-03 (161 5) '28.4 ( 17.5i 2.81- 0.94 , D0V-M00-C m -CC 27 2.50E-03 (163.5) 28.4 ( 17.5) 2.81 0.94 1EB234B-BCC-CC - 30 2.50E-03 (161.5) 28.4 ( 17.5) 2.El . 0.94 [ LPCI-TOV-CM1 4 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 CSCF068B-VCC-CC 3 2.50E-03 (161.5) 25.4 ( 17.5) 2.81 0.94 1EB233A-BCC-AS : 31. 2.50E-03 (161.5) 28.4 ( 17.5) 2.81 0.94 ; 2DG1PK18-RDO-LFO 17 5.00E-04 (251.0) 16.5 ( 35.5) 1.00 1.00 CSC02K18-R00-LFO~ 12 5.00E-04 (251.0) 16.5 ( 25.5) 1.00 1.00 i' 1E4327NX-ROO-1.FO 358 2.00E-02 ( 84.0) '16.3 .( 48.5) .' 1.54 0.86 RAL7K5-ROD-LFO 1 2.00E-02.( 84.0) 16.3 ( 48.5) 1.64 0.86 RACTK3-ROO-LFO - 1 .2.00E-02 ( 84.0)- 16.3 ( 48.5) -1.64 0.86 ' , EALTK9'R00-LFO ' 67 2.00E-02 ( 84.0) 16.3 ( 48.5) 1.64 0.86 16.3 ! 48.5) 1,64 0.66 , LAK14EPC-RCO-LFO . 26 2.00E-02 ( 84.0) ' 0.86 3 LAK18 ERB-R00-LFO 40 2.00E-02 ( 84.0) 16.3 ( 48.5) .1.64 t
Table 1 5 (Cmtirnei) INTERNAL EVEE S TOTAL FLAST RUN: l'NCERTAINTY ! % !ANCE BY BASE E*.ENT I REOUCTION IN TEE UNCERTAINTY OCCUR FROB l RANK) OF LOG RISK (RANK) Y 05/TE.05* Y.95/TE.95* BASE EVENT 16.3 ( 49.5) 1.54 0.86 LAK10RCA-ROO-LFO 39 2.00E-02 ( 84.0) 1.64 0,e6 1E4327NY-ROO-LFO 360 2.00E-02 ( 84.0) 16.3 ( 45.5) 16.3 1.64 0.96 RACTK17-ROO-LFO 1 2.00E-02 ( E4.0) ( 49.5) 1 2.00E-02 ( 84.0) 16.3 ( 49.5) 1.64 0.86 LAK2EROB-RCO-LFO 0.66 1 2.00E-02 ( e4.0) 16 3 t 48.53 1.64 LAK70 ARA-ROO-LFO 0.66 1 2.00E-02 ( 84.0) 16.3 ( 49.5) 1.64 LAK23BRC-ROO-LFO 16.3 ( 48.5) 1.64 0.66 AP039X2-ROO-LFO 342 2.00E-02 ( 84.0) 1.64 0.96 LAK70BRB-ROC-LFO 1 2.00E-02 ( 84.0) 16.3 ( 48.5) 16.3 ( 45.5) 1.64 0.66 LAK2ARCA-RCO-LFO 1 2.00E-02 ( 64.0) 16.3 ( 48.5) 1.64 0.e6 RACTK3-ROO-LFO 59 2.00E-Ot ( 64.0) 16 2.00E-02 ( 84.0) 16.3 t 46.5) 1.66 0 e6 AF037X3-ROO-LFO 16.3 ( 43.5) 1.64 0.e6 AF040X2-ROO-LFO 604 2.00E-02 ( 84.0) 1,64 0.86 LAK9ERCB-ROO-LFO 40 2.00E-02 ( 84.0) 16.3 ( 49.5) 16.3 ( 48.5) 1.64 0.66
.a LAE18 ARA-RCX)-LFO 27 2.00E-02 ( e4.0) 1.64 .66 LAK14 ARC-RCO-LFO 9 2.00E-02 ( 84.0) 16.3 ( 48.5) h.J LAK93 ARC-ROO-LFO 22 2.00E-02 ( E4.0) 16.3 ( 49.5) 1.64 0.96 16.3 ( 46.5) 1.64 0.86 LAK9ARCA-ROO-LFO 25 2.00E-02 ( e4.0) 1.66 LAK93BRC-ROO-LFO 46 2.00E-J2 ( 84.0) 16.3 ( 46.5) 0.66 16.1 ( 61.5) 1.00 1.00 LAK3BRCB-RCO-LFO 23 3.40E-03 (117.5) 1.00 3 3.40E-03 (117.5) 16.1 ( 61.5) 1.00 LAK3ARCA-RCO-LFO 1.00 15.8 ( 63.0) 1.00 IEK16 ARC-ROO-LFO 16 5.80E-04 (224.0) 1.06 1.00 r
SAK6BRCX-RCO-LFO 6 3.90E-02 ( 59.5) 15.8 ( 65.5) 15.8 1.06 1.00 SAK2ARCX-RCO-LFO 6 3.90E-02 ( 59.5) ( 65.5) 1.00 6 3.90E-02 ( 59.5) 15.S ( 65.5) 1.06 SAKE >.RCX-RCO-LFO 1.00 6 3.90E-02 ( 59.5) 15.8 ( 65.5) 1.06 SAK2BRCX-RCO-LFO 6.8 ( 69.5) 0.84 0.97 DG2B-GEN-LF-FTS 561 2.50E-02 ( 67.0) 0.84 0.97 DGX-GEN-CM-FTS 14 2.50E-02 ( 67 0) 6.8 ( E9.5) 66 ( 69.5) 0.84 0.97 DG2A-GEN-LF-FT3 307 2.50E-02 ( 67.0) 0.84 0.97 907 2.50E-02 ( 67.0) 6.8 ( 69.5) DGO-CEN-LF-TTS 1.00 1.00 SUR-001-L 54 1.90E-01 ( 44.0) 6.5 ( 72.0) 5.4 ( 73.5) 1.38 0.97 SUR-002-A-L 10 1.60E-01 ( 46.0) 315 1.60E-01 ( 46.0) 5.4 ( 73.5) 1.38 0.97 SUR-002-L 1.45 1.00 SUR-003-L 326 1.60E-01 ( 46.0) 5.3 ( 75.0) 5.1 ( 78.5) 1.00 1.00 1EB16211-BCO 4 8.40E-05 (346.5) 1.00 1.00 CCBODG1P-SCO-LF 3 8.40E-05 (346.5) 5.1 ( 78.5) 1.00 5 8.40E-05 (346.5) 5.1 ( 78.5) 1.00 1EB16212-BCO 1.00 ( 78.5) 1.00 HC001CB-BCO-LF 1 8.40E-05 (346.5) 5.1 1.00 CCB2DG1P-BOO-LF 3 8.40E-05 (346.5) 5.1 ( 78.5) 1.00 5.1 ( 78.5) 1.00 1.00 CCSC002-BCO-LF 1 8.40E-05 (346.5)
e b b w O G bk in O O O et f4 O O
% G. O. V. 2 d'% O P4 F1 e4 t4 (9
5 Se b
. . Ca ,
ws (1, wO.
, o
- p. eg H ha moooo 64 &4 t' )
np * % H =.. . O. O. O. O. g 54 O e4 ri ce r4 et
, 6 O .n,4 & Y'i 4 e+ ><=
v *M g oIIg;t 4 *ai
- _ , ,, m , _ _ _ , ._.
(8 a O. O. O. O, O. O. O. O. O. O O. O.
") .p0+yM 're a, e4 Nm4 o (D G G mGG m v
,p,... l C D,.
- . . - - - - o v - -w -
i yaa .M
.r4 v. u
,I,>< H O pI 5s 7. < *4 p Y. () to u;
$.e4 se
- e N. O. O. M.
< O. O. O. O. O. O. O.
E < -i a O N N e4 H e4 O O O O O O O
** De j t, ) () v4
$3' e) 7, e.)
LJ r'i t) L{ p t ==
#. m pl O D J
'1 to 6-e m - m - - -n - n n n n O. (4 %) . O. O. O. O. O. N. M. U I. O.
9 b k () (I ( O et e4 H 4 gw
& 4J t# %., %.# 4J %sn' %s# V W hJ V (1 Nd O'S N 9"4 94 O 0'4 O O O O k Q O O O O O O O OO O O e a 6 & e t + e a e e e ,
, M M kl b3 M W M W b) W W kl t) <> noooofs OO O O D, **4 e4 O. O. N. D. 4 U. Q. ( n. Q gt.' C 4 et @ 4 m t2 4 G1 M O N
<n es neo4 e - n4 n
{}i 1D +'4 8 v4 N 8
+.
7. 4 a I.I n. u N lhj ) O 4 Ill O M F O) W -
. *-4 A H r4 e4 _ 54 s m e e e e4 + . m4 f4 5
so D4 8 9 t 0 t 8 4 4 5 4 E, NN N b) M N hI M bj bI N N H u H H H H H H e-e H H e4 *s l 7-18
- . ~ _ . - . - . . - . - . _ _ _ _ _ _ - - --- - . _ _ . ~ - -
energized relays to remain energized, responsible _ for a - 16.1 % and 15.8% reduction (these were also divided into two - groups) . The sixth - mos t dominant claas the loss of offsite power initiator which is responsible for a 12.5% reduction, The seventh most domina .:t class _ is diesel generator failure to start which is responsible for a 6.8% reduction. The eighth to tenth most dominant classes are the severe environment failure , probabilities- of various types of equipment, responsible for ' 6,5% , - 5.4% , and 5.3% reductions. 7.4 Insights and Conclusions overall, the mean core damage frequency of.4.41E-05/R-yr, for the internal events analysis is very good considering that this is the first time a PRA has been performed on LaSalle and no design or construction deficiencies-were found that resulted in excessive core damage potential. Several changes could be made to systems and procedures that would result in a significant reduction in the current core damage frequency and not be too costly. The first is to climinate the sneak circuit in the RCIC isolation logic that results in the RCIC steam line inboard isolation valve closing when offsite AC power is lost and the appropriate diesel generator starts. This is is clearly an unwanted result that defeats the purpose of having a DC powered system to mitigate station blackout type accidents. This is particularly true here since the dominant core damage sequence involves a loss of offsite power followed by a delayed loss of the diesel generators as a result of the loss of diesel generator cooling water. This results in a delayed station blackout sequence in which the operator must reopen the isolation valve before the diesel generators fail. . Commonwealth Edison Company (CECO) immediately recognized that this was a design deficiency when it was initially found in the PRA analysis. A design modification was devised but implementation was delayed until the' PRA was completed so that its relative importance could be assessed. The design change should go in at the next refueling outage, The-second change would be to change the RCIC room temperature isolation logic so that, in cases where train A AC power has fail but train B AC is available, RCIC does not isolate if no other ECCS system is working. The current logic assumes that if either AC power train is working then sufficient other systems are available to cool the core and that RCIC is not _needed. For the type of sequences showing up here, a modification as described above would reduce the probability of RCIC isolation in these sequences - significant ly while introducing a very low probability failure event (i.e., a spurious inhibition signal). The third major change would be to change the venting procedure so that-venting does not result in severe environments in the reactor building. At LaSalle, this can be done solely by changing the procedures since a hardened vent line already exists. The current procedures require that the 7-19
1 j' i i L j' , i ! ! i j j ope ra t or vent the cont altunent through the standby gas t reat ment system, , This system has an open suction line from the reactor building and, even if this is Isolated, has some duct work and a rubber boot connecting the vent , pipe to the standby gas treatment filter. This duct work and/or boot will ! certainly full - if the main vent lines are opened. The resulting severe 1 environment in the reactor butiding has a very high probability of falling the ECCS atui CRD systems all of which have components in the reactor building. A simple change in procedure to close the reactor building suction line, isolate the standby gas t reat ment: system, and vent to the - steam tunnel should be able to mitigate this problem. The vent and purge
- system can not be used because it has a similar boot. Venting to the steam ,
I tunnel can produce some changes in the turbine building envi rotunent as a , r e t.u l t of leakage ftom the turbine cavity into the main building but the j blowout panel on the roof should open directing most of the steam out that j path, A morn detailed study of possible turbloe building, environments
- would need to be made before thin change could be made lu addition, i.evel ;
i 11/11I consideracions as to the effects on possible radioactive source terms from accidents, which progressed to core damage anyway would need to be assessed. Se c til on 4,6.4 of Volume 1 of thin report cont ains c more l_ ! detailed discunnion of this problem, 4 I l l 7.5 lich1engen ;
- 1. R. 1, Iman and M. J. Shortencarter, "A Use r's Guide for the Top '
Event Matrix Analysis Code (TEMAC)," NUREG/CR-4598, SAND 86-0960, Sandia National laboratorien, Albuqueique, NM, August 1986
?. L b 1 rr a n and M. J. Shor t enca ri e r , "A FORTRAN 77 program and i User's Guide for the Generation of 1.a t i n Ilype rcube and Random
!. Samplen for Use With Computer Models," NUREG/CR-3624, S AND!i3 - 2 365, , Sandia Natlonal 1.aboratorien, Albuquerque, NM, March 1984. , i i i i i i i l. 1 i i I I i I 1 20
sec u w an v s Nuctiaa nicutatoas couvissios s. eu m
*,m.
. .=
. :, i,,
- '. c, w .#. .. ..o,..
- m. .
~ < BIBLIOGRAPHIC DATA SHEET 0,.
. m-,s,,.."" NUREG/CR-4832 SAND 92-0537 2 m a Au se T.t Vol. 3 Part 1 Analysis of the LaSalle Unit 2 Nuclear Power Plant: Risk Methods Integration and Evaluation Program (RMIEP) 3 DATr a D D'" h M -!:
Internal Events Accident Sequence Quantification *^""
- l Main Report August 1992 4 e is es c,nasi suven A1386
$aumtm e'i m e, pipan3 A. C. Payne, Jr., S. L. Daniel, D. W. Whitehead, T. T. Sype, Technical S. E. Dlugman, C. J. Shaffer
? PE S iDD CO v t H L C m -> .te 6 Ft E 8 0& v % 0% J AN la' O. N Avt A% ADDb t S5 " u: um ,* c .. . ' e w o a re- o 5 % = aes w. Commiss<oa sw ... as emo , w - , r e., ;
.,-,,- ...,, n..
Sandia National Laboratories Albuquerque, NM 87185 r sm ssos. m m a w t w ,- scetas a m iss c u: m 3. , , , s w e .. u . r . . o c o . . 4 c,% , , , ,,- , s w,4,y . , c- ..
,4.......m.
Division of Safety Issue Resolution office of Nuclear Regulatory R2acacch U.S. Nuclear Regulatory Commission Washington, DC 20555 m svaattetNTans soTts o aep>*n u ,....m This volume presents the methodology and results of the internal event accident sequence aaalysis of the LaSalle Unit 11 nuclear power plant performed as part of the Level III Probabilistic Risk Assessment being performed by Sandia National Laboratories for the Nuclear Regulatory Commission. The total internal core damage frequency has a mean valve of 4.41E-05/R-yr with a 5th percentile of 2.05E-6/R-yr., a median value of 1.64E-05/R-yr., and a 95th percentile of 1.39E-04/R-yr. The dominant sequences involve a loss of off-site power (LOSP), immediate or delayed failure of on-site AC power resulting in station-blackout, and failure of the reactor core isolation cooling system (RCIC). The events most important to risk reduction are frequency of LOSP, non-recovery of offsite power within one hour, diesel generator (DC) cooling water pump common mode failure, and non-recoverable isolation of RCIC during station blackouts. The events most important to risk increase are: failure of various AC power circuit breakers resulting in pt.rtial loss of onsite AC power, failure to scram, and DC cooling water common mode failure. The dominant contributors to uncertainty are: control circuit failure rates, relay coil failure to energize, energized relay coils failing deenergized, frequency of LOSP, and DG failure to start, u
- t < v.c a u s e t sc s p i c a s a .. ..,,, m e.. . ,. + ...... . .u,, . .,, ,., ,,,c , o . . .u. 4 , , s wn ,
Unlimited pgg > u.ss ,a
- s. s r. m.
LaSalle Unclassified Level I m,, a,a Unclassified
,sse uc.&&as it PHILE MC70RVIE 2ev
- - _ _ . - _ _ _ _ _ _ _ _ ~ _ _ _ _ _ _ _ _ _ ____ _ _ _ _ _ _ _ _ _ _ _ - _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _________
s .r - n a .2- a s.s,-msma,. m s .. w +u m . u u s e.=-- > + e s a + s m,a + *- < -~m. . m+ m ar u s-> + e s a m .a .s . us n- a. x m.s. s 1x *,ss e, aans . - e s a .p . + x-a4 maenr=-~s:n ow n.w ss r d THIS DOCUMENT WAs PRINTED USI;;G RECYCLED PAPER
UNITED STATES SPECIAL FOURTH CLAOS RATE NUCt. EAR REGULATORY COMM SSION POSTAGE AND FECS PAD USNRC'
. WASHINGTON, D.C. 20555-0001 PERMIT NO G f)/
OFFICIAL BtJSiNESS y
, ,;c.4 PENALTY FOR PRIVATE USE, $3@ 1 n r c, e, e. , , = c i ,.
ug q ,.r-Otr" : nyv enta e ein;t i r . r t o m : u c q; Tr.g ma-q:cr' !
,m 1, Sa e, c . m
. 1 [, 4 , , e v - . p'
.s e
i 2 I t i
'h i
I I l l i I L-, I
~ ' ' ' :._-.... ___ _ _ _ _ _ _ _ _ _ __ _
' '-~ ---- - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _J}}